net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2025 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         for_each_rdev(rdev) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         const struct ieee80211_ext *ext;
 233         unsigned int fixedlen, hdrlen;
 234         bool s1g_bcn;
 235
 236         if (len < offsetofend(typeof(*mgmt), frame_control))
 237                 goto err;
 238
 239         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 240         if (s1g_bcn) {
 241                 ext = (struct ieee80211_ext *)mgmt;
 242                 fixedlen =
 243                         offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
 244                         ieee80211_s1g_optional_len(ext->frame_control);
 245                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 246         } else {
 247                 fixedlen = offsetof(struct ieee80211_mgmt,
 248                                     u.beacon.variable);
 249                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 250         }
 251
 252         if (len < fixedlen)
 253                 goto err;
 254
 255         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 256                 goto err;
 257
 258         data += fixedlen;
 259         len -= fixedlen;
 260
 261         for_each_element(elem, data, len) {
 262                 /* nothing */
 263         }
 264
 265         if (for_each_element_completed(elem, data, len))
 266                 return 0;
 267
 268 err:
 269         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 270         return -EINVAL;
 271 }
 272
 273 static int validate_ie_attr(const struct nlattr *attr,
 274                             struct netlink_ext_ack *extack)
 275 {
 276         const u8 *data = nla_data(attr);
 277         unsigned int len = nla_len(attr);
 278         const struct element *elem;
 279
 280         for_each_element(elem, data, len) {
 281                 /* nothing */
 282         }
 283
 284         if (for_each_element_completed(elem, data, len))
 285                 return 0;
 286
 287         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 288         return -EINVAL;
 289 }
 290
 291 static int validate_he_capa(const struct nlattr *attr,
 292                             struct netlink_ext_ack *extack)
 293 {
 294         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 295                 return -EINVAL;
 296
 297         return 0;
 298 }
 299
 300 static int validate_supported_selectors(const struct nlattr *attr,
 301                                         struct netlink_ext_ack *extack)
 302 {
 303         const u8 *supported_selectors = nla_data(attr);
 304         u8 supported_selectors_len = nla_len(attr);
 305
 306         /* The top bit must not be set as it is not part of the selector */
 307         for (int i = 0; i < supported_selectors_len; i++) {
 308                 if (supported_selectors[i] & 0x80)
 309                         return -EINVAL;
 310         }
 311
 312         return 0;
 313 }
 314
 315 /* policy for the attributes */
 316 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 317
 318 static const struct nla_policy
 319 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 320         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 321         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 322                                         .len = U8_MAX },
 323         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 324                                              .len = U8_MAX },
 325 };
 326
 327 static const struct nla_policy
 328 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 329         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 330         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 331         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 332                 NLA_POLICY_MAX(NLA_U8, 15),
 333         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 334         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 335                 NLA_POLICY_MAX(NLA_U8, 15),
 336         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
 337         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 338         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 339         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 340         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 341         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 342         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 343         [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
 344 };
 345
 346 static const struct nla_policy
 347 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 348         [NL80211_PMSR_TYPE_FTM] =
 349                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 350 };
 351
 352 static const struct nla_policy
 353 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 354         [NL80211_PMSR_REQ_ATTR_DATA] =
 355                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 356         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 357 };
 358
 359 static const struct nla_policy
 360 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 361         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 362         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 363         [NL80211_PMSR_PEER_ATTR_REQ] =
 364                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 365         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 366 };
 367
 368 static const struct nla_policy
 369 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 370         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 371         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 372         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 373         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 374         [NL80211_PMSR_ATTR_PEERS] =
 375                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 376 };
 377
 378 static const struct nla_policy
 379 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 380         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 381                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 382         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 383                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 384         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 385                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 386         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 387                 NLA_POLICY_EXACT_LEN(8),
 388         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 389                 NLA_POLICY_EXACT_LEN(8),
 390         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 391 };
 392
 393 static const struct nla_policy
 394 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 395         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 396         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 397         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 398 };
 399
 400 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 401         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 402                                     .len = NL80211_MAX_SUPP_RATES },
 403         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 404                                 .len = NL80211_MAX_SUPP_HT_RATES },
 405         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 406         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 407         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 408         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 409                                                    NL80211_RATE_INFO_HE_GI_0_8,
 410                                                    NL80211_RATE_INFO_HE_GI_3_2),
 411         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 412                                                    NL80211_RATE_INFO_HE_1XLTF,
 413                                                    NL80211_RATE_INFO_HE_4XLTF),
 414 };
 415
 416 static const struct nla_policy
 417 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 418         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 419         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 420         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 421         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 422         [NL80211_TID_CONFIG_ATTR_NOACK] =
 423                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 424         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 425         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 426         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 427                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 428         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 429                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 430         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 431                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 432         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 433                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 434         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 435                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 436 };
 437
 438 static const struct nla_policy
 439 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 440         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 441         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 442         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 443                         NLA_POLICY_RANGE(NLA_BINARY,
 444                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 445                                          IEEE80211_MAX_DATA_LEN),
 446 };
 447
 448 static const struct nla_policy
 449 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 450         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 451         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 452                                                        .len = IEEE80211_MAX_DATA_LEN }
 453 };
 454
 455 static const struct nla_policy
 456 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 457         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 458         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 459 };
 460
 461 static const struct nla_policy
 462 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 463         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 464         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 465 };
 466
 467 static const struct nla_policy
 468 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 469         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 470         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 471                                                 NLA_POLICY_MIN(NLA_U8, 1),
 472         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 473         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 474         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 475         [NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
 476                 NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
 477 };
 478
 479 static const struct nla_policy
 480 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 481         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 482         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 483 };
 484
 485 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
 486         .min = 0,
 487         .max = 0xffff,
 488 };
 489
 490 static const struct netlink_range_validation q_range = {
 491         .max = INT_MAX,
 492 };
 493
 494 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 495         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 496         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 497         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 498                                       .len = 20-1 },
 499         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 500
 501         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 502         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 503         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 504                                                 NL80211_EDMG_CHANNELS_MIN,
 505                                                 NL80211_EDMG_CHANNELS_MAX),
 506         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 507                                                 NL80211_EDMG_BW_CONFIG_MIN,
 508                                                 NL80211_EDMG_BW_CONFIG_MAX),
 509
 510         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 511         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 512         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 513         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 514
 515         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 516         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 517         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 518         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 519         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 520         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 521
 522         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 523         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 524         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 525
 526         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 527         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 528
 529         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 530         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 531                                     .len = WLAN_MAX_KEY_LEN },
 532         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 533         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 534         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 535         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 536         [NL80211_ATTR_KEY_TYPE] =
 537                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 538
 539         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 540         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 541         [NL80211_ATTR_BEACON_HEAD] =
 542                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 543                                        IEEE80211_MAX_DATA_LEN),
 544         [NL80211_ATTR_BEACON_TAIL] =
 545                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 546                                        IEEE80211_MAX_DATA_LEN),
 547         [NL80211_ATTR_STA_AID] =
 548                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 549         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 550         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 551         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 552                                                .len = NL80211_MAX_SUPP_RATES },
 553         [NL80211_ATTR_STA_PLINK_ACTION] =
 554                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 555         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 556                 NLA_POLICY_RANGE(NLA_U8,
 557                                  NL80211_TX_POWER_AUTOMATIC,
 558                                  NL80211_TX_POWER_FIXED),
 559         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 560         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 561         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 562         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 563                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 564         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 565
 566         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 567         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 568         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 569
 570         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 571         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 572         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 573         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 574                                            .len = NL80211_MAX_SUPP_RATES },
 575         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 576
 577         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 578         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 579
 580         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 581
 582         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 583         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 584                                                    validate_ie_attr,
 585                                                    IEEE80211_MAX_DATA_LEN),
 586         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 587         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 588
 589         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 590                                 .len = IEEE80211_MAX_SSID_LEN },
 591         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 592         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 593         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 594         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 595         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 596                                                   NL80211_MFP_NO,
 597                                                   NL80211_MFP_OPTIONAL),
 598         [NL80211_ATTR_STA_FLAGS2] =
 599                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 600         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 601         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 602         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 603         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 604         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 605         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 606         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 607         [NL80211_ATTR_WPA_VERSIONS] =
 608                 NLA_POLICY_RANGE(NLA_U32, 0,
 609                                  NL80211_WPA_VERSION_1 |
 610                                  NL80211_WPA_VERSION_2 |
 611                                  NL80211_WPA_VERSION_3),
 612         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 613         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 614         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 615         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 616         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 617         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 618         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 619                                  .len = IEEE80211_MAX_DATA_LEN },
 620         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 621         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 622                                                    NL80211_PS_DISABLED,
 623                                                    NL80211_PS_ENABLED),
 624         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 625         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 626         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 627         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 628         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 629         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 630         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 631         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 632         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 633         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 634         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 635         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 636         [NL80211_ATTR_STA_PLINK_STATE] =
 637                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 638         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 639         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 640         [NL80211_ATTR_MESH_PEER_AID] =
 641                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 642         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 643         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 644         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 645         [NL80211_ATTR_HIDDEN_SSID] =
 646                 NLA_POLICY_RANGE(NLA_U32,
 647                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 648                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 649         [NL80211_ATTR_IE_PROBE_RESP] =
 650                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 651                                        IEEE80211_MAX_DATA_LEN),
 652         [NL80211_ATTR_IE_ASSOC_RESP] =
 653                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 654                                        IEEE80211_MAX_DATA_LEN),
 655         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 656         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 657         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 658         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 659         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 660         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 661         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 662         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 663         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 664         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 665         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 666         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 667                                       .len = IEEE80211_MAX_DATA_LEN },
 668         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 669         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 670         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 671                 .len = NL80211_HT_CAPABILITY_LEN
 672         },
 673         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 674         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 675         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 676         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 677         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 678
 679         /* need to include at least Auth Transaction and Status Code */
 680         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 681
 682         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 683         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 684         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 685         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 686         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 687                 NLA_POLICY_RANGE(NLA_U32,
 688                                  NL80211_MESH_POWER_UNKNOWN + 1,
 689                                  NL80211_MESH_POWER_MAX),
 690         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 691         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 692         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 693         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 694         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 695         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 696         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 697                 .len = NL80211_VHT_CAPABILITY_LEN,
 698         },
 699         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 700         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 701                                   .len = IEEE80211_MAX_DATA_LEN },
 702         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 703         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 704                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 705         [NL80211_ATTR_PEER_AID] =
 706                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 707         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 708         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 709         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 710         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 711         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 712         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 713         /*
 714          * The value of the Length field of the Supported Operating
 715          * Classes element is between 2 and 253.
 716          */
 717         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 718                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 719         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 720         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 721         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 722         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 723         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 724         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 725                                                   IEEE80211_QOS_MAP_LEN_MIN,
 726                                                   IEEE80211_QOS_MAP_LEN_MAX),
 727         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 728         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 729         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 730         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 731         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 732         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 733         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 734         [NL80211_ATTR_USER_PRIO] =
 735                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 736         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 737         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 738         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 739         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 740         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 741         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 742         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 743         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 744         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 745         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 746         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 747                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 748         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 749                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 750         },
 751         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 752         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 753         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 754         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 755         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 756                                     .len = FILS_MAX_KEK_LEN },
 757         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 758         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 759         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 760         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 761         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 762                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 763         },
 764         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 765         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 766                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 767         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 768                                           .len = FILS_ERP_MAX_REALM_LEN },
 769         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 770         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 771                                         .len = FILS_ERP_MAX_RRK_LEN },
 772         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 773         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 774         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 775         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 776         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 777
 778         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 779         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 780         [NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
 781         [NL80211_ATTR_HE_CAPABILITY] =
 782                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 783                                        NL80211_HE_MAX_CAPABILITY_LEN),
 784         [NL80211_ATTR_FTM_RESPONDER] =
 785                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 786         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 787         [NL80211_ATTR_PEER_MEASUREMENTS] =
 788                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 789         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 790         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 791                                         .len = SAE_PASSWORD_MAX_LEN },
 792         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 793         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 794         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 795         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 796         [NL80211_ATTR_TID_CONFIG] =
 797                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 798         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 799         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 800         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 801         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 802         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 803         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 804         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 805                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 806         [NL80211_ATTR_FILS_DISCOVERY] =
 807                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 808         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 809                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 810         [NL80211_ATTR_S1G_CAPABILITY] =
 811                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 812         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 813                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 814         [NL80211_ATTR_SAE_PWE] =
 815                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 816                                  NL80211_SAE_PWE_BOTH),
 817         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 818         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 819         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 820         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 821         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 822         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 823         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 824         [NL80211_ATTR_MBSSID_CONFIG] =
 825                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 826         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 827         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 828         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 829         [NL80211_ATTR_EHT_CAPABILITY] =
 830                 NLA_POLICY_RANGE(NLA_BINARY,
 831                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 832                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 833         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 834         [NL80211_ATTR_MLO_LINKS] =
 835                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 836         [NL80211_ATTR_MLO_LINK_ID] =
 837                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
 838         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 839         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 840         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 841         [NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
 842         [NL80211_ATTR_PUNCT_BITMAP] =
 843                 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
 844
 845         [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
 846         [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
 847         [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
 848         [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
 849         [NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
 850         [NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
 851         [NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
 852         [NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
 853         [NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
 854         [NL80211_ATTR_SUPPORTED_SELECTORS] =
 855                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
 856                                        NL80211_MAX_SUPP_SELECTORS),
 857         [NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
 858         [NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
 859         [NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
 860 };
 861
 862 /* policy for the key attributes */
 863 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 864         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 865         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 866         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 867         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 868         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 869         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 870         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 871         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 872         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 873 };
 874
 875 /* policy for the key default flags */
 876 static const struct nla_policy
 877 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 878         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 879         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 880 };
 881
 882 #ifdef CONFIG_PM
 883 /* policy for WoWLAN attributes */
 884 static const struct nla_policy
 885 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 886         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 887         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 888         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 889         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 890         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 891         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 892         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 893         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 894         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 895         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 896 };
 897
 898 static const struct nla_policy
 899 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 900         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 901         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 902         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 903         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 904         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 905         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 906         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 907                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 908         },
 909         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 910                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 911         },
 912         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 913         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 914         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 915 };
 916 #endif /* CONFIG_PM */
 917
 918 /* policy for coalesce rule attributes */
 919 static const struct nla_policy
 920 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 921         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 922         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 923                 NLA_POLICY_RANGE(NLA_U32,
 924                                  NL80211_COALESCE_CONDITION_MATCH,
 925                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 926         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 927 };
 928
 929 /* policy for GTK rekey offload attributes */
 930 static const struct nla_policy
 931 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 932         [NL80211_REKEY_DATA_KEK] = {
 933                 .type = NLA_BINARY,
 934                 .len = NL80211_KEK_EXT_LEN
 935         },
 936         [NL80211_REKEY_DATA_KCK] = {
 937                 .type = NLA_BINARY,
 938                 .len = NL80211_KCK_EXT_LEN_32
 939         },
 940         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 941         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 942 };
 943
 944 static const struct nla_policy
 945 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 946         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 947                                                  .len = IEEE80211_MAX_SSID_LEN },
 948         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 949         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 950 };
 951
 952 static const struct nla_policy
 953 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 954         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 955         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 956 };
 957
 958 static const struct nla_policy
 959 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 960         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 961         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 962         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 963                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 964         },
 965 };
 966
 967 /* policy for NAN function attributes */
 968 static const struct nla_policy
 969 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 970         [NL80211_NAN_FUNC_TYPE] =
 971                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 972         [NL80211_NAN_FUNC_SERVICE_ID] = {
 973                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 974         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 975         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 976         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 977         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 978         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 979         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 980         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 981         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 982         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 983                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 984         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 985         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 986         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 987         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 988         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 989 };
 990
 991 /* policy for Service Response Filter attributes */
 992 static const struct nla_policy
 993 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 994         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 995         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 996                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 997         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 998         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 999 };
1000
1001 /* policy for packet pattern attributes */
1002 static const struct nla_policy
1003 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
1004         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
1005         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
1006         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
1007 };
1008
1009 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
1010                                      struct cfg80211_registered_device **rdev,
1011                                      struct wireless_dev **wdev,
1012                                      struct nlattr **attrbuf)
1013 {
1014         int err;
1015
1016         if (!cb->args[0]) {
1017                 struct nlattr **attrbuf_free = NULL;
1018
1019                 if (!attrbuf) {
1020                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
1021                                           GFP_KERNEL);
1022                         if (!attrbuf)
1023                                 return -ENOMEM;
1024                         attrbuf_free = attrbuf;
1025                 }
1026
1027                 err = nlmsg_parse_deprecated(cb->nlh,
1028                                              GENL_HDRLEN + nl80211_fam.hdrsize,
1029                                              attrbuf, nl80211_fam.maxattr,
1030                                              nl80211_policy, NULL);
1031                 if (err) {
1032                         kfree(attrbuf_free);
1033                         return err;
1034                 }
1035
1036                 rtnl_lock();
1037                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1038                                                    attrbuf);
1039                 kfree(attrbuf_free);
1040                 if (IS_ERR(*wdev)) {
1041                         rtnl_unlock();
1042                         return PTR_ERR(*wdev);
1043                 }
1044                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1045                 mutex_lock(&(*rdev)->wiphy.mtx);
1046                 rtnl_unlock();
1047                 /* 0 is the first index - add 1 to parse only once */
1048                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1049                 cb->args[1] = (*wdev)->identifier;
1050         } else {
1051                 /* subtract the 1 again here */
1052                 struct wiphy *wiphy;
1053                 struct wireless_dev *tmp;
1054
1055                 rtnl_lock();
1056                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1057                 if (!wiphy) {
1058                         rtnl_unlock();
1059                         return -ENODEV;
1060                 }
1061                 *rdev = wiphy_to_rdev(wiphy);
1062                 *wdev = NULL;
1063
1064                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1065                         if (tmp->identifier == cb->args[1]) {
1066                                 *wdev = tmp;
1067                                 break;
1068                         }
1069                 }
1070
1071                 if (!*wdev) {
1072                         rtnl_unlock();
1073                         return -ENODEV;
1074                 }
1075                 mutex_lock(&(*rdev)->wiphy.mtx);
1076                 rtnl_unlock();
1077         }
1078
1079         return 0;
1080 }
1081
1082 /* message building helper */
1083 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1084                      int flags, u8 cmd)
1085 {
1086         /* since there is no private header just add the generic one */
1087         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1088 }
1089
1090 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1091                                      const struct ieee80211_reg_rule *rule)
1092 {
1093         int j;
1094         struct nlattr *nl_wmm_rules =
1095                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1096
1097         if (!nl_wmm_rules)
1098                 goto nla_put_failure;
1099
1100         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1101                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1102
1103                 if (!nl_wmm_rule)
1104                         goto nla_put_failure;
1105
1106                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1107                                 rule->wmm_rule.client[j].cw_min) ||
1108                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1109                                 rule->wmm_rule.client[j].cw_max) ||
1110                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1111                                rule->wmm_rule.client[j].aifsn) ||
1112                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1113                                 rule->wmm_rule.client[j].cot))
1114                         goto nla_put_failure;
1115
1116                 nla_nest_end(msg, nl_wmm_rule);
1117         }
1118         nla_nest_end(msg, nl_wmm_rules);
1119
1120         return 0;
1121
1122 nla_put_failure:
1123         return -ENOBUFS;
1124 }
1125
1126 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1127                                    struct ieee80211_channel *chan,
1128                                    bool large)
1129 {
1130         /* Some channels must be completely excluded from the
1131          * list to protect old user-space tools from breaking
1132          */
1133         if (!large && chan->flags &
1134             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1135                 return 0;
1136         if (!large && chan->freq_offset)
1137                 return 0;
1138
1139         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1140                         chan->center_freq))
1141                 goto nla_put_failure;
1142
1143         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1144                 goto nla_put_failure;
1145
1146         if ((chan->flags & IEEE80211_CHAN_PSD) &&
1147             nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1148                 goto nla_put_failure;
1149
1150         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1151             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1152                 goto nla_put_failure;
1153         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1154                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1155                         goto nla_put_failure;
1156                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1157                         goto nla_put_failure;
1158         }
1159         if (chan->flags & IEEE80211_CHAN_RADAR) {
1160                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1161                         goto nla_put_failure;
1162                 if (large) {
1163                         u32 time;
1164
1165                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1166
1167                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1168                                         chan->dfs_state))
1169                                 goto nla_put_failure;
1170                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1171                                         time))
1172                                 goto nla_put_failure;
1173                         if (nla_put_u32(msg,
1174                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1175                                         chan->dfs_cac_ms))
1176                                 goto nla_put_failure;
1177                 }
1178         }
1179
1180         if (large) {
1181                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1182                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1183                         goto nla_put_failure;
1184                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1185                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1186                         goto nla_put_failure;
1187                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1188                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1189                         goto nla_put_failure;
1190                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1191                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1192                         goto nla_put_failure;
1193                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1194                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1195                         goto nla_put_failure;
1196                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1197                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1198                         goto nla_put_failure;
1199                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1200                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1201                         goto nla_put_failure;
1202                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1203                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1204                         goto nla_put_failure;
1205                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1206                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1207                         goto nla_put_failure;
1208                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1209                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1210                         goto nla_put_failure;
1211                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1212                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1213                         goto nla_put_failure;
1214                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1215                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1216                         goto nla_put_failure;
1217                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1218                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1219                         goto nla_put_failure;
1220                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1221                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1222                         goto nla_put_failure;
1223                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1224                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1225                         goto nla_put_failure;
1226                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1227                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1228                         goto nla_put_failure;
1229                 if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
1230                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
1231                         goto nla_put_failure;
1232                 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
1233                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
1234                         goto nla_put_failure;
1235                 if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
1236                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
1237                         goto nla_put_failure;
1238                 if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
1239                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
1240                         goto nla_put_failure;
1241                 if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
1242                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
1243                         goto nla_put_failure;
1244                 if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
1245                     nla_put_flag(msg,
1246                                  NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
1247                         goto nla_put_failure;
1248         }
1249
1250         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1251                         DBM_TO_MBM(chan->max_power)))
1252                 goto nla_put_failure;
1253
1254         if (large) {
1255                 const struct ieee80211_reg_rule *rule =
1256                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1257
1258                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1259                         if (nl80211_msg_put_wmm_rules(msg, rule))
1260                                 goto nla_put_failure;
1261                 }
1262         }
1263
1264         return 0;
1265
1266  nla_put_failure:
1267         return -ENOBUFS;
1268 }
1269
1270 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1271                                   struct cfg80211_txq_stats *txqstats,
1272                                   int attrtype)
1273 {
1274         struct nlattr *txqattr;
1275
1276 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1277         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1278             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1279                 return false;                                             \
1280         } while (0)
1281
1282         txqattr = nla_nest_start_noflag(msg, attrtype);
1283         if (!txqattr)
1284                 return false;
1285
1286         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1287         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1288         PUT_TXQVAL_U32(FLOWS, flows);
1289         PUT_TXQVAL_U32(DROPS, drops);
1290         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1291         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1292         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1293         PUT_TXQVAL_U32(COLLISIONS, collisions);
1294         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1295         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1296         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1297         nla_nest_end(msg, txqattr);
1298
1299 #undef PUT_TXQVAL_U32
1300         return true;
1301 }
1302
1303 /* netlink command implementations */
1304
1305 /**
1306  * nl80211_link_id - return link ID
1307  * @attrs: attributes to look at
1308  *
1309  * Returns: the link ID or 0 if not given
1310  *
1311  * Note this function doesn't do any validation of the link
1312  * ID validity wrt. links that were actually added, so it must
1313  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1314  * or if additional validation is done.
1315  */
1316 static unsigned int nl80211_link_id(struct nlattr **attrs)
1317 {
1318         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1319
1320         return nla_get_u8_default(linkid, 0);
1321 }
1322
1323 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1324 {
1325         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1326
1327         if (!linkid)
1328                 return -1;
1329
1330         return nla_get_u8(linkid);
1331 }
1332
1333 struct key_parse {
1334         struct key_params p;
1335         int idx;
1336         int type;
1337         bool def, defmgmt, defbeacon;
1338         bool def_uni, def_multi;
1339 };
1340
1341 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1342                                  struct key_parse *k)
1343 {
1344         struct nlattr *tb[NL80211_KEY_MAX + 1];
1345         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1346                                               nl80211_key_policy,
1347                                               info->extack);
1348         if (err)
1349                 return err;
1350
1351         k->def = !!tb[NL80211_KEY_DEFAULT];
1352         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1353         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1354
1355         if (k->def) {
1356                 k->def_uni = true;
1357                 k->def_multi = true;
1358         }
1359         if (k->defmgmt || k->defbeacon)
1360                 k->def_multi = true;
1361
1362         if (tb[NL80211_KEY_IDX])
1363                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1364
1365         if (tb[NL80211_KEY_DATA]) {
1366                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1367                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1368         }
1369
1370         if (tb[NL80211_KEY_SEQ]) {
1371                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1372                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1373         }
1374
1375         if (tb[NL80211_KEY_CIPHER])
1376                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1377
1378         if (tb[NL80211_KEY_TYPE])
1379                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1380
1381         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1382                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1383
1384                 err = nla_parse_nested_deprecated(kdt,
1385                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1386                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1387                                                   nl80211_key_default_policy,
1388                                                   info->extack);
1389                 if (err)
1390                         return err;
1391
1392                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1393                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1394         }
1395
1396         if (tb[NL80211_KEY_MODE])
1397                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1398
1399         return 0;
1400 }
1401
1402 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1403 {
1404         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1405                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1406                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1407         }
1408
1409         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1410                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1411                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1412         }
1413
1414         if (info->attrs[NL80211_ATTR_KEY_IDX])
1415                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1416
1417         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1418                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1419
1420         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1421         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1422
1423         if (k->def) {
1424                 k->def_uni = true;
1425                 k->def_multi = true;
1426         }
1427         if (k->defmgmt)
1428                 k->def_multi = true;
1429
1430         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1431                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1432
1433         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1434                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1435                 int err = nla_parse_nested_deprecated(kdt,
1436                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1437                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1438                                                       nl80211_key_default_policy,
1439                                                       info->extack);
1440                 if (err)
1441                         return err;
1442
1443                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1444                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1445         }
1446
1447         return 0;
1448 }
1449
1450 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1451 {
1452         int err;
1453
1454         memset(k, 0, sizeof(*k));
1455         k->idx = -1;
1456         k->type = -1;
1457
1458         if (info->attrs[NL80211_ATTR_KEY])
1459                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1460         else
1461                 err = nl80211_parse_key_old(info, k);
1462
1463         if (err)
1464                 return err;
1465
1466         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1467             (k->defbeacon ? 1 : 0) > 1) {
1468                 GENL_SET_ERR_MSG(info,
1469                                  "key with multiple default flags is invalid");
1470                 return -EINVAL;
1471         }
1472
1473         if (k->defmgmt || k->defbeacon) {
1474                 if (k->def_uni || !k->def_multi) {
1475                         GENL_SET_ERR_MSG(info,
1476                                          "defmgmt/defbeacon key must be mcast");
1477                         return -EINVAL;
1478                 }
1479         }
1480
1481         if (k->idx != -1) {
1482                 if (k->defmgmt) {
1483                         if (k->idx < 4 || k->idx > 5) {
1484                                 GENL_SET_ERR_MSG(info,
1485                                                  "defmgmt key idx not 4 or 5");
1486                                 return -EINVAL;
1487                         }
1488                 } else if (k->defbeacon) {
1489                         if (k->idx < 6 || k->idx > 7) {
1490                                 GENL_SET_ERR_MSG(info,
1491                                                  "defbeacon key idx not 6 or 7");
1492                                 return -EINVAL;
1493                         }
1494                 } else if (k->def) {
1495                         if (k->idx < 0 || k->idx > 3) {
1496                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1497                                 return -EINVAL;
1498                         }
1499                 } else {
1500                         if (k->idx < 0 || k->idx > 7) {
1501                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1502                                 return -EINVAL;
1503                         }
1504                 }
1505         }
1506
1507         return 0;
1508 }
1509
1510 static struct cfg80211_cached_keys *
1511 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1512                        struct genl_info *info, bool *no_ht)
1513 {
1514         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1515         struct key_parse parse;
1516         struct nlattr *key;
1517         struct cfg80211_cached_keys *result;
1518         int rem, err, def = 0;
1519         bool have_key = false;
1520
1521         nla_for_each_nested(key, keys, rem) {
1522                 have_key = true;
1523                 break;
1524         }
1525
1526         if (!have_key)
1527                 return NULL;
1528
1529         result = kzalloc(sizeof(*result), GFP_KERNEL);
1530         if (!result)
1531                 return ERR_PTR(-ENOMEM);
1532
1533         result->def = -1;
1534
1535         nla_for_each_nested(key, keys, rem) {
1536                 memset(&parse, 0, sizeof(parse));
1537                 parse.idx = -1;
1538
1539                 err = nl80211_parse_key_new(info, key, &parse);
1540                 if (err)
1541                         goto error;
1542                 err = -EINVAL;
1543                 if (!parse.p.key)
1544                         goto error;
1545                 if (parse.idx < 0 || parse.idx > 3) {
1546                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1547                         goto error;
1548                 }
1549                 if (parse.def) {
1550                         if (def) {
1551                                 GENL_SET_ERR_MSG(info,
1552                                                  "only one key can be default");
1553                                 goto error;
1554                         }
1555                         def = 1;
1556                         result->def = parse.idx;
1557                         if (!parse.def_uni || !parse.def_multi)
1558                                 goto error;
1559                 } else if (parse.defmgmt)
1560                         goto error;
1561                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1562                                                      parse.idx, false, NULL);
1563                 if (err)
1564                         goto error;
1565                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1566                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1567                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1568                         err = -EINVAL;
1569                         goto error;
1570                 }
1571                 result->params[parse.idx].cipher = parse.p.cipher;
1572                 result->params[parse.idx].key_len = parse.p.key_len;
1573                 result->params[parse.idx].key = result->data[parse.idx];
1574                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1575
1576                 /* must be WEP key if we got here */
1577                 if (no_ht)
1578                         *no_ht = true;
1579         }
1580
1581         if (result->def < 0) {
1582                 err = -EINVAL;
1583                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1584                 goto error;
1585         }
1586
1587         return result;
1588  error:
1589         kfree_sensitive(result);
1590         return ERR_PTR(err);
1591 }
1592
1593 static int nl80211_key_allowed(struct wireless_dev *wdev)
1594 {
1595         lockdep_assert_wiphy(wdev->wiphy);
1596
1597         switch (wdev->iftype) {
1598         case NL80211_IFTYPE_AP:
1599         case NL80211_IFTYPE_AP_VLAN:
1600         case NL80211_IFTYPE_P2P_GO:
1601         case NL80211_IFTYPE_MESH_POINT:
1602                 break;
1603         case NL80211_IFTYPE_ADHOC:
1604                 if (wdev->u.ibss.current_bss)
1605                         return 0;
1606                 return -ENOLINK;
1607         case NL80211_IFTYPE_STATION:
1608         case NL80211_IFTYPE_P2P_CLIENT:
1609                 if (wdev->connected)
1610                         return 0;
1611                 return -ENOLINK;
1612         case NL80211_IFTYPE_NAN:
1613                 if (wiphy_ext_feature_isset(wdev->wiphy,
1614                                             NL80211_EXT_FEATURE_SECURE_NAN))
1615                         return 0;
1616                 return -EINVAL;
1617         case NL80211_IFTYPE_UNSPECIFIED:
1618         case NL80211_IFTYPE_OCB:
1619         case NL80211_IFTYPE_MONITOR:
1620         case NL80211_IFTYPE_P2P_DEVICE:
1621         case NL80211_IFTYPE_WDS:
1622         case NUM_NL80211_IFTYPES:
1623                 return -EINVAL;
1624         }
1625
1626         return 0;
1627 }
1628
1629 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1630                                                         u32 freq)
1631 {
1632         struct ieee80211_channel *chan;
1633
1634         chan = ieee80211_get_channel_khz(wiphy, freq);
1635         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1636                 return NULL;
1637         return chan;
1638 }
1639
1640 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1641 {
1642         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1643         int i;
1644
1645         if (!nl_modes)
1646                 goto nla_put_failure;
1647
1648         i = 0;
1649         while (ifmodes) {
1650                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1651                         goto nla_put_failure;
1652                 ifmodes >>= 1;
1653                 i++;
1654         }
1655
1656         nla_nest_end(msg, nl_modes);
1657         return 0;
1658
1659 nla_put_failure:
1660         return -ENOBUFS;
1661 }
1662
1663 static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
1664                                    const struct ieee80211_iface_combination *c,
1665                                    u16 nested)
1666 {
1667         struct nlattr *nl_combi, *nl_limits;
1668         int i;
1669
1670         nl_combi = nla_nest_start_noflag(msg, idx | nested);
1671         if (!nl_combi)
1672                 goto nla_put_failure;
1673
1674         nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
1675                                                nested);
1676         if (!nl_limits)
1677                 goto nla_put_failure;
1678
1679         for (i = 0; i < c->n_limits; i++) {
1680                 struct nlattr *nl_limit;
1681
1682                 nl_limit = nla_nest_start_noflag(msg, i + 1);
1683                 if (!nl_limit)
1684                         goto nla_put_failure;
1685                 if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
1686                         goto nla_put_failure;
1687                 if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1688                                         c->limits[i].types))
1689                         goto nla_put_failure;
1690                 nla_nest_end(msg, nl_limit);
1691         }
1692
1693         nla_nest_end(msg, nl_limits);
1694
1695         if (c->beacon_int_infra_match &&
1696             nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1697                 goto nla_put_failure;
1698         if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1699                         c->num_different_channels) ||
1700             nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1701                         c->max_interfaces))
1702                 goto nla_put_failure;
1703         if (large &&
1704             (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1705                         c->radar_detect_widths) ||
1706              nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1707                         c->radar_detect_regions)))
1708                 goto nla_put_failure;
1709         if (c->beacon_int_min_gcd &&
1710             nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1711                         c->beacon_int_min_gcd))
1712                 goto nla_put_failure;
1713
1714         nla_nest_end(msg, nl_combi);
1715
1716         return 0;
1717 nla_put_failure:
1718         return -ENOBUFS;
1719 }
1720
1721 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1722                                           struct sk_buff *msg,
1723                                           int attr, int radio,
1724                                           bool large, u16 nested)
1725 {
1726         const struct ieee80211_iface_combination *c;
1727         struct nlattr *nl_combis;
1728         int i, n;
1729
1730         nl_combis = nla_nest_start_noflag(msg, attr | nested);
1731         if (!nl_combis)
1732                 goto nla_put_failure;
1733
1734         if (radio >= 0) {
1735                 c = wiphy->radio[0].iface_combinations;
1736                 n = wiphy->radio[0].n_iface_combinations;
1737         } else {
1738                 c = wiphy->iface_combinations;
1739                 n = wiphy->n_iface_combinations;
1740         }
1741         for (i = 0; i < n; i++)
1742                 if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
1743                         goto nla_put_failure;
1744
1745         nla_nest_end(msg, nl_combis);
1746
1747         return 0;
1748 nla_put_failure:
1749         return -ENOBUFS;
1750 }
1751
1752 #ifdef CONFIG_PM
1753 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1754                                         struct sk_buff *msg)
1755 {
1756         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1757         struct nlattr *nl_tcp;
1758
1759         if (!tcp)
1760                 return 0;
1761
1762         nl_tcp = nla_nest_start_noflag(msg,
1763                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1764         if (!nl_tcp)
1765                 return -ENOBUFS;
1766
1767         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1768                         tcp->data_payload_max))
1769                 return -ENOBUFS;
1770
1771         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1772                         tcp->data_payload_max))
1773                 return -ENOBUFS;
1774
1775         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1776                 return -ENOBUFS;
1777
1778         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1779                                 sizeof(*tcp->tok), tcp->tok))
1780                 return -ENOBUFS;
1781
1782         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1783                         tcp->data_interval_max))
1784                 return -ENOBUFS;
1785
1786         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1787                         tcp->wake_payload_max))
1788                 return -ENOBUFS;
1789
1790         nla_nest_end(msg, nl_tcp);
1791         return 0;
1792 }
1793
1794 static int nl80211_send_wowlan(struct sk_buff *msg,
1795                                struct cfg80211_registered_device *rdev,
1796                                bool large)
1797 {
1798         struct nlattr *nl_wowlan;
1799
1800         if (!rdev->wiphy.wowlan)
1801                 return 0;
1802
1803         nl_wowlan = nla_nest_start_noflag(msg,
1804                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1805         if (!nl_wowlan)
1806                 return -ENOBUFS;
1807
1808         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1809              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1810             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1811              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1812             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1813              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1814             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1815              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1816             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1817              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1818             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1819              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1820             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1821              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1822             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1823              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1824                 return -ENOBUFS;
1825
1826         if (rdev->wiphy.wowlan->n_patterns) {
1827                 struct nl80211_pattern_support pat = {
1828                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1829                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1830                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1831                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1832                 };
1833
1834                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1835                             sizeof(pat), &pat))
1836                         return -ENOBUFS;
1837         }
1838
1839         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1840             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1841                         rdev->wiphy.wowlan->max_nd_match_sets))
1842                 return -ENOBUFS;
1843
1844         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1845                 return -ENOBUFS;
1846
1847         nla_nest_end(msg, nl_wowlan);
1848
1849         return 0;
1850 }
1851 #endif
1852
1853 static int nl80211_send_coalesce(struct sk_buff *msg,
1854                                  struct cfg80211_registered_device *rdev)
1855 {
1856         struct nl80211_coalesce_rule_support rule;
1857
1858         if (!rdev->wiphy.coalesce)
1859                 return 0;
1860
1861         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1862         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1863         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1864         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1865         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1866         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1867
1868         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1869                 return -ENOBUFS;
1870
1871         return 0;
1872 }
1873
1874 static int
1875 nl80211_send_iftype_data(struct sk_buff *msg,
1876                          const struct ieee80211_supported_band *sband,
1877                          const struct ieee80211_sband_iftype_data *iftdata)
1878 {
1879         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1880         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1881
1882         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1883                                 iftdata->types_mask))
1884                 return -ENOBUFS;
1885
1886         if (he_cap->has_he) {
1887                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1888                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1889                             he_cap->he_cap_elem.mac_cap_info) ||
1890                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1891                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1892                             he_cap->he_cap_elem.phy_cap_info) ||
1893                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1894                             sizeof(he_cap->he_mcs_nss_supp),
1895                             &he_cap->he_mcs_nss_supp) ||
1896                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1897                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1898                         return -ENOBUFS;
1899         }
1900
1901         if (eht_cap->has_eht && he_cap->has_he) {
1902                 u8 mcs_nss_size, ppe_thresh_size;
1903                 u16 ppe_thres_hdr;
1904                 bool is_ap;
1905
1906                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1907                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1908
1909                 mcs_nss_size =
1910                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1911                                                    &eht_cap->eht_cap_elem,
1912                                                    is_ap);
1913
1914                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1915                 ppe_thresh_size =
1916                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1917                                                eht_cap->eht_cap_elem.phy_cap_info);
1918
1919                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1920                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1921                             eht_cap->eht_cap_elem.mac_cap_info) ||
1922                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1923                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1924                             eht_cap->eht_cap_elem.phy_cap_info) ||
1925                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1926                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1927                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1928                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1929                         return -ENOBUFS;
1930         }
1931
1932         if (sband->band == NL80211_BAND_6GHZ &&
1933             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1934                     sizeof(iftdata->he_6ghz_capa),
1935                     &iftdata->he_6ghz_capa))
1936                 return -ENOBUFS;
1937
1938         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1939             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1940                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1941                 return -ENOBUFS;
1942
1943         return 0;
1944 }
1945
1946 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1947                                       struct ieee80211_supported_band *sband,
1948                                       bool large)
1949 {
1950         struct nlattr *nl_rates, *nl_rate;
1951         struct ieee80211_rate *rate;
1952         int i;
1953
1954         /* add HT info */
1955         if (sband->ht_cap.ht_supported &&
1956             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1957                      sizeof(sband->ht_cap.mcs),
1958                      &sband->ht_cap.mcs) ||
1959              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1960                          sband->ht_cap.cap) ||
1961              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1962                         sband->ht_cap.ampdu_factor) ||
1963              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1964                         sband->ht_cap.ampdu_density)))
1965                 return -ENOBUFS;
1966
1967         /* add VHT info */
1968         if (sband->vht_cap.vht_supported &&
1969             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1970                      sizeof(sband->vht_cap.vht_mcs),
1971                      &sband->vht_cap.vht_mcs) ||
1972              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1973                          sband->vht_cap.cap)))
1974                 return -ENOBUFS;
1975
1976         if (large && sband->n_iftype_data) {
1977                 struct nlattr *nl_iftype_data =
1978                         nla_nest_start_noflag(msg,
1979                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1980                 const struct ieee80211_sband_iftype_data *iftd;
1981                 int err;
1982
1983                 if (!nl_iftype_data)
1984                         return -ENOBUFS;
1985
1986                 for_each_sband_iftype_data(sband, i, iftd) {
1987                         struct nlattr *iftdata;
1988
1989                         iftdata = nla_nest_start_noflag(msg, i + 1);
1990                         if (!iftdata)
1991                                 return -ENOBUFS;
1992
1993                         err = nl80211_send_iftype_data(msg, sband, iftd);
1994                         if (err)
1995                                 return err;
1996
1997                         nla_nest_end(msg, iftdata);
1998                 }
1999
2000                 nla_nest_end(msg, nl_iftype_data);
2001         }
2002
2003         /* add EDMG info */
2004         if (large && sband->edmg_cap.channels &&
2005             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
2006                        sband->edmg_cap.channels) ||
2007             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
2008                        sband->edmg_cap.bw_config)))
2009
2010                 return -ENOBUFS;
2011
2012         /* add bitrates */
2013         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
2014         if (!nl_rates)
2015                 return -ENOBUFS;
2016
2017         for (i = 0; i < sband->n_bitrates; i++) {
2018                 nl_rate = nla_nest_start_noflag(msg, i);
2019                 if (!nl_rate)
2020                         return -ENOBUFS;
2021
2022                 rate = &sband->bitrates[i];
2023                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
2024                                 rate->bitrate))
2025                         return -ENOBUFS;
2026                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
2027                     nla_put_flag(msg,
2028                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
2029                         return -ENOBUFS;
2030
2031                 nla_nest_end(msg, nl_rate);
2032         }
2033
2034         nla_nest_end(msg, nl_rates);
2035
2036         /* S1G capabilities */
2037         if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
2038             (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
2039                      sizeof(sband->s1g_cap.cap),
2040                      sband->s1g_cap.cap) ||
2041              nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
2042                      sizeof(sband->s1g_cap.nss_mcs),
2043                      sband->s1g_cap.nss_mcs)))
2044                 return -ENOBUFS;
2045
2046         return 0;
2047 }
2048
2049 static int
2050 nl80211_send_mgmt_stypes(struct sk_buff *msg,
2051                          const struct ieee80211_txrx_stypes *mgmt_stypes)
2052 {
2053         u16 stypes;
2054         struct nlattr *nl_ftypes, *nl_ifs;
2055         enum nl80211_iftype ift;
2056         int i;
2057
2058         if (!mgmt_stypes)
2059                 return 0;
2060
2061         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2062         if (!nl_ifs)
2063                 return -ENOBUFS;
2064
2065         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2066                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2067                 if (!nl_ftypes)
2068                         return -ENOBUFS;
2069                 i = 0;
2070                 stypes = mgmt_stypes[ift].tx;
2071                 while (stypes) {
2072                         if ((stypes & 1) &&
2073                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2074                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2075                                 return -ENOBUFS;
2076                         stypes >>= 1;
2077                         i++;
2078                 }
2079                 nla_nest_end(msg, nl_ftypes);
2080         }
2081
2082         nla_nest_end(msg, nl_ifs);
2083
2084         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2085         if (!nl_ifs)
2086                 return -ENOBUFS;
2087
2088         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2089                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2090                 if (!nl_ftypes)
2091                         return -ENOBUFS;
2092                 i = 0;
2093                 stypes = mgmt_stypes[ift].rx;
2094                 while (stypes) {
2095                         if ((stypes & 1) &&
2096                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2097                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2098                                 return -ENOBUFS;
2099                         stypes >>= 1;
2100                         i++;
2101                 }
2102                 nla_nest_end(msg, nl_ftypes);
2103         }
2104         nla_nest_end(msg, nl_ifs);
2105
2106         return 0;
2107 }
2108
2109 #define CMD(op, n)                                                      \
2110          do {                                                           \
2111                 if (rdev->ops->op) {                                    \
2112                         i++;                                            \
2113                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2114                                 goto nla_put_failure;                   \
2115                 }                                                       \
2116         } while (0)
2117
2118 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2119                                         struct sk_buff *msg)
2120 {
2121         int i = 0;
2122
2123         /*
2124          * do *NOT* add anything into this function, new things need to be
2125          * advertised only to new versions of userspace that can deal with
2126          * the split (and they can't possibly care about new features...
2127          */
2128         CMD(add_virtual_intf, NEW_INTERFACE);
2129         CMD(change_virtual_intf, SET_INTERFACE);
2130         CMD(add_key, NEW_KEY);
2131         CMD(start_ap, START_AP);
2132         CMD(add_station, NEW_STATION);
2133         CMD(add_mpath, NEW_MPATH);
2134         CMD(update_mesh_config, SET_MESH_CONFIG);
2135         CMD(change_bss, SET_BSS);
2136         CMD(auth, AUTHENTICATE);
2137         CMD(assoc, ASSOCIATE);
2138         CMD(deauth, DEAUTHENTICATE);
2139         CMD(disassoc, DISASSOCIATE);
2140         CMD(join_ibss, JOIN_IBSS);
2141         CMD(join_mesh, JOIN_MESH);
2142         CMD(set_pmksa, SET_PMKSA);
2143         CMD(del_pmksa, DEL_PMKSA);
2144         CMD(flush_pmksa, FLUSH_PMKSA);
2145         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2146                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2147         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2148         CMD(mgmt_tx, FRAME);
2149         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2150         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2151                 i++;
2152                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2153                         goto nla_put_failure;
2154         }
2155         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2156             rdev->ops->join_mesh) {
2157                 i++;
2158                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2159                         goto nla_put_failure;
2160         }
2161         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2162                 CMD(tdls_mgmt, TDLS_MGMT);
2163                 CMD(tdls_oper, TDLS_OPER);
2164         }
2165         if (rdev->wiphy.max_sched_scan_reqs)
2166                 CMD(sched_scan_start, START_SCHED_SCAN);
2167         CMD(probe_client, PROBE_CLIENT);
2168         CMD(set_noack_map, SET_NOACK_MAP);
2169         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2170                 i++;
2171                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2172                         goto nla_put_failure;
2173         }
2174         CMD(start_p2p_device, START_P2P_DEVICE);
2175         CMD(set_mcast_rate, SET_MCAST_RATE);
2176 #ifdef CONFIG_NL80211_TESTMODE
2177         CMD(testmode_cmd, TESTMODE);
2178 #endif
2179
2180         if (rdev->ops->connect || rdev->ops->auth) {
2181                 i++;
2182                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2183                         goto nla_put_failure;
2184         }
2185
2186         if (rdev->ops->disconnect || rdev->ops->deauth) {
2187                 i++;
2188                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2189                         goto nla_put_failure;
2190         }
2191
2192         return i;
2193  nla_put_failure:
2194         return -ENOBUFS;
2195 }
2196
2197 static int
2198 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2199                            struct sk_buff *msg)
2200 {
2201         struct nlattr *ftm;
2202
2203         if (!cap->ftm.supported)
2204                 return 0;
2205
2206         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2207         if (!ftm)
2208                 return -ENOBUFS;
2209
2210         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2211                 return -ENOBUFS;
2212         if (cap->ftm.non_asap &&
2213             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2214                 return -ENOBUFS;
2215         if (cap->ftm.request_lci &&
2216             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2217                 return -ENOBUFS;
2218         if (cap->ftm.request_civicloc &&
2219             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2220                 return -ENOBUFS;
2221         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2222                         cap->ftm.preambles))
2223                 return -ENOBUFS;
2224         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2225                         cap->ftm.bandwidths))
2226                 return -ENOBUFS;
2227         if (cap->ftm.max_bursts_exponent >= 0 &&
2228             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2229                         cap->ftm.max_bursts_exponent))
2230                 return -ENOBUFS;
2231         if (cap->ftm.max_ftms_per_burst &&
2232             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2233                         cap->ftm.max_ftms_per_burst))
2234                 return -ENOBUFS;
2235         if (cap->ftm.trigger_based &&
2236             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2237                 return -ENOBUFS;
2238         if (cap->ftm.non_trigger_based &&
2239             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2240                 return -ENOBUFS;
2241
2242         nla_nest_end(msg, ftm);
2243         return 0;
2244 }
2245
2246 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2247                                   struct sk_buff *msg)
2248 {
2249         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2250         struct nlattr *pmsr, *caps;
2251
2252         if (!cap)
2253                 return 0;
2254
2255         /*
2256          * we don't need to clean up anything here since the caller
2257          * will genlmsg_cancel() if we fail
2258          */
2259
2260         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2261         if (!pmsr)
2262                 return -ENOBUFS;
2263
2264         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2265                 return -ENOBUFS;
2266
2267         if (cap->report_ap_tsf &&
2268             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2269                 return -ENOBUFS;
2270
2271         if (cap->randomize_mac_addr &&
2272             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2273                 return -ENOBUFS;
2274
2275         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2276         if (!caps)
2277                 return -ENOBUFS;
2278
2279         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2280                 return -ENOBUFS;
2281
2282         nla_nest_end(msg, caps);
2283         nla_nest_end(msg, pmsr);
2284
2285         return 0;
2286 }
2287
2288 static int
2289 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2290                               struct sk_buff *msg)
2291 {
2292         int i;
2293         struct nlattr *nested, *nested_akms;
2294         const struct wiphy_iftype_akm_suites *iftype_akms;
2295
2296         if (!rdev->wiphy.num_iftype_akm_suites ||
2297             !rdev->wiphy.iftype_akm_suites)
2298                 return 0;
2299
2300         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2301         if (!nested)
2302                 return -ENOBUFS;
2303
2304         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2305                 nested_akms = nla_nest_start(msg, i + 1);
2306                 if (!nested_akms)
2307                         return -ENOBUFS;
2308
2309                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2310
2311                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2312                                         iftype_akms->iftypes_mask))
2313                         return -ENOBUFS;
2314
2315                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2316                             sizeof(u32) * iftype_akms->n_akm_suites,
2317                             iftype_akms->akm_suites)) {
2318                         return -ENOBUFS;
2319                 }
2320                 nla_nest_end(msg, nested_akms);
2321         }
2322
2323         nla_nest_end(msg, nested);
2324
2325         return 0;
2326 }
2327
2328 static int
2329 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2330                                struct sk_buff *msg)
2331 {
2332         struct nlattr *supp;
2333
2334         if (!rdev->wiphy.tid_config_support.vif &&
2335             !rdev->wiphy.tid_config_support.peer)
2336                 return 0;
2337
2338         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2339         if (!supp)
2340                 return -ENOSPC;
2341
2342         if (rdev->wiphy.tid_config_support.vif &&
2343             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2344                               rdev->wiphy.tid_config_support.vif,
2345                               NL80211_TID_CONFIG_ATTR_PAD))
2346                 goto fail;
2347
2348         if (rdev->wiphy.tid_config_support.peer &&
2349             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2350                               rdev->wiphy.tid_config_support.peer,
2351                               NL80211_TID_CONFIG_ATTR_PAD))
2352                 goto fail;
2353
2354         /* for now we just use the same value ... makes more sense */
2355         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2356                        rdev->wiphy.tid_config_support.max_retry))
2357                 goto fail;
2358         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2359                        rdev->wiphy.tid_config_support.max_retry))
2360                 goto fail;
2361
2362         nla_nest_end(msg, supp);
2363
2364         return 0;
2365 fail:
2366         nla_nest_cancel(msg, supp);
2367         return -ENOBUFS;
2368 }
2369
2370 static int
2371 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2372                       struct sk_buff *msg)
2373 {
2374         struct nlattr *sar_capa, *specs, *sub_freq_range;
2375         u8 num_freq_ranges;
2376         int i;
2377
2378         if (!rdev->wiphy.sar_capa)
2379                 return 0;
2380
2381         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2382
2383         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2384         if (!sar_capa)
2385                 return -ENOSPC;
2386
2387         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2388                 goto fail;
2389
2390         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2391         if (!specs)
2392                 goto fail;
2393
2394         /* report supported freq_ranges */
2395         for (i = 0; i < num_freq_ranges; i++) {
2396                 sub_freq_range = nla_nest_start(msg, i + 1);
2397                 if (!sub_freq_range)
2398                         goto fail;
2399
2400                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2401                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2402                         goto fail;
2403
2404                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2405                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2406                         goto fail;
2407
2408                 nla_nest_end(msg, sub_freq_range);
2409         }
2410
2411         nla_nest_end(msg, specs);
2412         nla_nest_end(msg, sar_capa);
2413
2414         return 0;
2415 fail:
2416         nla_nest_cancel(msg, sar_capa);
2417         return -ENOBUFS;
2418 }
2419
2420 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2421 {
2422         struct nlattr *config;
2423
2424         if (!wiphy->mbssid_max_interfaces)
2425                 return 0;
2426
2427         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2428         if (!config)
2429                 return -ENOBUFS;
2430
2431         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2432                        wiphy->mbssid_max_interfaces))
2433                 goto fail;
2434
2435         if (wiphy->ema_max_profile_periodicity &&
2436             nla_put_u8(msg,
2437                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2438                        wiphy->ema_max_profile_periodicity))
2439                 goto fail;
2440
2441         nla_nest_end(msg, config);
2442         return 0;
2443
2444 fail:
2445         nla_nest_cancel(msg, config);
2446         return -ENOBUFS;
2447 }
2448
2449 static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
2450 {
2451         const struct wiphy_radio *r = &wiphy->radio[idx];
2452         struct nlattr *radio, *freq;
2453         int i;
2454
2455         radio = nla_nest_start(msg, idx);
2456         if (!radio)
2457                 return -ENOBUFS;
2458
2459         if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
2460                 goto nla_put_failure;
2461
2462         if (r->antenna_mask &&
2463             nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
2464                         r->antenna_mask))
2465                 goto nla_put_failure;
2466
2467         for (i = 0; i < r->n_freq_range; i++) {
2468                 const struct wiphy_radio_freq_range *range = &r->freq_range[i];
2469
2470                 freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
2471                 if (!freq)
2472                         goto nla_put_failure;
2473
2474                 if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
2475                                 range->start_freq) ||
2476                     nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
2477                                 range->end_freq))
2478                         goto nla_put_failure;
2479
2480                 nla_nest_end(msg, freq);
2481         }
2482
2483         for (i = 0; i < r->n_iface_combinations; i++)
2484                 if (nl80211_put_ifcomb_data(msg, true,
2485                                             NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
2486                                             &r->iface_combinations[i],
2487                                             NLA_F_NESTED))
2488                         goto nla_put_failure;
2489
2490         nla_nest_end(msg, radio);
2491
2492         return 0;
2493
2494 nla_put_failure:
2495         return -ENOBUFS;
2496 }
2497
2498 static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
2499 {
2500         struct nlattr *radios;
2501         int i;
2502
2503         if (!wiphy->n_radio)
2504                 return 0;
2505
2506         radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
2507         if (!radios)
2508                 return -ENOBUFS;
2509
2510         for (i = 0; i < wiphy->n_radio; i++)
2511                 if (nl80211_put_radio(wiphy, msg, i))
2512                         goto fail;
2513
2514         nla_nest_end(msg, radios);
2515
2516         if (nl80211_put_iface_combinations(wiphy, msg,
2517                                            NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
2518                                            -1, true, NLA_F_NESTED))
2519                 return -ENOBUFS;
2520
2521         return 0;
2522
2523 fail:
2524         nla_nest_cancel(msg, radios);
2525         return -ENOBUFS;
2526 }
2527
2528 struct nl80211_dump_wiphy_state {
2529         s64 filter_wiphy;
2530         long start;
2531         long split_start, band_start, chan_start, capa_start;
2532         bool split;
2533 };
2534
2535 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2536                               enum nl80211_commands cmd,
2537                               struct sk_buff *msg, u32 portid, u32 seq,
2538                               int flags, struct nl80211_dump_wiphy_state *state)
2539 {
2540         void *hdr;
2541         struct nlattr *nl_bands, *nl_band;
2542         struct nlattr *nl_freqs, *nl_freq;
2543         struct nlattr *nl_cmds;
2544         enum nl80211_band band;
2545         struct ieee80211_channel *chan;
2546         int i;
2547         const struct ieee80211_txrx_stypes *mgmt_stypes =
2548                                 rdev->wiphy.mgmt_stypes;
2549         u32 features;
2550
2551         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2552         if (!hdr)
2553                 return -ENOBUFS;
2554
2555         if (WARN_ON(!state))
2556                 return -EINVAL;
2557
2558         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2559             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2560                            wiphy_name(&rdev->wiphy)) ||
2561             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2562                         cfg80211_rdev_list_generation))
2563                 goto nla_put_failure;
2564
2565         if (cmd != NL80211_CMD_NEW_WIPHY)
2566                 goto finish;
2567
2568         switch (state->split_start) {
2569         case 0:
2570                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2571                                rdev->wiphy.retry_short) ||
2572                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2573                                rdev->wiphy.retry_long) ||
2574                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2575                                 rdev->wiphy.frag_threshold) ||
2576                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2577                                 rdev->wiphy.rts_threshold) ||
2578                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2579                                rdev->wiphy.coverage_class) ||
2580                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2581                                rdev->wiphy.max_scan_ssids) ||
2582                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2583                                rdev->wiphy.max_sched_scan_ssids) ||
2584                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2585                                 rdev->wiphy.max_scan_ie_len) ||
2586                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2587                                 rdev->wiphy.max_sched_scan_ie_len) ||
2588                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2589                                rdev->wiphy.max_match_sets))
2590                         goto nla_put_failure;
2591
2592                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2593                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2594                         goto nla_put_failure;
2595                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2596                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2597                         goto nla_put_failure;
2598                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2599                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2600                         goto nla_put_failure;
2601                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2602                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2603                         goto nla_put_failure;
2604                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2605                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2606                         goto nla_put_failure;
2607                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2608                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2609                         goto nla_put_failure;
2610                 state->split_start++;
2611                 if (state->split)
2612                         break;
2613                 fallthrough;
2614         case 1:
2615                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2616                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2617                             rdev->wiphy.cipher_suites))
2618                         goto nla_put_failure;
2619
2620                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2621                                rdev->wiphy.max_num_pmkids))
2622                         goto nla_put_failure;
2623
2624                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2625                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2626                         goto nla_put_failure;
2627
2628                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2629                                 rdev->wiphy.available_antennas_tx) ||
2630                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2631                                 rdev->wiphy.available_antennas_rx))
2632                         goto nla_put_failure;
2633
2634                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2635                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2636                                 rdev->wiphy.probe_resp_offload))
2637                         goto nla_put_failure;
2638
2639                 if ((rdev->wiphy.available_antennas_tx ||
2640                      rdev->wiphy.available_antennas_rx) &&
2641                     rdev->ops->get_antenna) {
2642                         u32 tx_ant = 0, rx_ant = 0;
2643                         int res;
2644
2645                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2646                         if (!res) {
2647                                 if (nla_put_u32(msg,
2648                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2649                                                 tx_ant) ||
2650                                     nla_put_u32(msg,
2651                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2652                                                 rx_ant))
2653                                         goto nla_put_failure;
2654                         }
2655                 }
2656
2657                 state->split_start++;
2658                 if (state->split)
2659                         break;
2660                 fallthrough;
2661         case 2:
2662                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2663                                         rdev->wiphy.interface_modes))
2664                                 goto nla_put_failure;
2665                 state->split_start++;
2666                 if (state->split)
2667                         break;
2668                 fallthrough;
2669         case 3:
2670                 nl_bands = nla_nest_start_noflag(msg,
2671                                                  NL80211_ATTR_WIPHY_BANDS);
2672                 if (!nl_bands)
2673                         goto nla_put_failure;
2674
2675                 for (band = state->band_start;
2676                      band < (state->split ?
2677                                 NUM_NL80211_BANDS :
2678                                 NL80211_BAND_60GHZ + 1);
2679                      band++) {
2680                         struct ieee80211_supported_band *sband;
2681
2682                         /* omit higher bands for ancient software */
2683                         if (band > NL80211_BAND_5GHZ && !state->split)
2684                                 break;
2685
2686                         sband = rdev->wiphy.bands[band];
2687
2688                         if (!sband)
2689                                 continue;
2690
2691                         nl_band = nla_nest_start_noflag(msg, band);
2692                         if (!nl_band)
2693                                 goto nla_put_failure;
2694
2695                         switch (state->chan_start) {
2696                         case 0:
2697                                 if (nl80211_send_band_rateinfo(msg, sband,
2698                                                                state->split))
2699                                         goto nla_put_failure;
2700                                 state->chan_start++;
2701                                 if (state->split)
2702                                         break;
2703                                 fallthrough;
2704                         default:
2705                                 /* add frequencies */
2706                                 nl_freqs = nla_nest_start_noflag(msg,
2707                                                                  NL80211_BAND_ATTR_FREQS);
2708                                 if (!nl_freqs)
2709                                         goto nla_put_failure;
2710
2711                                 for (i = state->chan_start - 1;
2712                                      i < sband->n_channels;
2713                                      i++) {
2714                                         nl_freq = nla_nest_start_noflag(msg,
2715                                                                         i);
2716                                         if (!nl_freq)
2717                                                 goto nla_put_failure;
2718
2719                                         chan = &sband->channels[i];
2720
2721                                         if (nl80211_msg_put_channel(
2722                                                         msg, &rdev->wiphy, chan,
2723                                                         state->split))
2724                                                 goto nla_put_failure;
2725
2726                                         nla_nest_end(msg, nl_freq);
2727                                         if (state->split)
2728                                                 break;
2729                                 }
2730                                 if (i < sband->n_channels)
2731                                         state->chan_start = i + 2;
2732                                 else
2733                                         state->chan_start = 0;
2734                                 nla_nest_end(msg, nl_freqs);
2735                         }
2736
2737                         nla_nest_end(msg, nl_band);
2738
2739                         if (state->split) {
2740                                 /* start again here */
2741                                 if (state->chan_start)
2742                                         band--;
2743                                 break;
2744                         }
2745                 }
2746                 nla_nest_end(msg, nl_bands);
2747
2748                 if (band < NUM_NL80211_BANDS)
2749                         state->band_start = band + 1;
2750                 else
2751                         state->band_start = 0;
2752
2753                 /* if bands & channels are done, continue outside */
2754                 if (state->band_start == 0 && state->chan_start == 0)
2755                         state->split_start++;
2756                 if (state->split)
2757                         break;
2758                 fallthrough;
2759         case 4:
2760                 nl_cmds = nla_nest_start_noflag(msg,
2761                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2762                 if (!nl_cmds)
2763                         goto nla_put_failure;
2764
2765                 i = nl80211_add_commands_unsplit(rdev, msg);
2766                 if (i < 0)
2767                         goto nla_put_failure;
2768                 if (state->split) {
2769                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2770                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2771                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2772                                 CMD(channel_switch, CHANNEL_SWITCH);
2773                         CMD(set_qos_map, SET_QOS_MAP);
2774                         if (rdev->wiphy.features &
2775                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2776                                 CMD(add_tx_ts, ADD_TX_TS);
2777                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2778                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2779                         CMD(update_ft_ies, UPDATE_FT_IES);
2780                         if (rdev->wiphy.sar_capa)
2781                                 CMD(set_sar_specs, SET_SAR_SPECS);
2782                         CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
2783                 }
2784 #undef CMD
2785
2786                 nla_nest_end(msg, nl_cmds);
2787                 state->split_start++;
2788                 if (state->split)
2789                         break;
2790                 fallthrough;
2791         case 5:
2792                 if (rdev->ops->remain_on_channel &&
2793                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2794                     nla_put_u32(msg,
2795                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2796                                 rdev->wiphy.max_remain_on_channel_duration))
2797                         goto nla_put_failure;
2798
2799                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2800                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2801                         goto nla_put_failure;
2802
2803                 state->split_start++;
2804                 if (state->split)
2805                         break;
2806                 fallthrough;
2807         case 6:
2808 #ifdef CONFIG_PM
2809                 if (nl80211_send_wowlan(msg, rdev, state->split))
2810                         goto nla_put_failure;
2811                 state->split_start++;
2812                 if (state->split)
2813                         break;
2814 #else
2815                 state->split_start++;
2816 #endif
2817                 fallthrough;
2818         case 7:
2819                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2820                                         rdev->wiphy.software_iftypes))
2821                         goto nla_put_failure;
2822
2823                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2824                                                    NL80211_ATTR_INTERFACE_COMBINATIONS,
2825                                                    rdev->wiphy.n_radio ? 0 : -1,
2826                                                    state->split, 0))
2827                         goto nla_put_failure;
2828
2829                 state->split_start++;
2830                 if (state->split)
2831                         break;
2832                 fallthrough;
2833         case 8:
2834                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2835                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2836                                 rdev->wiphy.ap_sme_capa))
2837                         goto nla_put_failure;
2838
2839                 features = rdev->wiphy.features;
2840                 /*
2841                  * We can only add the per-channel limit information if the
2842                  * dump is split, otherwise it makes it too big. Therefore
2843                  * only advertise it in that case.
2844                  */
2845                 if (state->split)
2846                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2847                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2848                         goto nla_put_failure;
2849
2850                 if (rdev->wiphy.ht_capa_mod_mask &&
2851                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2852                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2853                             rdev->wiphy.ht_capa_mod_mask))
2854                         goto nla_put_failure;
2855
2856                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2857                     rdev->wiphy.max_acl_mac_addrs &&
2858                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2859                                 rdev->wiphy.max_acl_mac_addrs))
2860                         goto nla_put_failure;
2861
2862                 /*
2863                  * Any information below this point is only available to
2864                  * applications that can deal with it being split. This
2865                  * helps ensure that newly added capabilities don't break
2866                  * older tools by overrunning their buffers.
2867                  *
2868                  * We still increment split_start so that in the split
2869                  * case we'll continue with more data in the next round,
2870                  * but break unconditionally so unsplit data stops here.
2871                  */
2872                 if (state->split)
2873                         state->split_start++;
2874                 else
2875                         state->split_start = 0;
2876                 break;
2877         case 9:
2878                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2879                         goto nla_put_failure;
2880
2881                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2882                                 rdev->wiphy.max_sched_scan_plans) ||
2883                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2884                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2885                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2886                                 rdev->wiphy.max_sched_scan_plan_iterations))
2887                         goto nla_put_failure;
2888
2889                 if (rdev->wiphy.extended_capabilities &&
2890                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2891                              rdev->wiphy.extended_capabilities_len,
2892                              rdev->wiphy.extended_capabilities) ||
2893                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2894                              rdev->wiphy.extended_capabilities_len,
2895                              rdev->wiphy.extended_capabilities_mask)))
2896                         goto nla_put_failure;
2897
2898                 if (rdev->wiphy.vht_capa_mod_mask &&
2899                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2900                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2901                             rdev->wiphy.vht_capa_mod_mask))
2902                         goto nla_put_failure;
2903
2904                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2905                             rdev->wiphy.perm_addr))
2906                         goto nla_put_failure;
2907
2908                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2909                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2910                             rdev->wiphy.addr_mask))
2911                         goto nla_put_failure;
2912
2913                 if (rdev->wiphy.n_addresses > 1) {
2914                         void *attr;
2915
2916                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2917                         if (!attr)
2918                                 goto nla_put_failure;
2919
2920                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2921                                 if (nla_put(msg, i + 1, ETH_ALEN,
2922                                             rdev->wiphy.addresses[i].addr))
2923                                         goto nla_put_failure;
2924
2925                         nla_nest_end(msg, attr);
2926                 }
2927
2928                 state->split_start++;
2929                 break;
2930         case 10:
2931                 if (nl80211_send_coalesce(msg, rdev))
2932                         goto nla_put_failure;
2933
2934                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2935                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2936                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2937                         goto nla_put_failure;
2938
2939                 if (rdev->wiphy.max_ap_assoc_sta &&
2940                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2941                                 rdev->wiphy.max_ap_assoc_sta))
2942                         goto nla_put_failure;
2943
2944                 state->split_start++;
2945                 break;
2946         case 11:
2947                 if (rdev->wiphy.n_vendor_commands) {
2948                         const struct nl80211_vendor_cmd_info *info;
2949                         struct nlattr *nested;
2950
2951                         nested = nla_nest_start_noflag(msg,
2952                                                        NL80211_ATTR_VENDOR_DATA);
2953                         if (!nested)
2954                                 goto nla_put_failure;
2955
2956                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2957                                 info = &rdev->wiphy.vendor_commands[i].info;
2958                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2959                                         goto nla_put_failure;
2960                         }
2961                         nla_nest_end(msg, nested);
2962                 }
2963
2964                 if (rdev->wiphy.n_vendor_events) {
2965                         const struct nl80211_vendor_cmd_info *info;
2966                         struct nlattr *nested;
2967
2968                         nested = nla_nest_start_noflag(msg,
2969                                                        NL80211_ATTR_VENDOR_EVENTS);
2970                         if (!nested)
2971                                 goto nla_put_failure;
2972
2973                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2974                                 info = &rdev->wiphy.vendor_events[i];
2975                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2976                                         goto nla_put_failure;
2977                         }
2978                         nla_nest_end(msg, nested);
2979                 }
2980                 state->split_start++;
2981                 break;
2982         case 12:
2983                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2984                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2985                                rdev->wiphy.max_num_csa_counters))
2986                         goto nla_put_failure;
2987
2988                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2989                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2990                         goto nla_put_failure;
2991
2992                 if (rdev->wiphy.max_sched_scan_reqs &&
2993                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2994                                 rdev->wiphy.max_sched_scan_reqs))
2995                         goto nla_put_failure;
2996
2997                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2998                             sizeof(rdev->wiphy.ext_features),
2999                             rdev->wiphy.ext_features))
3000                         goto nla_put_failure;
3001
3002                 if (rdev->wiphy.bss_select_support) {
3003                         struct nlattr *nested;
3004                         u32 bss_select_support = rdev->wiphy.bss_select_support;
3005
3006                         nested = nla_nest_start_noflag(msg,
3007                                                        NL80211_ATTR_BSS_SELECT);
3008                         if (!nested)
3009                                 goto nla_put_failure;
3010
3011                         i = 0;
3012                         while (bss_select_support) {
3013                                 if ((bss_select_support & 1) &&
3014                                     nla_put_flag(msg, i))
3015                                         goto nla_put_failure;
3016                                 i++;
3017                                 bss_select_support >>= 1;
3018                         }
3019                         nla_nest_end(msg, nested);
3020                 }
3021
3022                 state->split_start++;
3023                 break;
3024         case 13:
3025                 if (rdev->wiphy.num_iftype_ext_capab &&
3026                     rdev->wiphy.iftype_ext_capab) {
3027                         struct nlattr *nested_ext_capab, *nested;
3028
3029                         nested = nla_nest_start_noflag(msg,
3030                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
3031                         if (!nested)
3032                                 goto nla_put_failure;
3033
3034                         for (i = state->capa_start;
3035                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
3036                                 const struct wiphy_iftype_ext_capab *capab;
3037
3038                                 capab = &rdev->wiphy.iftype_ext_capab[i];
3039
3040                                 nested_ext_capab = nla_nest_start_noflag(msg,
3041                                                                          i);
3042                                 if (!nested_ext_capab ||
3043                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
3044                                                 capab->iftype) ||
3045                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
3046                                             capab->extended_capabilities_len,
3047                                             capab->extended_capabilities) ||
3048                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
3049                                             capab->extended_capabilities_len,
3050                                             capab->extended_capabilities_mask))
3051                                         goto nla_put_failure;
3052
3053                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
3054                                     (nla_put_u16(msg,
3055                                                  NL80211_ATTR_EML_CAPABILITY,
3056                                                  capab->eml_capabilities) ||
3057                                      nla_put_u16(msg,
3058                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
3059                                                  capab->mld_capa_and_ops)))
3060                                         goto nla_put_failure;
3061
3062                                 nla_nest_end(msg, nested_ext_capab);
3063                                 if (state->split)
3064                                         break;
3065                         }
3066                         nla_nest_end(msg, nested);
3067                         if (i < rdev->wiphy.num_iftype_ext_capab) {
3068                                 state->capa_start = i + 1;
3069                                 break;
3070                         }
3071                 }
3072
3073                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
3074                                 rdev->wiphy.nan_supported_bands))
3075                         goto nla_put_failure;
3076
3077                 if (wiphy_ext_feature_isset(&rdev->wiphy,
3078                                             NL80211_EXT_FEATURE_TXQS)) {
3079                         struct cfg80211_txq_stats txqstats = {};
3080                         int res;
3081
3082                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
3083                         if (!res &&
3084                             !nl80211_put_txq_stats(msg, &txqstats,
3085                                                    NL80211_ATTR_TXQ_STATS))
3086                                 goto nla_put_failure;
3087
3088                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
3089                                         rdev->wiphy.txq_limit))
3090                                 goto nla_put_failure;
3091                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
3092                                         rdev->wiphy.txq_memory_limit))
3093                                 goto nla_put_failure;
3094                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
3095                                         rdev->wiphy.txq_quantum))
3096                                 goto nla_put_failure;
3097                 }
3098
3099                 state->split_start++;
3100                 break;
3101         case 14:
3102                 if (nl80211_send_pmsr_capa(rdev, msg))
3103                         goto nla_put_failure;
3104
3105                 state->split_start++;
3106                 break;
3107         case 15:
3108                 if (rdev->wiphy.akm_suites &&
3109                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
3110                             sizeof(u32) * rdev->wiphy.n_akm_suites,
3111                             rdev->wiphy.akm_suites))
3112                         goto nla_put_failure;
3113
3114                 if (nl80211_put_iftype_akm_suites(rdev, msg))
3115                         goto nla_put_failure;
3116
3117                 if (nl80211_put_tid_config_support(rdev, msg))
3118                         goto nla_put_failure;
3119                 state->split_start++;
3120                 break;
3121         case 16:
3122                 if (nl80211_put_sar_specs(rdev, msg))
3123                         goto nla_put_failure;
3124
3125                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
3126                         goto nla_put_failure;
3127
3128                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
3129                                 rdev->wiphy.max_num_akm_suites))
3130                         goto nla_put_failure;
3131
3132                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
3133                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
3134
3135                 if (rdev->wiphy.hw_timestamp_max_peers &&
3136                     nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
3137                                 rdev->wiphy.hw_timestamp_max_peers))
3138                         goto nla_put_failure;
3139
3140                 state->split_start++;
3141                 break;
3142         case 17:
3143                 if (nl80211_put_radios(&rdev->wiphy, msg))
3144                         goto nla_put_failure;
3145
3146                 /* done */
3147                 state->split_start = 0;
3148                 break;
3149         }
3150  finish:
3151         genlmsg_end(msg, hdr);
3152         return 0;
3153
3154  nla_put_failure:
3155         genlmsg_cancel(msg, hdr);
3156         return -EMSGSIZE;
3157 }
3158
3159 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3160                                     struct netlink_callback *cb,
3161                                     struct nl80211_dump_wiphy_state *state)
3162 {
3163         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3164         int ret;
3165
3166         if (!tb)
3167                 return -ENOMEM;
3168
3169         ret = nlmsg_parse_deprecated(cb->nlh,
3170                                      GENL_HDRLEN + nl80211_fam.hdrsize,
3171                                      tb, nl80211_fam.maxattr,
3172                                      nl80211_policy, NULL);
3173         /* ignore parse errors for backward compatibility */
3174         if (ret) {
3175                 ret = 0;
3176                 goto out;
3177         }
3178
3179         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3180         if (tb[NL80211_ATTR_WIPHY])
3181                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3182         if (tb[NL80211_ATTR_WDEV])
3183                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3184         if (tb[NL80211_ATTR_IFINDEX]) {
3185                 struct net_device *netdev;
3186                 struct cfg80211_registered_device *rdev;
3187                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3188
3189                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3190                 if (!netdev) {
3191                         ret = -ENODEV;
3192                         goto out;
3193                 }
3194                 if (netdev->ieee80211_ptr) {
3195                         rdev = wiphy_to_rdev(
3196                                 netdev->ieee80211_ptr->wiphy);
3197                         state->filter_wiphy = rdev->wiphy_idx;
3198                 }
3199         }
3200
3201         ret = 0;
3202 out:
3203         kfree(tb);
3204         return ret;
3205 }
3206
3207 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3208 {
3209         int idx = 0, ret;
3210         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3211         struct cfg80211_registered_device *rdev;
3212
3213         rtnl_lock();
3214         if (!state) {
3215                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3216                 if (!state) {
3217                         rtnl_unlock();
3218                         return -ENOMEM;
3219                 }
3220                 state->filter_wiphy = -1;
3221                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3222                 if (ret) {
3223                         kfree(state);
3224                         rtnl_unlock();
3225                         return ret;
3226                 }
3227                 cb->args[0] = (long)state;
3228         }
3229
3230         for_each_rdev(rdev) {
3231                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3232                         continue;
3233                 if (++idx <= state->start)
3234                         continue;
3235                 if (state->filter_wiphy != -1 &&
3236                     state->filter_wiphy != rdev->wiphy_idx)
3237                         continue;
3238                 wiphy_lock(&rdev->wiphy);
3239                 /* attempt to fit multiple wiphy data chunks into the skb */
3240                 do {
3241                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3242                                                  skb,
3243                                                  NETLINK_CB(cb->skb).portid,
3244                                                  cb->nlh->nlmsg_seq,
3245                                                  NLM_F_MULTI, state);
3246                         if (ret < 0) {
3247                                 /*
3248                                  * If sending the wiphy data didn't fit (ENOBUFS
3249                                  * or EMSGSIZE returned), this SKB is still
3250                                  * empty (so it's not too big because another
3251                                  * wiphy dataset is already in the skb) and
3252                                  * we've not tried to adjust the dump allocation
3253                                  * yet ... then adjust the alloc size to be
3254                                  * bigger, and return 1 but with the empty skb.
3255                                  * This results in an empty message being RX'ed
3256                                  * in userspace, but that is ignored.
3257                                  *
3258                                  * We can then retry with the larger buffer.
3259                                  */
3260                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3261                                     !skb->len && !state->split &&
3262                                     cb->min_dump_alloc < 4096) {
3263                                         cb->min_dump_alloc = 4096;
3264                                         state->split_start = 0;
3265                                         wiphy_unlock(&rdev->wiphy);
3266                                         rtnl_unlock();
3267                                         return 1;
3268                                 }
3269                                 idx--;
3270                                 break;
3271                         }
3272                 } while (state->split_start > 0);
3273                 wiphy_unlock(&rdev->wiphy);
3274                 break;
3275         }
3276         rtnl_unlock();
3277
3278         state->start = idx;
3279
3280         return skb->len;
3281 }
3282
3283 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3284 {
3285         kfree((void *)cb->args[0]);
3286         return 0;
3287 }
3288
3289 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3290 {
3291         struct sk_buff *msg;
3292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3293         struct nl80211_dump_wiphy_state state = {};
3294
3295         msg = nlmsg_new(4096, GFP_KERNEL);
3296         if (!msg)
3297                 return -ENOMEM;
3298
3299         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3300                                info->snd_portid, info->snd_seq, 0,
3301                                &state) < 0) {
3302                 nlmsg_free(msg);
3303                 return -ENOBUFS;
3304         }
3305
3306         return genlmsg_reply(msg, info);
3307 }
3308
3309 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3310         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3311         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3312         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3313         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3314         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3315 };
3316
3317 static int parse_txq_params(struct nlattr *tb[],
3318                             struct ieee80211_txq_params *txq_params)
3319 {
3320         u8 ac;
3321
3322         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3323             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3324             !tb[NL80211_TXQ_ATTR_AIFS])
3325                 return -EINVAL;
3326
3327         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3328         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3329         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3330         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3331         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3332
3333         if (ac >= NL80211_NUM_ACS)
3334                 return -EINVAL;
3335         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3336         return 0;
3337 }
3338
3339 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3340 {
3341         /*
3342          * You can only set the channel explicitly for some interfaces,
3343          * most have their channel managed via their respective
3344          * "establish a connection" command (connect, join, ...)
3345          *
3346          * For AP/GO and mesh mode, the channel can be set with the
3347          * channel userspace API, but is only stored and passed to the
3348          * low-level driver when the AP starts or the mesh is joined.
3349          * This is for backward compatibility, userspace can also give
3350          * the channel in the start-ap or join-mesh commands instead.
3351          *
3352          * Monitors are special as they are normally slaved to
3353          * whatever else is going on, so they have their own special
3354          * operation to set the monitor channel if possible.
3355          */
3356         return !wdev ||
3357                 wdev->iftype == NL80211_IFTYPE_AP ||
3358                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3359                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3360                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3361 }
3362
3363 static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3364                                   struct genl_info *info, bool monitor,
3365                                   struct cfg80211_chan_def *chandef)
3366 {
3367         struct netlink_ext_ack *extack = info->extack;
3368         struct nlattr **attrs = info->attrs;
3369         u32 control_freq;
3370
3371         if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3372                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3373                                     "Frequency is missing");
3374                 return -EINVAL;
3375         }
3376
3377         control_freq = MHZ_TO_KHZ(
3378                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3379         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3380                 control_freq +=
3381                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3382
3383         memset(chandef, 0, sizeof(*chandef));
3384         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3385         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3386         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3387         chandef->freq1_offset = control_freq % 1000;
3388         chandef->center_freq2 = 0;
3389
3390         if (!chandef->chan) {
3391                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3392                                     "Unknown channel");
3393                 return -EINVAL;
3394         }
3395
3396         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3397                 enum nl80211_channel_type chantype;
3398
3399                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3400
3401                 switch (chantype) {
3402                 case NL80211_CHAN_NO_HT:
3403                 case NL80211_CHAN_HT20:
3404                 case NL80211_CHAN_HT40PLUS:
3405                 case NL80211_CHAN_HT40MINUS:
3406                         cfg80211_chandef_create(chandef, chandef->chan,
3407                                                 chantype);
3408                         /* user input for center_freq is incorrect */
3409                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3410                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3411                                 NL_SET_ERR_MSG_ATTR(extack,
3412                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3413                                                     "bad center frequency 1");
3414                                 return -EINVAL;
3415                         }
3416                         /* center_freq2 must be zero */
3417                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3418                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3419                                 NL_SET_ERR_MSG_ATTR(extack,
3420                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3421                                                     "center frequency 2 can't be used");
3422                                 return -EINVAL;
3423                         }
3424                         break;
3425                 default:
3426                         NL_SET_ERR_MSG_ATTR(extack,
3427                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3428                                             "invalid channel type");
3429                         return -EINVAL;
3430                 }
3431         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3432                 chandef->width =
3433                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3434                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3435                         /* User input error for channel width doesn't match channel  */
3436                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3437                                 NL_SET_ERR_MSG_ATTR(extack,
3438                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3439                                                     "bad channel width");
3440                                 return -EINVAL;
3441                         }
3442                 }
3443                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3444                         chandef->center_freq1 =
3445                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3446                         chandef->freq1_offset =
3447                                 nla_get_u32_default(attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET],
3448                                                     0);
3449                 }
3450                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3451                         chandef->center_freq2 =
3452                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3453         }
3454
3455         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3456                 chandef->edmg.channels =
3457                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3458
3459                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3460                         chandef->edmg.bw_config =
3461                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3462         } else {
3463                 chandef->edmg.bw_config = 0;
3464                 chandef->edmg.channels = 0;
3465         }
3466
3467         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
3468                 chandef->punctured =
3469                         nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3470
3471                 if (chandef->punctured &&
3472                     !wiphy_ext_feature_isset(&rdev->wiphy,
3473                                              NL80211_EXT_FEATURE_PUNCT)) {
3474                         NL_SET_ERR_MSG(extack,
3475                                        "driver doesn't support puncturing");
3476                         return -EINVAL;
3477                 }
3478         }
3479
3480         if (!cfg80211_chandef_valid(chandef)) {
3481                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3482                 return -EINVAL;
3483         }
3484
3485         if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
3486                                       IEEE80211_CHAN_DISABLED,
3487                                       monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
3488                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3489                 return -EINVAL;
3490         }
3491
3492         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3493              chandef->width == NL80211_CHAN_WIDTH_10) &&
3494             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3495                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3496                 return -EINVAL;
3497         }
3498
3499         return 0;
3500 }
3501
3502 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3503                           struct genl_info *info,
3504                           struct cfg80211_chan_def *chandef)
3505 {
3506         return _nl80211_parse_chandef(rdev, info, false, chandef);
3507 }
3508
3509 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3510                                  struct net_device *dev,
3511                                  struct genl_info *info,
3512                                  int _link_id)
3513 {
3514         struct cfg80211_chan_def chandef;
3515         int result;
3516         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3517         struct wireless_dev *wdev = NULL;
3518         int link_id = _link_id;
3519
3520         if (dev)
3521                 wdev = dev->ieee80211_ptr;
3522         if (!nl80211_can_set_dev_channel(wdev))
3523                 return -EOPNOTSUPP;
3524         if (wdev)
3525                 iftype = wdev->iftype;
3526
3527         if (link_id < 0) {
3528                 if (wdev && wdev->valid_links)
3529                         return -EINVAL;
3530                 link_id = 0;
3531         }
3532
3533         result = _nl80211_parse_chandef(rdev, info,
3534                                         iftype == NL80211_IFTYPE_MONITOR,
3535                                         &chandef);
3536         if (result)
3537                 return result;
3538
3539         switch (iftype) {
3540         case NL80211_IFTYPE_AP:
3541         case NL80211_IFTYPE_P2P_GO:
3542                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3543                                                    iftype))
3544                         return -EINVAL;
3545                 if (wdev->links[link_id].ap.beacon_interval) {
3546                         struct ieee80211_channel *cur_chan;
3547
3548                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3549                             !(rdev->wiphy.features &
3550                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3551                                 return -EBUSY;
3552
3553                         /* Only allow dynamic channel width changes */
3554                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3555                         if (chandef.chan != cur_chan)
3556                                 return -EBUSY;
3557
3558                         /* only allow this for regular channel widths */
3559                         switch (wdev->links[link_id].ap.chandef.width) {
3560                         case NL80211_CHAN_WIDTH_20_NOHT:
3561                         case NL80211_CHAN_WIDTH_20:
3562                         case NL80211_CHAN_WIDTH_40:
3563                         case NL80211_CHAN_WIDTH_80:
3564                         case NL80211_CHAN_WIDTH_80P80:
3565                         case NL80211_CHAN_WIDTH_160:
3566                         case NL80211_CHAN_WIDTH_320:
3567                                 break;
3568                         default:
3569                                 return -EINVAL;
3570                         }
3571
3572                         switch (chandef.width) {
3573                         case NL80211_CHAN_WIDTH_20_NOHT:
3574                         case NL80211_CHAN_WIDTH_20:
3575                         case NL80211_CHAN_WIDTH_40:
3576                         case NL80211_CHAN_WIDTH_80:
3577                         case NL80211_CHAN_WIDTH_80P80:
3578                         case NL80211_CHAN_WIDTH_160:
3579                         case NL80211_CHAN_WIDTH_320:
3580                                 break;
3581                         default:
3582                                 return -EINVAL;
3583                         }
3584
3585                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3586                                                        &chandef);
3587                         if (result)
3588                                 return result;
3589                         wdev->links[link_id].ap.chandef = chandef;
3590                 } else {
3591                         wdev->u.ap.preset_chandef = chandef;
3592                 }
3593                 return 0;
3594         case NL80211_IFTYPE_MESH_POINT:
3595                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3596         case NL80211_IFTYPE_MONITOR:
3597                 return cfg80211_set_monitor_channel(rdev, dev, &chandef);
3598         default:
3599                 break;
3600         }
3601
3602         return -EINVAL;
3603 }
3604
3605 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3606 {
3607         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3608         int link_id = nl80211_link_id_or_invalid(info->attrs);
3609         struct net_device *netdev = info->user_ptr[1];
3610
3611         return __nl80211_set_channel(rdev, netdev, info, link_id);
3612 }
3613
3614 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3615 {
3616         struct cfg80211_registered_device *rdev = NULL;
3617         struct net_device *netdev = NULL;
3618         struct wireless_dev *wdev;
3619         int result = 0, rem_txq_params = 0;
3620         struct nlattr *nl_txq_params;
3621         u32 changed;
3622         u8 retry_short = 0, retry_long = 0;
3623         u32 frag_threshold = 0, rts_threshold = 0;
3624         u8 coverage_class = 0;
3625         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3626
3627         rtnl_lock();
3628         /*
3629          * Try to find the wiphy and netdev. Normally this
3630          * function shouldn't need the netdev, but this is
3631          * done for backward compatibility -- previously
3632          * setting the channel was done per wiphy, but now
3633          * it is per netdev. Previous userland like hostapd
3634          * also passed a netdev to set_wiphy, so that it is
3635          * possible to let that go to the right netdev!
3636          */
3637
3638         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3639                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3640
3641                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3642                 if (netdev && netdev->ieee80211_ptr)
3643                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3644                 else
3645                         netdev = NULL;
3646         }
3647
3648         if (!netdev) {
3649                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3650                                                   info->attrs);
3651                 if (IS_ERR(rdev)) {
3652                         rtnl_unlock();
3653                         return PTR_ERR(rdev);
3654                 }
3655                 wdev = NULL;
3656                 netdev = NULL;
3657                 result = 0;
3658         } else
3659                 wdev = netdev->ieee80211_ptr;
3660
3661         guard(wiphy)(&rdev->wiphy);
3662
3663         /*
3664          * end workaround code, by now the rdev is available
3665          * and locked, and wdev may or may not be NULL.
3666          */
3667
3668         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3669                 result = cfg80211_dev_rename(
3670                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3671         rtnl_unlock();
3672
3673         if (result)
3674                 return result;
3675
3676         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3677                 struct ieee80211_txq_params txq_params;
3678                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3679
3680                 if (!rdev->ops->set_txq_params)
3681                         return -EOPNOTSUPP;
3682
3683                 if (!netdev)
3684                         return -EINVAL;
3685
3686                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3687                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3688                         return -EINVAL;
3689
3690                 if (!netif_running(netdev))
3691                         return -ENETDOWN;
3692
3693                 nla_for_each_nested(nl_txq_params,
3694                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3695                                     rem_txq_params) {
3696                         result = nla_parse_nested_deprecated(tb,
3697                                                              NL80211_TXQ_ATTR_MAX,
3698                                                              nl_txq_params,
3699                                                              txq_params_policy,
3700                                                              info->extack);
3701                         if (result)
3702                                 return result;
3703
3704                         result = parse_txq_params(tb, &txq_params);
3705                         if (result)
3706                                 return result;
3707
3708                         txq_params.link_id =
3709                                 nl80211_link_id_or_invalid(info->attrs);
3710
3711                         if (txq_params.link_id >= 0 &&
3712                             !(netdev->ieee80211_ptr->valid_links &
3713                               BIT(txq_params.link_id)))
3714                                 result = -ENOLINK;
3715                         else if (txq_params.link_id >= 0 &&
3716                                  !netdev->ieee80211_ptr->valid_links)
3717                                 result = -EINVAL;
3718                         else
3719                                 result = rdev_set_txq_params(rdev, netdev,
3720                                                              &txq_params);
3721                         if (result)
3722                                 return result;
3723                 }
3724         }
3725
3726         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3727                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3728
3729                 if (wdev) {
3730                         result = __nl80211_set_channel(
3731                                 rdev,
3732                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3733                                 info, link_id);
3734                 } else {
3735                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3736                 }
3737
3738                 if (result)
3739                         return result;
3740         }
3741
3742         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3743                 struct wireless_dev *txp_wdev = wdev;
3744                 enum nl80211_tx_power_setting type;
3745                 int idx, mbm = 0;
3746
3747                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3748                         txp_wdev = NULL;
3749
3750                 if (!rdev->ops->set_tx_power)
3751                         return -EOPNOTSUPP;
3752
3753                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3754                 type = nla_get_u32(info->attrs[idx]);
3755
3756                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3757                     (type != NL80211_TX_POWER_AUTOMATIC))
3758                         return -EINVAL;
3759
3760                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3761                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3762                         mbm = nla_get_u32(info->attrs[idx]);
3763                 }
3764
3765                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3766                 if (result)
3767                         return result;
3768         }
3769
3770         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3771             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3772                 u32 tx_ant, rx_ant;
3773
3774                 if ((!rdev->wiphy.available_antennas_tx &&
3775                      !rdev->wiphy.available_antennas_rx) ||
3776                     !rdev->ops->set_antenna)
3777                         return -EOPNOTSUPP;
3778
3779                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3780                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3781
3782                 /* reject antenna configurations which don't match the
3783                  * available antenna masks, except for the "all" mask */
3784                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3785                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3786                         return -EINVAL;
3787
3788                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3789                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3790
3791                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3792                 if (result)
3793                         return result;
3794         }
3795
3796         changed = 0;
3797
3798         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3799                 retry_short = nla_get_u8(
3800                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3801
3802                 changed |= WIPHY_PARAM_RETRY_SHORT;
3803         }
3804
3805         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3806                 retry_long = nla_get_u8(
3807                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3808
3809                 changed |= WIPHY_PARAM_RETRY_LONG;
3810         }
3811
3812         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3813                 frag_threshold = nla_get_u32(
3814                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3815                 if (frag_threshold < 256)
3816                         return -EINVAL;
3817
3818                 if (frag_threshold != (u32) -1) {
3819                         /*
3820                          * Fragments (apart from the last one) are required to
3821                          * have even length. Make the fragmentation code
3822                          * simpler by stripping LSB should someone try to use
3823                          * odd threshold value.
3824                          */
3825                         frag_threshold &= ~0x1;
3826                 }
3827                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3828         }
3829
3830         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3831                 rts_threshold = nla_get_u32(
3832                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3833                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3834         }
3835
3836         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3837                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3838                         return -EINVAL;
3839
3840                 coverage_class = nla_get_u8(
3841                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3842                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3843         }
3844
3845         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3846                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3847                         return -EOPNOTSUPP;
3848
3849                 changed |= WIPHY_PARAM_DYN_ACK;
3850         }
3851
3852         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3853                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3854                                              NL80211_EXT_FEATURE_TXQS))
3855                         return -EOPNOTSUPP;
3856
3857                 txq_limit = nla_get_u32(
3858                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3859                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3860         }
3861
3862         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3863                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3864                                              NL80211_EXT_FEATURE_TXQS))
3865                         return -EOPNOTSUPP;
3866
3867                 txq_memory_limit = nla_get_u32(
3868                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3869                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3870         }
3871
3872         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3873                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3874                                              NL80211_EXT_FEATURE_TXQS))
3875                         return -EOPNOTSUPP;
3876
3877                 txq_quantum = nla_get_u32(
3878                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3879                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3880         }
3881
3882         if (changed) {
3883                 u8 old_retry_short, old_retry_long;
3884                 u32 old_frag_threshold, old_rts_threshold;
3885                 u8 old_coverage_class;
3886                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3887
3888                 if (!rdev->ops->set_wiphy_params)
3889                         return -EOPNOTSUPP;
3890
3891                 old_retry_short = rdev->wiphy.retry_short;
3892                 old_retry_long = rdev->wiphy.retry_long;
3893                 old_frag_threshold = rdev->wiphy.frag_threshold;
3894                 old_rts_threshold = rdev->wiphy.rts_threshold;
3895                 old_coverage_class = rdev->wiphy.coverage_class;
3896                 old_txq_limit = rdev->wiphy.txq_limit;
3897                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3898                 old_txq_quantum = rdev->wiphy.txq_quantum;
3899
3900                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3901                         rdev->wiphy.retry_short = retry_short;
3902                 if (changed & WIPHY_PARAM_RETRY_LONG)
3903                         rdev->wiphy.retry_long = retry_long;
3904                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3905                         rdev->wiphy.frag_threshold = frag_threshold;
3906                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3907                         rdev->wiphy.rts_threshold = rts_threshold;
3908                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3909                         rdev->wiphy.coverage_class = coverage_class;
3910                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3911                         rdev->wiphy.txq_limit = txq_limit;
3912                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3913                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3914                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3915                         rdev->wiphy.txq_quantum = txq_quantum;
3916
3917                 result = rdev_set_wiphy_params(rdev, changed);
3918                 if (result) {
3919                         rdev->wiphy.retry_short = old_retry_short;
3920                         rdev->wiphy.retry_long = old_retry_long;
3921                         rdev->wiphy.frag_threshold = old_frag_threshold;
3922                         rdev->wiphy.rts_threshold = old_rts_threshold;
3923                         rdev->wiphy.coverage_class = old_coverage_class;
3924                         rdev->wiphy.txq_limit = old_txq_limit;
3925                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3926                         rdev->wiphy.txq_quantum = old_txq_quantum;
3927                         return result;
3928                 }
3929         }
3930
3931         return 0;
3932 }
3933
3934 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3935 {
3936         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3937                 return -EINVAL;
3938
3939         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3940                         chandef->chan->center_freq))
3941                 return -ENOBUFS;
3942         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3943                         chandef->chan->freq_offset))
3944                 return -ENOBUFS;
3945         switch (chandef->width) {
3946         case NL80211_CHAN_WIDTH_20_NOHT:
3947         case NL80211_CHAN_WIDTH_20:
3948         case NL80211_CHAN_WIDTH_40:
3949                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3950                                 cfg80211_get_chandef_type(chandef)))
3951                         return -ENOBUFS;
3952                 break;
3953         default:
3954                 break;
3955         }
3956         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3957                 return -ENOBUFS;
3958         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3959                 return -ENOBUFS;
3960         if (chandef->center_freq2 &&
3961             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3962                 return -ENOBUFS;
3963         if (chandef->punctured &&
3964             nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
3965                 return -ENOBUFS;
3966
3967         return 0;
3968 }
3969 EXPORT_SYMBOL(nl80211_send_chandef);
3970
3971 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3972                               struct cfg80211_registered_device *rdev,
3973                               struct wireless_dev *wdev,
3974                               enum nl80211_commands cmd)
3975 {
3976         struct net_device *dev = wdev->netdev;
3977         void *hdr;
3978
3979         lockdep_assert_wiphy(&rdev->wiphy);
3980
3981         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3982                 cmd != NL80211_CMD_DEL_INTERFACE &&
3983                 cmd != NL80211_CMD_SET_INTERFACE);
3984
3985         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3986         if (!hdr)
3987                 return -1;
3988
3989         if (dev &&
3990             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3991              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3992                 goto nla_put_failure;
3993
3994         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3995             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3996             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3997                               NL80211_ATTR_PAD) ||
3998             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3999             nla_put_u32(msg, NL80211_ATTR_GENERATION,
4000                         rdev->devlist_generation ^
4001                         (cfg80211_rdev_list_generation << 2)) ||
4002             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
4003             nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
4004                 goto nla_put_failure;
4005
4006         if (rdev->ops->get_channel && !wdev->valid_links) {
4007                 struct cfg80211_chan_def chandef = {};
4008                 int ret;
4009
4010                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
4011                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4012                         goto nla_put_failure;
4013         }
4014
4015         if (rdev->ops->get_tx_power && !wdev->valid_links) {
4016                 int dbm, ret;
4017
4018                 ret = rdev_get_tx_power(rdev, wdev, 0, &dbm);
4019                 if (ret == 0 &&
4020                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4021                                 DBM_TO_MBM(dbm)))
4022                         goto nla_put_failure;
4023         }
4024
4025         switch (wdev->iftype) {
4026         case NL80211_IFTYPE_AP:
4027         case NL80211_IFTYPE_P2P_GO:
4028                 if (wdev->u.ap.ssid_len &&
4029                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
4030                             wdev->u.ap.ssid))
4031                         goto nla_put_failure;
4032                 break;
4033         case NL80211_IFTYPE_STATION:
4034         case NL80211_IFTYPE_P2P_CLIENT:
4035                 if (wdev->u.client.ssid_len &&
4036                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
4037                             wdev->u.client.ssid))
4038                         goto nla_put_failure;
4039                 break;
4040         case NL80211_IFTYPE_ADHOC:
4041                 if (wdev->u.ibss.ssid_len &&
4042                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
4043                             wdev->u.ibss.ssid))
4044                         goto nla_put_failure;
4045                 break;
4046         default:
4047                 /* nothing */
4048                 break;
4049         }
4050
4051         if (rdev->ops->get_txq_stats) {
4052                 struct cfg80211_txq_stats txqstats = {};
4053                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
4054
4055                 if (ret == 0 &&
4056                     !nl80211_put_txq_stats(msg, &txqstats,
4057                                            NL80211_ATTR_TXQ_STATS))
4058                         goto nla_put_failure;
4059         }
4060
4061         if (wdev->valid_links) {
4062                 unsigned int link_id;
4063                 struct nlattr *links = nla_nest_start(msg,
4064                                                       NL80211_ATTR_MLO_LINKS);
4065
4066                 if (!links)
4067                         goto nla_put_failure;
4068
4069                 for_each_valid_link(wdev, link_id) {
4070                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
4071                         struct cfg80211_chan_def chandef = {};
4072                         int ret;
4073
4074                         if (!link)
4075                                 goto nla_put_failure;
4076
4077                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
4078                                 goto nla_put_failure;
4079                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
4080                                     wdev->links[link_id].addr))
4081                                 goto nla_put_failure;
4082
4083                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
4084                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
4085                                 goto nla_put_failure;
4086
4087                         if (rdev->ops->get_tx_power) {
4088                                 int dbm, ret;
4089
4090                                 ret = rdev_get_tx_power(rdev, wdev, link_id, &dbm);
4091                                 if (ret == 0 &&
4092                                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
4093                                                 DBM_TO_MBM(dbm)))
4094                                         goto nla_put_failure;
4095                         }
4096                         nla_nest_end(msg, link);
4097                 }
4098
4099                 nla_nest_end(msg, links);
4100         }
4101
4102         genlmsg_end(msg, hdr);
4103         return 0;
4104
4105  nla_put_failure:
4106         genlmsg_cancel(msg, hdr);
4107         return -EMSGSIZE;
4108 }
4109
4110 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
4111 {
4112         int wp_idx = 0;
4113         int if_idx = 0;
4114         int wp_start = cb->args[0];
4115         int if_start = cb->args[1];
4116         int filter_wiphy = -1;
4117         struct cfg80211_registered_device *rdev;
4118         struct wireless_dev *wdev;
4119         int ret;
4120
4121         rtnl_lock();
4122         if (!cb->args[2]) {
4123                 struct nl80211_dump_wiphy_state state = {
4124                         .filter_wiphy = -1,
4125                 };
4126
4127                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
4128                 if (ret)
4129                         goto out_unlock;
4130
4131                 filter_wiphy = state.filter_wiphy;
4132
4133                 /*
4134                  * if filtering, set cb->args[2] to +1 since 0 is the default
4135                  * value needed to determine that parsing is necessary.
4136                  */
4137                 if (filter_wiphy >= 0)
4138                         cb->args[2] = filter_wiphy + 1;
4139                 else
4140                         cb->args[2] = -1;
4141         } else if (cb->args[2] > 0) {
4142                 filter_wiphy = cb->args[2] - 1;
4143         }
4144
4145         for_each_rdev(rdev) {
4146                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
4147                         continue;
4148                 if (wp_idx < wp_start) {
4149                         wp_idx++;
4150                         continue;
4151                 }
4152
4153                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
4154                         continue;
4155
4156                 if_idx = 0;
4157
4158                 guard(wiphy)(&rdev->wiphy);
4159
4160                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4161                         if (if_idx < if_start) {
4162                                 if_idx++;
4163                                 continue;
4164                         }
4165
4166                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4167                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
4168                                                rdev, wdev,
4169                                                NL80211_CMD_NEW_INTERFACE) < 0)
4170                                 goto out;
4171
4172                         if_idx++;
4173                 }
4174
4175                 if_start = 0;
4176                 wp_idx++;
4177         }
4178  out:
4179         cb->args[0] = wp_idx;
4180         cb->args[1] = if_idx;
4181
4182         ret = skb->len;
4183  out_unlock:
4184         rtnl_unlock();
4185
4186         return ret;
4187 }
4188
4189 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4190 {
4191         struct sk_buff *msg;
4192         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4193         struct wireless_dev *wdev = info->user_ptr[1];
4194
4195         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4196         if (!msg)
4197                 return -ENOMEM;
4198
4199         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4200                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4201                 nlmsg_free(msg);
4202                 return -ENOBUFS;
4203         }
4204
4205         return genlmsg_reply(msg, info);
4206 }
4207
4208 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4209         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4210         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4211         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4212         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4213         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4214         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4215         [NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
4216 };
4217
4218 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4219 {
4220         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4221         int flag;
4222
4223         *mntrflags = 0;
4224
4225         if (!nla)
4226                 return -EINVAL;
4227
4228         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4229                 return -EINVAL;
4230
4231         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4232                 if (flags[flag])
4233                         *mntrflags |= (1<<flag);
4234
4235         /* cooked monitor mode is incompatible with other modes */
4236         if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
4237             *mntrflags != MONITOR_FLAG_COOK_FRAMES)
4238                 return -EOPNOTSUPP;
4239
4240         *mntrflags |= MONITOR_FLAG_CHANGED;
4241
4242         return 0;
4243 }
4244
4245 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4246                                      enum nl80211_iftype type,
4247                                      struct genl_info *info,
4248                                      struct vif_params *params)
4249 {
4250         bool change = false;
4251         int err;
4252
4253         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4254                 if (type != NL80211_IFTYPE_MONITOR)
4255                         return -EINVAL;
4256
4257                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4258                                           &params->flags);
4259                 if (err)
4260                         return err;
4261
4262                 change = true;
4263         }
4264
4265         /* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
4266         if (params->flags & MONITOR_FLAG_COOK_FRAMES)
4267                 return -EOPNOTSUPP;
4268
4269         if (params->flags & MONITOR_FLAG_ACTIVE &&
4270             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4271                 return -EOPNOTSUPP;
4272
4273         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4274                 const u8 *mumimo_groups;
4275                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4276
4277                 if (type != NL80211_IFTYPE_MONITOR)
4278                         return -EINVAL;
4279
4280                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4281                         return -EOPNOTSUPP;
4282
4283                 mumimo_groups =
4284                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4285
4286                 /* bits 0 and 63 are reserved and must be zero */
4287                 if ((mumimo_groups[0] & BIT(0)) ||
4288                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4289                         return -EINVAL;
4290
4291                 params->vht_mumimo_groups = mumimo_groups;
4292                 change = true;
4293         }
4294
4295         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4296                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4297
4298                 if (type != NL80211_IFTYPE_MONITOR)
4299                         return -EINVAL;
4300
4301                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4302                         return -EOPNOTSUPP;
4303
4304                 params->vht_mumimo_follow_addr =
4305                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4306                 change = true;
4307         }
4308
4309         return change ? 1 : 0;
4310 }
4311
4312 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4313                                struct net_device *netdev, u8 use_4addr,
4314                                enum nl80211_iftype iftype)
4315 {
4316         if (!use_4addr) {
4317                 if (netdev && netif_is_bridge_port(netdev))
4318                         return -EBUSY;
4319                 return 0;
4320         }
4321
4322         switch (iftype) {
4323         case NL80211_IFTYPE_AP_VLAN:
4324                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4325                         return 0;
4326                 break;
4327         case NL80211_IFTYPE_STATION:
4328                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4329                         return 0;
4330                 break;
4331         default:
4332                 break;
4333         }
4334
4335         return -EOPNOTSUPP;
4336 }
4337
4338 static int nl80211_parse_vif_radio_mask(struct genl_info *info,
4339                                         u32 *radio_mask)
4340 {
4341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4342         struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
4343         u32 mask, allowed;
4344
4345         if (!attr) {
4346                 *radio_mask = 0;
4347                 return 0;
4348         }
4349
4350         allowed = BIT(rdev->wiphy.n_radio) - 1;
4351         mask = nla_get_u32(attr);
4352         if (mask & ~allowed)
4353                 return -EINVAL;
4354         if (!mask)
4355                 mask = allowed;
4356         *radio_mask = mask;
4357
4358         return 1;
4359 }
4360
4361 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4362 {
4363         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4364         struct vif_params params;
4365         int err;
4366         enum nl80211_iftype otype, ntype;
4367         struct net_device *dev = info->user_ptr[1];
4368         struct wireless_dev *wdev = dev->ieee80211_ptr;
4369         u32 radio_mask = 0;
4370         bool change = false;
4371
4372         memset(&params, 0, sizeof(params));
4373
4374         otype = ntype = dev->ieee80211_ptr->iftype;
4375
4376         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4377                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4378                 if (otype != ntype)
4379                         change = true;
4380         }
4381
4382         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4383                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4384                         return -EINVAL;
4385                 if (otype != NL80211_IFTYPE_MESH_POINT)
4386                         return -EINVAL;
4387                 if (netif_running(dev))
4388                         return -EBUSY;
4389
4390                 wdev->u.mesh.id_up_len =
4391                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4392                 memcpy(wdev->u.mesh.id,
4393                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4394                        wdev->u.mesh.id_up_len);
4395         }
4396
4397         if (info->attrs[NL80211_ATTR_4ADDR]) {
4398                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4399                 change = true;
4400                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4401                 if (err)
4402                         return err;
4403         } else {
4404                 params.use_4addr = -1;
4405         }
4406
4407         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4408         if (err < 0)
4409                 return err;
4410         if (err > 0)
4411                 change = true;
4412
4413         err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4414         if (err < 0)
4415                 return err;
4416         if (err && netif_running(dev))
4417                 return -EBUSY;
4418
4419         if (change)
4420                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4421         else
4422                 err = 0;
4423
4424         if (!err && params.use_4addr != -1)
4425                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4426
4427         if (radio_mask)
4428                 wdev->radio_mask = radio_mask;
4429
4430         if (change && !err)
4431                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4432
4433         return err;
4434 }
4435
4436 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4437 {
4438         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4439         struct vif_params params;
4440         struct wireless_dev *wdev;
4441         struct sk_buff *msg;
4442         u32 radio_mask;
4443         int err;
4444         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4445
4446         memset(&params, 0, sizeof(params));
4447
4448         if (!info->attrs[NL80211_ATTR_IFNAME])
4449                 return -EINVAL;
4450
4451         if (info->attrs[NL80211_ATTR_IFTYPE])
4452                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4453
4454         if (!rdev->ops->add_virtual_intf)
4455                 return -EOPNOTSUPP;
4456
4457         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4458              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4459             info->attrs[NL80211_ATTR_MAC]) {
4460                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4461                            ETH_ALEN);
4462                 if (!is_valid_ether_addr(params.macaddr))
4463                         return -EADDRNOTAVAIL;
4464         }
4465
4466         if (info->attrs[NL80211_ATTR_4ADDR]) {
4467                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4468                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4469                 if (err)
4470                         return err;
4471         }
4472
4473         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4474                 return -EOPNOTSUPP;
4475
4476         err = nl80211_parse_mon_options(rdev, type, info, &params);
4477         if (err < 0)
4478                 return err;
4479
4480         err = nl80211_parse_vif_radio_mask(info, &radio_mask);
4481         if (err < 0)
4482                 return err;
4483
4484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4485         if (!msg)
4486                 return -ENOMEM;
4487
4488         wdev = rdev_add_virtual_intf(rdev,
4489                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4490                                 NET_NAME_USER, type, &params);
4491         if (WARN_ON(!wdev)) {
4492                 nlmsg_free(msg);
4493                 return -EPROTO;
4494         } else if (IS_ERR(wdev)) {
4495                 nlmsg_free(msg);
4496                 return PTR_ERR(wdev);
4497         }
4498
4499         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4500                 wdev->owner_nlportid = info->snd_portid;
4501
4502         switch (type) {
4503         case NL80211_IFTYPE_MESH_POINT:
4504                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4505                         break;
4506                 wdev->u.mesh.id_up_len =
4507                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4508                 memcpy(wdev->u.mesh.id,
4509                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4510                        wdev->u.mesh.id_up_len);
4511                 break;
4512         case NL80211_IFTYPE_NAN:
4513         case NL80211_IFTYPE_P2P_DEVICE:
4514                 /*
4515                  * P2P Device and NAN do not have a netdev, so don't go
4516                  * through the netdev notifier and must be added here
4517                  */
4518                 cfg80211_init_wdev(wdev);
4519                 cfg80211_register_wdev(rdev, wdev);
4520                 break;
4521         default:
4522                 break;
4523         }
4524
4525         if (radio_mask)
4526                 wdev->radio_mask = radio_mask;
4527
4528         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4529                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4530                 nlmsg_free(msg);
4531                 return -ENOBUFS;
4532         }
4533
4534         return genlmsg_reply(msg, info);
4535 }
4536
4537 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4538 {
4539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4540
4541         /* to avoid failing a new interface creation due to pending removal */
4542         cfg80211_destroy_ifaces(rdev);
4543
4544         guard(wiphy)(&rdev->wiphy);
4545
4546         return _nl80211_new_interface(skb, info);
4547 }
4548
4549 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4550 {
4551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4552         struct wireless_dev *wdev = info->user_ptr[1];
4553
4554         if (!rdev->ops->del_virtual_intf)
4555                 return -EOPNOTSUPP;
4556
4557         /*
4558          * We hold RTNL, so this is safe, without RTNL opencount cannot
4559          * reach 0, and thus the rdev cannot be deleted.
4560          *
4561          * We need to do it for the dev_close(), since that will call
4562          * the netdev notifiers, and we need to acquire the mutex there
4563          * but don't know if we get there from here or from some other
4564          * place (e.g. "ip link set ... down").
4565          */
4566         mutex_unlock(&rdev->wiphy.mtx);
4567
4568         /*
4569          * If we remove a wireless device without a netdev then clear
4570          * user_ptr[1] so that nl80211_post_doit won't dereference it
4571          * to check if it needs to do dev_put(). Otherwise it crashes
4572          * since the wdev has been freed, unlike with a netdev where
4573          * we need the dev_put() for the netdev to really be freed.
4574          */
4575         if (!wdev->netdev)
4576                 info->user_ptr[1] = NULL;
4577         else
4578                 dev_close(wdev->netdev);
4579
4580         mutex_lock(&rdev->wiphy.mtx);
4581
4582         return cfg80211_remove_virtual_intf(rdev, wdev);
4583 }
4584
4585 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4586 {
4587         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4588         struct net_device *dev = info->user_ptr[1];
4589         u16 noack_map;
4590
4591         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4592                 return -EINVAL;
4593
4594         if (!rdev->ops->set_noack_map)
4595                 return -EOPNOTSUPP;
4596
4597         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4598
4599         return rdev_set_noack_map(rdev, dev, noack_map);
4600 }
4601
4602 static int nl80211_validate_key_link_id(struct genl_info *info,
4603                                         struct wireless_dev *wdev,
4604                                         int link_id, bool pairwise)
4605 {
4606         if (pairwise) {
4607                 if (link_id != -1) {
4608                         GENL_SET_ERR_MSG(info,
4609                                          "link ID not allowed for pairwise key");
4610                         return -EINVAL;
4611                 }
4612
4613                 return 0;
4614         }
4615
4616         if (wdev->valid_links) {
4617                 if (link_id == -1) {
4618                         GENL_SET_ERR_MSG(info,
4619                                          "link ID must for MLO group key");
4620                         return -EINVAL;
4621                 }
4622                 if (!(wdev->valid_links & BIT(link_id))) {
4623                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4624                         return -EINVAL;
4625                 }
4626         } else if (link_id != -1) {
4627                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4628                 return -EINVAL;
4629         }
4630
4631         return 0;
4632 }
4633
4634 struct get_key_cookie {
4635         struct sk_buff *msg;
4636         int error;
4637         int idx;
4638 };
4639
4640 static void get_key_callback(void *c, struct key_params *params)
4641 {
4642         struct nlattr *key;
4643         struct get_key_cookie *cookie = c;
4644
4645         if ((params->seq &&
4646              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4647                      params->seq_len, params->seq)) ||
4648             (params->cipher &&
4649              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4650                          params->cipher)))
4651                 goto nla_put_failure;
4652
4653         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4654         if (!key)
4655                 goto nla_put_failure;
4656
4657         if ((params->seq &&
4658              nla_put(cookie->msg, NL80211_KEY_SEQ,
4659                      params->seq_len, params->seq)) ||
4660             (params->cipher &&
4661              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4662                          params->cipher)))
4663                 goto nla_put_failure;
4664
4665         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4666                 goto nla_put_failure;
4667
4668         nla_nest_end(cookie->msg, key);
4669
4670         return;
4671  nla_put_failure:
4672         cookie->error = 1;
4673 }
4674
4675 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4676 {
4677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4678         int err;
4679         struct net_device *dev = info->user_ptr[1];
4680         u8 key_idx = 0;
4681         const u8 *mac_addr = NULL;
4682         bool pairwise;
4683         struct get_key_cookie cookie = {
4684                 .error = 0,
4685         };
4686         void *hdr;
4687         struct sk_buff *msg;
4688         bool bigtk_support = false;
4689         int link_id = nl80211_link_id_or_invalid(info->attrs);
4690         struct wireless_dev *wdev = dev->ieee80211_ptr;
4691
4692         if (wiphy_ext_feature_isset(&rdev->wiphy,
4693                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4694                 bigtk_support = true;
4695
4696         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4697              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4698             wiphy_ext_feature_isset(&rdev->wiphy,
4699                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4700                 bigtk_support = true;
4701
4702         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4703                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4704
4705                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4706                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4707                         return -EINVAL;
4708                 }
4709         }
4710
4711         if (info->attrs[NL80211_ATTR_MAC])
4712                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4713
4714         pairwise = !!mac_addr;
4715         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4716                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4717
4718                 if (kt != NL80211_KEYTYPE_GROUP &&
4719                     kt != NL80211_KEYTYPE_PAIRWISE)
4720                         return -EINVAL;
4721                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4722         }
4723
4724         if (!rdev->ops->get_key)
4725                 return -EOPNOTSUPP;
4726
4727         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4728                 return -ENOENT;
4729
4730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4731         if (!msg)
4732                 return -ENOMEM;
4733
4734         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4735                              NL80211_CMD_NEW_KEY);
4736         if (!hdr)
4737                 goto nla_put_failure;
4738
4739         cookie.msg = msg;
4740         cookie.idx = key_idx;
4741
4742         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4743             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4744                 goto nla_put_failure;
4745         if (mac_addr &&
4746             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4747                 goto nla_put_failure;
4748
4749         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4750         if (err)
4751                 goto free_msg;
4752
4753         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4754                            &cookie, get_key_callback);
4755
4756         if (err)
4757                 goto free_msg;
4758
4759         if (cookie.error)
4760                 goto nla_put_failure;
4761
4762         genlmsg_end(msg, hdr);
4763         return genlmsg_reply(msg, info);
4764
4765  nla_put_failure:
4766         err = -ENOBUFS;
4767  free_msg:
4768         nlmsg_free(msg);
4769         return err;
4770 }
4771
4772 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4773 {
4774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4775         struct key_parse key;
4776         int err;
4777         struct net_device *dev = info->user_ptr[1];
4778         int link_id = nl80211_link_id_or_invalid(info->attrs);
4779         struct wireless_dev *wdev = dev->ieee80211_ptr;
4780
4781         err = nl80211_parse_key(info, &key);
4782         if (err)
4783                 return err;
4784
4785         if (key.idx < 0)
4786                 return -EINVAL;
4787
4788         /* Only support setting default key and
4789          * Extended Key ID action NL80211_KEY_SET_TX.
4790          */
4791         if (!key.def && !key.defmgmt && !key.defbeacon &&
4792             !(key.p.mode == NL80211_KEY_SET_TX))
4793                 return -EINVAL;
4794
4795         if (key.def) {
4796                 if (!rdev->ops->set_default_key)
4797                         return -EOPNOTSUPP;
4798
4799                 err = nl80211_key_allowed(wdev);
4800                 if (err)
4801                         return err;
4802
4803                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4804                 if (err)
4805                         return err;
4806
4807                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4808                                            key.def_uni, key.def_multi);
4809
4810                 if (err)
4811                         return err;
4812
4813 #ifdef CONFIG_CFG80211_WEXT
4814                 wdev->wext.default_key = key.idx;
4815 #endif
4816                 return 0;
4817         } else if (key.defmgmt) {
4818                 if (key.def_uni || !key.def_multi)
4819                         return -EINVAL;
4820
4821                 if (!rdev->ops->set_default_mgmt_key)
4822                         return -EOPNOTSUPP;
4823
4824                 err = nl80211_key_allowed(wdev);
4825                 if (err)
4826                         return err;
4827
4828                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4829                 if (err)
4830                         return err;
4831
4832                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4833                 if (err)
4834                         return err;
4835
4836 #ifdef CONFIG_CFG80211_WEXT
4837                 wdev->wext.default_mgmt_key = key.idx;
4838 #endif
4839                 return 0;
4840         } else if (key.defbeacon) {
4841                 if (key.def_uni || !key.def_multi)
4842                         return -EINVAL;
4843
4844                 if (!rdev->ops->set_default_beacon_key)
4845                         return -EOPNOTSUPP;
4846
4847                 err = nl80211_key_allowed(wdev);
4848                 if (err)
4849                         return err;
4850
4851                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4852                 if (err)
4853                         return err;
4854
4855                 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4856         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4857                    wiphy_ext_feature_isset(&rdev->wiphy,
4858                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4859                 u8 *mac_addr = NULL;
4860
4861                 if (info->attrs[NL80211_ATTR_MAC])
4862                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4863
4864                 if (!mac_addr || key.idx < 0 || key.idx > 1)
4865                         return -EINVAL;
4866
4867                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4868                 if (err)
4869                         return err;
4870
4871                 return rdev_add_key(rdev, dev, link_id, key.idx,
4872                                     NL80211_KEYTYPE_PAIRWISE,
4873                                     mac_addr, &key.p);
4874         }
4875
4876         return -EINVAL;
4877 }
4878
4879 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4880 {
4881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4882         int err;
4883         struct net_device *dev = info->user_ptr[1];
4884         struct key_parse key;
4885         const u8 *mac_addr = NULL;
4886         int link_id = nl80211_link_id_or_invalid(info->attrs);
4887         struct wireless_dev *wdev = dev->ieee80211_ptr;
4888
4889         err = nl80211_parse_key(info, &key);
4890         if (err)
4891                 return err;
4892
4893         if (!key.p.key) {
4894                 GENL_SET_ERR_MSG(info, "no key");
4895                 return -EINVAL;
4896         }
4897
4898         if (info->attrs[NL80211_ATTR_MAC])
4899                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4900
4901         if (key.type == -1) {
4902                 if (mac_addr)
4903                         key.type = NL80211_KEYTYPE_PAIRWISE;
4904                 else
4905                         key.type = NL80211_KEYTYPE_GROUP;
4906         }
4907
4908         /* for now */
4909         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4910             key.type != NL80211_KEYTYPE_GROUP) {
4911                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4912                 return -EINVAL;
4913         }
4914
4915         if (key.type == NL80211_KEYTYPE_GROUP &&
4916             info->attrs[NL80211_ATTR_VLAN_ID])
4917                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4918
4919         if (!rdev->ops->add_key)
4920                 return -EOPNOTSUPP;
4921
4922         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4923                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4924                                            mac_addr)) {
4925                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4926                 return -EINVAL;
4927         }
4928
4929         err = nl80211_key_allowed(wdev);
4930         if (err)
4931                 GENL_SET_ERR_MSG(info, "key not allowed");
4932
4933         if (!err)
4934                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4935                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4936
4937         if (!err) {
4938                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4939                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4940                                     mac_addr, &key.p);
4941                 if (err)
4942                         GENL_SET_ERR_MSG(info, "key addition failed");
4943         }
4944
4945         return err;
4946 }
4947
4948 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4949 {
4950         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4951         int err;
4952         struct net_device *dev = info->user_ptr[1];
4953         u8 *mac_addr = NULL;
4954         struct key_parse key;
4955         int link_id = nl80211_link_id_or_invalid(info->attrs);
4956         struct wireless_dev *wdev = dev->ieee80211_ptr;
4957
4958         err = nl80211_parse_key(info, &key);
4959         if (err)
4960                 return err;
4961
4962         if (info->attrs[NL80211_ATTR_MAC])
4963                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4964
4965         if (key.type == -1) {
4966                 if (mac_addr)
4967                         key.type = NL80211_KEYTYPE_PAIRWISE;
4968                 else
4969                         key.type = NL80211_KEYTYPE_GROUP;
4970         }
4971
4972         /* for now */
4973         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4974             key.type != NL80211_KEYTYPE_GROUP)
4975                 return -EINVAL;
4976
4977         if (!cfg80211_valid_key_idx(rdev, key.idx,
4978                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4979                 return -EINVAL;
4980
4981         if (!rdev->ops->del_key)
4982                 return -EOPNOTSUPP;
4983
4984         err = nl80211_key_allowed(wdev);
4985
4986         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4987             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4988                 err = -ENOENT;
4989
4990         if (!err)
4991                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4992                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4993
4994         if (!err)
4995                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4996                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4997                                    mac_addr);
4998
4999 #ifdef CONFIG_CFG80211_WEXT
5000         if (!err) {
5001                 if (key.idx == wdev->wext.default_key)
5002                         wdev->wext.default_key = -1;
5003                 else if (key.idx == wdev->wext.default_mgmt_key)
5004                         wdev->wext.default_mgmt_key = -1;
5005         }
5006 #endif
5007
5008         return err;
5009 }
5010
5011 /* This function returns an error or the number of nested attributes */
5012 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
5013 {
5014         struct nlattr *attr;
5015         int n_entries = 0, tmp;
5016
5017         nla_for_each_nested(attr, nl_attr, tmp) {
5018                 if (nla_len(attr) != ETH_ALEN)
5019                         return -EINVAL;
5020
5021                 n_entries++;
5022         }
5023
5024         return n_entries;
5025 }
5026
5027 /*
5028  * This function parses ACL information and allocates memory for ACL data.
5029  * On successful return, the calling function is responsible to free the
5030  * ACL buffer returned by this function.
5031  */
5032 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
5033                                                 struct genl_info *info)
5034 {
5035         enum nl80211_acl_policy acl_policy;
5036         struct nlattr *attr;
5037         struct cfg80211_acl_data *acl;
5038         int i = 0, n_entries, tmp;
5039
5040         if (!wiphy->max_acl_mac_addrs)
5041                 return ERR_PTR(-EOPNOTSUPP);
5042
5043         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
5044                 return ERR_PTR(-EINVAL);
5045
5046         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
5047         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
5048             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
5049                 return ERR_PTR(-EINVAL);
5050
5051         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
5052                 return ERR_PTR(-EINVAL);
5053
5054         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
5055         if (n_entries < 0)
5056                 return ERR_PTR(n_entries);
5057
5058         if (n_entries > wiphy->max_acl_mac_addrs)
5059                 return ERR_PTR(-EOPNOTSUPP);
5060
5061         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
5062         if (!acl)
5063                 return ERR_PTR(-ENOMEM);
5064         acl->n_acl_entries = n_entries;
5065
5066         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
5067                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
5068                 i++;
5069         }
5070         acl->acl_policy = acl_policy;
5071
5072         return acl;
5073 }
5074
5075 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
5076 {
5077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5078         struct net_device *dev = info->user_ptr[1];
5079         struct cfg80211_acl_data *acl;
5080         int err;
5081
5082         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5083             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5084                 return -EOPNOTSUPP;
5085
5086         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
5087                 return -EINVAL;
5088
5089         acl = parse_acl_data(&rdev->wiphy, info);
5090         if (IS_ERR(acl))
5091                 return PTR_ERR(acl);
5092
5093         err = rdev_set_mac_acl(rdev, dev, acl);
5094
5095         kfree(acl);
5096
5097         return err;
5098 }
5099
5100 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
5101                            u8 *rates, u8 rates_len)
5102 {
5103         u8 i;
5104         u32 mask = 0;
5105
5106         for (i = 0; i < rates_len; i++) {
5107                 int rate = (rates[i] & 0x7f) * 5;
5108                 int ridx;
5109
5110                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
5111                         struct ieee80211_rate *srate =
5112                                 &sband->bitrates[ridx];
5113                         if (rate == srate->bitrate) {
5114                                 mask |= 1 << ridx;
5115                                 break;
5116                         }
5117                 }
5118                 if (ridx == sband->n_bitrates)
5119                         return 0; /* rate not found */
5120         }
5121
5122         return mask;
5123 }
5124
5125 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
5126                                u8 *rates, u8 rates_len,
5127                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
5128 {
5129         u8 i;
5130
5131         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
5132
5133         for (i = 0; i < rates_len; i++) {
5134                 int ridx, rbit;
5135
5136                 ridx = rates[i] / 8;
5137                 rbit = BIT(rates[i] % 8);
5138
5139                 /* check validity */
5140                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
5141                         return false;
5142
5143                 /* check availability */
5144                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
5145                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
5146                         mcs[ridx] |= rbit;
5147                 else
5148                         return false;
5149         }
5150
5151         return true;
5152 }
5153
5154 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
5155 {
5156         u16 mcs_mask = 0;
5157
5158         switch (vht_mcs_map) {
5159         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
5160                 break;
5161         case IEEE80211_VHT_MCS_SUPPORT_0_7:
5162                 mcs_mask = 0x00FF;
5163                 break;
5164         case IEEE80211_VHT_MCS_SUPPORT_0_8:
5165                 mcs_mask = 0x01FF;
5166                 break;
5167         case IEEE80211_VHT_MCS_SUPPORT_0_9:
5168                 mcs_mask = 0x03FF;
5169                 break;
5170         default:
5171                 break;
5172         }
5173
5174         return mcs_mask;
5175 }
5176
5177 static void vht_build_mcs_mask(u16 vht_mcs_map,
5178                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5179 {
5180         u8 nss;
5181
5182         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5183                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5184                 vht_mcs_map >>= 2;
5185         }
5186 }
5187
5188 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5189                              struct nl80211_txrate_vht *txrate,
5190                              u16 mcs[NL80211_VHT_NSS_MAX])
5191 {
5192         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5193         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5194         u8 i;
5195
5196         if (!sband->vht_cap.vht_supported)
5197                 return false;
5198
5199         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5200
5201         /* Build vht_mcs_mask from VHT capabilities */
5202         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5203
5204         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5205                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5206                         mcs[i] = txrate->mcs[i];
5207                 else
5208                         return false;
5209         }
5210
5211         return true;
5212 }
5213
5214 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5215 {
5216         switch (he_mcs_map) {
5217         case IEEE80211_HE_MCS_NOT_SUPPORTED:
5218                 return 0;
5219         case IEEE80211_HE_MCS_SUPPORT_0_7:
5220                 return 0x00FF;
5221         case IEEE80211_HE_MCS_SUPPORT_0_9:
5222                 return 0x03FF;
5223         case IEEE80211_HE_MCS_SUPPORT_0_11:
5224                 return 0xFFF;
5225         default:
5226                 break;
5227         }
5228         return 0;
5229 }
5230
5231 static void he_build_mcs_mask(u16 he_mcs_map,
5232                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5233 {
5234         u8 nss;
5235
5236         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5237                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5238                 he_mcs_map >>= 2;
5239         }
5240 }
5241
5242 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5243                            const struct ieee80211_sta_he_cap *he_cap)
5244 {
5245         struct net_device *dev = info->user_ptr[1];
5246         struct wireless_dev *wdev = dev->ieee80211_ptr;
5247         struct cfg80211_chan_def *chandef;
5248         __le16 tx_mcs;
5249
5250         chandef = wdev_chandef(wdev, link_id);
5251         if (!chandef) {
5252                 /*
5253                  * This is probably broken, but we never maintained
5254                  * a chandef in these cases, so it always was.
5255                  */
5256                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5257         }
5258
5259         switch (chandef->width) {
5260         case NL80211_CHAN_WIDTH_80P80:
5261                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5262                 break;
5263         case NL80211_CHAN_WIDTH_160:
5264                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5265                 break;
5266         default:
5267                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5268                 break;
5269         }
5270
5271         return le16_to_cpu(tx_mcs);
5272 }
5273
5274 static bool he_set_mcs_mask(struct genl_info *info,
5275                             struct wireless_dev *wdev,
5276                             struct ieee80211_supported_band *sband,
5277                             struct nl80211_txrate_he *txrate,
5278                             u16 mcs[NL80211_HE_NSS_MAX],
5279                             unsigned int link_id)
5280 {
5281         const struct ieee80211_sta_he_cap *he_cap;
5282         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5283         u16 tx_mcs_map = 0;
5284         u8 i;
5285
5286         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5287         if (!he_cap)
5288                 return false;
5289
5290         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5291
5292         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5293
5294         /* Build he_mcs_mask from HE capabilities */
5295         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5296
5297         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5298                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5299                         mcs[i] = txrate->mcs[i];
5300                 else
5301                         return false;
5302         }
5303
5304         return true;
5305 }
5306
5307 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5308                                          struct nlattr *attrs[],
5309                                          enum nl80211_attrs attr,
5310                                          struct cfg80211_bitrate_mask *mask,
5311                                          struct net_device *dev,
5312                                          bool default_all_enabled,
5313                                          unsigned int link_id)
5314 {
5315         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5316         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5317         struct wireless_dev *wdev = dev->ieee80211_ptr;
5318         int rem, i;
5319         struct nlattr *tx_rates;
5320         struct ieee80211_supported_band *sband;
5321         u16 vht_tx_mcs_map, he_tx_mcs_map;
5322
5323         memset(mask, 0, sizeof(*mask));
5324         /* Default to all rates enabled */
5325         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5326                 const struct ieee80211_sta_he_cap *he_cap;
5327
5328                 if (!default_all_enabled)
5329                         break;
5330
5331                 sband = rdev->wiphy.bands[i];
5332
5333                 if (!sband)
5334                         continue;
5335
5336                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5337                 memcpy(mask->control[i].ht_mcs,
5338                        sband->ht_cap.mcs.rx_mask,
5339                        sizeof(mask->control[i].ht_mcs));
5340
5341                 if (sband->vht_cap.vht_supported) {
5342                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5343                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5344                 }
5345
5346                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5347                 if (!he_cap)
5348                         continue;
5349
5350                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5351                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5352
5353                 mask->control[i].he_gi = 0xFF;
5354                 mask->control[i].he_ltf = 0xFF;
5355         }
5356
5357         /* if no rates are given set it back to the defaults */
5358         if (!attrs[attr])
5359                 goto out;
5360
5361         /* The nested attribute uses enum nl80211_band as the index. This maps
5362          * directly to the enum nl80211_band values used in cfg80211.
5363          */
5364         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5365         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5366                 enum nl80211_band band = nla_type(tx_rates);
5367                 int err;
5368
5369                 if (band < 0 || band >= NUM_NL80211_BANDS)
5370                         return -EINVAL;
5371                 sband = rdev->wiphy.bands[band];
5372                 if (sband == NULL)
5373                         return -EINVAL;
5374                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5375                                                   tx_rates,
5376                                                   nl80211_txattr_policy,
5377                                                   info->extack);
5378                 if (err)
5379                         return err;
5380                 if (tb[NL80211_TXRATE_LEGACY]) {
5381                         mask->control[band].legacy = rateset_to_mask(
5382                                 sband,
5383                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5384                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5385                         if ((mask->control[band].legacy == 0) &&
5386                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5387                                 return -EINVAL;
5388                 }
5389                 if (tb[NL80211_TXRATE_HT]) {
5390                         if (!ht_rateset_to_mask(
5391                                         sband,
5392                                         nla_data(tb[NL80211_TXRATE_HT]),
5393                                         nla_len(tb[NL80211_TXRATE_HT]),
5394                                         mask->control[band].ht_mcs))
5395                                 return -EINVAL;
5396                 }
5397
5398                 if (tb[NL80211_TXRATE_VHT]) {
5399                         if (!vht_set_mcs_mask(
5400                                         sband,
5401                                         nla_data(tb[NL80211_TXRATE_VHT]),
5402                                         mask->control[band].vht_mcs))
5403                                 return -EINVAL;
5404                 }
5405
5406                 if (tb[NL80211_TXRATE_GI]) {
5407                         mask->control[band].gi =
5408                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5409                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5410                                 return -EINVAL;
5411                 }
5412                 if (tb[NL80211_TXRATE_HE] &&
5413                     !he_set_mcs_mask(info, wdev, sband,
5414                                      nla_data(tb[NL80211_TXRATE_HE]),
5415                                      mask->control[band].he_mcs,
5416                                      link_id))
5417                         return -EINVAL;
5418
5419                 if (tb[NL80211_TXRATE_HE_GI])
5420                         mask->control[band].he_gi =
5421                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5422                 if (tb[NL80211_TXRATE_HE_LTF])
5423                         mask->control[band].he_ltf =
5424                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5425
5426                 if (mask->control[band].legacy == 0) {
5427                         /* don't allow empty legacy rates if HT, VHT or HE
5428                          * are not even supported.
5429                          */
5430                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5431                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5432                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5433                                 return -EINVAL;
5434
5435                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5436                                 if (mask->control[band].ht_mcs[i])
5437                                         goto out;
5438
5439                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5440                                 if (mask->control[band].vht_mcs[i])
5441                                         goto out;
5442
5443                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5444                                 if (mask->control[band].he_mcs[i])
5445                                         goto out;
5446
5447                         /* legacy and mcs rates may not be both empty */
5448                         return -EINVAL;
5449                 }
5450         }
5451
5452 out:
5453         return 0;
5454 }
5455
5456 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5457                                    enum nl80211_band band,
5458                                    struct cfg80211_bitrate_mask *beacon_rate)
5459 {
5460         u32 count_ht, count_vht, count_he, i;
5461         u32 rate = beacon_rate->control[band].legacy;
5462
5463         /* Allow only one rate */
5464         if (hweight32(rate) > 1)
5465                 return -EINVAL;
5466
5467         count_ht = 0;
5468         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5469                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5470                         return -EINVAL;
5471                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5472                         count_ht++;
5473                         if (count_ht > 1)
5474                                 return -EINVAL;
5475                 }
5476                 if (count_ht && rate)
5477                         return -EINVAL;
5478         }
5479
5480         count_vht = 0;
5481         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5482                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5483                         return -EINVAL;
5484                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5485                         count_vht++;
5486                         if (count_vht > 1)
5487                                 return -EINVAL;
5488                 }
5489                 if (count_vht && rate)
5490                         return -EINVAL;
5491         }
5492
5493         count_he = 0;
5494         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5495                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5496                         return -EINVAL;
5497                 } else if (beacon_rate->control[band].he_mcs[i]) {
5498                         count_he++;
5499                         if (count_he > 1)
5500                                 return -EINVAL;
5501                 }
5502                 if (count_he && rate)
5503                         return -EINVAL;
5504         }
5505
5506         if ((count_ht && count_vht && count_he) ||
5507             (!rate && !count_ht && !count_vht && !count_he))
5508                 return -EINVAL;
5509
5510         if (rate &&
5511             !wiphy_ext_feature_isset(&rdev->wiphy,
5512                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5513                 return -EINVAL;
5514         if (count_ht &&
5515             !wiphy_ext_feature_isset(&rdev->wiphy,
5516                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5517                 return -EINVAL;
5518         if (count_vht &&
5519             !wiphy_ext_feature_isset(&rdev->wiphy,
5520                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5521                 return -EINVAL;
5522         if (count_he &&
5523             !wiphy_ext_feature_isset(&rdev->wiphy,
5524                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5525                 return -EINVAL;
5526
5527         return 0;
5528 }
5529
5530 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5531                                        struct net_device *dev,
5532                                        unsigned int link_id,
5533                                        struct nlattr *attrs,
5534                                        struct cfg80211_mbssid_config *config,
5535                                        u8 num_elems)
5536 {
5537         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5538         int tx_link_id = -1;
5539
5540         if (!wiphy->mbssid_max_interfaces)
5541                 return -EOPNOTSUPP;
5542
5543         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5544                              NULL) ||
5545             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5546                 return -EINVAL;
5547
5548         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5549         if (config->ema) {
5550                 if (!wiphy->ema_max_profile_periodicity)
5551                         return -EOPNOTSUPP;
5552
5553                 if (num_elems > wiphy->ema_max_profile_periodicity)
5554                         return -EINVAL;
5555         }
5556
5557         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5558         if (config->index >= wiphy->mbssid_max_interfaces ||
5559             (!config->index && !num_elems))
5560                 return -EINVAL;
5561
5562         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
5563                 tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
5564
5565         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5566                 u32 tx_ifindex =
5567                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5568
5569                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5570                     (config->index && tx_ifindex == dev->ifindex))
5571                         return -EINVAL;
5572
5573                 if (tx_ifindex != dev->ifindex) {
5574                         struct net_device *tx_netdev =
5575                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5576
5577                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5578                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5579                             tx_netdev->ieee80211_ptr->iftype !=
5580                                                         NL80211_IFTYPE_AP) {
5581                                 dev_put(tx_netdev);
5582                                 return -EINVAL;
5583                         }
5584
5585                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5586                         /* Caller should call dev_put(config->tx_wdev) from this point */
5587
5588                         if (config->tx_wdev->valid_links) {
5589                                 if (tx_link_id == -1 ||
5590                                     !(config->tx_wdev->valid_links & BIT(tx_link_id)))
5591                                         return -ENOLINK;
5592
5593                                 config->tx_link_id = tx_link_id;
5594                         }
5595                 } else {
5596                         if (tx_link_id >= 0 && tx_link_id != link_id)
5597                                 return -EINVAL;
5598
5599                         config->tx_wdev = dev->ieee80211_ptr;
5600                 }
5601         } else if (!config->index) {
5602                 if (tx_link_id >= 0 && tx_link_id != link_id)
5603                         return -EINVAL;
5604
5605                 config->tx_wdev = dev->ieee80211_ptr;
5606         } else {
5607                 return -EINVAL;
5608         }
5609
5610         return 0;
5611 }
5612
5613 static struct cfg80211_mbssid_elems *
5614 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5615 {
5616         struct nlattr *nl_elems;
5617         struct cfg80211_mbssid_elems *elems;
5618         int rem_elems;
5619         u8 i = 0, num_elems = 0;
5620
5621         if (!wiphy->mbssid_max_interfaces)
5622                 return ERR_PTR(-EINVAL);
5623
5624         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5625                 if (num_elems >= 255)
5626                         return ERR_PTR(-EINVAL);
5627                 num_elems++;
5628         }
5629
5630         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5631         if (!elems)
5632                 return ERR_PTR(-ENOMEM);
5633         elems->cnt = num_elems;
5634
5635         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5636                 elems->elem[i].data = nla_data(nl_elems);
5637                 elems->elem[i].len = nla_len(nl_elems);
5638                 i++;
5639         }
5640         return elems;
5641 }
5642
5643 static struct cfg80211_rnr_elems *
5644 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5645                         struct netlink_ext_ack *extack)
5646 {
5647         struct nlattr *nl_elems;
5648         struct cfg80211_rnr_elems *elems;
5649         int rem_elems;
5650         u8 i = 0, num_elems = 0;
5651
5652         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5653                 int ret;
5654
5655                 ret = validate_ie_attr(nl_elems, extack);
5656                 if (ret)
5657                         return ERR_PTR(ret);
5658
5659                 num_elems++;
5660         }
5661
5662         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5663         if (!elems)
5664                 return ERR_PTR(-ENOMEM);
5665         elems->cnt = num_elems;
5666
5667         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5668                 elems->elem[i].data = nla_data(nl_elems);
5669                 elems->elem[i].len = nla_len(nl_elems);
5670                 i++;
5671         }
5672         return elems;
5673 }
5674
5675 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5676                                       struct cfg80211_he_bss_color *he_bss_color)
5677 {
5678         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5679         int err;
5680
5681         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5682                                he_bss_color_policy, NULL);
5683         if (err)
5684                 return err;
5685
5686         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5687                 return -EINVAL;
5688
5689         he_bss_color->color =
5690                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5691         he_bss_color->enabled =
5692                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5693         he_bss_color->partial =
5694                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5695
5696         return 0;
5697 }
5698
5699 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5700                                 struct nlattr *attrs[],
5701                                 struct cfg80211_beacon_data *bcn,
5702                                 struct netlink_ext_ack *extack)
5703 {
5704         bool haveinfo = false;
5705         int err;
5706
5707         memset(bcn, 0, sizeof(*bcn));
5708
5709         bcn->link_id = nl80211_link_id(attrs);
5710
5711         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5712                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5713                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5714                 if (!bcn->head_len)
5715                         return -EINVAL;
5716                 haveinfo = true;
5717         }
5718
5719         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5720                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5721                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5722                 haveinfo = true;
5723         }
5724
5725         if (!haveinfo)
5726                 return -EINVAL;
5727
5728         if (attrs[NL80211_ATTR_IE]) {
5729                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5730                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5731         }
5732
5733         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5734                 bcn->proberesp_ies =
5735                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5736                 bcn->proberesp_ies_len =
5737                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5738         }
5739
5740         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5741                 bcn->assocresp_ies =
5742                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5743                 bcn->assocresp_ies_len =
5744                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5745         }
5746
5747         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5748                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5749                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5750         }
5751
5752         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5753                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5754
5755                 err = nla_parse_nested_deprecated(tb,
5756                                                   NL80211_FTM_RESP_ATTR_MAX,
5757                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5758                                                   NULL, NULL);
5759                 if (err)
5760                         return err;
5761
5762                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5763                     wiphy_ext_feature_isset(&rdev->wiphy,
5764                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5765                         bcn->ftm_responder = 1;
5766                 else
5767                         return -EOPNOTSUPP;
5768
5769                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5770                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5771                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5772                 }
5773
5774                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5775                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5776                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5777                 }
5778         } else {
5779                 bcn->ftm_responder = -1;
5780         }
5781
5782         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5783                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5784                                                  &bcn->he_bss_color);
5785                 if (err)
5786                         return err;
5787                 bcn->he_bss_color_valid = true;
5788         }
5789
5790         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5791                 struct cfg80211_mbssid_elems *mbssid =
5792                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5793                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5794
5795                 if (IS_ERR(mbssid))
5796                         return PTR_ERR(mbssid);
5797
5798                 bcn->mbssid_ies = mbssid;
5799
5800                 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5801                         struct cfg80211_rnr_elems *rnr =
5802                                 nl80211_parse_rnr_elems(&rdev->wiphy,
5803                                                         attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5804                                                         extack);
5805
5806                         if (IS_ERR(rnr))
5807                                 return PTR_ERR(rnr);
5808
5809                         if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5810                                 return -EINVAL;
5811
5812                         bcn->rnr_ies = rnr;
5813                 }
5814         }
5815
5816         return 0;
5817 }
5818
5819 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5820                                     struct ieee80211_he_obss_pd *he_obss_pd)
5821 {
5822         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5823         int err;
5824
5825         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5826                                he_obss_pd_policy, NULL);
5827         if (err)
5828                 return err;
5829
5830         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5831                 return -EINVAL;
5832
5833         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5834
5835         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5836                 he_obss_pd->min_offset =
5837                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5838         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5839                 he_obss_pd->max_offset =
5840                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5841         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5842                 he_obss_pd->non_srg_max_offset =
5843                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5844
5845         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5846                 return -EINVAL;
5847
5848         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5849                 memcpy(he_obss_pd->bss_color_bitmap,
5850                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5851                        sizeof(he_obss_pd->bss_color_bitmap));
5852
5853         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5854                 memcpy(he_obss_pd->partial_bssid_bitmap,
5855                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5856                        sizeof(he_obss_pd->partial_bssid_bitmap));
5857
5858         he_obss_pd->enable = true;
5859
5860         return 0;
5861 }
5862
5863 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5864                                         struct nlattr *attrs,
5865                                         struct cfg80211_fils_discovery *fd)
5866 {
5867         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5868         int ret;
5869
5870         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5871                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5872                 return -EINVAL;
5873
5874         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5875                                NULL, NULL);
5876         if (ret)
5877                 return ret;
5878
5879         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
5880             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
5881             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
5882                 fd->update = true;
5883                 return 0;
5884         }
5885
5886         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5887             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5888             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5889                 return -EINVAL;
5890
5891         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5892         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5893         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5894         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5895         fd->update = true;
5896         return 0;
5897 }
5898
5899 static int
5900 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5901                                      struct nlattr *attrs,
5902                                      struct cfg80211_unsol_bcast_probe_resp *presp)
5903 {
5904         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5905         int ret;
5906
5907         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5908                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5909                 return -EINVAL;
5910
5911         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5912                                attrs, NULL, NULL);
5913         if (ret)
5914                 return ret;
5915
5916         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
5917             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
5918                 presp->update = true;
5919                 return 0;
5920         }
5921
5922         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5923             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5924                 return -EINVAL;
5925
5926         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5927         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5928         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5929         presp->update = true;
5930         return 0;
5931 }
5932
5933 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5934                                             const struct element *rates)
5935 {
5936         int i;
5937
5938         if (!rates)
5939                 return;
5940
5941         for (i = 0; i < rates->datalen; i++) {
5942                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5943                         params->ht_required = true;
5944                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5945                         params->vht_required = true;
5946                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5947                         params->he_required = true;
5948                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5949                         params->sae_h2e_required = true;
5950         }
5951 }
5952
5953 /*
5954  * Since the nl80211 API didn't include, from the beginning, attributes about
5955  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5956  * benefit of drivers that rebuild IEs in the firmware.
5957  */
5958 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5959 {
5960         const struct cfg80211_beacon_data *bcn = &params->beacon;
5961         size_t ies_len = bcn->tail_len;
5962         const u8 *ies = bcn->tail;
5963         const struct element *rates;
5964         const struct element *cap;
5965
5966         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5967         nl80211_check_ap_rate_selectors(params, rates);
5968
5969         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5970         nl80211_check_ap_rate_selectors(params, rates);
5971
5972         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5973         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5974                 params->ht_cap = (void *)cap->data;
5975         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5976         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5977                 params->vht_cap = (void *)cap->data;
5978         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5979         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5980                 params->he_cap = (void *)(cap->data + 1);
5981         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5982         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5983                 params->he_oper = (void *)(cap->data + 1);
5984         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5985         if (cap) {
5986                 if (!cap->datalen)
5987                         return -EINVAL;
5988                 params->eht_cap = (void *)(cap->data + 1);
5989                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5990                                                 (const u8 *)params->eht_cap,
5991                                                 cap->datalen - 1, true))
5992                         return -EINVAL;
5993         }
5994         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5995         if (cap) {
5996                 if (!cap->datalen)
5997                         return -EINVAL;
5998                 params->eht_oper = (void *)(cap->data + 1);
5999                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
6000                                                 cap->datalen - 1))
6001                         return -EINVAL;
6002         }
6003         return 0;
6004 }
6005
6006 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
6007                                    struct cfg80211_ap_settings *params)
6008 {
6009         struct wireless_dev *wdev;
6010
6011         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
6012                 if (wdev->iftype != NL80211_IFTYPE_AP &&
6013                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
6014                         continue;
6015
6016                 if (!wdev->u.ap.preset_chandef.chan)
6017                         continue;
6018
6019                 params->chandef = wdev->u.ap.preset_chandef;
6020                 return true;
6021         }
6022
6023         return false;
6024 }
6025
6026 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
6027                                     enum nl80211_auth_type auth_type,
6028                                     enum nl80211_commands cmd)
6029 {
6030         if (auth_type > NL80211_AUTHTYPE_MAX)
6031                 return false;
6032
6033         switch (cmd) {
6034         case NL80211_CMD_AUTHENTICATE:
6035                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6036                     auth_type == NL80211_AUTHTYPE_SAE)
6037                         return false;
6038                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6039                                              NL80211_EXT_FEATURE_FILS_STA) &&
6040                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6041                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6042                      auth_type == NL80211_AUTHTYPE_FILS_PK))
6043                         return false;
6044                 return true;
6045         case NL80211_CMD_CONNECT:
6046                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
6047                     !wiphy_ext_feature_isset(&rdev->wiphy,
6048                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
6049                     auth_type == NL80211_AUTHTYPE_SAE)
6050                         return false;
6051
6052                 /* FILS with SK PFS or PK not supported yet */
6053                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6054                     auth_type == NL80211_AUTHTYPE_FILS_PK)
6055                         return false;
6056                 if (!wiphy_ext_feature_isset(
6057                             &rdev->wiphy,
6058                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
6059                     auth_type == NL80211_AUTHTYPE_FILS_SK)
6060                         return false;
6061                 return true;
6062         case NL80211_CMD_START_AP:
6063                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
6064                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
6065                     auth_type == NL80211_AUTHTYPE_SAE)
6066                         return false;
6067                 /* FILS not supported yet */
6068                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
6069                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
6070                     auth_type == NL80211_AUTHTYPE_FILS_PK)
6071                         return false;
6072                 return true;
6073         default:
6074                 return false;
6075         }
6076 }
6077
6078 static void nl80211_send_ap_started(struct wireless_dev *wdev,
6079                                     unsigned int link_id)
6080 {
6081         struct wiphy *wiphy = wdev->wiphy;
6082         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6083         struct sk_buff *msg;
6084         void *hdr;
6085
6086         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6087         if (!msg)
6088                 return;
6089
6090         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
6091         if (!hdr)
6092                 goto out;
6093
6094         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
6095             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
6096             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
6097                               NL80211_ATTR_PAD) ||
6098             (wdev->u.ap.ssid_len &&
6099              nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
6100                      wdev->u.ap.ssid)) ||
6101             (wdev->valid_links &&
6102              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
6103                 goto out;
6104
6105         genlmsg_end(msg, hdr);
6106
6107         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
6108                                 NL80211_MCGRP_MLME, GFP_KERNEL);
6109         return;
6110 out:
6111         nlmsg_free(msg);
6112 }
6113
6114 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
6115 {
6116         struct ieee80211_channel *channel = params->chandef.chan;
6117
6118         if ((params->he_cap ||  params->he_oper) &&
6119             (channel->flags & IEEE80211_CHAN_NO_HE))
6120                 return -EOPNOTSUPP;
6121
6122         if ((params->eht_cap || params->eht_oper) &&
6123             (channel->flags & IEEE80211_CHAN_NO_EHT))
6124                 return -EOPNOTSUPP;
6125
6126         return 0;
6127 }
6128
6129 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
6130 {
6131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6132         struct cfg80211_beaconing_check_config beacon_check = {};
6133         unsigned int link_id = nl80211_link_id(info->attrs);
6134         struct net_device *dev = info->user_ptr[1];
6135         struct wireless_dev *wdev = dev->ieee80211_ptr;
6136         struct cfg80211_ap_settings *params;
6137         int err;
6138
6139         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6140             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6141                 return -EOPNOTSUPP;
6142
6143         if (!rdev->ops->start_ap)
6144                 return -EOPNOTSUPP;
6145
6146         if (wdev->links[link_id].cac_started)
6147                 return -EBUSY;
6148
6149         if (wdev->links[link_id].ap.beacon_interval)
6150                 return -EALREADY;
6151
6152         /* these are required for START_AP */
6153         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
6154             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
6155             !info->attrs[NL80211_ATTR_BEACON_HEAD])
6156                 return -EINVAL;
6157
6158         if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
6159             nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
6160                 return -EOPNOTSUPP;
6161
6162         params = kzalloc(sizeof(*params), GFP_KERNEL);
6163         if (!params)
6164                 return -ENOMEM;
6165
6166         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
6167                                    info->extack);
6168         if (err)
6169                 goto out;
6170
6171         params->beacon_interval =
6172                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6173         params->dtim_period =
6174                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
6175
6176         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
6177                                            params->beacon_interval);
6178         if (err)
6179                 goto out;
6180
6181         /*
6182          * In theory, some of these attributes should be required here
6183          * but since they were not used when the command was originally
6184          * added, keep them optional for old user space programs to let
6185          * them continue to work with drivers that do not need the
6186          * additional information -- drivers must check!
6187          */
6188         if (info->attrs[NL80211_ATTR_SSID]) {
6189                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6190                 params->ssid_len =
6191                         nla_len(info->attrs[NL80211_ATTR_SSID]);
6192                 if (params->ssid_len == 0) {
6193                         err = -EINVAL;
6194                         goto out;
6195                 }
6196
6197                 if (wdev->u.ap.ssid_len &&
6198                     (wdev->u.ap.ssid_len != params->ssid_len ||
6199                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
6200                         /* require identical SSID for MLO */
6201                         err = -EINVAL;
6202                         goto out;
6203                 }
6204         } else if (wdev->valid_links) {
6205                 /* require SSID for MLO */
6206                 err = -EINVAL;
6207                 goto out;
6208         }
6209
6210         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
6211                 params->hidden_ssid = nla_get_u32(
6212                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
6213
6214         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6215
6216         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6217                 params->auth_type = nla_get_u32(
6218                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
6219                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
6220                                              NL80211_CMD_START_AP)) {
6221                         err = -EINVAL;
6222                         goto out;
6223                 }
6224         } else
6225                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6226
6227         err = nl80211_crypto_settings(rdev, info, &params->crypto,
6228                                       NL80211_MAX_NR_CIPHER_SUITES);
6229         if (err)
6230                 goto out;
6231
6232         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6233                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6234                         err = -EOPNOTSUPP;
6235                         goto out;
6236                 }
6237                 params->inactivity_timeout = nla_get_u16(
6238                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6239         }
6240
6241         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6242                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6243                         err = -EINVAL;
6244                         goto out;
6245                 }
6246                 params->p2p_ctwindow =
6247                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6248                 if (params->p2p_ctwindow != 0 &&
6249                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6250                         err = -EINVAL;
6251                         goto out;
6252                 }
6253         }
6254
6255         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6256                 u8 tmp;
6257
6258                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6259                         err = -EINVAL;
6260                         goto out;
6261                 }
6262                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6263                 params->p2p_opp_ps = tmp;
6264                 if (params->p2p_opp_ps != 0 &&
6265                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6266                         err = -EINVAL;
6267                         goto out;
6268                 }
6269         }
6270
6271         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6272                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6273                 if (err)
6274                         goto out;
6275         } else if (wdev->valid_links) {
6276                 /* with MLD need to specify the channel configuration */
6277                 err = -EINVAL;
6278                 goto out;
6279         } else if (wdev->u.ap.preset_chandef.chan) {
6280                 params->chandef = wdev->u.ap.preset_chandef;
6281         } else if (!nl80211_get_ap_channel(rdev, params)) {
6282                 err = -EINVAL;
6283                 goto out;
6284         }
6285
6286         beacon_check.iftype = wdev->iftype;
6287         beacon_check.relax = true;
6288         beacon_check.reg_power =
6289                 cfg80211_get_6ghz_power_type(params->beacon.tail,
6290                                              params->beacon.tail_len);
6291         if (!cfg80211_reg_check_beaconing(&rdev->wiphy, &params->chandef,
6292                                           &beacon_check)) {
6293                 err = -EINVAL;
6294                 goto out;
6295         }
6296
6297         if (info->attrs[NL80211_ATTR_TX_RATES]) {
6298                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6299                                                     NL80211_ATTR_TX_RATES,
6300                                                     &params->beacon_rate,
6301                                                     dev, false, link_id);
6302                 if (err)
6303                         goto out;
6304
6305                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6306                                               &params->beacon_rate);
6307                 if (err)
6308                         goto out;
6309         }
6310
6311         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6312         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6313                 err = -EOPNOTSUPP;
6314                 goto out;
6315         }
6316
6317         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6318                 params->acl = parse_acl_data(&rdev->wiphy, info);
6319                 if (IS_ERR(params->acl)) {
6320                         err = PTR_ERR(params->acl);
6321                         params->acl = NULL;
6322                         goto out;
6323                 }
6324         }
6325
6326         params->twt_responder =
6327                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6328
6329         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6330                 err = nl80211_parse_he_obss_pd(
6331                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
6332                                         &params->he_obss_pd);
6333                 if (err)
6334                         goto out;
6335         }
6336
6337         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6338                 err = nl80211_parse_fils_discovery(rdev,
6339                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6340                                                    &params->fils_discovery);
6341                 if (err)
6342                         goto out;
6343         }
6344
6345         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6346                 err = nl80211_parse_unsol_bcast_probe_resp(
6347                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6348                         &params->unsol_bcast_probe_resp);
6349                 if (err)
6350                         goto out;
6351         }
6352
6353         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6354                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
6355                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6356                                                   &params->mbssid_config,
6357                                                   params->beacon.mbssid_ies ?
6358                                                         params->beacon.mbssid_ies->cnt :
6359                                                         0);
6360                 if (err)
6361                         goto out;
6362         }
6363
6364         if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6365                 err = -EINVAL;
6366                 goto out;
6367         }
6368
6369         err = nl80211_calculate_ap_params(params);
6370         if (err)
6371                 goto out;
6372
6373         err = nl80211_validate_ap_phy_operation(params);
6374         if (err)
6375                 goto out;
6376
6377         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6378                 params->flags = nla_get_u32(
6379                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6380         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6381                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6382
6383         if (wdev->conn_owner_nlportid &&
6384             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6385             wdev->conn_owner_nlportid != info->snd_portid) {
6386                 err = -EINVAL;
6387                 goto out;
6388         }
6389
6390         /* FIXME: validate MLO/link-id against driver capabilities */
6391
6392         err = rdev_start_ap(rdev, dev, params);
6393         if (!err) {
6394                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6395                 wdev->links[link_id].ap.chandef = params->chandef;
6396                 wdev->u.ap.ssid_len = params->ssid_len;
6397                 memcpy(wdev->u.ap.ssid, params->ssid,
6398                        params->ssid_len);
6399
6400                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6401                         wdev->conn_owner_nlportid = info->snd_portid;
6402
6403                 nl80211_send_ap_started(wdev, link_id);
6404         }
6405 out:
6406         kfree(params->acl);
6407         kfree(params->beacon.mbssid_ies);
6408         if (params->mbssid_config.tx_wdev &&
6409             params->mbssid_config.tx_wdev->netdev &&
6410             params->mbssid_config.tx_wdev->netdev != dev)
6411                 dev_put(params->mbssid_config.tx_wdev->netdev);
6412         kfree(params->beacon.rnr_ies);
6413         kfree(params);
6414
6415         return err;
6416 }
6417
6418 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6419 {
6420         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6421         struct cfg80211_beaconing_check_config beacon_check = {};
6422         unsigned int link_id = nl80211_link_id(info->attrs);
6423         struct net_device *dev = info->user_ptr[1];
6424         struct wireless_dev *wdev = dev->ieee80211_ptr;
6425         struct cfg80211_ap_update *params;
6426         struct nlattr *attr;
6427         int err;
6428
6429         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6430             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6431                 return -EOPNOTSUPP;
6432
6433         if (!rdev->ops->change_beacon)
6434                 return -EOPNOTSUPP;
6435
6436         if (!wdev->links[link_id].ap.beacon_interval)
6437                 return -EINVAL;
6438
6439         params = kzalloc(sizeof(*params), GFP_KERNEL);
6440         if (!params)
6441                 return -ENOMEM;
6442
6443         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
6444                                    info->extack);
6445         if (err)
6446                 goto out;
6447
6448         /* recheck beaconing is permitted with possibly changed power type */
6449         beacon_check.iftype = wdev->iftype;
6450         beacon_check.relax = true;
6451         beacon_check.reg_power =
6452                 cfg80211_get_6ghz_power_type(params->beacon.tail,
6453                                              params->beacon.tail_len);
6454         if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
6455                                           &wdev->links[link_id].ap.chandef,
6456                                           &beacon_check)) {
6457                 err = -EINVAL;
6458                 goto out;
6459         }
6460
6461         attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6462         if (attr) {
6463                 err = nl80211_parse_fils_discovery(rdev, attr,
6464                                                    &params->fils_discovery);
6465                 if (err)
6466                         goto out;
6467         }
6468
6469         attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6470         if (attr) {
6471                 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6472                                                            &params->unsol_bcast_probe_resp);
6473                 if (err)
6474                         goto out;
6475         }
6476
6477         err = rdev_change_beacon(rdev, dev, params);
6478
6479 out:
6480         kfree(params->beacon.mbssid_ies);
6481         kfree(params->beacon.rnr_ies);
6482         kfree(params);
6483         return err;
6484 }
6485
6486 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6487 {
6488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6489         unsigned int link_id = nl80211_link_id(info->attrs);
6490         struct net_device *dev = info->user_ptr[1];
6491
6492         return cfg80211_stop_ap(rdev, dev, link_id, false);
6493 }
6494
6495 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6496         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6497         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6498         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6499         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6500         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6501         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6502 };
6503
6504 static int parse_station_flags(struct genl_info *info,
6505                                enum nl80211_iftype iftype,
6506                                struct station_parameters *params)
6507 {
6508         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6509         struct nlattr *nla;
6510         int flag;
6511
6512         /*
6513          * Try parsing the new attribute first so userspace
6514          * can specify both for older kernels.
6515          */
6516         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6517         if (nla) {
6518                 struct nl80211_sta_flag_update *sta_flags;
6519
6520                 sta_flags = nla_data(nla);
6521                 params->sta_flags_mask = sta_flags->mask;
6522                 params->sta_flags_set = sta_flags->set;
6523                 params->sta_flags_set &= params->sta_flags_mask;
6524                 if ((params->sta_flags_mask |
6525                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6526                         return -EINVAL;
6527                 return 0;
6528         }
6529
6530         /* if present, parse the old attribute */
6531
6532         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6533         if (!nla)
6534                 return 0;
6535
6536         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6537                 return -EINVAL;
6538
6539         /*
6540          * Only allow certain flags for interface types so that
6541          * other attributes are silently ignored. Remember that
6542          * this is backward compatibility code with old userspace
6543          * and shouldn't be hit in other cases anyway.
6544          */
6545         switch (iftype) {
6546         case NL80211_IFTYPE_AP:
6547         case NL80211_IFTYPE_AP_VLAN:
6548         case NL80211_IFTYPE_P2P_GO:
6549                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6550                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6551                                          BIT(NL80211_STA_FLAG_WME) |
6552                                          BIT(NL80211_STA_FLAG_MFP);
6553                 break;
6554         case NL80211_IFTYPE_P2P_CLIENT:
6555         case NL80211_IFTYPE_STATION:
6556                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6557                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6558                 break;
6559         case NL80211_IFTYPE_MESH_POINT:
6560                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6561                                          BIT(NL80211_STA_FLAG_MFP) |
6562                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6563                 break;
6564         default:
6565                 return -EINVAL;
6566         }
6567
6568         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6569                 if (flags[flag]) {
6570                         params->sta_flags_set |= (1<<flag);
6571
6572                         /* no longer support new API additions in old API */
6573                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6574                                 return -EINVAL;
6575                 }
6576         }
6577
6578         return 0;
6579 }
6580
6581 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6582 {
6583         struct nlattr *rate;
6584         u32 bitrate;
6585         u16 bitrate_compat;
6586         enum nl80211_rate_info rate_flg;
6587
6588         rate = nla_nest_start_noflag(msg, attr);
6589         if (!rate)
6590                 return false;
6591
6592         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6593         bitrate = cfg80211_calculate_bitrate(info);
6594         /* report 16-bit bitrate only if we can */
6595         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6596         if (bitrate > 0 &&
6597             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6598                 return false;
6599         if (bitrate_compat > 0 &&
6600             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6601                 return false;
6602
6603         switch (info->bw) {
6604         case RATE_INFO_BW_1:
6605                 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6606                 break;
6607         case RATE_INFO_BW_2:
6608                 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6609                 break;
6610         case RATE_INFO_BW_4:
6611                 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6612                 break;
6613         case RATE_INFO_BW_5:
6614                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6615                 break;
6616         case RATE_INFO_BW_8:
6617                 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6618                 break;
6619         case RATE_INFO_BW_10:
6620                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6621                 break;
6622         case RATE_INFO_BW_16:
6623                 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6624                 break;
6625         default:
6626                 WARN_ON(1);
6627                 fallthrough;
6628         case RATE_INFO_BW_20:
6629                 rate_flg = 0;
6630                 break;
6631         case RATE_INFO_BW_40:
6632                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6633                 break;
6634         case RATE_INFO_BW_80:
6635                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6636                 break;
6637         case RATE_INFO_BW_160:
6638                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6639                 break;
6640         case RATE_INFO_BW_HE_RU:
6641                 rate_flg = 0;
6642                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6643                 break;
6644         case RATE_INFO_BW_320:
6645                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6646                 break;
6647         case RATE_INFO_BW_EHT_RU:
6648                 rate_flg = 0;
6649                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6650                 break;
6651         }
6652
6653         if (rate_flg && nla_put_flag(msg, rate_flg))
6654                 return false;
6655
6656         if (info->flags & RATE_INFO_FLAGS_MCS) {
6657                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6658                         return false;
6659                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6660                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6661                         return false;
6662         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6663                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6664                         return false;
6665                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6666                         return false;
6667                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6668                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6669                         return false;
6670         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6671                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6672                         return false;
6673                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6674                         return false;
6675                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6676                         return false;
6677                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6678                         return false;
6679                 if (info->bw == RATE_INFO_BW_HE_RU &&
6680                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6681                                info->he_ru_alloc))
6682                         return false;
6683         } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6684                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6685                         return false;
6686                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6687                         return false;
6688                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6689                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6690                         return false;
6691         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6692                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6693                         return false;
6694                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6695                         return false;
6696                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6697                         return false;
6698                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6699                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6700                                info->eht_ru_alloc))
6701                         return false;
6702         }
6703
6704         nla_nest_end(msg, rate);
6705         return true;
6706 }
6707
6708 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6709                                int id)
6710 {
6711         void *attr;
6712         int i = 0;
6713
6714         if (!mask)
6715                 return true;
6716
6717         attr = nla_nest_start_noflag(msg, id);
6718         if (!attr)
6719                 return false;
6720
6721         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6722                 if (!(mask & BIT(i)))
6723                         continue;
6724
6725                 if (nla_put_u8(msg, i, signal[i]))
6726                         return false;
6727         }
6728
6729         nla_nest_end(msg, attr);
6730
6731         return true;
6732 }
6733
6734 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6735                                 u32 seq, int flags,
6736                                 struct cfg80211_registered_device *rdev,
6737                                 struct net_device *dev,
6738                                 const u8 *mac_addr, struct station_info *sinfo)
6739 {
6740         void *hdr;
6741         struct nlattr *sinfoattr, *bss_param;
6742
6743         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6744         if (!hdr) {
6745                 cfg80211_sinfo_release_content(sinfo);
6746                 return -1;
6747         }
6748
6749         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6750             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6751             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6752                 goto nla_put_failure;
6753
6754         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6755         if (!sinfoattr)
6756                 goto nla_put_failure;
6757
6758 #define PUT_SINFO(attr, memb, type) do {                                \
6759         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6760         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6761             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6762                              sinfo->memb))                              \
6763                 goto nla_put_failure;                                   \
6764         } while (0)
6765 #define PUT_SINFO_U64(attr, memb) do {                                  \
6766         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6767             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6768                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6769                 goto nla_put_failure;                                   \
6770         } while (0)
6771
6772         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6773         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6774         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6775
6776         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6777                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6778             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6779                         (u32)sinfo->rx_bytes))
6780                 goto nla_put_failure;
6781
6782         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6783                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6784             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6785                         (u32)sinfo->tx_bytes))
6786                 goto nla_put_failure;
6787
6788         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6789         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6790         PUT_SINFO_U64(RX_DURATION, rx_duration);
6791         PUT_SINFO_U64(TX_DURATION, tx_duration);
6792
6793         if (wiphy_ext_feature_isset(&rdev->wiphy,
6794                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6795                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6796
6797         switch (rdev->wiphy.signal_type) {
6798         case CFG80211_SIGNAL_TYPE_MBM:
6799                 PUT_SINFO(SIGNAL, signal, u8);
6800                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6801                 break;
6802         default:
6803                 break;
6804         }
6805         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6806                 if (!nl80211_put_signal(msg, sinfo->chains,
6807                                         sinfo->chain_signal,
6808                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6809                         goto nla_put_failure;
6810         }
6811         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6812                 if (!nl80211_put_signal(msg, sinfo->chains,
6813                                         sinfo->chain_signal_avg,
6814                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6815                         goto nla_put_failure;
6816         }
6817         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6818                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6819                                           NL80211_STA_INFO_TX_BITRATE))
6820                         goto nla_put_failure;
6821         }
6822         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6823                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6824                                           NL80211_STA_INFO_RX_BITRATE))
6825                         goto nla_put_failure;
6826         }
6827
6828         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6829         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6830         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6831         PUT_SINFO(TX_FAILED, tx_failed, u32);
6832         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6833         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6834
6835         PUT_SINFO(LLID, llid, u16);
6836         PUT_SINFO(PLID, plid, u16);
6837         PUT_SINFO(PLINK_STATE, plink_state, u8);
6838         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6839         PUT_SINFO(LOCAL_PM, local_pm, u32);
6840         PUT_SINFO(PEER_PM, peer_pm, u32);
6841         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6842         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6843         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6844         PUT_SINFO_U64(T_OFFSET, t_offset);
6845
6846         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6847                 bss_param = nla_nest_start_noflag(msg,
6848                                                   NL80211_STA_INFO_BSS_PARAM);
6849                 if (!bss_param)
6850                         goto nla_put_failure;
6851
6852                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6853                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6854                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6855                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6856                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6857                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6858                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6859                                sinfo->bss_param.dtim_period) ||
6860                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6861                                 sinfo->bss_param.beacon_interval))
6862                         goto nla_put_failure;
6863
6864                 nla_nest_end(msg, bss_param);
6865         }
6866         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6867             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6868                     sizeof(struct nl80211_sta_flag_update),
6869                     &sinfo->sta_flags))
6870                 goto nla_put_failure;
6871
6872         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6873         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6874         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6875         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6876         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6877         if (wiphy_ext_feature_isset(&rdev->wiphy,
6878                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6879                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6880                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6881         }
6882
6883 #undef PUT_SINFO
6884 #undef PUT_SINFO_U64
6885
6886         if (sinfo->pertid) {
6887                 struct nlattr *tidsattr;
6888                 int tid;
6889
6890                 tidsattr = nla_nest_start_noflag(msg,
6891                                                  NL80211_STA_INFO_TID_STATS);
6892                 if (!tidsattr)
6893                         goto nla_put_failure;
6894
6895                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6896                         struct cfg80211_tid_stats *tidstats;
6897                         struct nlattr *tidattr;
6898
6899                         tidstats = &sinfo->pertid[tid];
6900
6901                         if (!tidstats->filled)
6902                                 continue;
6903
6904                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6905                         if (!tidattr)
6906                                 goto nla_put_failure;
6907
6908 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6909         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6910             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6911                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6912                 goto nla_put_failure;                                   \
6913         } while (0)
6914
6915                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6916                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6917                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6918                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6919
6920 #undef PUT_TIDVAL_U64
6921                         if ((tidstats->filled &
6922                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6923                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6924                                                    NL80211_TID_STATS_TXQ_STATS))
6925                                 goto nla_put_failure;
6926
6927                         nla_nest_end(msg, tidattr);
6928                 }
6929
6930                 nla_nest_end(msg, tidsattr);
6931         }
6932
6933         nla_nest_end(msg, sinfoattr);
6934
6935         if (sinfo->assoc_req_ies_len &&
6936             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6937                     sinfo->assoc_req_ies))
6938                 goto nla_put_failure;
6939
6940         if (sinfo->assoc_resp_ies_len &&
6941             nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6942                     sinfo->assoc_resp_ies))
6943                 goto nla_put_failure;
6944
6945         if (sinfo->mlo_params_valid) {
6946                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6947                                sinfo->assoc_link_id))
6948                         goto nla_put_failure;
6949
6950                 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6951                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6952                             sinfo->mld_addr))
6953                         goto nla_put_failure;
6954         }
6955
6956         cfg80211_sinfo_release_content(sinfo);
6957         genlmsg_end(msg, hdr);
6958         return 0;
6959
6960  nla_put_failure:
6961         cfg80211_sinfo_release_content(sinfo);
6962         genlmsg_cancel(msg, hdr);
6963         return -EMSGSIZE;
6964 }
6965
6966 static int nl80211_dump_station(struct sk_buff *skb,
6967                                 struct netlink_callback *cb)
6968 {
6969         struct station_info sinfo;
6970         struct cfg80211_registered_device *rdev;
6971         struct wireless_dev *wdev;
6972         u8 mac_addr[ETH_ALEN];
6973         int sta_idx = cb->args[2];
6974         int err;
6975
6976         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6977         if (err)
6978                 return err;
6979         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6980         __acquire(&rdev->wiphy.mtx);
6981
6982         if (!wdev->netdev) {
6983                 err = -EINVAL;
6984                 goto out_err;
6985         }
6986
6987         if (!rdev->ops->dump_station) {
6988                 err = -EOPNOTSUPP;
6989                 goto out_err;
6990         }
6991
6992         while (1) {
6993                 memset(&sinfo, 0, sizeof(sinfo));
6994                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6995                                         mac_addr, &sinfo);
6996                 if (err == -ENOENT)
6997                         break;
6998                 if (err)
6999                         goto out_err;
7000
7001                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
7002                                 NETLINK_CB(cb->skb).portid,
7003                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7004                                 rdev, wdev->netdev, mac_addr,
7005                                 &sinfo) < 0)
7006                         goto out;
7007
7008                 sta_idx++;
7009         }
7010
7011  out:
7012         cb->args[2] = sta_idx;
7013         err = skb->len;
7014  out_err:
7015         wiphy_unlock(&rdev->wiphy);
7016
7017         return err;
7018 }
7019
7020 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
7021 {
7022         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7023         struct net_device *dev = info->user_ptr[1];
7024         struct station_info sinfo;
7025         struct sk_buff *msg;
7026         u8 *mac_addr = NULL;
7027         int err;
7028
7029         memset(&sinfo, 0, sizeof(sinfo));
7030
7031         if (!info->attrs[NL80211_ATTR_MAC])
7032                 return -EINVAL;
7033
7034         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7035
7036         if (!rdev->ops->get_station)
7037                 return -EOPNOTSUPP;
7038
7039         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
7040         if (err)
7041                 return err;
7042
7043         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7044         if (!msg) {
7045                 cfg80211_sinfo_release_content(&sinfo);
7046                 return -ENOMEM;
7047         }
7048
7049         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
7050                                  info->snd_portid, info->snd_seq, 0,
7051                                  rdev, dev, mac_addr, &sinfo) < 0) {
7052                 nlmsg_free(msg);
7053                 return -ENOBUFS;
7054         }
7055
7056         return genlmsg_reply(msg, info);
7057 }
7058
7059 int cfg80211_check_station_change(struct wiphy *wiphy,
7060                                   struct station_parameters *params,
7061                                   enum cfg80211_station_type statype)
7062 {
7063         if (params->listen_interval != -1 &&
7064             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7065                 return -EINVAL;
7066
7067         if (params->support_p2p_ps != -1 &&
7068             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7069                 return -EINVAL;
7070
7071         if (params->aid &&
7072             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
7073             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
7074                 return -EINVAL;
7075
7076         /* When you run into this, adjust the code below for the new flag */
7077         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7078
7079         switch (statype) {
7080         case CFG80211_STA_MESH_PEER_KERNEL:
7081         case CFG80211_STA_MESH_PEER_USER:
7082                 /*
7083                  * No ignoring the TDLS flag here -- the userspace mesh
7084                  * code doesn't have the bug of including TDLS in the
7085                  * mask everywhere.
7086                  */
7087                 if (params->sta_flags_mask &
7088                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7089                                   BIT(NL80211_STA_FLAG_MFP) |
7090                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
7091                         return -EINVAL;
7092                 break;
7093         case CFG80211_STA_TDLS_PEER_SETUP:
7094         case CFG80211_STA_TDLS_PEER_ACTIVE:
7095                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7096                         return -EINVAL;
7097                 /* ignore since it can't change */
7098                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7099                 break;
7100         default:
7101                 /* disallow mesh-specific things */
7102                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
7103                         return -EINVAL;
7104                 if (params->local_pm)
7105                         return -EINVAL;
7106                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7107                         return -EINVAL;
7108         }
7109
7110         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7111             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
7112                 /* TDLS can't be set, ... */
7113                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
7114                         return -EINVAL;
7115                 /*
7116                  * ... but don't bother the driver with it. This works around
7117                  * a hostapd/wpa_supplicant issue -- it always includes the
7118                  * TLDS_PEER flag in the mask even for AP mode.
7119                  */
7120                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7121         }
7122
7123         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
7124             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7125                 /* reject other things that can't change */
7126                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
7127                         return -EINVAL;
7128                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
7129                         return -EINVAL;
7130                 if (params->link_sta_params.supported_rates)
7131                         return -EINVAL;
7132                 if (params->ext_capab || params->link_sta_params.ht_capa ||
7133                     params->link_sta_params.vht_capa ||
7134                     params->link_sta_params.he_capa ||
7135                     params->link_sta_params.eht_capa)
7136                         return -EINVAL;
7137                 if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7138                         return -EINVAL;
7139         }
7140
7141         if (statype != CFG80211_STA_AP_CLIENT &&
7142             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
7143                 if (params->vlan)
7144                         return -EINVAL;
7145         }
7146
7147         /* Accept EMLSR capabilities only for AP client before association */
7148         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7149             params->eml_cap_present)
7150                 return -EINVAL;
7151
7152         switch (statype) {
7153         case CFG80211_STA_AP_MLME_CLIENT:
7154                 /* Use this only for authorizing/unauthorizing a station */
7155                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
7156                         return -EOPNOTSUPP;
7157                 break;
7158         case CFG80211_STA_AP_CLIENT:
7159         case CFG80211_STA_AP_CLIENT_UNASSOC:
7160                 /* accept only the listed bits */
7161                 if (params->sta_flags_mask &
7162                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7163                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7164                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
7165                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
7166                                   BIT(NL80211_STA_FLAG_WME) |
7167                                   BIT(NL80211_STA_FLAG_MFP) |
7168                                   BIT(NL80211_STA_FLAG_SPP_AMSDU)))
7169                         return -EINVAL;
7170
7171                 /* but authenticated/associated only if driver handles it */
7172                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7173                     params->sta_flags_mask &
7174                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7175                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
7176                         return -EINVAL;
7177                 break;
7178         case CFG80211_STA_IBSS:
7179         case CFG80211_STA_AP_STA:
7180                 /* reject any changes other than AUTHORIZED */
7181                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
7182                         return -EINVAL;
7183                 break;
7184         case CFG80211_STA_TDLS_PEER_SETUP:
7185                 /* reject any changes other than AUTHORIZED or WME */
7186                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
7187                                                BIT(NL80211_STA_FLAG_WME)))
7188                         return -EINVAL;
7189                 /* force (at least) rates when authorizing */
7190                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
7191                     !params->link_sta_params.supported_rates)
7192                         return -EINVAL;
7193                 break;
7194         case CFG80211_STA_TDLS_PEER_ACTIVE:
7195                 /* reject any changes */
7196                 return -EINVAL;
7197         case CFG80211_STA_MESH_PEER_KERNEL:
7198                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
7199                         return -EINVAL;
7200                 break;
7201         case CFG80211_STA_MESH_PEER_USER:
7202                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
7203                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
7204                         return -EINVAL;
7205                 break;
7206         }
7207
7208         /*
7209          * Older kernel versions ignored this attribute entirely, so don't
7210          * reject attempts to update it but mark it as unused instead so the
7211          * driver won't look at the data.
7212          */
7213         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
7214             statype != CFG80211_STA_TDLS_PEER_SETUP)
7215                 params->link_sta_params.opmode_notif_used = false;
7216
7217         return 0;
7218 }
7219 EXPORT_SYMBOL(cfg80211_check_station_change);
7220
7221 /*
7222  * Get vlan interface making sure it is running and on the right wiphy.
7223  */
7224 static struct net_device *get_vlan(struct genl_info *info,
7225                                    struct cfg80211_registered_device *rdev)
7226 {
7227         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7228         struct net_device *v;
7229         int ret;
7230
7231         if (!vlanattr)
7232                 return NULL;
7233
7234         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7235         if (!v)
7236                 return ERR_PTR(-ENODEV);
7237
7238         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7239                 ret = -EINVAL;
7240                 goto error;
7241         }
7242
7243         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7244             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7245             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7246                 ret = -EINVAL;
7247                 goto error;
7248         }
7249
7250         if (!netif_running(v)) {
7251                 ret = -ENETDOWN;
7252                 goto error;
7253         }
7254
7255         return v;
7256  error:
7257         dev_put(v);
7258         return ERR_PTR(ret);
7259 }
7260
7261 static int nl80211_parse_sta_wme(struct genl_info *info,
7262                                  struct station_parameters *params)
7263 {
7264         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7265         struct nlattr *nla;
7266         int err;
7267
7268         /* parse WME attributes if present */
7269         if (!info->attrs[NL80211_ATTR_STA_WME])
7270                 return 0;
7271
7272         nla = info->attrs[NL80211_ATTR_STA_WME];
7273         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7274                                           nl80211_sta_wme_policy,
7275                                           info->extack);
7276         if (err)
7277                 return err;
7278
7279         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7280                 params->uapsd_queues = nla_get_u8(
7281                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
7282         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7283                 return -EINVAL;
7284
7285         if (tb[NL80211_STA_WME_MAX_SP])
7286                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7287
7288         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7289                 return -EINVAL;
7290
7291         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7292
7293         return 0;
7294 }
7295
7296 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7297                                       struct station_parameters *params)
7298 {
7299         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7300                 params->supported_channels =
7301                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7302                 params->supported_channels_len =
7303                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7304                 /*
7305                  * Need to include at least one (first channel, number of
7306                  * channels) tuple for each subband (checked in policy),
7307                  * and must have proper tuples for the rest of the data as well.
7308                  */
7309                 if (params->supported_channels_len % 2)
7310                         return -EINVAL;
7311         }
7312
7313         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7314                 params->supported_oper_classes =
7315                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7316                 params->supported_oper_classes_len =
7317                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7318         }
7319         return 0;
7320 }
7321
7322 static int nl80211_set_station_tdls(struct genl_info *info,
7323                                     struct station_parameters *params)
7324 {
7325         int err;
7326         /* Dummy STA entry gets updated once the peer capabilities are known */
7327         if (info->attrs[NL80211_ATTR_PEER_AID])
7328                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7329         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7330                 params->link_sta_params.ht_capa =
7331                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7332         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7333                 params->link_sta_params.vht_capa =
7334                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7335         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7336                 params->link_sta_params.he_capa =
7337                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7338                 params->link_sta_params.he_capa_len =
7339                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7340
7341                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7342                         params->link_sta_params.eht_capa =
7343                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7344                         params->link_sta_params.eht_capa_len =
7345                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7346
7347                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7348                                                         (const u8 *)params->link_sta_params.eht_capa,
7349                                                         params->link_sta_params.eht_capa_len,
7350                                                         false))
7351                                 return -EINVAL;
7352                 }
7353         }
7354
7355         err = nl80211_parse_sta_channel_info(info, params);
7356         if (err)
7357                 return err;
7358
7359         return nl80211_parse_sta_wme(info, params);
7360 }
7361
7362 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7363                                              struct sta_txpwr *txpwr,
7364                                              bool *txpwr_set)
7365 {
7366         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7367         int idx;
7368
7369         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7370                 if (!rdev->ops->set_tx_power ||
7371                     !wiphy_ext_feature_isset(&rdev->wiphy,
7372                                          NL80211_EXT_FEATURE_STA_TX_PWR))
7373                         return -EOPNOTSUPP;
7374
7375                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7376                 txpwr->type = nla_get_u8(info->attrs[idx]);
7377
7378                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7379                         idx = NL80211_ATTR_STA_TX_POWER;
7380
7381                         if (info->attrs[idx])
7382                                 txpwr->power = nla_get_s16(info->attrs[idx]);
7383                         else
7384                                 return -EINVAL;
7385                 }
7386
7387                 *txpwr_set = true;
7388         } else {
7389                 *txpwr_set = false;
7390         }
7391
7392         return 0;
7393 }
7394
7395 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7396 {
7397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7398         struct net_device *dev = info->user_ptr[1];
7399         struct station_parameters params;
7400         u8 *mac_addr;
7401         int err;
7402
7403         memset(&params, 0, sizeof(params));
7404
7405         if (!rdev->ops->change_station)
7406                 return -EOPNOTSUPP;
7407
7408         /*
7409          * AID and listen_interval properties can be set only for unassociated
7410          * station. Include these parameters here and will check them in
7411          * cfg80211_check_station_change().
7412          */
7413         if (info->attrs[NL80211_ATTR_STA_AID])
7414                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7415
7416         if (info->attrs[NL80211_ATTR_VLAN_ID])
7417                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7418
7419         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7420                 params.listen_interval =
7421                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7422         else
7423                 params.listen_interval = -1;
7424
7425         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7426                 params.support_p2p_ps =
7427                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7428         else
7429                 params.support_p2p_ps = -1;
7430
7431         if (!info->attrs[NL80211_ATTR_MAC])
7432                 return -EINVAL;
7433
7434         params.link_sta_params.link_id =
7435                 nl80211_link_id_or_invalid(info->attrs);
7436
7437         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7438                 /* If MLD_ADDR attribute is set then this is an MLD station
7439                  * and the MLD_ADDR attribute holds the MLD address and the
7440                  * MAC attribute holds for the LINK address.
7441                  * In that case, the link_id is also expected to be valid.
7442                  */
7443                 if (params.link_sta_params.link_id < 0)
7444                         return -EINVAL;
7445
7446                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7447                 params.link_sta_params.mld_mac = mac_addr;
7448                 params.link_sta_params.link_mac =
7449                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7450                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7451                         return -EINVAL;
7452         } else {
7453                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7454         }
7455
7456
7457         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7458                 params.link_sta_params.supported_rates =
7459                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7460                 params.link_sta_params.supported_rates_len =
7461                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7462         }
7463
7464         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7465                 params.capability =
7466                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7467                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7468         }
7469
7470         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7471                 params.ext_capab =
7472                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7473                 params.ext_capab_len =
7474                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7475         }
7476
7477         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7478                 return -EINVAL;
7479
7480         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7481                 params.plink_action =
7482                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7483
7484         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7485                 params.plink_state =
7486                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7487                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7488                         params.peer_aid = nla_get_u16(
7489                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7490                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7491         }
7492
7493         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7494                 params.local_pm = nla_get_u32(
7495                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7496
7497         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7498                 params.link_sta_params.opmode_notif_used = true;
7499                 params.link_sta_params.opmode_notif =
7500                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7501         }
7502
7503         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7504                 params.link_sta_params.he_6ghz_capa =
7505                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7506
7507         if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
7508                 params.eml_cap_present = true;
7509                 params.eml_cap =
7510                         nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
7511         }
7512
7513         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7514                 params.airtime_weight =
7515                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7516
7517         if (params.airtime_weight &&
7518             !wiphy_ext_feature_isset(&rdev->wiphy,
7519                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7520                 return -EOPNOTSUPP;
7521
7522         err = nl80211_parse_sta_txpower_setting(info,
7523                                                 &params.link_sta_params.txpwr,
7524                                                 &params.link_sta_params.txpwr_set);
7525         if (err)
7526                 return err;
7527
7528         /* Include parameters for TDLS peer (will check later) */
7529         err = nl80211_set_station_tdls(info, &params);
7530         if (err)
7531                 return err;
7532
7533         params.vlan = get_vlan(info, rdev);
7534         if (IS_ERR(params.vlan))
7535                 return PTR_ERR(params.vlan);
7536
7537         switch (dev->ieee80211_ptr->iftype) {
7538         case NL80211_IFTYPE_AP:
7539         case NL80211_IFTYPE_AP_VLAN:
7540         case NL80211_IFTYPE_P2P_GO:
7541         case NL80211_IFTYPE_P2P_CLIENT:
7542         case NL80211_IFTYPE_STATION:
7543         case NL80211_IFTYPE_ADHOC:
7544         case NL80211_IFTYPE_MESH_POINT:
7545                 break;
7546         default:
7547                 err = -EOPNOTSUPP;
7548                 goto out_put_vlan;
7549         }
7550
7551         /* driver will call cfg80211_check_station_change() */
7552         err = rdev_change_station(rdev, dev, mac_addr, &params);
7553
7554  out_put_vlan:
7555         dev_put(params.vlan);
7556
7557         return err;
7558 }
7559
7560 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7561 {
7562         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7563         int err;
7564         struct net_device *dev = info->user_ptr[1];
7565         struct wireless_dev *wdev = dev->ieee80211_ptr;
7566         struct station_parameters params;
7567         u8 *mac_addr = NULL;
7568         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7569                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7570
7571         memset(&params, 0, sizeof(params));
7572
7573         if (!rdev->ops->add_station)
7574                 return -EOPNOTSUPP;
7575
7576         if (!info->attrs[NL80211_ATTR_MAC])
7577                 return -EINVAL;
7578
7579         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7580                 return -EINVAL;
7581
7582         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7583                 return -EINVAL;
7584
7585         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7586             !info->attrs[NL80211_ATTR_PEER_AID])
7587                 return -EINVAL;
7588
7589         params.link_sta_params.link_id =
7590                 nl80211_link_id_or_invalid(info->attrs);
7591
7592         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7593                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7594                 params.link_sta_params.mld_mac = mac_addr;
7595                 params.link_sta_params.link_mac =
7596                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7597                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7598                         return -EINVAL;
7599         } else {
7600                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7601         }
7602
7603         params.link_sta_params.supported_rates =
7604                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7605         params.link_sta_params.supported_rates_len =
7606                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7607         params.listen_interval =
7608                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7609
7610         if (info->attrs[NL80211_ATTR_VLAN_ID])
7611                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7612
7613         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7614                 params.support_p2p_ps =
7615                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7616         } else {
7617                 /*
7618                  * if not specified, assume it's supported for P2P GO interface,
7619                  * and is NOT supported for AP interface
7620                  */
7621                 params.support_p2p_ps =
7622                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7623         }
7624
7625         if (info->attrs[NL80211_ATTR_PEER_AID])
7626                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7627         else
7628                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7629
7630         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7631                 params.capability =
7632                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7633                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7634         }
7635
7636         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7637                 params.ext_capab =
7638                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7639                 params.ext_capab_len =
7640                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7641         }
7642
7643         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7644                 params.link_sta_params.ht_capa =
7645                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7646
7647         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7648                 params.link_sta_params.vht_capa =
7649                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7650
7651         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7652                 params.link_sta_params.he_capa =
7653                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7654                 params.link_sta_params.he_capa_len =
7655                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7656
7657                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7658                         params.link_sta_params.eht_capa =
7659                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7660                         params.link_sta_params.eht_capa_len =
7661                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7662
7663                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7664                                                         (const u8 *)params.link_sta_params.eht_capa,
7665                                                         params.link_sta_params.eht_capa_len,
7666                                                         false))
7667                                 return -EINVAL;
7668                 }
7669         }
7670
7671         if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
7672                 params.eml_cap_present = true;
7673                 params.eml_cap =
7674                         nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
7675         }
7676
7677         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7678                 params.link_sta_params.he_6ghz_capa =
7679                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7680
7681         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7682                 params.link_sta_params.opmode_notif_used = true;
7683                 params.link_sta_params.opmode_notif =
7684                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7685         }
7686
7687         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7688                 params.plink_action =
7689                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7690
7691         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7692                 params.airtime_weight =
7693                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7694
7695         if (params.airtime_weight &&
7696             !wiphy_ext_feature_isset(&rdev->wiphy,
7697                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7698                 return -EOPNOTSUPP;
7699
7700         err = nl80211_parse_sta_txpower_setting(info,
7701                                                 &params.link_sta_params.txpwr,
7702                                                 &params.link_sta_params.txpwr_set);
7703         if (err)
7704                 return err;
7705
7706         err = nl80211_parse_sta_channel_info(info, &params);
7707         if (err)
7708                 return err;
7709
7710         err = nl80211_parse_sta_wme(info, &params);
7711         if (err)
7712                 return err;
7713
7714         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7715                 return -EINVAL;
7716
7717         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7718          * as userspace might just pass through the capabilities from the IEs
7719          * directly, rather than enforcing this restriction and returning an
7720          * error in this case.
7721          */
7722         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7723                 params.link_sta_params.ht_capa = NULL;
7724                 params.link_sta_params.vht_capa = NULL;
7725
7726                 /* HE and EHT require WME */
7727                 if (params.link_sta_params.he_capa_len ||
7728                     params.link_sta_params.he_6ghz_capa ||
7729                     params.link_sta_params.eht_capa_len)
7730                         return -EINVAL;
7731         }
7732
7733         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7734         if (params.link_sta_params.he_6ghz_capa &&
7735             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7736                 return -EINVAL;
7737
7738         /* When you run into this, adjust the code below for the new flag */
7739         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
7740
7741         switch (dev->ieee80211_ptr->iftype) {
7742         case NL80211_IFTYPE_AP:
7743         case NL80211_IFTYPE_AP_VLAN:
7744         case NL80211_IFTYPE_P2P_GO:
7745                 /* ignore WME attributes if iface/sta is not capable */
7746                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7747                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7748                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7749
7750                 /* TDLS peers cannot be added */
7751                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7752                     info->attrs[NL80211_ATTR_PEER_AID])
7753                         return -EINVAL;
7754                 /* but don't bother the driver with it */
7755                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7756
7757                 /* allow authenticated/associated only if driver handles it */
7758                 if (!(rdev->wiphy.features &
7759                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7760                     params.sta_flags_mask & auth_assoc)
7761                         return -EINVAL;
7762
7763                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
7764                                              NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
7765                     params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
7766                         return -EINVAL;
7767
7768                 /* Older userspace, or userspace wanting to be compatible with
7769                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7770                  * and assoc flags in the mask, but assumes the station will be
7771                  * added as associated anyway since this was the required driver
7772                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7773                  * introduced.
7774                  * In order to not bother drivers with this quirk in the API
7775                  * set the flags in both the mask and set for new stations in
7776                  * this case.
7777                  */
7778                 if (!(params.sta_flags_mask & auth_assoc)) {
7779                         params.sta_flags_mask |= auth_assoc;
7780                         params.sta_flags_set |= auth_assoc;
7781                 }
7782
7783                 /* must be last in here for error handling */
7784                 params.vlan = get_vlan(info, rdev);
7785                 if (IS_ERR(params.vlan))
7786                         return PTR_ERR(params.vlan);
7787                 break;
7788         case NL80211_IFTYPE_MESH_POINT:
7789                 /* ignore uAPSD data */
7790                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7791
7792                 /* associated is disallowed */
7793                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7794                         return -EINVAL;
7795                 /* TDLS peers cannot be added */
7796                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7797                     info->attrs[NL80211_ATTR_PEER_AID])
7798                         return -EINVAL;
7799                 break;
7800         case NL80211_IFTYPE_STATION:
7801         case NL80211_IFTYPE_P2P_CLIENT:
7802                 /* ignore uAPSD data */
7803                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7804
7805                 /* these are disallowed */
7806                 if (params.sta_flags_mask &
7807                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7808                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7809                         return -EINVAL;
7810                 /* Only TDLS peers can be added */
7811                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7812                         return -EINVAL;
7813                 /* Can only add if TDLS ... */
7814                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7815                         return -EOPNOTSUPP;
7816                 /* ... with external setup is supported */
7817                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7818                         return -EOPNOTSUPP;
7819                 /*
7820                  * Older wpa_supplicant versions always mark the TDLS peer
7821                  * as authorized, but it shouldn't yet be.
7822                  */
7823                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7824                 break;
7825         default:
7826                 return -EOPNOTSUPP;
7827         }
7828
7829         /* be aware of params.vlan when changing code here */
7830
7831         if (wdev->valid_links) {
7832                 if (params.link_sta_params.link_id < 0) {
7833                         err = -EINVAL;
7834                         goto out;
7835                 }
7836                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7837                         err = -ENOLINK;
7838                         goto out;
7839                 }
7840         } else {
7841                 if (params.link_sta_params.link_id >= 0) {
7842                         err = -EINVAL;
7843                         goto out;
7844                 }
7845         }
7846         err = rdev_add_station(rdev, dev, mac_addr, &params);
7847 out:
7848         dev_put(params.vlan);
7849         return err;
7850 }
7851
7852 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7853 {
7854         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7855         struct net_device *dev = info->user_ptr[1];
7856         struct wireless_dev *wdev = dev->ieee80211_ptr;
7857         struct station_del_parameters params;
7858         int link_id = nl80211_link_id_or_invalid(info->attrs);
7859
7860         memset(&params, 0, sizeof(params));
7861
7862         if (info->attrs[NL80211_ATTR_MAC])
7863                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7864
7865         switch (wdev->iftype) {
7866         case NL80211_IFTYPE_AP:
7867         case NL80211_IFTYPE_AP_VLAN:
7868         case NL80211_IFTYPE_MESH_POINT:
7869         case NL80211_IFTYPE_P2P_GO:
7870                 /* always accept these */
7871                 break;
7872         case NL80211_IFTYPE_ADHOC:
7873                 /* conditionally accept */
7874                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7875                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7876                         break;
7877                 return -EINVAL;
7878         default:
7879                 return -EINVAL;
7880         }
7881
7882         if (!rdev->ops->del_station)
7883                 return -EOPNOTSUPP;
7884
7885         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7886                 params.subtype =
7887                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7888                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7889                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7890                         return -EINVAL;
7891         } else {
7892                 /* Default to Deauthentication frame */
7893                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7894         }
7895
7896         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7897                 params.reason_code =
7898                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7899                 if (params.reason_code == 0)
7900                         return -EINVAL; /* 0 is reserved */
7901         } else {
7902                 /* Default to reason code 2 */
7903                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7904         }
7905
7906         /* Link ID not expected in case of non-ML operation */
7907         if (!wdev->valid_links && link_id != -1)
7908                 return -EINVAL;
7909
7910         /* If given, a valid link ID should be passed during MLO */
7911         if (wdev->valid_links && link_id >= 0 &&
7912             !(wdev->valid_links & BIT(link_id)))
7913                 return -EINVAL;
7914
7915         params.link_id = link_id;
7916
7917         return rdev_del_station(rdev, dev, &params);
7918 }
7919
7920 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7921                                 int flags, struct net_device *dev,
7922                                 u8 *dst, u8 *next_hop,
7923                                 struct mpath_info *pinfo)
7924 {
7925         void *hdr;
7926         struct nlattr *pinfoattr;
7927
7928         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7929         if (!hdr)
7930                 return -1;
7931
7932         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7933             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7934             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7935             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7936                 goto nla_put_failure;
7937
7938         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7939         if (!pinfoattr)
7940                 goto nla_put_failure;
7941         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7942             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7943                         pinfo->frame_qlen))
7944                 goto nla_put_failure;
7945         if (((pinfo->filled & MPATH_INFO_SN) &&
7946              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7947             ((pinfo->filled & MPATH_INFO_METRIC) &&
7948              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7949                          pinfo->metric)) ||
7950             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7951              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7952                          pinfo->exptime)) ||
7953             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7954              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7955                         pinfo->flags)) ||
7956             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7957              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7958                          pinfo->discovery_timeout)) ||
7959             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7960              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7961                         pinfo->discovery_retries)) ||
7962             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7963              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7964                         pinfo->hop_count)) ||
7965             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7966              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7967                          pinfo->path_change_count)))
7968                 goto nla_put_failure;
7969
7970         nla_nest_end(msg, pinfoattr);
7971
7972         genlmsg_end(msg, hdr);
7973         return 0;
7974
7975  nla_put_failure:
7976         genlmsg_cancel(msg, hdr);
7977         return -EMSGSIZE;
7978 }
7979
7980 static int nl80211_dump_mpath(struct sk_buff *skb,
7981                               struct netlink_callback *cb)
7982 {
7983         struct mpath_info pinfo;
7984         struct cfg80211_registered_device *rdev;
7985         struct wireless_dev *wdev;
7986         u8 dst[ETH_ALEN];
7987         u8 next_hop[ETH_ALEN];
7988         int path_idx = cb->args[2];
7989         int err;
7990
7991         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7992         if (err)
7993                 return err;
7994         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7995         __acquire(&rdev->wiphy.mtx);
7996
7997         if (!rdev->ops->dump_mpath) {
7998                 err = -EOPNOTSUPP;
7999                 goto out_err;
8000         }
8001
8002         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8003                 err = -EOPNOTSUPP;
8004                 goto out_err;
8005         }
8006
8007         while (1) {
8008                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
8009                                       next_hop, &pinfo);
8010                 if (err == -ENOENT)
8011                         break;
8012                 if (err)
8013                         goto out_err;
8014
8015                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8016                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
8017                                        wdev->netdev, dst, next_hop,
8018                                        &pinfo) < 0)
8019                         goto out;
8020
8021                 path_idx++;
8022         }
8023
8024  out:
8025         cb->args[2] = path_idx;
8026         err = skb->len;
8027  out_err:
8028         wiphy_unlock(&rdev->wiphy);
8029         return err;
8030 }
8031
8032 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
8033 {
8034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8035         int err;
8036         struct net_device *dev = info->user_ptr[1];
8037         struct mpath_info pinfo;
8038         struct sk_buff *msg;
8039         u8 *dst = NULL;
8040         u8 next_hop[ETH_ALEN];
8041
8042         memset(&pinfo, 0, sizeof(pinfo));
8043
8044         if (!info->attrs[NL80211_ATTR_MAC])
8045                 return -EINVAL;
8046
8047         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8048
8049         if (!rdev->ops->get_mpath)
8050                 return -EOPNOTSUPP;
8051
8052         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8053                 return -EOPNOTSUPP;
8054
8055         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
8056         if (err)
8057                 return err;
8058
8059         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8060         if (!msg)
8061                 return -ENOMEM;
8062
8063         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8064                                  dev, dst, next_hop, &pinfo) < 0) {
8065                 nlmsg_free(msg);
8066                 return -ENOBUFS;
8067         }
8068
8069         return genlmsg_reply(msg, info);
8070 }
8071
8072 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
8073 {
8074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8075         struct net_device *dev = info->user_ptr[1];
8076         u8 *dst = NULL;
8077         u8 *next_hop = NULL;
8078
8079         if (!info->attrs[NL80211_ATTR_MAC])
8080                 return -EINVAL;
8081
8082         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8083                 return -EINVAL;
8084
8085         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8086         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8087
8088         if (!rdev->ops->change_mpath)
8089                 return -EOPNOTSUPP;
8090
8091         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8092                 return -EOPNOTSUPP;
8093
8094         return rdev_change_mpath(rdev, dev, dst, next_hop);
8095 }
8096
8097 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
8098 {
8099         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8100         struct net_device *dev = info->user_ptr[1];
8101         u8 *dst = NULL;
8102         u8 *next_hop = NULL;
8103
8104         if (!info->attrs[NL80211_ATTR_MAC])
8105                 return -EINVAL;
8106
8107         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
8108                 return -EINVAL;
8109
8110         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8111         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
8112
8113         if (!rdev->ops->add_mpath)
8114                 return -EOPNOTSUPP;
8115
8116         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8117                 return -EOPNOTSUPP;
8118
8119         return rdev_add_mpath(rdev, dev, dst, next_hop);
8120 }
8121
8122 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
8123 {
8124         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8125         struct net_device *dev = info->user_ptr[1];
8126         u8 *dst = NULL;
8127
8128         if (info->attrs[NL80211_ATTR_MAC])
8129                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8130
8131         if (!rdev->ops->del_mpath)
8132                 return -EOPNOTSUPP;
8133
8134         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8135                 return -EOPNOTSUPP;
8136
8137         return rdev_del_mpath(rdev, dev, dst);
8138 }
8139
8140 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
8141 {
8142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8143         int err;
8144         struct net_device *dev = info->user_ptr[1];
8145         struct mpath_info pinfo;
8146         struct sk_buff *msg;
8147         u8 *dst = NULL;
8148         u8 mpp[ETH_ALEN];
8149
8150         memset(&pinfo, 0, sizeof(pinfo));
8151
8152         if (!info->attrs[NL80211_ATTR_MAC])
8153                 return -EINVAL;
8154
8155         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
8156
8157         if (!rdev->ops->get_mpp)
8158                 return -EOPNOTSUPP;
8159
8160         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
8161                 return -EOPNOTSUPP;
8162
8163         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
8164         if (err)
8165                 return err;
8166
8167         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8168         if (!msg)
8169                 return -ENOMEM;
8170
8171         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
8172                                dev, dst, mpp, &pinfo) < 0) {
8173                 nlmsg_free(msg);
8174                 return -ENOBUFS;
8175         }
8176
8177         return genlmsg_reply(msg, info);
8178 }
8179
8180 static int nl80211_dump_mpp(struct sk_buff *skb,
8181                             struct netlink_callback *cb)
8182 {
8183         struct mpath_info pinfo;
8184         struct cfg80211_registered_device *rdev;
8185         struct wireless_dev *wdev;
8186         u8 dst[ETH_ALEN];
8187         u8 mpp[ETH_ALEN];
8188         int path_idx = cb->args[2];
8189         int err;
8190
8191         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
8192         if (err)
8193                 return err;
8194         /* nl80211_prepare_wdev_dump acquired it in the successful case */
8195         __acquire(&rdev->wiphy.mtx);
8196
8197         if (!rdev->ops->dump_mpp) {
8198                 err = -EOPNOTSUPP;
8199                 goto out_err;
8200         }
8201
8202         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
8203                 err = -EOPNOTSUPP;
8204                 goto out_err;
8205         }
8206
8207         while (1) {
8208                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
8209                                     mpp, &pinfo);
8210                 if (err == -ENOENT)
8211                         break;
8212                 if (err)
8213                         goto out_err;
8214
8215                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
8216                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
8217                                        wdev->netdev, dst, mpp,
8218                                        &pinfo) < 0)
8219                         goto out;
8220
8221                 path_idx++;
8222         }
8223
8224  out:
8225         cb->args[2] = path_idx;
8226         err = skb->len;
8227  out_err:
8228         wiphy_unlock(&rdev->wiphy);
8229         return err;
8230 }
8231
8232 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
8233 {
8234         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8235         struct net_device *dev = info->user_ptr[1];
8236         struct bss_parameters params;
8237
8238         memset(&params, 0, sizeof(params));
8239         params.link_id = nl80211_link_id_or_invalid(info->attrs);
8240         /* default to not changing parameters */
8241         params.use_cts_prot = -1;
8242         params.use_short_preamble = -1;
8243         params.use_short_slot_time = -1;
8244         params.ap_isolate = -1;
8245         params.ht_opmode = -1;
8246         params.p2p_ctwindow = -1;
8247         params.p2p_opp_ps = -1;
8248
8249         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
8250                 params.use_cts_prot =
8251                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8252         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8253                 params.use_short_preamble =
8254                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8255         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8256                 params.use_short_slot_time =
8257                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8258         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8259                 params.basic_rates =
8260                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8261                 params.basic_rates_len =
8262                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8263         }
8264         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8265                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8266         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8267                 params.ht_opmode =
8268                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8269
8270         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8271                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8272                         return -EINVAL;
8273                 params.p2p_ctwindow =
8274                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8275                 if (params.p2p_ctwindow != 0 &&
8276                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8277                         return -EINVAL;
8278         }
8279
8280         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8281                 u8 tmp;
8282
8283                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8284                         return -EINVAL;
8285                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8286                 params.p2p_opp_ps = tmp;
8287                 if (params.p2p_opp_ps &&
8288                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8289                         return -EINVAL;
8290         }
8291
8292         if (!rdev->ops->change_bss)
8293                 return -EOPNOTSUPP;
8294
8295         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8296             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8297                 return -EOPNOTSUPP;
8298
8299         return rdev_change_bss(rdev, dev, &params);
8300 }
8301
8302 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8303 {
8304         char *data = NULL;
8305         bool is_indoor;
8306         enum nl80211_user_reg_hint_type user_reg_hint_type;
8307         u32 owner_nlportid;
8308
8309         /*
8310          * You should only get this when cfg80211 hasn't yet initialized
8311          * completely when built-in to the kernel right between the time
8312          * window between nl80211_init() and regulatory_init(), if that is
8313          * even possible.
8314          */
8315         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8316                 return -EINPROGRESS;
8317
8318         user_reg_hint_type =
8319                 nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
8320                                     NL80211_USER_REG_HINT_USER);
8321
8322         switch (user_reg_hint_type) {
8323         case NL80211_USER_REG_HINT_USER:
8324         case NL80211_USER_REG_HINT_CELL_BASE:
8325                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8326                         return -EINVAL;
8327
8328                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8329                 return regulatory_hint_user(data, user_reg_hint_type);
8330         case NL80211_USER_REG_HINT_INDOOR:
8331                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8332                         owner_nlportid = info->snd_portid;
8333                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8334                 } else {
8335                         owner_nlportid = 0;
8336                         is_indoor = true;
8337                 }
8338
8339                 regulatory_hint_indoor(is_indoor, owner_nlportid);
8340                 return 0;
8341         default:
8342                 return -EINVAL;
8343         }
8344 }
8345
8346 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8347 {
8348         return reg_reload_regdb();
8349 }
8350
8351 static int nl80211_get_mesh_config(struct sk_buff *skb,
8352                                    struct genl_info *info)
8353 {
8354         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8355         struct net_device *dev = info->user_ptr[1];
8356         struct wireless_dev *wdev = dev->ieee80211_ptr;
8357         struct mesh_config cur_params;
8358         int err = 0;
8359         void *hdr;
8360         struct nlattr *pinfoattr;
8361         struct sk_buff *msg;
8362
8363         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8364                 return -EOPNOTSUPP;
8365
8366         if (!rdev->ops->get_mesh_config)
8367                 return -EOPNOTSUPP;
8368
8369         /* If not connected, get default parameters */
8370         if (!wdev->u.mesh.id_len)
8371                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8372         else
8373                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8374
8375         if (err)
8376                 return err;
8377
8378         /* Draw up a netlink message to send back */
8379         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8380         if (!msg)
8381                 return -ENOMEM;
8382         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8383                              NL80211_CMD_GET_MESH_CONFIG);
8384         if (!hdr)
8385                 goto out;
8386         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8387         if (!pinfoattr)
8388                 goto nla_put_failure;
8389         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8390             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8391                         cur_params.dot11MeshRetryTimeout) ||
8392             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8393                         cur_params.dot11MeshConfirmTimeout) ||
8394             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8395                         cur_params.dot11MeshHoldingTimeout) ||
8396             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8397                         cur_params.dot11MeshMaxPeerLinks) ||
8398             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8399                        cur_params.dot11MeshMaxRetries) ||
8400             nla_put_u8(msg, NL80211_MESHCONF_TTL,
8401                        cur_params.dot11MeshTTL) ||
8402             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8403                        cur_params.element_ttl) ||
8404             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8405                        cur_params.auto_open_plinks) ||
8406             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8407                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8408             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8409                        cur_params.dot11MeshHWMPmaxPREQretries) ||
8410             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8411                         cur_params.path_refresh_time) ||
8412             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8413                         cur_params.min_discovery_timeout) ||
8414             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8415                         cur_params.dot11MeshHWMPactivePathTimeout) ||
8416             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8417                         cur_params.dot11MeshHWMPpreqMinInterval) ||
8418             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8419                         cur_params.dot11MeshHWMPperrMinInterval) ||
8420             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8421                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8422             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8423                        cur_params.dot11MeshHWMPRootMode) ||
8424             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8425                         cur_params.dot11MeshHWMPRannInterval) ||
8426             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8427                        cur_params.dot11MeshGateAnnouncementProtocol) ||
8428             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8429                        cur_params.dot11MeshForwarding) ||
8430             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8431                         cur_params.rssi_threshold) ||
8432             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8433                         cur_params.ht_opmode) ||
8434             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8435                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8436             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8437                         cur_params.dot11MeshHWMProotInterval) ||
8438             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8439                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8440             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8441                         cur_params.power_mode) ||
8442             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8443                         cur_params.dot11MeshAwakeWindowDuration) ||
8444             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8445                         cur_params.plink_timeout) ||
8446             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8447                        cur_params.dot11MeshConnectedToMeshGate) ||
8448             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8449                        cur_params.dot11MeshNolearn) ||
8450             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8451                        cur_params.dot11MeshConnectedToAuthServer))
8452                 goto nla_put_failure;
8453         nla_nest_end(msg, pinfoattr);
8454         genlmsg_end(msg, hdr);
8455         return genlmsg_reply(msg, info);
8456
8457  nla_put_failure:
8458  out:
8459         nlmsg_free(msg);
8460         return -ENOBUFS;
8461 }
8462
8463 static const struct nla_policy
8464 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8465         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8466                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8467         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8468                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8469         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8470                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8471         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8472                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8473         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8474         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8475         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8476         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8477         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8478                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8479         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8480         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8481         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8482         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8483         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8484                 NLA_POLICY_MIN(NLA_U16, 1),
8485         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8486                 NLA_POLICY_MIN(NLA_U16, 1),
8487         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8488                 NLA_POLICY_MIN(NLA_U16, 1),
8489         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8490         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8491                 NLA_POLICY_MIN(NLA_U16, 1),
8492         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8493         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8494         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8495                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8496         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8497         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8498         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8499                 NLA_POLICY_MIN(NLA_U16, 1),
8500         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8501                 NLA_POLICY_MIN(NLA_U16, 1),
8502         [NL80211_MESHCONF_POWER_MODE] =
8503                 NLA_POLICY_RANGE(NLA_U32,
8504                                  NL80211_MESH_POWER_ACTIVE,
8505                                  NL80211_MESH_POWER_MAX),
8506         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8507         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8508         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8509         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8510         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8511 };
8512
8513 static const struct nla_policy
8514         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8515         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8516         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8517         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8518         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8519         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8520         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8521         [NL80211_MESH_SETUP_IE] =
8522                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8523                                        IEEE80211_MAX_DATA_LEN),
8524         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8525 };
8526
8527 static int nl80211_parse_mesh_config(struct genl_info *info,
8528                                      struct mesh_config *cfg,
8529                                      u32 *mask_out)
8530 {
8531         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8532         u32 mask = 0;
8533         u16 ht_opmode;
8534
8535 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8536 do {                                                                    \
8537         if (tb[attr]) {                                                 \
8538                 cfg->param = fn(tb[attr]);                              \
8539                 mask |= BIT((attr) - 1);                                \
8540         }                                                               \
8541 } while (0)
8542
8543         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8544                 return -EINVAL;
8545         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8546                 return -EINVAL;
8547
8548         /* This makes sure that there aren't more than 32 mesh config
8549          * parameters (otherwise our bitfield scheme would not work.) */
8550         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8551
8552         /* Fill in the params struct */
8553         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8554                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8555         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8556                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8557                                   nla_get_u16);
8558         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8559                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8560                                   nla_get_u16);
8561         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8562                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8563                                   nla_get_u16);
8564         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8565                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8566         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8567                                   NL80211_MESHCONF_TTL, nla_get_u8);
8568         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8569                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8570         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8571                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8572                                   nla_get_u8);
8573         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8574                                   mask,
8575                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8576                                   nla_get_u32);
8577         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8578                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8579                                   nla_get_u8);
8580         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8581                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8582                                   nla_get_u32);
8583         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8584             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8585                 return -EINVAL;
8586         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8587                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8588                                   nla_get_u16);
8589         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8590                                   mask,
8591                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8592                                   nla_get_u32);
8593         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8594             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8595              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8596                 return -EINVAL;
8597         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8598                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8599                                   nla_get_u16);
8600         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8601                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8602                                   nla_get_u16);
8603         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8604                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8605                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8606                                   nla_get_u16);
8607         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8608                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8609         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8610                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8611                                   nla_get_u16);
8612         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8613                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8614                                   nla_get_u8);
8615         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8616                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8617         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8618                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8619                                   nla_get_s32);
8620         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8621                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8622                                   nla_get_u8);
8623         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8624                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8625                                   nla_get_u8);
8626         /*
8627          * Check HT operation mode based on
8628          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8629          */
8630         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8631                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8632
8633                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8634                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8635                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8636                         return -EINVAL;
8637
8638                 /* NON_HT_STA bit is reserved, but some programs set it */
8639                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8640
8641                 cfg->ht_opmode = ht_opmode;
8642                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8643         }
8644         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8645                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8646                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8647                                   nla_get_u32);
8648         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8649             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8650              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8651                 return -EINVAL;
8652         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8653                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8654                                   nla_get_u16);
8655         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8656                                   mask,
8657                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8658                                   nla_get_u16);
8659         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8660                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8661         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8662                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8663         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8664                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8665         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8666                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8667         if (mask_out)
8668                 *mask_out = mask;
8669
8670         return 0;
8671
8672 #undef FILL_IN_MESH_PARAM_IF_SET
8673 }
8674
8675 static int nl80211_parse_mesh_setup(struct genl_info *info,
8676                                      struct mesh_setup *setup)
8677 {
8678         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8679         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8680
8681         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8682                 return -EINVAL;
8683         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8684                 return -EINVAL;
8685
8686         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8687                 setup->sync_method =
8688                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8689                  IEEE80211_SYNC_METHOD_VENDOR :
8690                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8691
8692         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8693                 setup->path_sel_proto =
8694                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8695                  IEEE80211_PATH_PROTOCOL_VENDOR :
8696                  IEEE80211_PATH_PROTOCOL_HWMP;
8697
8698         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8699                 setup->path_metric =
8700                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8701                  IEEE80211_PATH_METRIC_VENDOR :
8702                  IEEE80211_PATH_METRIC_AIRTIME;
8703
8704         if (tb[NL80211_MESH_SETUP_IE]) {
8705                 struct nlattr *ieattr =
8706                         tb[NL80211_MESH_SETUP_IE];
8707                 setup->ie = nla_data(ieattr);
8708                 setup->ie_len = nla_len(ieattr);
8709         }
8710         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8711             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8712                 return -EINVAL;
8713         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8714         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8715         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8716         if (setup->is_secure)
8717                 setup->user_mpm = true;
8718
8719         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8720                 if (!setup->user_mpm)
8721                         return -EINVAL;
8722                 setup->auth_id =
8723                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8724         }
8725
8726         return 0;
8727 }
8728
8729 static int nl80211_update_mesh_config(struct sk_buff *skb,
8730                                       struct genl_info *info)
8731 {
8732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8733         struct net_device *dev = info->user_ptr[1];
8734         struct wireless_dev *wdev = dev->ieee80211_ptr;
8735         struct mesh_config cfg = {};
8736         u32 mask;
8737         int err;
8738
8739         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8740                 return -EOPNOTSUPP;
8741
8742         if (!rdev->ops->update_mesh_config)
8743                 return -EOPNOTSUPP;
8744
8745         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8746         if (err)
8747                 return err;
8748
8749         if (!wdev->u.mesh.id_len)
8750                 err = -ENOLINK;
8751
8752         if (!err)
8753                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8754
8755         return err;
8756 }
8757
8758 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8759                               struct sk_buff *msg)
8760 {
8761         struct nlattr *nl_reg_rules;
8762         unsigned int i;
8763
8764         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8765             (regdom->dfs_region &&
8766              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8767                 goto nla_put_failure;
8768
8769         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8770         if (!nl_reg_rules)
8771                 goto nla_put_failure;
8772
8773         for (i = 0; i < regdom->n_reg_rules; i++) {
8774                 struct nlattr *nl_reg_rule;
8775                 const struct ieee80211_reg_rule *reg_rule;
8776                 const struct ieee80211_freq_range *freq_range;
8777                 const struct ieee80211_power_rule *power_rule;
8778                 unsigned int max_bandwidth_khz;
8779
8780                 reg_rule = &regdom->reg_rules[i];
8781                 freq_range = &reg_rule->freq_range;
8782                 power_rule = &reg_rule->power_rule;
8783
8784                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8785                 if (!nl_reg_rule)
8786                         goto nla_put_failure;
8787
8788                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8789                 if (!max_bandwidth_khz)
8790                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8791                                                                   reg_rule);
8792
8793                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8794                                 reg_rule->flags) ||
8795                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8796                                 freq_range->start_freq_khz) ||
8797                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8798                                 freq_range->end_freq_khz) ||
8799                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8800                                 max_bandwidth_khz) ||
8801                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8802                                 power_rule->max_antenna_gain) ||
8803                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8804                                 power_rule->max_eirp) ||
8805                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8806                                 reg_rule->dfs_cac_ms))
8807                         goto nla_put_failure;
8808
8809                 if ((reg_rule->flags & NL80211_RRF_PSD) &&
8810                     nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
8811                                reg_rule->psd))
8812                         goto nla_put_failure;
8813
8814                 nla_nest_end(msg, nl_reg_rule);
8815         }
8816
8817         nla_nest_end(msg, nl_reg_rules);
8818         return 0;
8819
8820 nla_put_failure:
8821         return -EMSGSIZE;
8822 }
8823
8824 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8825 {
8826         const struct ieee80211_regdomain *regdom = NULL;
8827         struct cfg80211_registered_device *rdev;
8828         struct wiphy *wiphy = NULL;
8829         struct sk_buff *msg;
8830         int err = -EMSGSIZE;
8831         void *hdr;
8832
8833         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8834         if (!msg)
8835                 return -ENOBUFS;
8836
8837         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8838                              NL80211_CMD_GET_REG);
8839         if (!hdr)
8840                 goto put_failure;
8841
8842         rtnl_lock();
8843
8844         if (info->attrs[NL80211_ATTR_WIPHY]) {
8845                 bool self_managed;
8846
8847                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8848                 if (IS_ERR(rdev)) {
8849                         err = PTR_ERR(rdev);
8850                         goto nla_put_failure;
8851                 }
8852
8853                 wiphy = &rdev->wiphy;
8854                 self_managed = wiphy->regulatory_flags &
8855                                REGULATORY_WIPHY_SELF_MANAGED;
8856
8857                 rcu_read_lock();
8858
8859                 regdom = get_wiphy_regdom(wiphy);
8860
8861                 /* a self-managed-reg device must have a private regdom */
8862                 if (WARN_ON(!regdom && self_managed)) {
8863                         err = -EINVAL;
8864                         goto nla_put_failure_rcu;
8865                 }
8866
8867                 if (regdom &&
8868                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8869                         goto nla_put_failure_rcu;
8870         } else {
8871                 rcu_read_lock();
8872         }
8873
8874         if (!wiphy && reg_last_request_cell_base() &&
8875             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8876                         NL80211_USER_REG_HINT_CELL_BASE))
8877                 goto nla_put_failure_rcu;
8878
8879         if (!regdom)
8880                 regdom = rcu_dereference(cfg80211_regdomain);
8881
8882         if (nl80211_put_regdom(regdom, msg))
8883                 goto nla_put_failure_rcu;
8884
8885         rcu_read_unlock();
8886
8887         genlmsg_end(msg, hdr);
8888         rtnl_unlock();
8889         return genlmsg_reply(msg, info);
8890
8891 nla_put_failure_rcu:
8892         rcu_read_unlock();
8893 nla_put_failure:
8894         rtnl_unlock();
8895 put_failure:
8896         nlmsg_free(msg);
8897         return err;
8898 }
8899
8900 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8901                                u32 seq, int flags, struct wiphy *wiphy,
8902                                const struct ieee80211_regdomain *regdom)
8903 {
8904         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8905                                    NL80211_CMD_GET_REG);
8906
8907         if (!hdr)
8908                 return -1;
8909
8910         genl_dump_check_consistent(cb, hdr);
8911
8912         if (nl80211_put_regdom(regdom, msg))
8913                 goto nla_put_failure;
8914
8915         if (!wiphy && reg_last_request_cell_base() &&
8916             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8917                         NL80211_USER_REG_HINT_CELL_BASE))
8918                 goto nla_put_failure;
8919
8920         if (wiphy &&
8921             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8922                 goto nla_put_failure;
8923
8924         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8925             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8926                 goto nla_put_failure;
8927
8928         genlmsg_end(msg, hdr);
8929         return 0;
8930
8931 nla_put_failure:
8932         genlmsg_cancel(msg, hdr);
8933         return -EMSGSIZE;
8934 }
8935
8936 static int nl80211_get_reg_dump(struct sk_buff *skb,
8937                                 struct netlink_callback *cb)
8938 {
8939         const struct ieee80211_regdomain *regdom = NULL;
8940         struct cfg80211_registered_device *rdev;
8941         int err, reg_idx, start = cb->args[2];
8942
8943         rcu_read_lock();
8944
8945         if (cfg80211_regdomain && start == 0) {
8946                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8947                                           NLM_F_MULTI, NULL,
8948                                           rcu_dereference(cfg80211_regdomain));
8949                 if (err < 0)
8950                         goto out_err;
8951         }
8952
8953         /* the global regdom is idx 0 */
8954         reg_idx = 1;
8955         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8956                 regdom = get_wiphy_regdom(&rdev->wiphy);
8957                 if (!regdom)
8958                         continue;
8959
8960                 if (++reg_idx <= start)
8961                         continue;
8962
8963                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8964                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8965                 if (err < 0) {
8966                         reg_idx--;
8967                         break;
8968                 }
8969         }
8970
8971         cb->args[2] = reg_idx;
8972         err = skb->len;
8973 out_err:
8974         rcu_read_unlock();
8975         return err;
8976 }
8977
8978 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8979 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8980         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8981         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8982         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8983         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8984         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8985         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8986         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8987 };
8988
8989 static int parse_reg_rule(struct nlattr *tb[],
8990         struct ieee80211_reg_rule *reg_rule)
8991 {
8992         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8993         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8994
8995         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8996                 return -EINVAL;
8997         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8998                 return -EINVAL;
8999         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
9000                 return -EINVAL;
9001         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
9002                 return -EINVAL;
9003         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
9004                 return -EINVAL;
9005
9006         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
9007
9008         freq_range->start_freq_khz =
9009                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
9010         freq_range->end_freq_khz =
9011                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
9012         freq_range->max_bandwidth_khz =
9013                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
9014
9015         power_rule->max_eirp =
9016                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
9017
9018         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
9019                 power_rule->max_antenna_gain =
9020                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
9021
9022         if (tb[NL80211_ATTR_DFS_CAC_TIME])
9023                 reg_rule->dfs_cac_ms =
9024                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
9025
9026         return 0;
9027 }
9028
9029 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
9030 {
9031         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
9032         struct nlattr *nl_reg_rule;
9033         char *alpha2;
9034         int rem_reg_rules, r;
9035         u32 num_rules = 0, rule_idx = 0;
9036         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
9037         struct ieee80211_regdomain *rd;
9038
9039         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
9040                 return -EINVAL;
9041
9042         if (!info->attrs[NL80211_ATTR_REG_RULES])
9043                 return -EINVAL;
9044
9045         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
9046
9047         if (info->attrs[NL80211_ATTR_DFS_REGION])
9048                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
9049
9050         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9051                             rem_reg_rules) {
9052                 num_rules++;
9053                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
9054                         return -EINVAL;
9055         }
9056
9057         rtnl_lock();
9058         if (!reg_is_valid_request(alpha2)) {
9059                 r = -EINVAL;
9060                 goto out;
9061         }
9062
9063         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
9064         if (!rd) {
9065                 r = -ENOMEM;
9066                 goto out;
9067         }
9068
9069         rd->n_reg_rules = num_rules;
9070         rd->alpha2[0] = alpha2[0];
9071         rd->alpha2[1] = alpha2[1];
9072
9073         /*
9074          * Disable DFS master mode if the DFS region was
9075          * not supported or known on this kernel.
9076          */
9077         if (reg_supported_dfs_region(dfs_region))
9078                 rd->dfs_region = dfs_region;
9079
9080         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
9081                             rem_reg_rules) {
9082                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
9083                                                 nl_reg_rule, reg_rule_policy,
9084                                                 info->extack);
9085                 if (r)
9086                         goto bad_reg;
9087                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
9088                 if (r)
9089                         goto bad_reg;
9090
9091                 rule_idx++;
9092
9093                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
9094                         r = -EINVAL;
9095                         goto bad_reg;
9096                 }
9097         }
9098
9099         r = set_regdom(rd, REGD_SOURCE_CRDA);
9100         /* set_regdom takes ownership of rd */
9101         rd = NULL;
9102  bad_reg:
9103         kfree(rd);
9104  out:
9105         rtnl_unlock();
9106         return r;
9107 }
9108 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
9109
9110 static int validate_scan_freqs(struct nlattr *freqs)
9111 {
9112         struct nlattr *attr1, *attr2;
9113         int n_channels = 0, tmp1, tmp2;
9114
9115         nla_for_each_nested(attr1, freqs, tmp1)
9116                 if (nla_len(attr1) != sizeof(u32))
9117                         return 0;
9118
9119         nla_for_each_nested(attr1, freqs, tmp1) {
9120                 n_channels++;
9121                 /*
9122                  * Some hardware has a limited channel list for
9123                  * scanning, and it is pretty much nonsensical
9124                  * to scan for a channel twice, so disallow that
9125                  * and don't require drivers to check that the
9126                  * channel list they get isn't longer than what
9127                  * they can scan, as long as they can scan all
9128                  * the channels they registered at once.
9129                  */
9130                 nla_for_each_nested(attr2, freqs, tmp2)
9131                         if (attr1 != attr2 &&
9132                             nla_get_u32(attr1) == nla_get_u32(attr2))
9133                                 return 0;
9134         }
9135
9136         return n_channels;
9137 }
9138
9139 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
9140 {
9141         return b < NUM_NL80211_BANDS && wiphy->bands[b];
9142 }
9143
9144 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
9145                             struct cfg80211_bss_selection *bss_select)
9146 {
9147         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
9148         struct nlattr *nest;
9149         int err;
9150         bool found = false;
9151         int i;
9152
9153         /* only process one nested attribute */
9154         nest = nla_data(nla);
9155         if (!nla_ok(nest, nla_len(nest)))
9156                 return -EINVAL;
9157
9158         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
9159                                           nest, nl80211_bss_select_policy,
9160                                           NULL);
9161         if (err)
9162                 return err;
9163
9164         /* only one attribute may be given */
9165         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
9166                 if (attr[i]) {
9167                         if (found)
9168                                 return -EINVAL;
9169                         found = true;
9170                 }
9171         }
9172
9173         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
9174
9175         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
9176                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
9177
9178         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
9179                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
9180                 bss_select->param.band_pref =
9181                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
9182                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
9183                         return -EINVAL;
9184         }
9185
9186         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
9187                 struct nl80211_bss_select_rssi_adjust *adj_param;
9188
9189                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
9190                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
9191                 bss_select->param.adjust.band = adj_param->band;
9192                 bss_select->param.adjust.delta = adj_param->delta;
9193                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
9194                         return -EINVAL;
9195         }
9196
9197         /* user-space did not provide behaviour attribute */
9198         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
9199                 return -EINVAL;
9200
9201         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
9202                 return -EINVAL;
9203
9204         return 0;
9205 }
9206
9207 int nl80211_parse_random_mac(struct nlattr **attrs,
9208                              u8 *mac_addr, u8 *mac_addr_mask)
9209 {
9210         int i;
9211
9212         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
9213                 eth_zero_addr(mac_addr);
9214                 eth_zero_addr(mac_addr_mask);
9215                 mac_addr[0] = 0x2;
9216                 mac_addr_mask[0] = 0x3;
9217
9218                 return 0;
9219         }
9220
9221         /* need both or none */
9222         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
9223                 return -EINVAL;
9224
9225         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
9226         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
9227
9228         /* don't allow or configure an mcast address */
9229         if (!is_multicast_ether_addr(mac_addr_mask) ||
9230             is_multicast_ether_addr(mac_addr))
9231                 return -EINVAL;
9232
9233         /*
9234          * allow users to pass a MAC address that has bits set outside
9235          * of the mask, but don't bother drivers with having to deal
9236          * with such bits
9237          */
9238         for (i = 0; i < ETH_ALEN; i++)
9239                 mac_addr[i] &= mac_addr_mask[i];
9240
9241         return 0;
9242 }
9243
9244 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
9245                                               struct ieee80211_channel *chan)
9246 {
9247         unsigned int link_id;
9248         bool all_ok = true;
9249
9250         lockdep_assert_wiphy(wdev->wiphy);
9251
9252         if (!cfg80211_wdev_channel_allowed(wdev, chan))
9253                 return false;
9254
9255         if (!cfg80211_beaconing_iface_active(wdev))
9256                 return true;
9257
9258         /*
9259          * FIXME: check if we have a free HW resource/link for chan
9260          *
9261          * This, as well as the FIXME below, requires knowing the link
9262          * capabilities of the hardware.
9263          */
9264
9265         /* we cannot leave radar channels */
9266         for_each_valid_link(wdev, link_id) {
9267                 struct cfg80211_chan_def *chandef;
9268
9269                 chandef = wdev_chandef(wdev, link_id);
9270                 if (!chandef || !chandef->chan)
9271                         continue;
9272
9273                 /*
9274                  * FIXME: don't require all_ok, but rather check only the
9275                  *        correct HW resource/link onto which 'chan' falls,
9276                  *        as only that link leaves the channel for doing
9277                  *        the off-channel operation.
9278                  */
9279
9280                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9281                         all_ok = false;
9282         }
9283
9284         if (all_ok)
9285                 return true;
9286
9287         return regulatory_pre_cac_allowed(wdev->wiphy);
9288 }
9289
9290 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9291                                     enum nl80211_ext_feature_index feat)
9292 {
9293         if (!(flags & flag))
9294                 return true;
9295         if (wiphy_ext_feature_isset(wiphy, feat))
9296                 return true;
9297         return false;
9298 }
9299
9300 static int
9301 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9302                          void *request, struct nlattr **attrs,
9303                          bool is_sched_scan)
9304 {
9305         u8 *mac_addr, *mac_addr_mask;
9306         u32 *flags;
9307         enum nl80211_feature_flags randomness_flag;
9308
9309         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9310                 return 0;
9311
9312         if (is_sched_scan) {
9313                 struct cfg80211_sched_scan_request *req = request;
9314
9315                 randomness_flag = wdev ?
9316                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9317                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9318                 flags = &req->flags;
9319                 mac_addr = req->mac_addr;
9320                 mac_addr_mask = req->mac_addr_mask;
9321         } else {
9322                 struct cfg80211_scan_request *req = request;
9323
9324                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9325                 flags = &req->flags;
9326                 mac_addr = req->mac_addr;
9327                 mac_addr_mask = req->mac_addr_mask;
9328         }
9329
9330         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9331
9332         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9333              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9334             !nl80211_check_scan_feat(wiphy, *flags,
9335                                      NL80211_SCAN_FLAG_LOW_SPAN,
9336                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9337             !nl80211_check_scan_feat(wiphy, *flags,
9338                                      NL80211_SCAN_FLAG_LOW_POWER,
9339                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9340             !nl80211_check_scan_feat(wiphy, *flags,
9341                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
9342                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9343             !nl80211_check_scan_feat(wiphy, *flags,
9344                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9345                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9346             !nl80211_check_scan_feat(wiphy, *flags,
9347                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9348                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9349             !nl80211_check_scan_feat(wiphy, *flags,
9350                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9351                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9352             !nl80211_check_scan_feat(wiphy, *flags,
9353                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9354                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9355             !nl80211_check_scan_feat(wiphy, *flags,
9356                                      NL80211_SCAN_FLAG_RANDOM_SN,
9357                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9358             !nl80211_check_scan_feat(wiphy, *flags,
9359                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9360                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9361                 return -EOPNOTSUPP;
9362
9363         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9364                 int err;
9365
9366                 if (!(wiphy->features & randomness_flag) ||
9367                     (wdev && wdev->connected))
9368                         return -EOPNOTSUPP;
9369
9370                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9371                 if (err)
9372                         return err;
9373         }
9374
9375         return 0;
9376 }
9377
9378 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9379 {
9380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9381         struct wireless_dev *wdev = info->user_ptr[1];
9382         struct cfg80211_scan_request *request;
9383         struct nlattr *scan_freqs = NULL;
9384         bool scan_freqs_khz = false;
9385         struct nlattr *attr;
9386         struct wiphy *wiphy;
9387         int err, tmp, n_ssids = 0, n_channels, i;
9388         size_t ie_len, size;
9389         size_t ssids_offset, ie_offset;
9390
9391         wiphy = &rdev->wiphy;
9392
9393         if (wdev->iftype == NL80211_IFTYPE_NAN)
9394                 return -EOPNOTSUPP;
9395
9396         if (!rdev->ops->scan)
9397                 return -EOPNOTSUPP;
9398
9399         if (rdev->scan_req || rdev->scan_msg)
9400                 return -EBUSY;
9401
9402         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9403                 if (!wiphy_ext_feature_isset(wiphy,
9404                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9405                         return -EOPNOTSUPP;
9406                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9407                 scan_freqs_khz = true;
9408         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9409                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9410
9411         if (scan_freqs) {
9412                 n_channels = validate_scan_freqs(scan_freqs);
9413                 if (!n_channels)
9414                         return -EINVAL;
9415         } else {
9416                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9417         }
9418
9419         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9420                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9421                         n_ssids++;
9422
9423         if (n_ssids > wiphy->max_scan_ssids)
9424                 return -EINVAL;
9425
9426         if (info->attrs[NL80211_ATTR_IE])
9427                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9428         else
9429                 ie_len = 0;
9430
9431         if (ie_len > wiphy->max_scan_ie_len)
9432                 return -EINVAL;
9433
9434         size = struct_size(request, channels, n_channels);
9435         ssids_offset = size;
9436         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9437         ie_offset = size;
9438         size = size_add(size, ie_len);
9439         request = kzalloc(size, GFP_KERNEL);
9440         if (!request)
9441                 return -ENOMEM;
9442         request->n_channels = n_channels;
9443
9444         if (n_ssids)
9445                 request->ssids = (void *)request + ssids_offset;
9446         request->n_ssids = n_ssids;
9447         if (ie_len)
9448                 request->ie = (void *)request + ie_offset;
9449
9450         i = 0;
9451         if (scan_freqs) {
9452                 /* user specified, bail out if channel not found */
9453                 nla_for_each_nested(attr, scan_freqs, tmp) {
9454                         struct ieee80211_channel *chan;
9455                         int freq = nla_get_u32(attr);
9456
9457                         if (!scan_freqs_khz)
9458                                 freq = MHZ_TO_KHZ(freq);
9459
9460                         chan = ieee80211_get_channel_khz(wiphy, freq);
9461                         if (!chan) {
9462                                 err = -EINVAL;
9463                                 goto out_free;
9464                         }
9465
9466                         /* ignore disabled channels */
9467                         if (chan->flags & IEEE80211_CHAN_DISABLED ||
9468                             !cfg80211_wdev_channel_allowed(wdev, chan))
9469                                 continue;
9470
9471                         request->channels[i] = chan;
9472                         i++;
9473                 }
9474         } else {
9475                 enum nl80211_band band;
9476
9477                 /* all channels */
9478                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9479                         int j;
9480
9481                         if (!wiphy->bands[band])
9482                                 continue;
9483                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9484                                 struct ieee80211_channel *chan;
9485
9486                                 chan = &wiphy->bands[band]->channels[j];
9487
9488                                 if (chan->flags & IEEE80211_CHAN_DISABLED ||
9489                                     !cfg80211_wdev_channel_allowed(wdev, chan))
9490                                         continue;
9491
9492                                 request->channels[i] = chan;
9493                                 i++;
9494                         }
9495                 }
9496         }
9497
9498         if (!i) {
9499                 err = -EINVAL;
9500                 goto out_free;
9501         }
9502
9503         request->n_channels = i;
9504
9505         for (i = 0; i < request->n_channels; i++) {
9506                 struct ieee80211_channel *chan = request->channels[i];
9507
9508                 /* if we can go off-channel to the target channel we're good */
9509                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9510                         continue;
9511
9512                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9513                         err = -EBUSY;
9514                         goto out_free;
9515                 }
9516         }
9517
9518         i = 0;
9519         if (n_ssids) {
9520                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9521                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9522                                 err = -EINVAL;
9523                                 goto out_free;
9524                         }
9525                         request->ssids[i].ssid_len = nla_len(attr);
9526                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9527                         i++;
9528                 }
9529         }
9530
9531         if (info->attrs[NL80211_ATTR_IE]) {
9532                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9533                 memcpy((void *)request->ie,
9534                        nla_data(info->attrs[NL80211_ATTR_IE]),
9535                        request->ie_len);
9536         }
9537
9538         for (i = 0; i < NUM_NL80211_BANDS; i++)
9539                 if (wiphy->bands[i])
9540                         request->rates[i] =
9541                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9542
9543         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9544                 nla_for_each_nested(attr,
9545                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9546                                     tmp) {
9547                         enum nl80211_band band = nla_type(attr);
9548
9549                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9550                                 err = -EINVAL;
9551                                 goto out_free;
9552                         }
9553
9554                         if (!wiphy->bands[band])
9555                                 continue;
9556
9557                         err = ieee80211_get_ratemask(wiphy->bands[band],
9558                                                      nla_data(attr),
9559                                                      nla_len(attr),
9560                                                      &request->rates[band]);
9561                         if (err)
9562                                 goto out_free;
9563                 }
9564         }
9565
9566         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9567                 request->duration =
9568                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9569                 request->duration_mandatory =
9570                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9571         }
9572
9573         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9574                                        false);
9575         if (err)
9576                 goto out_free;
9577
9578         request->no_cck =
9579                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9580
9581         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9582          * BSSID to scan for. This was problematic because that same attribute
9583          * was already used for another purpose (local random MAC address). The
9584          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9585          * compatibility with older userspace components, also use the
9586          * NL80211_ATTR_MAC value here if it can be determined to be used for
9587          * the specific BSSID use case instead of the random MAC address
9588          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9589          */
9590         if (info->attrs[NL80211_ATTR_BSSID])
9591                 memcpy(request->bssid,
9592                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9593         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9594                  info->attrs[NL80211_ATTR_MAC])
9595                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9596                        ETH_ALEN);
9597         else
9598                 eth_broadcast_addr(request->bssid);
9599
9600         request->tsf_report_link_id = nl80211_link_id_or_invalid(info->attrs);
9601         request->wdev = wdev;
9602         request->wiphy = &rdev->wiphy;
9603         request->scan_start = jiffies;
9604
9605         rdev->scan_req = request;
9606         err = cfg80211_scan(rdev);
9607
9608         if (err)
9609                 goto out_free;
9610
9611         nl80211_send_scan_start(rdev, wdev);
9612         dev_hold(wdev->netdev);
9613
9614         return 0;
9615
9616  out_free:
9617         rdev->scan_req = NULL;
9618         kfree(request);
9619
9620         return err;
9621 }
9622
9623 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9624 {
9625         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9626         struct wireless_dev *wdev = info->user_ptr[1];
9627
9628         if (!rdev->ops->abort_scan)
9629                 return -EOPNOTSUPP;
9630
9631         if (rdev->scan_msg)
9632                 return 0;
9633
9634         if (!rdev->scan_req)
9635                 return -ENOENT;
9636
9637         rdev_abort_scan(rdev, wdev);
9638         return 0;
9639 }
9640
9641 static int
9642 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9643                                struct cfg80211_sched_scan_request *request,
9644                                struct nlattr **attrs)
9645 {
9646         int tmp, err, i = 0;
9647         struct nlattr *attr;
9648
9649         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9650                 u32 interval;
9651
9652                 /*
9653                  * If scan plans are not specified,
9654                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9655                  * case one scan plan will be set with the specified scan
9656                  * interval and infinite number of iterations.
9657                  */
9658                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9659                 if (!interval)
9660                         return -EINVAL;
9661
9662                 request->scan_plans[0].interval =
9663                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9664                 if (!request->scan_plans[0].interval)
9665                         return -EINVAL;
9666
9667                 if (request->scan_plans[0].interval >
9668                     wiphy->max_sched_scan_plan_interval)
9669                         request->scan_plans[0].interval =
9670                                 wiphy->max_sched_scan_plan_interval;
9671
9672                 return 0;
9673         }
9674
9675         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9676                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9677
9678                 if (WARN_ON(i >= n_plans))
9679                         return -EINVAL;
9680
9681                 err = nla_parse_nested_deprecated(plan,
9682                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9683                                                   attr, nl80211_plan_policy,
9684                                                   NULL);
9685                 if (err)
9686                         return err;
9687
9688                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9689                         return -EINVAL;
9690
9691                 request->scan_plans[i].interval =
9692                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9693                 if (!request->scan_plans[i].interval ||
9694                     request->scan_plans[i].interval >
9695                     wiphy->max_sched_scan_plan_interval)
9696                         return -EINVAL;
9697
9698                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9699                         request->scan_plans[i].iterations =
9700                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9701                         if (!request->scan_plans[i].iterations ||
9702                             (request->scan_plans[i].iterations >
9703                              wiphy->max_sched_scan_plan_iterations))
9704                                 return -EINVAL;
9705                 } else if (i < n_plans - 1) {
9706                         /*
9707                          * All scan plans but the last one must specify
9708                          * a finite number of iterations
9709                          */
9710                         return -EINVAL;
9711                 }
9712
9713                 i++;
9714         }
9715
9716         /*
9717          * The last scan plan must not specify the number of
9718          * iterations, it is supposed to run infinitely
9719          */
9720         if (request->scan_plans[n_plans - 1].iterations)
9721                 return  -EINVAL;
9722
9723         return 0;
9724 }
9725
9726 static struct cfg80211_sched_scan_request *
9727 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9728                          struct nlattr **attrs, int max_match_sets)
9729 {
9730         struct cfg80211_sched_scan_request *request;
9731         struct nlattr *attr;
9732         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9733         enum nl80211_band band;
9734         size_t ie_len, size;
9735         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9736         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9737
9738         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9739                 n_channels = validate_scan_freqs(
9740                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9741                 if (!n_channels)
9742                         return ERR_PTR(-EINVAL);
9743         } else {
9744                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9745         }
9746
9747         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9748                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9749                                     tmp)
9750                         n_ssids++;
9751
9752         if (n_ssids > wiphy->max_sched_scan_ssids)
9753                 return ERR_PTR(-EINVAL);
9754
9755         /*
9756          * First, count the number of 'real' matchsets. Due to an issue with
9757          * the old implementation, matchsets containing only the RSSI attribute
9758          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9759          * RSSI for all matchsets, rather than their own matchset for reporting
9760          * all APs with a strong RSSI. This is needed to be compatible with
9761          * older userspace that treated a matchset with only the RSSI as the
9762          * global RSSI for all other matchsets - if there are other matchsets.
9763          */
9764         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9765                 nla_for_each_nested(attr,
9766                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9767                                     tmp) {
9768                         struct nlattr *rssi;
9769
9770                         err = nla_parse_nested_deprecated(tb,
9771                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9772                                                           attr,
9773                                                           nl80211_match_policy,
9774                                                           NULL);
9775                         if (err)
9776                                 return ERR_PTR(err);
9777
9778                         /* SSID and BSSID are mutually exclusive */
9779                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9780                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9781                                 return ERR_PTR(-EINVAL);
9782
9783                         /* add other standalone attributes here */
9784                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9785                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9786                                 n_match_sets++;
9787                                 continue;
9788                         }
9789                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9790                         if (rssi)
9791                                 default_match_rssi = nla_get_s32(rssi);
9792                 }
9793         }
9794
9795         /* However, if there's no other matchset, add the RSSI one */
9796         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9797                 n_match_sets = 1;
9798
9799         if (n_match_sets > max_match_sets)
9800                 return ERR_PTR(-EINVAL);
9801
9802         if (attrs[NL80211_ATTR_IE])
9803                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9804         else
9805                 ie_len = 0;
9806
9807         if (ie_len > wiphy->max_sched_scan_ie_len)
9808                 return ERR_PTR(-EINVAL);
9809
9810         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9811                 /*
9812                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9813                  * each scan plan already specifies its own interval
9814                  */
9815                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9816                         return ERR_PTR(-EINVAL);
9817
9818                 nla_for_each_nested(attr,
9819                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9820                         n_plans++;
9821         } else {
9822                 /*
9823                  * The scan interval attribute is kept for backward
9824                  * compatibility. If no scan plans are specified and sched scan
9825                  * interval is specified, one scan plan will be set with this
9826                  * scan interval and infinite number of iterations.
9827                  */
9828                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9829                         return ERR_PTR(-EINVAL);
9830
9831                 n_plans = 1;
9832         }
9833
9834         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9835                 return ERR_PTR(-EINVAL);
9836
9837         if (!wiphy_ext_feature_isset(
9838                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9839             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9840              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9841                 return ERR_PTR(-EINVAL);
9842
9843         size = struct_size(request, channels, n_channels);
9844         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9845         size = size_add(size, array_size(sizeof(*request->match_sets),
9846                                          n_match_sets));
9847         size = size_add(size, array_size(sizeof(*request->scan_plans),
9848                                          n_plans));
9849         size = size_add(size, ie_len);
9850         request = kzalloc(size, GFP_KERNEL);
9851         if (!request)
9852                 return ERR_PTR(-ENOMEM);
9853         request->n_channels = n_channels;
9854
9855         if (n_ssids)
9856                 request->ssids = (void *)request +
9857                         struct_size(request, channels, n_channels);
9858         request->n_ssids = n_ssids;
9859         if (ie_len) {
9860                 if (n_ssids)
9861                         request->ie = (void *)(request->ssids + n_ssids);
9862                 else
9863                         request->ie = (void *)(request->channels + n_channels);
9864         }
9865
9866         if (n_match_sets) {
9867                 if (request->ie)
9868                         request->match_sets = (void *)(request->ie + ie_len);
9869                 else if (n_ssids)
9870                         request->match_sets =
9871                                 (void *)(request->ssids + n_ssids);
9872                 else
9873                         request->match_sets =
9874                                 (void *)(request->channels + n_channels);
9875         }
9876         request->n_match_sets = n_match_sets;
9877
9878         if (n_match_sets)
9879                 request->scan_plans = (void *)(request->match_sets +
9880                                                n_match_sets);
9881         else if (request->ie)
9882                 request->scan_plans = (void *)(request->ie + ie_len);
9883         else if (n_ssids)
9884                 request->scan_plans = (void *)(request->ssids + n_ssids);
9885         else
9886                 request->scan_plans = (void *)(request->channels + n_channels);
9887
9888         request->n_scan_plans = n_plans;
9889
9890         i = 0;
9891         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9892                 /* user specified, bail out if channel not found */
9893                 nla_for_each_nested(attr,
9894                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9895                                     tmp) {
9896                         struct ieee80211_channel *chan;
9897
9898                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9899
9900                         if (!chan) {
9901                                 err = -EINVAL;
9902                                 goto out_free;
9903                         }
9904
9905                         /* ignore disabled channels */
9906                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9907                                 continue;
9908
9909                         request->channels[i] = chan;
9910                         i++;
9911                 }
9912         } else {
9913                 /* all channels */
9914                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9915                         int j;
9916
9917                         if (!wiphy->bands[band])
9918                                 continue;
9919                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9920                                 struct ieee80211_channel *chan;
9921
9922                                 chan = &wiphy->bands[band]->channels[j];
9923
9924                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9925                                         continue;
9926
9927                                 request->channels[i] = chan;
9928                                 i++;
9929                         }
9930                 }
9931         }
9932
9933         if (!i) {
9934                 err = -EINVAL;
9935                 goto out_free;
9936         }
9937
9938         request->n_channels = i;
9939
9940         i = 0;
9941         if (n_ssids) {
9942                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9943                                     tmp) {
9944                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9945                                 err = -EINVAL;
9946                                 goto out_free;
9947                         }
9948                         request->ssids[i].ssid_len = nla_len(attr);
9949                         memcpy(request->ssids[i].ssid, nla_data(attr),
9950                                nla_len(attr));
9951                         i++;
9952                 }
9953         }
9954
9955         i = 0;
9956         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9957                 nla_for_each_nested(attr,
9958                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9959                                     tmp) {
9960                         struct nlattr *ssid, *bssid, *rssi;
9961
9962                         err = nla_parse_nested_deprecated(tb,
9963                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9964                                                           attr,
9965                                                           nl80211_match_policy,
9966                                                           NULL);
9967                         if (err)
9968                                 goto out_free;
9969                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9970                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9971
9972                         if (!ssid && !bssid) {
9973                                 i++;
9974                                 continue;
9975                         }
9976
9977                         if (WARN_ON(i >= n_match_sets)) {
9978                                 /* this indicates a programming error,
9979                                  * the loop above should have verified
9980                                  * things properly
9981                                  */
9982                                 err = -EINVAL;
9983                                 goto out_free;
9984                         }
9985
9986                         if (ssid) {
9987                                 memcpy(request->match_sets[i].ssid.ssid,
9988                                        nla_data(ssid), nla_len(ssid));
9989                                 request->match_sets[i].ssid.ssid_len =
9990                                         nla_len(ssid);
9991                         }
9992                         if (bssid)
9993                                 memcpy(request->match_sets[i].bssid,
9994                                        nla_data(bssid), ETH_ALEN);
9995
9996                         /* special attribute - old implementation w/a */
9997                         request->match_sets[i].rssi_thold = default_match_rssi;
9998                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9999                         if (rssi)
10000                                 request->match_sets[i].rssi_thold =
10001                                         nla_get_s32(rssi);
10002                         i++;
10003                 }
10004
10005                 /* there was no other matchset, so the RSSI one is alone */
10006                 if (i == 0 && n_match_sets)
10007                         request->match_sets[0].rssi_thold = default_match_rssi;
10008
10009                 request->min_rssi_thold = INT_MAX;
10010                 for (i = 0; i < n_match_sets; i++)
10011                         request->min_rssi_thold =
10012                                 min(request->match_sets[i].rssi_thold,
10013                                     request->min_rssi_thold);
10014         } else {
10015                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
10016         }
10017
10018         if (ie_len) {
10019                 request->ie_len = ie_len;
10020                 memcpy((void *)request->ie,
10021                        nla_data(attrs[NL80211_ATTR_IE]),
10022                        request->ie_len);
10023         }
10024
10025         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
10026         if (err)
10027                 goto out_free;
10028
10029         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
10030                 request->delay =
10031                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
10032
10033         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
10034                 request->relative_rssi = nla_get_s8(
10035                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
10036                 request->relative_rssi_set = true;
10037         }
10038
10039         if (request->relative_rssi_set &&
10040             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
10041                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
10042
10043                 rssi_adjust = nla_data(
10044                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
10045                 request->rssi_adjust.band = rssi_adjust->band;
10046                 request->rssi_adjust.delta = rssi_adjust->delta;
10047                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
10048                         err = -EINVAL;
10049                         goto out_free;
10050                 }
10051         }
10052
10053         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
10054         if (err)
10055                 goto out_free;
10056
10057         request->scan_start = jiffies;
10058
10059         return request;
10060
10061 out_free:
10062         kfree(request);
10063         return ERR_PTR(err);
10064 }
10065
10066 static int nl80211_start_sched_scan(struct sk_buff *skb,
10067                                     struct genl_info *info)
10068 {
10069         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10070         struct net_device *dev = info->user_ptr[1];
10071         struct wireless_dev *wdev = dev->ieee80211_ptr;
10072         struct cfg80211_sched_scan_request *sched_scan_req;
10073         bool want_multi;
10074         int err;
10075
10076         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
10077                 return -EOPNOTSUPP;
10078
10079         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
10080         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
10081         if (err)
10082                 return err;
10083
10084         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
10085                                                   info->attrs,
10086                                                   rdev->wiphy.max_match_sets);
10087
10088         err = PTR_ERR_OR_ZERO(sched_scan_req);
10089         if (err)
10090                 goto out_err;
10091
10092         /* leave request id zero for legacy request
10093          * or if driver does not support multi-scheduled scan
10094          */
10095         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
10096                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
10097
10098         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
10099         if (err)
10100                 goto out_free;
10101
10102         sched_scan_req->dev = dev;
10103         sched_scan_req->wiphy = &rdev->wiphy;
10104
10105         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10106                 sched_scan_req->owner_nlportid = info->snd_portid;
10107
10108         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
10109
10110         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
10111         return 0;
10112
10113 out_free:
10114         kfree(sched_scan_req);
10115 out_err:
10116         return err;
10117 }
10118
10119 static int nl80211_stop_sched_scan(struct sk_buff *skb,
10120                                    struct genl_info *info)
10121 {
10122         struct cfg80211_sched_scan_request *req;
10123         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10124         u64 cookie;
10125
10126         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
10127                 return -EOPNOTSUPP;
10128
10129         if (info->attrs[NL80211_ATTR_COOKIE]) {
10130                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10131                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
10132         }
10133
10134         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
10135                                      struct cfg80211_sched_scan_request,
10136                                      list);
10137         if (!req || req->reqid ||
10138             (req->owner_nlportid &&
10139              req->owner_nlportid != info->snd_portid))
10140                 return -ENOENT;
10141
10142         return cfg80211_stop_sched_scan_req(rdev, req, false);
10143 }
10144
10145 static int nl80211_start_radar_detection(struct sk_buff *skb,
10146                                          struct genl_info *info)
10147 {
10148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10149         struct net_device *dev = info->user_ptr[1];
10150         struct wireless_dev *wdev = dev->ieee80211_ptr;
10151         int link_id = nl80211_link_id(info->attrs);
10152         struct wiphy *wiphy = wdev->wiphy;
10153         struct cfg80211_chan_def chandef;
10154         enum nl80211_dfs_regions dfs_region;
10155         unsigned int cac_time_ms;
10156         int err;
10157
10158         flush_delayed_work(&rdev->dfs_update_channels_wk);
10159
10160         switch (wdev->iftype) {
10161         case NL80211_IFTYPE_AP:
10162         case NL80211_IFTYPE_P2P_GO:
10163         case NL80211_IFTYPE_MESH_POINT:
10164         case NL80211_IFTYPE_ADHOC:
10165                 break;
10166         default:
10167                 /* caution - see cfg80211_beaconing_iface_active() below */
10168                 return -EINVAL;
10169         }
10170
10171         guard(wiphy)(wiphy);
10172
10173         dfs_region = reg_get_dfs_region(wiphy);
10174         if (dfs_region == NL80211_DFS_UNSET)
10175                 return -EINVAL;
10176
10177         err = nl80211_parse_chandef(rdev, info, &chandef);
10178         if (err)
10179                 return err;
10180
10181         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10182         if (err < 0)
10183                 return err;
10184
10185         if (err == 0)
10186                 return -EINVAL;
10187
10188         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
10189                 return -EINVAL;
10190
10191         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
10192                 return cfg80211_start_background_radar_detection(rdev, wdev,
10193                                                                  &chandef);
10194
10195         if (cfg80211_beaconing_iface_active(wdev)) {
10196                 /* During MLO other link(s) can beacon, only the current link
10197                  * can not already beacon
10198                  */
10199                 if (wdev->valid_links &&
10200                     !wdev->links[link_id].ap.beacon_interval) {
10201                         /* nothing */
10202                 } else {
10203                         return -EBUSY;
10204                 }
10205         }
10206
10207         if (wdev->links[link_id].cac_started)
10208                 return -EBUSY;
10209
10210         /* CAC start is offloaded to HW and can't be started manually */
10211         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
10212                 return -EOPNOTSUPP;
10213
10214         if (!rdev->ops->start_radar_detection)
10215                 return -EOPNOTSUPP;
10216
10217         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
10218         if (WARN_ON(!cac_time_ms))
10219                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10220
10221         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
10222                                          link_id);
10223         if (err)
10224                 return err;
10225
10226         switch (wdev->iftype) {
10227         case NL80211_IFTYPE_AP:
10228         case NL80211_IFTYPE_P2P_GO:
10229                 wdev->links[link_id].ap.chandef = chandef;
10230                 break;
10231         case NL80211_IFTYPE_ADHOC:
10232                 wdev->u.ibss.chandef = chandef;
10233                 break;
10234         case NL80211_IFTYPE_MESH_POINT:
10235                 wdev->u.mesh.chandef = chandef;
10236                 break;
10237         default:
10238                 break;
10239         }
10240         wdev->links[link_id].cac_started = true;
10241         wdev->links[link_id].cac_start_time = jiffies;
10242         wdev->links[link_id].cac_time_ms = cac_time_ms;
10243
10244         return 0;
10245 }
10246
10247 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10248                                           struct genl_info *info)
10249 {
10250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10251         struct net_device *dev = info->user_ptr[1];
10252         struct wireless_dev *wdev = dev->ieee80211_ptr;
10253         struct wiphy *wiphy = wdev->wiphy;
10254         struct cfg80211_chan_def chandef;
10255         enum nl80211_dfs_regions dfs_region;
10256         int err;
10257
10258         dfs_region = reg_get_dfs_region(wiphy);
10259         if (dfs_region == NL80211_DFS_UNSET) {
10260                 GENL_SET_ERR_MSG(info,
10261                                  "DFS Region is not set. Unexpected Radar indication");
10262                 return -EINVAL;
10263         }
10264
10265         err = nl80211_parse_chandef(rdev, info, &chandef);
10266         if (err) {
10267                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10268                 return err;
10269         }
10270
10271         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10272         if (err < 0) {
10273                 GENL_SET_ERR_MSG(info, "chandef is invalid");
10274                 return err;
10275         }
10276
10277         if (err == 0) {
10278                 GENL_SET_ERR_MSG(info,
10279                                  "Unexpected Radar indication for chandef/iftype");
10280                 return -EINVAL;
10281         }
10282
10283         /* Do not process this notification if radar is already detected
10284          * by kernel on this channel, and return success.
10285          */
10286         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10287                 return 0;
10288
10289         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10290
10291         cfg80211_sched_dfs_chan_update(rdev);
10292
10293         rdev->radar_chandef = chandef;
10294
10295         /* Propagate this notification to other radios as well */
10296         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10297
10298         return 0;
10299 }
10300
10301 static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
10302                                          const u8 *data, size_t datalen,
10303                                          int first_count, struct nlattr *attr,
10304                                          const u16 **offsets, unsigned int *n_offsets)
10305 {
10306         int i;
10307
10308         *n_offsets = 0;
10309
10310         if (!attr)
10311                 return 0;
10312
10313         if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
10314                 return -EINVAL;
10315
10316         *n_offsets = nla_len(attr) / sizeof(u16);
10317         if (rdev->wiphy.max_num_csa_counters &&
10318             (*n_offsets > rdev->wiphy.max_num_csa_counters))
10319                 return -EINVAL;
10320
10321         *offsets = nla_data(attr);
10322
10323         /* sanity checks - counters should fit and be the same */
10324         for (i = 0; i < *n_offsets; i++) {
10325                 u16 offset = (*offsets)[i];
10326
10327                 if (offset >= datalen)
10328                         return -EINVAL;
10329
10330                 if (first_count != -1 && data[offset] != first_count)
10331                         return -EINVAL;
10332         }
10333
10334         return 0;
10335 }
10336
10337 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10338 {
10339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10340         unsigned int link_id = nl80211_link_id(info->attrs);
10341         struct net_device *dev = info->user_ptr[1];
10342         struct wireless_dev *wdev = dev->ieee80211_ptr;
10343         struct cfg80211_csa_settings params;
10344         struct nlattr **csa_attrs = NULL;
10345         int err;
10346         bool need_new_beacon = false;
10347         bool need_handle_dfs_flag = true;
10348         u32 cs_count;
10349
10350         if (!rdev->ops->channel_switch ||
10351             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10352                 return -EOPNOTSUPP;
10353
10354         switch (dev->ieee80211_ptr->iftype) {
10355         case NL80211_IFTYPE_AP:
10356         case NL80211_IFTYPE_P2P_GO:
10357                 need_new_beacon = true;
10358                 /* For all modes except AP the handle_dfs flag needs to be
10359                  * supplied to tell the kernel that userspace will handle radar
10360                  * events when they happen. Otherwise a switch to a channel
10361                  * requiring DFS will be rejected.
10362                  */
10363                 need_handle_dfs_flag = false;
10364
10365                 /* useless if AP is not running */
10366                 if (!wdev->links[link_id].ap.beacon_interval)
10367                         return -ENOTCONN;
10368                 break;
10369         case NL80211_IFTYPE_ADHOC:
10370                 if (!wdev->u.ibss.ssid_len)
10371                         return -ENOTCONN;
10372                 break;
10373         case NL80211_IFTYPE_MESH_POINT:
10374                 if (!wdev->u.mesh.id_len)
10375                         return -ENOTCONN;
10376                 break;
10377         default:
10378                 return -EOPNOTSUPP;
10379         }
10380
10381         memset(&params, 0, sizeof(params));
10382         params.beacon_csa.ftm_responder = -1;
10383
10384         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10385             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10386                 return -EINVAL;
10387
10388         /* only important for AP, IBSS and mesh create IEs internally */
10389         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10390                 return -EINVAL;
10391
10392         /* Even though the attribute is u32, the specification says
10393          * u8, so let's make sure we don't overflow.
10394          */
10395         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10396         if (cs_count > 255)
10397                 return -EINVAL;
10398
10399         params.count = cs_count;
10400
10401         if (!need_new_beacon)
10402                 goto skip_beacons;
10403
10404         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10405                                    info->extack);
10406         if (err)
10407                 goto free;
10408
10409         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10410                             GFP_KERNEL);
10411         if (!csa_attrs) {
10412                 err = -ENOMEM;
10413                 goto free;
10414         }
10415
10416         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10417                                           info->attrs[NL80211_ATTR_CSA_IES],
10418                                           nl80211_policy, info->extack);
10419         if (err)
10420                 goto free;
10421
10422         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10423                                    info->extack);
10424         if (err)
10425                 goto free;
10426
10427         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10428                 err = -EINVAL;
10429                 goto free;
10430         }
10431
10432         err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
10433                                             params.beacon_csa.tail_len,
10434                                             params.count,
10435                                             csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
10436                                             &params.counter_offsets_beacon,
10437                                             &params.n_counter_offsets_beacon);
10438         if (err)
10439                 goto free;
10440
10441         err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
10442                                             params.beacon_csa.probe_resp_len,
10443                                             params.count,
10444                                             csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
10445                                             &params.counter_offsets_presp,
10446                                             &params.n_counter_offsets_presp);
10447         if (err)
10448                 goto free;
10449
10450 skip_beacons:
10451         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10452         if (err)
10453                 goto free;
10454
10455         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10456                                            wdev->iftype)) {
10457                 err = -EINVAL;
10458                 goto free;
10459         }
10460
10461         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10462                                             &params.chandef,
10463                                             wdev->iftype);
10464         if (err < 0)
10465                 goto free;
10466
10467         if (err > 0) {
10468                 params.radar_required = true;
10469                 if (need_handle_dfs_flag &&
10470                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10471                         err = -EINVAL;
10472                         goto free;
10473                 }
10474         }
10475
10476         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10477                 params.block_tx = true;
10478
10479         params.link_id = link_id;
10480         err = rdev_channel_switch(rdev, dev, &params);
10481
10482 free:
10483         kfree(params.beacon_after.mbssid_ies);
10484         kfree(params.beacon_csa.mbssid_ies);
10485         kfree(params.beacon_after.rnr_ies);
10486         kfree(params.beacon_csa.rnr_ies);
10487         kfree(csa_attrs);
10488         return err;
10489 }
10490
10491 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10492                             u32 seq, int flags,
10493                             struct cfg80211_registered_device *rdev,
10494                             struct wireless_dev *wdev,
10495                             struct cfg80211_internal_bss *intbss)
10496 {
10497         struct cfg80211_bss *res = &intbss->pub;
10498         const struct cfg80211_bss_ies *ies;
10499         unsigned int link_id;
10500         void *hdr;
10501         struct nlattr *bss;
10502
10503         lockdep_assert_wiphy(wdev->wiphy);
10504
10505         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10506                              NL80211_CMD_NEW_SCAN_RESULTS);
10507         if (!hdr)
10508                 return -1;
10509
10510         genl_dump_check_consistent(cb, hdr);
10511
10512         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10513                 goto nla_put_failure;
10514         if (wdev->netdev &&
10515             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10516                 goto nla_put_failure;
10517         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10518                               NL80211_ATTR_PAD))
10519                 goto nla_put_failure;
10520
10521         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10522         if (!bss)
10523                 goto nla_put_failure;
10524         if ((!is_zero_ether_addr(res->bssid) &&
10525              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10526                 goto nla_put_failure;
10527
10528         rcu_read_lock();
10529         /* indicate whether we have probe response data or not */
10530         if (rcu_access_pointer(res->proberesp_ies) &&
10531             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10532                 goto fail_unlock_rcu;
10533
10534         /* this pointer prefers to be pointed to probe response data
10535          * but is always valid
10536          */
10537         ies = rcu_dereference(res->ies);
10538         if (ies) {
10539                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10540                                       NL80211_BSS_PAD))
10541                         goto fail_unlock_rcu;
10542                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10543                                         ies->len, ies->data))
10544                         goto fail_unlock_rcu;
10545         }
10546
10547         /* and this pointer is always (unless driver didn't know) beacon data */
10548         ies = rcu_dereference(res->beacon_ies);
10549         if (ies && ies->from_beacon) {
10550                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10551                                       NL80211_BSS_PAD))
10552                         goto fail_unlock_rcu;
10553                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10554                                         ies->len, ies->data))
10555                         goto fail_unlock_rcu;
10556         }
10557         rcu_read_unlock();
10558
10559         if (res->beacon_interval &&
10560             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10561                 goto nla_put_failure;
10562         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10563             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10564             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10565                         res->channel->freq_offset) ||
10566             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10567                         jiffies_to_msecs(jiffies - intbss->ts)))
10568                 goto nla_put_failure;
10569
10570         if (intbss->parent_tsf &&
10571             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10572                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10573              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10574                      intbss->parent_bssid)))
10575                 goto nla_put_failure;
10576
10577         if (res->ts_boottime &&
10578             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10579                               res->ts_boottime, NL80211_BSS_PAD))
10580                 goto nla_put_failure;
10581
10582         if (!nl80211_put_signal(msg, intbss->pub.chains,
10583                                 intbss->pub.chain_signal,
10584                                 NL80211_BSS_CHAIN_SIGNAL))
10585                 goto nla_put_failure;
10586
10587         if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
10588                 switch (rdev->wiphy.signal_type) {
10589                 case CFG80211_SIGNAL_TYPE_MBM:
10590                         if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
10591                                         res->signal))
10592                                 goto nla_put_failure;
10593                         break;
10594                 case CFG80211_SIGNAL_TYPE_UNSPEC:
10595                         if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
10596                                        res->signal))
10597                                 goto nla_put_failure;
10598                         break;
10599                 default:
10600                         break;
10601                 }
10602         }
10603
10604         switch (wdev->iftype) {
10605         case NL80211_IFTYPE_P2P_CLIENT:
10606         case NL80211_IFTYPE_STATION:
10607                 for_each_valid_link(wdev, link_id) {
10608                         if (intbss == wdev->links[link_id].client.current_bss &&
10609                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10610                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10611                              (wdev->valid_links &&
10612                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10613                                           link_id) ||
10614                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10615                                        wdev->u.client.connected_addr)))))
10616                                 goto nla_put_failure;
10617                 }
10618                 break;
10619         case NL80211_IFTYPE_ADHOC:
10620                 if (intbss == wdev->u.ibss.current_bss &&
10621                     nla_put_u32(msg, NL80211_BSS_STATUS,
10622                                 NL80211_BSS_STATUS_IBSS_JOINED))
10623                         goto nla_put_failure;
10624                 break;
10625         default:
10626                 break;
10627         }
10628
10629         if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
10630                 goto nla_put_failure;
10631
10632         if (res->cannot_use_reasons &&
10633             nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
10634                               res->cannot_use_reasons,
10635                               NL80211_BSS_PAD))
10636                 goto nla_put_failure;
10637
10638         nla_nest_end(msg, bss);
10639
10640         genlmsg_end(msg, hdr);
10641         return 0;
10642
10643  fail_unlock_rcu:
10644         rcu_read_unlock();
10645  nla_put_failure:
10646         genlmsg_cancel(msg, hdr);
10647         return -EMSGSIZE;
10648 }
10649
10650 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10651 {
10652         struct cfg80211_registered_device *rdev;
10653         struct cfg80211_internal_bss *scan;
10654         struct wireless_dev *wdev;
10655         struct nlattr **attrbuf;
10656         int start = cb->args[2], idx = 0;
10657         bool dump_include_use_data;
10658         int err;
10659
10660         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10661         if (!attrbuf)
10662                 return -ENOMEM;
10663
10664         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10665         if (err) {
10666                 kfree(attrbuf);
10667                 return err;
10668         }
10669         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10670         __acquire(&rdev->wiphy.mtx);
10671
10672         dump_include_use_data =
10673                 attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
10674         kfree(attrbuf);
10675
10676         spin_lock_bh(&rdev->bss_lock);
10677
10678         /*
10679          * dump_scan will be called multiple times to break up the scan results
10680          * into multiple messages.  It is unlikely that any more bss-es will be
10681          * expired after the first call, so only call only call this on the
10682          * first dump_scan invocation.
10683          */
10684         if (start == 0)
10685                 cfg80211_bss_expire(rdev);
10686
10687         cb->seq = rdev->bss_generation;
10688
10689         list_for_each_entry(scan, &rdev->bss_list, list) {
10690                 if (++idx <= start)
10691                         continue;
10692                 if (!dump_include_use_data &&
10693                     !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
10694                         continue;
10695                 if (nl80211_send_bss(skb, cb,
10696                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10697                                 rdev, wdev, scan) < 0) {
10698                         idx--;
10699                         break;
10700                 }
10701         }
10702
10703         spin_unlock_bh(&rdev->bss_lock);
10704
10705         cb->args[2] = idx;
10706         wiphy_unlock(&rdev->wiphy);
10707
10708         return skb->len;
10709 }
10710
10711 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10712                                int flags, struct net_device *dev,
10713                                bool allow_radio_stats,
10714                                struct survey_info *survey)
10715 {
10716         void *hdr;
10717         struct nlattr *infoattr;
10718
10719         /* skip radio stats if userspace didn't request them */
10720         if (!survey->channel && !allow_radio_stats)
10721                 return 0;
10722
10723         hdr = nl80211hdr_put(msg, portid, seq, flags,
10724                              NL80211_CMD_NEW_SURVEY_RESULTS);
10725         if (!hdr)
10726                 return -ENOMEM;
10727
10728         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10729                 goto nla_put_failure;
10730
10731         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10732         if (!infoattr)
10733                 goto nla_put_failure;
10734
10735         if (survey->channel &&
10736             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10737                         survey->channel->center_freq))
10738                 goto nla_put_failure;
10739
10740         if (survey->channel && survey->channel->freq_offset &&
10741             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10742                         survey->channel->freq_offset))
10743                 goto nla_put_failure;
10744
10745         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10746             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10747                 goto nla_put_failure;
10748         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10749             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10750                 goto nla_put_failure;
10751         if ((survey->filled & SURVEY_INFO_TIME) &&
10752             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10753                         survey->time, NL80211_SURVEY_INFO_PAD))
10754                 goto nla_put_failure;
10755         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10756             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10757                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10758                 goto nla_put_failure;
10759         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10760             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10761                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10762                 goto nla_put_failure;
10763         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10764             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10765                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10766                 goto nla_put_failure;
10767         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10768             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10769                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10770                 goto nla_put_failure;
10771         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10772             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10773                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10774                 goto nla_put_failure;
10775         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10776             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10777                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10778                 goto nla_put_failure;
10779
10780         nla_nest_end(msg, infoattr);
10781
10782         genlmsg_end(msg, hdr);
10783         return 0;
10784
10785  nla_put_failure:
10786         genlmsg_cancel(msg, hdr);
10787         return -EMSGSIZE;
10788 }
10789
10790 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10791 {
10792         struct nlattr **attrbuf;
10793         struct survey_info survey;
10794         struct cfg80211_registered_device *rdev;
10795         struct wireless_dev *wdev;
10796         int survey_idx = cb->args[2];
10797         int res;
10798         bool radio_stats;
10799
10800         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10801         if (!attrbuf)
10802                 return -ENOMEM;
10803
10804         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10805         if (res) {
10806                 kfree(attrbuf);
10807                 return res;
10808         }
10809         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10810         __acquire(&rdev->wiphy.mtx);
10811
10812         /* prepare_wdev_dump parsed the attributes */
10813         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10814
10815         if (!wdev->netdev) {
10816                 res = -EINVAL;
10817                 goto out_err;
10818         }
10819
10820         if (!rdev->ops->dump_survey) {
10821                 res = -EOPNOTSUPP;
10822                 goto out_err;
10823         }
10824
10825         while (1) {
10826                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10827                 if (res == -ENOENT)
10828                         break;
10829                 if (res)
10830                         goto out_err;
10831
10832                 /* don't send disabled channels, but do send non-channel data */
10833                 if (survey.channel &&
10834                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10835                         survey_idx++;
10836                         continue;
10837                 }
10838
10839                 if (nl80211_send_survey(skb,
10840                                 NETLINK_CB(cb->skb).portid,
10841                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10842                                 wdev->netdev, radio_stats, &survey) < 0)
10843                         goto out;
10844                 survey_idx++;
10845         }
10846
10847  out:
10848         cb->args[2] = survey_idx;
10849         res = skb->len;
10850  out_err:
10851         kfree(attrbuf);
10852         wiphy_unlock(&rdev->wiphy);
10853         return res;
10854 }
10855
10856 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10857 {
10858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10859         struct net_device *dev = info->user_ptr[1];
10860         struct ieee80211_channel *chan;
10861         const u8 *bssid, *ssid;
10862         int err, ssid_len;
10863         enum nl80211_auth_type auth_type;
10864         struct key_parse key;
10865         bool local_state_change;
10866         struct cfg80211_auth_request req = {};
10867         u32 freq;
10868
10869         if (!info->attrs[NL80211_ATTR_MAC])
10870                 return -EINVAL;
10871
10872         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10873                 return -EINVAL;
10874
10875         if (!info->attrs[NL80211_ATTR_SSID])
10876                 return -EINVAL;
10877
10878         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10879                 return -EINVAL;
10880
10881         err = nl80211_parse_key(info, &key);
10882         if (err)
10883                 return err;
10884
10885         if (key.idx >= 0) {
10886                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10887                         return -EINVAL;
10888                 if (!key.p.key || !key.p.key_len)
10889                         return -EINVAL;
10890                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10891                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10892                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10893                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10894                         return -EINVAL;
10895                 if (key.idx > 3)
10896                         return -EINVAL;
10897         } else {
10898                 key.p.key_len = 0;
10899                 key.p.key = NULL;
10900         }
10901
10902         if (key.idx >= 0) {
10903                 int i;
10904                 bool ok = false;
10905
10906                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10907                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10908                                 ok = true;
10909                                 break;
10910                         }
10911                 }
10912                 if (!ok)
10913                         return -EINVAL;
10914         }
10915
10916         if (!rdev->ops->auth)
10917                 return -EOPNOTSUPP;
10918
10919         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10920             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10921                 return -EOPNOTSUPP;
10922
10923         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10924         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10925         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10926                 freq +=
10927                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10928
10929         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10930         if (!chan)
10931                 return -EINVAL;
10932
10933         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10934         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10935
10936         if (info->attrs[NL80211_ATTR_IE]) {
10937                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10938                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10939         }
10940
10941         if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
10942                 req.supported_selectors =
10943                         nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10944                 req.supported_selectors_len =
10945                         nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
10946         }
10947
10948         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10949         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10950                 return -EINVAL;
10951
10952         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10953              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10954              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10955              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10956             !info->attrs[NL80211_ATTR_AUTH_DATA])
10957                 return -EINVAL;
10958
10959         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10960                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10961                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10962                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10963                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10964                         return -EINVAL;
10965                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10966                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10967         }
10968
10969         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10970
10971         /*
10972          * Since we no longer track auth state, ignore
10973          * requests to only change local state.
10974          */
10975         if (local_state_change)
10976                 return 0;
10977
10978         req.auth_type = auth_type;
10979         req.key = key.p.key;
10980         req.key_len = key.p.key_len;
10981         req.key_idx = key.idx;
10982         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10983         if (req.link_id >= 0) {
10984                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10985                         return -EINVAL;
10986                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10987                         return -EINVAL;
10988                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10989                 if (!is_valid_ether_addr(req.ap_mld_addr))
10990                         return -EINVAL;
10991         }
10992
10993         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10994                                    IEEE80211_BSS_TYPE_ESS,
10995                                    IEEE80211_PRIVACY_ANY);
10996         if (!req.bss)
10997                 return -ENOENT;
10998
10999         err = cfg80211_mlme_auth(rdev, dev, &req);
11000
11001         cfg80211_put_bss(&rdev->wiphy, req.bss);
11002
11003         return err;
11004 }
11005
11006 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
11007                                      struct genl_info *info)
11008 {
11009         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11010                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
11011                 return -EINVAL;
11012         }
11013
11014         if (!rdev->ops->tx_control_port ||
11015             !wiphy_ext_feature_isset(&rdev->wiphy,
11016                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
11017                 return -EOPNOTSUPP;
11018
11019         return 0;
11020 }
11021
11022 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
11023                                    struct genl_info *info,
11024                                    struct cfg80211_crypto_settings *settings,
11025                                    int cipher_limit)
11026 {
11027         memset(settings, 0, sizeof(*settings));
11028
11029         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
11030
11031         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
11032                 u16 proto;
11033
11034                 proto = nla_get_u16(
11035                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
11036                 settings->control_port_ethertype = cpu_to_be16(proto);
11037                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
11038                     proto != ETH_P_PAE)
11039                         return -EINVAL;
11040                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
11041                         settings->control_port_no_encrypt = true;
11042         } else
11043                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
11044
11045         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11046                 int r = validate_pae_over_nl80211(rdev, info);
11047
11048                 if (r < 0)
11049                         return r;
11050
11051                 settings->control_port_over_nl80211 = true;
11052
11053                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
11054                         settings->control_port_no_preauth = true;
11055         }
11056
11057         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
11058                 void *data;
11059                 int len, i;
11060
11061                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11062                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
11063                 settings->n_ciphers_pairwise = len / sizeof(u32);
11064
11065                 if (len % sizeof(u32))
11066                         return -EINVAL;
11067
11068                 if (settings->n_ciphers_pairwise > cipher_limit)
11069                         return -EINVAL;
11070
11071                 memcpy(settings->ciphers_pairwise, data, len);
11072
11073                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
11074                         if (!cfg80211_supported_cipher_suite(
11075                                         &rdev->wiphy,
11076                                         settings->ciphers_pairwise[i]))
11077                                 return -EINVAL;
11078         }
11079
11080         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
11081                 settings->cipher_group =
11082                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
11083                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
11084                                                      settings->cipher_group))
11085                         return -EINVAL;
11086         }
11087
11088         if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
11089                 settings->wpa_versions =
11090                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
11091
11092         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
11093                 void *data;
11094                 int len;
11095
11096                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
11097                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
11098                 settings->n_akm_suites = len / sizeof(u32);
11099
11100                 if (len % sizeof(u32))
11101                         return -EINVAL;
11102
11103                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
11104                         return -EINVAL;
11105
11106                 memcpy(settings->akm_suites, data, len);
11107         }
11108
11109         if (info->attrs[NL80211_ATTR_PMK]) {
11110                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
11111                         return -EINVAL;
11112                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11113                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
11114                     !wiphy_ext_feature_isset(&rdev->wiphy,
11115                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
11116                         return -EINVAL;
11117                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11118         }
11119
11120         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
11121                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11122                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
11123                     !wiphy_ext_feature_isset(&rdev->wiphy,
11124                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
11125                         return -EINVAL;
11126                 settings->sae_pwd =
11127                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11128                 settings->sae_pwd_len =
11129                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
11130         }
11131
11132         settings->sae_pwe =
11133                 nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
11134                                    NL80211_SAE_PWE_UNSPECIFIED);
11135
11136         return 0;
11137 }
11138
11139 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
11140                                               const u8 *ssid, int ssid_len,
11141                                               struct nlattr **attrs,
11142                                               int assoc_link_id, int link_id)
11143 {
11144         struct ieee80211_channel *chan;
11145         struct cfg80211_bss *bss;
11146         const u8 *bssid;
11147         u32 freq, use_for = 0;
11148
11149         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
11150                 return ERR_PTR(-EINVAL);
11151
11152         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
11153
11154         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
11155         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11156                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11157
11158         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11159         if (!chan)
11160                 return ERR_PTR(-EINVAL);
11161
11162         if (assoc_link_id >= 0)
11163                 use_for = NL80211_BSS_USE_FOR_MLD_LINK;
11164         if (assoc_link_id == link_id)
11165                 use_for |= NL80211_BSS_USE_FOR_NORMAL;
11166
11167         bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
11168                                  ssid, ssid_len,
11169                                  IEEE80211_BSS_TYPE_ESS,
11170                                  IEEE80211_PRIVACY_ANY,
11171                                  use_for);
11172         if (!bss)
11173                 return ERR_PTR(-ENOENT);
11174
11175         return bss;
11176 }
11177
11178 static int nl80211_process_links(struct cfg80211_registered_device *rdev,
11179                                  struct cfg80211_assoc_link *links,
11180                                  int assoc_link_id,
11181                                  const u8 *ssid, int ssid_len,
11182                                  struct genl_info *info)
11183 {
11184         unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
11185         struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
11186         struct nlattr *link;
11187         unsigned int link_id;
11188         int rem, err;
11189
11190         if (!attrs)
11191                 return -ENOMEM;
11192
11193         nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
11194                 memset(attrs, 0, attrsize);
11195
11196                 nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
11197
11198                 if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11199                         NL_SET_BAD_ATTR(info->extack, link);
11200                         return -EINVAL;
11201                 }
11202
11203                 link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11204                 /* cannot use the same link ID again */
11205                 if (links[link_id].bss) {
11206                         NL_SET_BAD_ATTR(info->extack, link);
11207                         return -EINVAL;
11208                 }
11209                 links[link_id].bss =
11210                         nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
11211                                           assoc_link_id, link_id);
11212                 if (IS_ERR(links[link_id].bss)) {
11213                         err = PTR_ERR(links[link_id].bss);
11214                         links[link_id].bss = NULL;
11215                         NL_SET_ERR_MSG_ATTR(info->extack, link,
11216                                             "Error fetching BSS for link");
11217                         return err;
11218                 }
11219
11220                 if (attrs[NL80211_ATTR_IE]) {
11221                         links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
11222                         links[link_id].elems_len =
11223                                 nla_len(attrs[NL80211_ATTR_IE]);
11224
11225                         if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11226                                                links[link_id].elems,
11227                                                links[link_id].elems_len)) {
11228                                 NL_SET_ERR_MSG_ATTR(info->extack,
11229                                                     attrs[NL80211_ATTR_IE],
11230                                                     "cannot deal with fragmentation");
11231                                 return -EINVAL;
11232                         }
11233
11234                         if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11235                                                    links[link_id].elems,
11236                                                    links[link_id].elems_len)) {
11237                                 NL_SET_ERR_MSG_ATTR(info->extack,
11238                                                     attrs[NL80211_ATTR_IE],
11239                                                     "cannot deal with non-inheritance");
11240                                 return -EINVAL;
11241                         }
11242                 }
11243
11244                 links[link_id].disabled =
11245                         nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11246         }
11247
11248         return 0;
11249 }
11250
11251 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
11252 {
11253         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11254         struct net_device *dev = info->user_ptr[1];
11255         struct cfg80211_assoc_request req = {};
11256         const u8 *ap_addr, *ssid;
11257         unsigned int link_id;
11258         int err, ssid_len;
11259
11260         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11261             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11262                 return -EPERM;
11263
11264         if (!info->attrs[NL80211_ATTR_SSID])
11265                 return -EINVAL;
11266
11267         if (!rdev->ops->assoc)
11268                 return -EOPNOTSUPP;
11269
11270         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11271             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11272                 return -EOPNOTSUPP;
11273
11274         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11275         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11276
11277         if (info->attrs[NL80211_ATTR_IE]) {
11278                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11279                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11280
11281                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11282                                            req.ie, req.ie_len)) {
11283                         NL_SET_ERR_MSG_ATTR(info->extack,
11284                                             info->attrs[NL80211_ATTR_IE],
11285                                             "non-inheritance makes no sense");
11286                         return -EINVAL;
11287                 }
11288         }
11289
11290         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11291                 enum nl80211_mfp mfp =
11292                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11293                 if (mfp == NL80211_MFP_REQUIRED)
11294                         req.use_mfp = true;
11295                 else if (mfp != NL80211_MFP_NO)
11296                         return -EINVAL;
11297         }
11298
11299         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11300                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11301
11302         if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11303                 req.supported_selectors =
11304                         nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11305                 req.supported_selectors_len =
11306                         nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11307         }
11308
11309         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11310                 req.flags |= ASSOC_REQ_DISABLE_HT;
11311
11312         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11313                 memcpy(&req.ht_capa_mask,
11314                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11315                        sizeof(req.ht_capa_mask));
11316
11317         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11318                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11319                         return -EINVAL;
11320                 memcpy(&req.ht_capa,
11321                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11322                        sizeof(req.ht_capa));
11323         }
11324
11325         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11326                 req.flags |= ASSOC_REQ_DISABLE_VHT;
11327
11328         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11329                 req.flags |= ASSOC_REQ_DISABLE_HE;
11330
11331         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11332                 req.flags |= ASSOC_REQ_DISABLE_EHT;
11333
11334         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11335                 memcpy(&req.vht_capa_mask,
11336                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11337                        sizeof(req.vht_capa_mask));
11338
11339         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11340                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11341                         return -EINVAL;
11342                 memcpy(&req.vht_capa,
11343                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11344                        sizeof(req.vht_capa));
11345         }
11346
11347         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11348                 if (!((rdev->wiphy.features &
11349                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11350                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11351                     !wiphy_ext_feature_isset(&rdev->wiphy,
11352                                              NL80211_EXT_FEATURE_RRM))
11353                         return -EINVAL;
11354                 req.flags |= ASSOC_REQ_USE_RRM;
11355         }
11356
11357         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11358                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11359                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11360                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11361                         return -EINVAL;
11362                 req.fils_nonces =
11363                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11364         }
11365
11366         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11367                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11368                         return -EINVAL;
11369                 memcpy(&req.s1g_capa_mask,
11370                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11371                        sizeof(req.s1g_capa_mask));
11372         }
11373
11374         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11375                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11376                         return -EINVAL;
11377                 memcpy(&req.s1g_capa,
11378                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11379                        sizeof(req.s1g_capa));
11380         }
11381
11382         if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
11383                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11384                                              NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
11385                         GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
11386                         return -EINVAL;
11387                 }
11388                 req.flags |= ASSOC_REQ_SPP_AMSDU;
11389         }
11390
11391         req.link_id = nl80211_link_id_or_invalid(info->attrs);
11392
11393         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11394                 if (req.link_id < 0)
11395                         return -EINVAL;
11396
11397                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11398                         return -EINVAL;
11399
11400                 if (info->attrs[NL80211_ATTR_MAC] ||
11401                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11402                     !info->attrs[NL80211_ATTR_MLD_ADDR])
11403                         return -EINVAL;
11404
11405                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11406                 ap_addr = req.ap_mld_addr;
11407
11408                 err = nl80211_process_links(rdev, req.links, req.link_id,
11409                                             ssid, ssid_len, info);
11410                 if (err)
11411                         goto free;
11412
11413                 if (!req.links[req.link_id].bss) {
11414                         err = -EINVAL;
11415                         goto free;
11416                 }
11417
11418                 if (req.links[req.link_id].elems_len) {
11419                         GENL_SET_ERR_MSG(info,
11420                                          "cannot have per-link elems on assoc link");
11421                         err = -EINVAL;
11422                         goto free;
11423                 }
11424
11425                 if (req.links[req.link_id].disabled) {
11426                         GENL_SET_ERR_MSG(info,
11427                                          "cannot have assoc link disabled");
11428                         err = -EINVAL;
11429                         goto free;
11430                 }
11431
11432                 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11433                         req.ext_mld_capa_ops =
11434                                 nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
11435         } else {
11436                 if (req.link_id >= 0)
11437                         return -EINVAL;
11438
11439                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
11440                                             -1, -1);
11441                 if (IS_ERR(req.bss))
11442                         return PTR_ERR(req.bss);
11443                 ap_addr = req.bss->bssid;
11444
11445                 if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
11446                         return -EINVAL;
11447         }
11448
11449         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11450         if (!err) {
11451                 struct nlattr *link;
11452                 int rem = 0;
11453
11454                 err = cfg80211_mlme_assoc(rdev, dev, &req,
11455                                           info->extack);
11456
11457                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11458                         dev->ieee80211_ptr->conn_owner_nlportid =
11459                                 info->snd_portid;
11460                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11461                                ap_addr, ETH_ALEN);
11462                 }
11463
11464                 /* Report error from first problematic link */
11465                 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11466                         nla_for_each_nested(link,
11467                                             info->attrs[NL80211_ATTR_MLO_LINKS],
11468                                             rem) {
11469                                 struct nlattr *link_id_attr =
11470                                         nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
11471
11472                                 if (!link_id_attr)
11473                                         continue;
11474
11475                                 link_id = nla_get_u8(link_id_attr);
11476
11477                                 if (link_id == req.link_id)
11478                                         continue;
11479
11480                                 if (!req.links[link_id].error ||
11481                                     WARN_ON(req.links[link_id].error > 0))
11482                                         continue;
11483
11484                                 WARN_ON(err >= 0);
11485
11486                                 NL_SET_BAD_ATTR(info->extack, link);
11487                                 err = req.links[link_id].error;
11488                                 break;
11489                         }
11490                 }
11491         }
11492
11493 free:
11494         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11495                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11496         cfg80211_put_bss(&rdev->wiphy, req.bss);
11497
11498         return err;
11499 }
11500
11501 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11502 {
11503         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11504         struct net_device *dev = info->user_ptr[1];
11505         const u8 *ie = NULL, *bssid;
11506         int ie_len = 0;
11507         u16 reason_code;
11508         bool local_state_change;
11509
11510         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11511             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11512                 return -EPERM;
11513
11514         if (!info->attrs[NL80211_ATTR_MAC])
11515                 return -EINVAL;
11516
11517         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11518                 return -EINVAL;
11519
11520         if (!rdev->ops->deauth)
11521                 return -EOPNOTSUPP;
11522
11523         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11524             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11525                 return -EOPNOTSUPP;
11526
11527         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11528
11529         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11530         if (reason_code == 0) {
11531                 /* Reason Code 0 is reserved */
11532                 return -EINVAL;
11533         }
11534
11535         if (info->attrs[NL80211_ATTR_IE]) {
11536                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11537                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11538         }
11539
11540         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11541
11542         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11543                                     local_state_change);
11544 }
11545
11546 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11547 {
11548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11549         struct net_device *dev = info->user_ptr[1];
11550         const u8 *ie = NULL, *bssid;
11551         int ie_len = 0;
11552         u16 reason_code;
11553         bool local_state_change;
11554
11555         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11556             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11557                 return -EPERM;
11558
11559         if (!info->attrs[NL80211_ATTR_MAC])
11560                 return -EINVAL;
11561
11562         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11563                 return -EINVAL;
11564
11565         if (!rdev->ops->disassoc)
11566                 return -EOPNOTSUPP;
11567
11568         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11570                 return -EOPNOTSUPP;
11571
11572         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11573
11574         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11575         if (reason_code == 0) {
11576                 /* Reason Code 0 is reserved */
11577                 return -EINVAL;
11578         }
11579
11580         if (info->attrs[NL80211_ATTR_IE]) {
11581                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11582                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11583         }
11584
11585         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11586
11587         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11588                                       local_state_change);
11589 }
11590
11591 static bool
11592 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11593                          int mcast_rate[NUM_NL80211_BANDS],
11594                          int rateval)
11595 {
11596         struct wiphy *wiphy = &rdev->wiphy;
11597         bool found = false;
11598         int band, i;
11599
11600         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11601                 struct ieee80211_supported_band *sband;
11602
11603                 sband = wiphy->bands[band];
11604                 if (!sband)
11605                         continue;
11606
11607                 for (i = 0; i < sband->n_bitrates; i++) {
11608                         if (sband->bitrates[i].bitrate == rateval) {
11609                                 mcast_rate[band] = i + 1;
11610                                 found = true;
11611                                 break;
11612                         }
11613                 }
11614         }
11615
11616         return found;
11617 }
11618
11619 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11620 {
11621         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11622         struct net_device *dev = info->user_ptr[1];
11623         struct cfg80211_ibss_params ibss;
11624         struct wiphy *wiphy;
11625         struct cfg80211_cached_keys *connkeys = NULL;
11626         int err;
11627
11628         memset(&ibss, 0, sizeof(ibss));
11629
11630         if (!info->attrs[NL80211_ATTR_SSID] ||
11631             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11632                 return -EINVAL;
11633
11634         ibss.beacon_interval = 100;
11635
11636         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11637                 ibss.beacon_interval =
11638                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11639
11640         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11641                                            ibss.beacon_interval);
11642         if (err)
11643                 return err;
11644
11645         if (!rdev->ops->join_ibss)
11646                 return -EOPNOTSUPP;
11647
11648         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11649                 return -EOPNOTSUPP;
11650
11651         wiphy = &rdev->wiphy;
11652
11653         if (info->attrs[NL80211_ATTR_MAC]) {
11654                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11655
11656                 if (!is_valid_ether_addr(ibss.bssid))
11657                         return -EINVAL;
11658         }
11659         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11660         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11661
11662         if (info->attrs[NL80211_ATTR_IE]) {
11663                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11664                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11665         }
11666
11667         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11668         if (err)
11669                 return err;
11670
11671         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11672                                      NL80211_IFTYPE_ADHOC))
11673                 return -EINVAL;
11674
11675         switch (ibss.chandef.width) {
11676         case NL80211_CHAN_WIDTH_5:
11677         case NL80211_CHAN_WIDTH_10:
11678         case NL80211_CHAN_WIDTH_20_NOHT:
11679                 break;
11680         case NL80211_CHAN_WIDTH_20:
11681         case NL80211_CHAN_WIDTH_40:
11682                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11683                         return -EINVAL;
11684                 break;
11685         case NL80211_CHAN_WIDTH_80:
11686         case NL80211_CHAN_WIDTH_80P80:
11687         case NL80211_CHAN_WIDTH_160:
11688                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11689                         return -EINVAL;
11690                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11691                                              NL80211_EXT_FEATURE_VHT_IBSS))
11692                         return -EINVAL;
11693                 break;
11694         case NL80211_CHAN_WIDTH_320:
11695                 return -EINVAL;
11696         default:
11697                 return -EINVAL;
11698         }
11699
11700         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11701         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11702
11703         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11704                 u8 *rates =
11705                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11706                 int n_rates =
11707                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11708                 struct ieee80211_supported_band *sband =
11709                         wiphy->bands[ibss.chandef.chan->band];
11710
11711                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11712                                              &ibss.basic_rates);
11713                 if (err)
11714                         return err;
11715         }
11716
11717         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11718                 memcpy(&ibss.ht_capa_mask,
11719                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11720                        sizeof(ibss.ht_capa_mask));
11721
11722         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11723                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11724                         return -EINVAL;
11725                 memcpy(&ibss.ht_capa,
11726                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11727                        sizeof(ibss.ht_capa));
11728         }
11729
11730         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11731             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11732                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11733                 return -EINVAL;
11734
11735         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11736                 bool no_ht = false;
11737
11738                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11739                 if (IS_ERR(connkeys))
11740                         return PTR_ERR(connkeys);
11741
11742                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11743                     no_ht) {
11744                         kfree_sensitive(connkeys);
11745                         return -EINVAL;
11746                 }
11747         }
11748
11749         ibss.control_port =
11750                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11751
11752         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11753                 int r = validate_pae_over_nl80211(rdev, info);
11754
11755                 if (r < 0) {
11756                         kfree_sensitive(connkeys);
11757                         return r;
11758                 }
11759
11760                 ibss.control_port_over_nl80211 = true;
11761         }
11762
11763         ibss.userspace_handles_dfs =
11764                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11765
11766         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11767         if (err)
11768                 kfree_sensitive(connkeys);
11769         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11770                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11771
11772         return err;
11773 }
11774
11775 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11776 {
11777         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11778         struct net_device *dev = info->user_ptr[1];
11779
11780         if (!rdev->ops->leave_ibss)
11781                 return -EOPNOTSUPP;
11782
11783         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11784                 return -EOPNOTSUPP;
11785
11786         return cfg80211_leave_ibss(rdev, dev, false);
11787 }
11788
11789 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11790 {
11791         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11792         struct net_device *dev = info->user_ptr[1];
11793         int mcast_rate[NUM_NL80211_BANDS];
11794         u32 nla_rate;
11795
11796         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11797             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11798             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11799                 return -EOPNOTSUPP;
11800
11801         if (!rdev->ops->set_mcast_rate)
11802                 return -EOPNOTSUPP;
11803
11804         memset(mcast_rate, 0, sizeof(mcast_rate));
11805
11806         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11807                 return -EINVAL;
11808
11809         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11810         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11811                 return -EINVAL;
11812
11813         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11814 }
11815
11816 static struct sk_buff *
11817 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11818                             struct wireless_dev *wdev, int approxlen,
11819                             u32 portid, u32 seq, enum nl80211_commands cmd,
11820                             enum nl80211_attrs attr,
11821                             const struct nl80211_vendor_cmd_info *info,
11822                             gfp_t gfp)
11823 {
11824         struct sk_buff *skb;
11825         void *hdr;
11826         struct nlattr *data;
11827
11828         skb = nlmsg_new(approxlen + 100, gfp);
11829         if (!skb)
11830                 return NULL;
11831
11832         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11833         if (!hdr) {
11834                 kfree_skb(skb);
11835                 return NULL;
11836         }
11837
11838         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11839                 goto nla_put_failure;
11840
11841         if (info) {
11842                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11843                                 info->vendor_id))
11844                         goto nla_put_failure;
11845                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11846                                 info->subcmd))
11847                         goto nla_put_failure;
11848         }
11849
11850         if (wdev) {
11851                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11852                                       wdev_id(wdev), NL80211_ATTR_PAD))
11853                         goto nla_put_failure;
11854                 if (wdev->netdev &&
11855                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11856                                 wdev->netdev->ifindex))
11857                         goto nla_put_failure;
11858         }
11859
11860         data = nla_nest_start_noflag(skb, attr);
11861         if (!data)
11862                 goto nla_put_failure;
11863
11864         ((void **)skb->cb)[0] = rdev;
11865         ((void **)skb->cb)[1] = hdr;
11866         ((void **)skb->cb)[2] = data;
11867
11868         return skb;
11869
11870  nla_put_failure:
11871         kfree_skb(skb);
11872         return NULL;
11873 }
11874
11875 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11876                                            struct wireless_dev *wdev,
11877                                            enum nl80211_commands cmd,
11878                                            enum nl80211_attrs attr,
11879                                            unsigned int portid,
11880                                            int vendor_event_idx,
11881                                            int approxlen, gfp_t gfp)
11882 {
11883         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11884         const struct nl80211_vendor_cmd_info *info;
11885
11886         switch (cmd) {
11887         case NL80211_CMD_TESTMODE:
11888                 if (WARN_ON(vendor_event_idx != -1))
11889                         return NULL;
11890                 info = NULL;
11891                 break;
11892         case NL80211_CMD_VENDOR:
11893                 if (WARN_ON(vendor_event_idx < 0 ||
11894                             vendor_event_idx >= wiphy->n_vendor_events))
11895                         return NULL;
11896                 info = &wiphy->vendor_events[vendor_event_idx];
11897                 break;
11898         default:
11899                 WARN_ON(1);
11900                 return NULL;
11901         }
11902
11903         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11904                                            cmd, attr, info, gfp);
11905 }
11906 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11907
11908 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11909 {
11910         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11911         void *hdr = ((void **)skb->cb)[1];
11912         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11913         struct nlattr *data = ((void **)skb->cb)[2];
11914         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11915
11916         /* clear CB data for netlink core to own from now on */
11917         memset(skb->cb, 0, sizeof(skb->cb));
11918
11919         nla_nest_end(skb, data);
11920         genlmsg_end(skb, hdr);
11921
11922         if (nlhdr->nlmsg_pid) {
11923                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11924                                 nlhdr->nlmsg_pid);
11925         } else {
11926                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11927                         mcgrp = NL80211_MCGRP_VENDOR;
11928
11929                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11930                                         skb, 0, mcgrp, gfp);
11931         }
11932 }
11933 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11934
11935 #ifdef CONFIG_NL80211_TESTMODE
11936 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11937 {
11938         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11939         struct wireless_dev *wdev;
11940         int err;
11941
11942         lockdep_assert_held(&rdev->wiphy.mtx);
11943
11944         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11945                                           info->attrs);
11946
11947         if (!rdev->ops->testmode_cmd)
11948                 return -EOPNOTSUPP;
11949
11950         if (IS_ERR(wdev)) {
11951                 err = PTR_ERR(wdev);
11952                 if (err != -EINVAL)
11953                         return err;
11954                 wdev = NULL;
11955         } else if (wdev->wiphy != &rdev->wiphy) {
11956                 return -EINVAL;
11957         }
11958
11959         if (!info->attrs[NL80211_ATTR_TESTDATA])
11960                 return -EINVAL;
11961
11962         rdev->cur_cmd_info = info;
11963         err = rdev_testmode_cmd(rdev, wdev,
11964                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11965                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11966         rdev->cur_cmd_info = NULL;
11967
11968         return err;
11969 }
11970
11971 static int nl80211_testmode_dump(struct sk_buff *skb,
11972                                  struct netlink_callback *cb)
11973 {
11974         struct cfg80211_registered_device *rdev;
11975         struct nlattr **attrbuf = NULL;
11976         int err;
11977         long phy_idx;
11978         void *data = NULL;
11979         int data_len = 0;
11980
11981         rtnl_lock();
11982
11983         if (cb->args[0]) {
11984                 /*
11985                  * 0 is a valid index, but not valid for args[0],
11986                  * so we need to offset by 1.
11987                  */
11988                 phy_idx = cb->args[0] - 1;
11989
11990                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11991                 if (!rdev) {
11992                         err = -ENOENT;
11993                         goto out_err;
11994                 }
11995         } else {
11996                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11997                                   GFP_KERNEL);
11998                 if (!attrbuf) {
11999                         err = -ENOMEM;
12000                         goto out_err;
12001                 }
12002
12003                 err = nlmsg_parse_deprecated(cb->nlh,
12004                                              GENL_HDRLEN + nl80211_fam.hdrsize,
12005                                              attrbuf, nl80211_fam.maxattr,
12006                                              nl80211_policy, NULL);
12007                 if (err)
12008                         goto out_err;
12009
12010                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12011                 if (IS_ERR(rdev)) {
12012                         err = PTR_ERR(rdev);
12013                         goto out_err;
12014                 }
12015                 phy_idx = rdev->wiphy_idx;
12016
12017                 if (attrbuf[NL80211_ATTR_TESTDATA])
12018                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
12019         }
12020
12021         if (cb->args[1]) {
12022                 data = nla_data((void *)cb->args[1]);
12023                 data_len = nla_len((void *)cb->args[1]);
12024         }
12025
12026         if (!rdev->ops->testmode_dump) {
12027                 err = -EOPNOTSUPP;
12028                 goto out_err;
12029         }
12030
12031         while (1) {
12032                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12033                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12034                                            NL80211_CMD_TESTMODE);
12035                 struct nlattr *tmdata;
12036
12037                 if (!hdr)
12038                         break;
12039
12040                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
12041                         genlmsg_cancel(skb, hdr);
12042                         break;
12043                 }
12044
12045                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
12046                 if (!tmdata) {
12047                         genlmsg_cancel(skb, hdr);
12048                         break;
12049                 }
12050                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
12051                 nla_nest_end(skb, tmdata);
12052
12053                 if (err == -ENOBUFS || err == -ENOENT) {
12054                         genlmsg_cancel(skb, hdr);
12055                         break;
12056                 } else if (err) {
12057                         genlmsg_cancel(skb, hdr);
12058                         goto out_err;
12059                 }
12060
12061                 genlmsg_end(skb, hdr);
12062         }
12063
12064         err = skb->len;
12065         /* see above */
12066         cb->args[0] = phy_idx + 1;
12067  out_err:
12068         kfree(attrbuf);
12069         rtnl_unlock();
12070         return err;
12071 }
12072 #endif
12073
12074 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
12075 {
12076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12077         struct net_device *dev = info->user_ptr[1];
12078         struct cfg80211_connect_params connect;
12079         struct wiphy *wiphy;
12080         struct cfg80211_cached_keys *connkeys = NULL;
12081         u32 freq = 0;
12082         int err;
12083
12084         memset(&connect, 0, sizeof(connect));
12085
12086         if (!info->attrs[NL80211_ATTR_SSID] ||
12087             !nla_len(info->attrs[NL80211_ATTR_SSID]))
12088                 return -EINVAL;
12089
12090         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12091                 connect.auth_type =
12092                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12093                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
12094                                              NL80211_CMD_CONNECT))
12095                         return -EINVAL;
12096         } else
12097                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
12098
12099         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
12100
12101         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
12102             !wiphy_ext_feature_isset(&rdev->wiphy,
12103                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12104                 return -EINVAL;
12105         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
12106
12107         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
12108                                       NL80211_MAX_NR_CIPHER_SUITES);
12109         if (err)
12110                 return err;
12111
12112         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12113             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12114                 return -EOPNOTSUPP;
12115
12116         wiphy = &rdev->wiphy;
12117
12118         connect.bg_scan_period = -1;
12119         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
12120                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
12121                 connect.bg_scan_period =
12122                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
12123         }
12124
12125         if (info->attrs[NL80211_ATTR_MAC])
12126                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12127         else if (info->attrs[NL80211_ATTR_MAC_HINT])
12128                 connect.bssid_hint =
12129                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
12130         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12131         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12132
12133         if (info->attrs[NL80211_ATTR_IE]) {
12134                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12135                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12136         }
12137
12138         if (info->attrs[NL80211_ATTR_USE_MFP]) {
12139                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12140                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
12141                     !wiphy_ext_feature_isset(&rdev->wiphy,
12142                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
12143                         return -EOPNOTSUPP;
12144         } else {
12145                 connect.mfp = NL80211_MFP_NO;
12146         }
12147
12148         if (info->attrs[NL80211_ATTR_PREV_BSSID])
12149                 connect.prev_bssid =
12150                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12151
12152         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
12153                 freq = MHZ_TO_KHZ(nla_get_u32(
12154                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
12155         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12156                 freq +=
12157                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12158
12159         if (freq) {
12160                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
12161                 if (!connect.channel)
12162                         return -EINVAL;
12163         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
12164                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
12165                 freq = MHZ_TO_KHZ(freq);
12166                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
12167                 if (!connect.channel_hint)
12168                         return -EINVAL;
12169         }
12170
12171         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
12172                 connect.edmg.channels =
12173                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
12174
12175                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
12176                         connect.edmg.bw_config =
12177                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
12178         }
12179
12180         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12181                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
12182                 if (IS_ERR(connkeys))
12183                         return PTR_ERR(connkeys);
12184         }
12185
12186         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12187                 connect.flags |= ASSOC_REQ_DISABLE_HT;
12188
12189         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12190                 memcpy(&connect.ht_capa_mask,
12191                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12192                        sizeof(connect.ht_capa_mask));
12193
12194         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12195                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
12196                         kfree_sensitive(connkeys);
12197                         return -EINVAL;
12198                 }
12199                 memcpy(&connect.ht_capa,
12200                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12201                        sizeof(connect.ht_capa));
12202         }
12203
12204         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12205                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
12206
12207         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12208                 connect.flags |= ASSOC_REQ_DISABLE_HE;
12209
12210         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12211                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
12212
12213         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12214                 memcpy(&connect.vht_capa_mask,
12215                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12216                        sizeof(connect.vht_capa_mask));
12217
12218         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12219                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
12220                         kfree_sensitive(connkeys);
12221                         return -EINVAL;
12222                 }
12223                 memcpy(&connect.vht_capa,
12224                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12225                        sizeof(connect.vht_capa));
12226         }
12227
12228         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12229                 if (!((rdev->wiphy.features &
12230                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12231                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12232                     !wiphy_ext_feature_isset(&rdev->wiphy,
12233                                              NL80211_EXT_FEATURE_RRM)) {
12234                         kfree_sensitive(connkeys);
12235                         return -EINVAL;
12236                 }
12237                 connect.flags |= ASSOC_REQ_USE_RRM;
12238         }
12239
12240         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
12241         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
12242                 kfree_sensitive(connkeys);
12243                 return -EOPNOTSUPP;
12244         }
12245
12246         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
12247                 /* bss selection makes no sense if bssid is set */
12248                 if (connect.bssid) {
12249                         kfree_sensitive(connkeys);
12250                         return -EINVAL;
12251                 }
12252
12253                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
12254                                        wiphy, &connect.bss_select);
12255                 if (err) {
12256                         kfree_sensitive(connkeys);
12257                         return err;
12258                 }
12259         }
12260
12261         if (wiphy_ext_feature_isset(&rdev->wiphy,
12262                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
12263             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12264             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12265             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12266             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12267                 connect.fils_erp_username =
12268                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12269                 connect.fils_erp_username_len =
12270                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12271                 connect.fils_erp_realm =
12272                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12273                 connect.fils_erp_realm_len =
12274                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12275                 connect.fils_erp_next_seq_num =
12276                         nla_get_u16(
12277                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12278                 connect.fils_erp_rrk =
12279                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12280                 connect.fils_erp_rrk_len =
12281                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12282         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12283                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12284                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12285                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12286                 kfree_sensitive(connkeys);
12287                 return -EINVAL;
12288         }
12289
12290         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12291                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12292                         kfree_sensitive(connkeys);
12293                         GENL_SET_ERR_MSG(info,
12294                                          "external auth requires connection ownership");
12295                         return -EINVAL;
12296                 }
12297                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12298         }
12299
12300         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12301                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12302
12303         err = cfg80211_connect(rdev, dev, &connect, connkeys,
12304                                connect.prev_bssid);
12305         if (err)
12306                 kfree_sensitive(connkeys);
12307
12308         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12309                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12310                 if (connect.bssid)
12311                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
12312                                connect.bssid, ETH_ALEN);
12313                 else
12314                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12315         }
12316
12317         return err;
12318 }
12319
12320 static int nl80211_update_connect_params(struct sk_buff *skb,
12321                                          struct genl_info *info)
12322 {
12323         struct cfg80211_connect_params connect = {};
12324         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12325         struct net_device *dev = info->user_ptr[1];
12326         struct wireless_dev *wdev = dev->ieee80211_ptr;
12327         bool fils_sk_offload;
12328         u32 auth_type;
12329         u32 changed = 0;
12330
12331         if (!rdev->ops->update_connect_params)
12332                 return -EOPNOTSUPP;
12333
12334         if (info->attrs[NL80211_ATTR_IE]) {
12335                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12336                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12337                 changed |= UPDATE_ASSOC_IES;
12338         }
12339
12340         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12341                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12342
12343         /*
12344          * when driver supports fils-sk offload all attributes must be
12345          * provided. So the else covers "fils-sk-not-all" and
12346          * "no-fils-sk-any".
12347          */
12348         if (fils_sk_offload &&
12349             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12350             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12351             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12352             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12353                 connect.fils_erp_username =
12354                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12355                 connect.fils_erp_username_len =
12356                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12357                 connect.fils_erp_realm =
12358                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12359                 connect.fils_erp_realm_len =
12360                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12361                 connect.fils_erp_next_seq_num =
12362                         nla_get_u16(
12363                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12364                 connect.fils_erp_rrk =
12365                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12366                 connect.fils_erp_rrk_len =
12367                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12368                 changed |= UPDATE_FILS_ERP_INFO;
12369         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12370                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12371                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12372                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12373                 return -EINVAL;
12374         }
12375
12376         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12377                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12378                 if (!nl80211_valid_auth_type(rdev, auth_type,
12379                                              NL80211_CMD_CONNECT))
12380                         return -EINVAL;
12381
12382                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12383                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12384                         return -EINVAL;
12385
12386                 connect.auth_type = auth_type;
12387                 changed |= UPDATE_AUTH_TYPE;
12388         }
12389
12390         if (!wdev->connected)
12391                 return -ENOLINK;
12392
12393         return rdev_update_connect_params(rdev, dev, &connect, changed);
12394 }
12395
12396 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12397 {
12398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12399         struct net_device *dev = info->user_ptr[1];
12400         u16 reason;
12401
12402         if (dev->ieee80211_ptr->conn_owner_nlportid &&
12403             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12404                 return -EPERM;
12405
12406         reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
12407                                      WLAN_REASON_DEAUTH_LEAVING);
12408
12409         if (reason == 0)
12410                 return -EINVAL;
12411
12412         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12413             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12414                 return -EOPNOTSUPP;
12415
12416         return cfg80211_disconnect(rdev, dev, reason, true);
12417 }
12418
12419 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12420 {
12421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12422         struct net *net;
12423         int err;
12424
12425         if (info->attrs[NL80211_ATTR_PID]) {
12426                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12427
12428                 net = get_net_ns_by_pid(pid);
12429         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12430                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12431
12432                 net = get_net_ns_by_fd(fd);
12433         } else {
12434                 return -EINVAL;
12435         }
12436
12437         if (IS_ERR(net))
12438                 return PTR_ERR(net);
12439
12440         err = 0;
12441
12442         /* check if anything to do */
12443         if (!net_eq(wiphy_net(&rdev->wiphy), net))
12444                 err = cfg80211_switch_netns(rdev, net);
12445
12446         put_net(net);
12447         return err;
12448 }
12449
12450 static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
12451 {
12452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12453         struct net_device *dev = info->user_ptr[1];
12454         struct cfg80211_pmksa pmksa;
12455         bool ap_pmksa_caching_support = false;
12456
12457         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12458
12459         ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12460                 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12461
12462         if (!info->attrs[NL80211_ATTR_PMKID])
12463                 return -EINVAL;
12464
12465         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12466
12467         if (info->attrs[NL80211_ATTR_MAC]) {
12468                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12469         } else if (info->attrs[NL80211_ATTR_SSID] &&
12470                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12471                    info->attrs[NL80211_ATTR_PMK]) {
12472                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12473                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12474                 pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12475         } else {
12476                 return -EINVAL;
12477         }
12478
12479         if (info->attrs[NL80211_ATTR_PMK]) {
12480                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12481                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12482         }
12483
12484         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12485                 pmksa.pmk_lifetime =
12486                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12487
12488         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12489                 pmksa.pmk_reauth_threshold =
12490                         nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12491
12492         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12493             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12494             !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12495                dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12496                ap_pmksa_caching_support))
12497                 return -EOPNOTSUPP;
12498
12499         if (!rdev->ops->set_pmksa)
12500                 return -EOPNOTSUPP;
12501
12502         return rdev_set_pmksa(rdev, dev, &pmksa);
12503 }
12504
12505 static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
12506 {
12507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12508         struct net_device *dev = info->user_ptr[1];
12509         struct cfg80211_pmksa pmksa;
12510         bool sae_offload_support = false;
12511         bool owe_offload_support = false;
12512         bool ap_pmksa_caching_support = false;
12513
12514         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12515
12516         sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12517                 NL80211_EXT_FEATURE_SAE_OFFLOAD);
12518         owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
12519                 NL80211_EXT_FEATURE_OWE_OFFLOAD);
12520         ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
12521                 NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
12522
12523         if (info->attrs[NL80211_ATTR_PMKID])
12524                 pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12525
12526         if (info->attrs[NL80211_ATTR_MAC]) {
12527                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12528         } else if (info->attrs[NL80211_ATTR_SSID]) {
12529                 /* SSID based pmksa flush supported only for FILS,
12530                  * OWE/SAE OFFLOAD cases
12531                  */
12532                 if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12533                     info->attrs[NL80211_ATTR_PMK]) {
12534                         pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12535                 } else if (!sae_offload_support && !owe_offload_support) {
12536                         return -EINVAL;
12537                 }
12538                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12539                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12540         } else {
12541                 return -EINVAL;
12542         }
12543
12544         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12545             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12546             !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
12547                dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
12548                ap_pmksa_caching_support))
12549                 return -EOPNOTSUPP;
12550
12551         if (!rdev->ops->del_pmksa)
12552                 return -EOPNOTSUPP;
12553
12554         return rdev_del_pmksa(rdev, dev, &pmksa);
12555 }
12556
12557 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12558 {
12559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12560         struct net_device *dev = info->user_ptr[1];
12561
12562         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12563             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12564                 return -EOPNOTSUPP;
12565
12566         if (!rdev->ops->flush_pmksa)
12567                 return -EOPNOTSUPP;
12568
12569         return rdev_flush_pmksa(rdev, dev);
12570 }
12571
12572 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12573 {
12574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12575         struct net_device *dev = info->user_ptr[1];
12576         u8 action_code, dialog_token;
12577         u32 peer_capability = 0;
12578         u16 status_code;
12579         u8 *peer;
12580         int link_id;
12581         bool initiator;
12582
12583         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12584             !rdev->ops->tdls_mgmt)
12585                 return -EOPNOTSUPP;
12586
12587         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12588             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12589             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12590             !info->attrs[NL80211_ATTR_IE] ||
12591             !info->attrs[NL80211_ATTR_MAC])
12592                 return -EINVAL;
12593
12594         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12595         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12596         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12597         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12598         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12599         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12600                 peer_capability =
12601                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12602         link_id = nl80211_link_id_or_invalid(info->attrs);
12603
12604         return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12605                               dialog_token, status_code, peer_capability,
12606                               initiator,
12607                               nla_data(info->attrs[NL80211_ATTR_IE]),
12608                               nla_len(info->attrs[NL80211_ATTR_IE]));
12609 }
12610
12611 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12612 {
12613         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12614         struct net_device *dev = info->user_ptr[1];
12615         enum nl80211_tdls_operation operation;
12616         u8 *peer;
12617
12618         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12619             !rdev->ops->tdls_oper)
12620                 return -EOPNOTSUPP;
12621
12622         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12623             !info->attrs[NL80211_ATTR_MAC])
12624                 return -EINVAL;
12625
12626         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12627         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12628
12629         return rdev_tdls_oper(rdev, dev, peer, operation);
12630 }
12631
12632 static int nl80211_remain_on_channel(struct sk_buff *skb,
12633                                      struct genl_info *info)
12634 {
12635         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12636         unsigned int link_id = nl80211_link_id(info->attrs);
12637         struct wireless_dev *wdev = info->user_ptr[1];
12638         struct cfg80211_chan_def chandef;
12639         struct sk_buff *msg;
12640         void *hdr;
12641         u64 cookie;
12642         u32 duration;
12643         int err;
12644
12645         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12646             !info->attrs[NL80211_ATTR_DURATION])
12647                 return -EINVAL;
12648
12649         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12650
12651         if (!rdev->ops->remain_on_channel ||
12652             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12653                 return -EOPNOTSUPP;
12654
12655         /*
12656          * We should be on that channel for at least a minimum amount of
12657          * time (10ms) but no longer than the driver supports.
12658          */
12659         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12660             duration > rdev->wiphy.max_remain_on_channel_duration)
12661                 return -EINVAL;
12662
12663         err = nl80211_parse_chandef(rdev, info, &chandef);
12664         if (err)
12665                 return err;
12666
12667         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12668                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12669
12670                 oper_chandef = wdev_chandef(wdev, link_id);
12671
12672                 if (WARN_ON(!oper_chandef)) {
12673                         /* cannot happen since we must beacon to get here */
12674                         WARN_ON(1);
12675                         return -EBUSY;
12676                 }
12677
12678                 /* note: returns first one if identical chandefs */
12679                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12680                                                              oper_chandef);
12681
12682                 if (compat_chandef != &chandef)
12683                         return -EBUSY;
12684         }
12685
12686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12687         if (!msg)
12688                 return -ENOMEM;
12689
12690         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12691                              NL80211_CMD_REMAIN_ON_CHANNEL);
12692         if (!hdr) {
12693                 err = -ENOBUFS;
12694                 goto free_msg;
12695         }
12696
12697         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12698                                      duration, &cookie);
12699
12700         if (err)
12701                 goto free_msg;
12702
12703         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12704                               NL80211_ATTR_PAD))
12705                 goto nla_put_failure;
12706
12707         genlmsg_end(msg, hdr);
12708
12709         return genlmsg_reply(msg, info);
12710
12711  nla_put_failure:
12712         err = -ENOBUFS;
12713  free_msg:
12714         nlmsg_free(msg);
12715         return err;
12716 }
12717
12718 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12719                                             struct genl_info *info)
12720 {
12721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12722         struct wireless_dev *wdev = info->user_ptr[1];
12723         u64 cookie;
12724
12725         if (!info->attrs[NL80211_ATTR_COOKIE])
12726                 return -EINVAL;
12727
12728         if (!rdev->ops->cancel_remain_on_channel)
12729                 return -EOPNOTSUPP;
12730
12731         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12732
12733         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12734 }
12735
12736 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12737                                        struct genl_info *info)
12738 {
12739         struct cfg80211_bitrate_mask mask;
12740         unsigned int link_id = nl80211_link_id(info->attrs);
12741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12742         struct net_device *dev = info->user_ptr[1];
12743         int err;
12744
12745         if (!rdev->ops->set_bitrate_mask)
12746                 return -EOPNOTSUPP;
12747
12748         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12749                                             NL80211_ATTR_TX_RATES, &mask,
12750                                             dev, true, link_id);
12751         if (err)
12752                 return err;
12753
12754         return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12755 }
12756
12757 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12758 {
12759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12760         struct wireless_dev *wdev = info->user_ptr[1];
12761         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12762
12763         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12764                 return -EINVAL;
12765
12766         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12767                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12768
12769         switch (wdev->iftype) {
12770         case NL80211_IFTYPE_STATION:
12771         case NL80211_IFTYPE_ADHOC:
12772         case NL80211_IFTYPE_P2P_CLIENT:
12773         case NL80211_IFTYPE_AP:
12774         case NL80211_IFTYPE_AP_VLAN:
12775         case NL80211_IFTYPE_MESH_POINT:
12776         case NL80211_IFTYPE_P2P_GO:
12777         case NL80211_IFTYPE_P2P_DEVICE:
12778                 break;
12779         case NL80211_IFTYPE_NAN:
12780                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12781                                              NL80211_EXT_FEATURE_SECURE_NAN))
12782                         return -EOPNOTSUPP;
12783                 break;
12784         default:
12785                 return -EOPNOTSUPP;
12786         }
12787
12788         /* not much point in registering if we can't reply */
12789         if (!rdev->ops->mgmt_tx)
12790                 return -EOPNOTSUPP;
12791
12792         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12793             !wiphy_ext_feature_isset(&rdev->wiphy,
12794                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12795                 GENL_SET_ERR_MSG(info,
12796                                  "multicast RX registrations are not supported");
12797                 return -EOPNOTSUPP;
12798         }
12799
12800         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12801                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12802                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12803                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12804                                            info->extack);
12805 }
12806
12807 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12808 {
12809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12810         struct wireless_dev *wdev = info->user_ptr[1];
12811         struct cfg80211_chan_def chandef;
12812         int err;
12813         void *hdr = NULL;
12814         u64 cookie;
12815         struct sk_buff *msg = NULL;
12816         struct cfg80211_mgmt_tx_params params = {
12817                 .dont_wait_for_ack =
12818                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12819         };
12820
12821         if (!info->attrs[NL80211_ATTR_FRAME])
12822                 return -EINVAL;
12823
12824         if (!rdev->ops->mgmt_tx)
12825                 return -EOPNOTSUPP;
12826
12827         switch (wdev->iftype) {
12828         case NL80211_IFTYPE_P2P_DEVICE:
12829                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12830                         return -EINVAL;
12831                 break;
12832         case NL80211_IFTYPE_STATION:
12833         case NL80211_IFTYPE_ADHOC:
12834         case NL80211_IFTYPE_P2P_CLIENT:
12835         case NL80211_IFTYPE_AP:
12836         case NL80211_IFTYPE_AP_VLAN:
12837         case NL80211_IFTYPE_MESH_POINT:
12838         case NL80211_IFTYPE_P2P_GO:
12839                 break;
12840         case NL80211_IFTYPE_NAN:
12841                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12842                                              NL80211_EXT_FEATURE_SECURE_NAN))
12843                         return -EOPNOTSUPP;
12844                 break;
12845         default:
12846                 return -EOPNOTSUPP;
12847         }
12848
12849         if (info->attrs[NL80211_ATTR_DURATION]) {
12850                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12851                         return -EINVAL;
12852                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12853
12854                 /*
12855                  * We should wait on the channel for at least a minimum amount
12856                  * of time (10ms) but no longer than the driver supports.
12857                  */
12858                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12859                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12860                         return -EINVAL;
12861         }
12862
12863         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12864
12865         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12866                 return -EINVAL;
12867
12868         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12869
12870         /* get the channel if any has been specified, otherwise pass NULL to
12871          * the driver. The latter will use the current one
12872          */
12873         chandef.chan = NULL;
12874         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12875                 err = nl80211_parse_chandef(rdev, info, &chandef);
12876                 if (err)
12877                         return err;
12878         }
12879
12880         if (!chandef.chan && params.offchan)
12881                 return -EINVAL;
12882
12883         if (params.offchan &&
12884             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
12885                 return -EBUSY;
12886
12887         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12888         /*
12889          * This now races due to the unlock, but we cannot check
12890          * the valid links for the _station_ anyway, so that's up
12891          * to the driver.
12892          */
12893         if (params.link_id >= 0 &&
12894             !(wdev->valid_links & BIT(params.link_id)))
12895                 return -EINVAL;
12896
12897         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12898         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12899
12900         err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
12901                                             info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
12902                                             &params.csa_offsets,
12903                                             &params.n_csa_offsets);
12904         if (err)
12905                 return err;
12906
12907         if (!params.dont_wait_for_ack) {
12908                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12909                 if (!msg)
12910                         return -ENOMEM;
12911
12912                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12913                                      NL80211_CMD_FRAME);
12914                 if (!hdr) {
12915                         err = -ENOBUFS;
12916                         goto free_msg;
12917                 }
12918         }
12919
12920         params.chan = chandef.chan;
12921         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12922         if (err)
12923                 goto free_msg;
12924
12925         if (msg) {
12926                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12927                                       NL80211_ATTR_PAD))
12928                         goto nla_put_failure;
12929
12930                 genlmsg_end(msg, hdr);
12931                 return genlmsg_reply(msg, info);
12932         }
12933
12934         return 0;
12935
12936  nla_put_failure:
12937         err = -ENOBUFS;
12938  free_msg:
12939         nlmsg_free(msg);
12940         return err;
12941 }
12942
12943 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12944 {
12945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12946         struct wireless_dev *wdev = info->user_ptr[1];
12947         u64 cookie;
12948
12949         if (!info->attrs[NL80211_ATTR_COOKIE])
12950                 return -EINVAL;
12951
12952         if (!rdev->ops->mgmt_tx_cancel_wait)
12953                 return -EOPNOTSUPP;
12954
12955         switch (wdev->iftype) {
12956         case NL80211_IFTYPE_STATION:
12957         case NL80211_IFTYPE_ADHOC:
12958         case NL80211_IFTYPE_P2P_CLIENT:
12959         case NL80211_IFTYPE_AP:
12960         case NL80211_IFTYPE_AP_VLAN:
12961         case NL80211_IFTYPE_P2P_GO:
12962         case NL80211_IFTYPE_P2P_DEVICE:
12963                 break;
12964         case NL80211_IFTYPE_NAN:
12965                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12966                                              NL80211_EXT_FEATURE_SECURE_NAN))
12967                         return -EOPNOTSUPP;
12968                 break;
12969         default:
12970                 return -EOPNOTSUPP;
12971         }
12972
12973         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12974
12975         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12976 }
12977
12978 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12979 {
12980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12981         struct wireless_dev *wdev;
12982         struct net_device *dev = info->user_ptr[1];
12983         u8 ps_state;
12984         bool state;
12985         int err;
12986
12987         if (!info->attrs[NL80211_ATTR_PS_STATE])
12988                 return -EINVAL;
12989
12990         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12991
12992         wdev = dev->ieee80211_ptr;
12993
12994         if (!rdev->ops->set_power_mgmt)
12995                 return -EOPNOTSUPP;
12996
12997         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12998
12999         if (state == wdev->ps)
13000                 return 0;
13001
13002         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
13003         if (!err)
13004                 wdev->ps = state;
13005         return err;
13006 }
13007
13008 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
13009 {
13010         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13011         enum nl80211_ps_state ps_state;
13012         struct wireless_dev *wdev;
13013         struct net_device *dev = info->user_ptr[1];
13014         struct sk_buff *msg;
13015         void *hdr;
13016         int err;
13017
13018         wdev = dev->ieee80211_ptr;
13019
13020         if (!rdev->ops->set_power_mgmt)
13021                 return -EOPNOTSUPP;
13022
13023         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13024         if (!msg)
13025                 return -ENOMEM;
13026
13027         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13028                              NL80211_CMD_GET_POWER_SAVE);
13029         if (!hdr) {
13030                 err = -ENOBUFS;
13031                 goto free_msg;
13032         }
13033
13034         if (wdev->ps)
13035                 ps_state = NL80211_PS_ENABLED;
13036         else
13037                 ps_state = NL80211_PS_DISABLED;
13038
13039         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
13040                 goto nla_put_failure;
13041
13042         genlmsg_end(msg, hdr);
13043         return genlmsg_reply(msg, info);
13044
13045  nla_put_failure:
13046         err = -ENOBUFS;
13047  free_msg:
13048         nlmsg_free(msg);
13049         return err;
13050 }
13051
13052 static const struct nla_policy
13053 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
13054         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
13055         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
13056         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
13057         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
13058         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
13059         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
13060         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
13061 };
13062
13063 static int nl80211_set_cqm_txe(struct genl_info *info,
13064                                u32 rate, u32 pkts, u32 intvl)
13065 {
13066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13067         struct net_device *dev = info->user_ptr[1];
13068         struct wireless_dev *wdev = dev->ieee80211_ptr;
13069
13070         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
13071                 return -EINVAL;
13072
13073         if (!rdev->ops->set_cqm_txe_config)
13074                 return -EOPNOTSUPP;
13075
13076         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13077             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13078                 return -EOPNOTSUPP;
13079
13080         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
13081 }
13082
13083 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
13084                                     struct net_device *dev,
13085                                     struct cfg80211_cqm_config *cqm_config)
13086 {
13087         struct wireless_dev *wdev = dev->ieee80211_ptr;
13088         s32 last, low, high;
13089         u32 hyst;
13090         int i, n, low_index;
13091         int err;
13092
13093         /*
13094          * Obtain current RSSI value if possible, if not and no RSSI threshold
13095          * event has been received yet, we should receive an event after a
13096          * connection is established and enough beacons received to calculate
13097          * the average.
13098          */
13099         if (!cqm_config->last_rssi_event_value &&
13100             wdev->links[0].client.current_bss &&
13101             rdev->ops->get_station) {
13102                 struct station_info sinfo = {};
13103                 u8 *mac_addr;
13104
13105                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
13106
13107                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
13108                 if (err)
13109                         return err;
13110
13111                 cfg80211_sinfo_release_content(&sinfo);
13112                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
13113                         cqm_config->last_rssi_event_value =
13114                                 (s8) sinfo.rx_beacon_signal_avg;
13115         }
13116
13117         last = cqm_config->last_rssi_event_value;
13118         hyst = cqm_config->rssi_hyst;
13119         n = cqm_config->n_rssi_thresholds;
13120
13121         for (i = 0; i < n; i++) {
13122                 i = array_index_nospec(i, n);
13123                 if (last < cqm_config->rssi_thresholds[i])
13124                         break;
13125         }
13126
13127         low_index = i - 1;
13128         if (low_index >= 0) {
13129                 low_index = array_index_nospec(low_index, n);
13130                 low = cqm_config->rssi_thresholds[low_index] - hyst;
13131         } else {
13132                 low = S32_MIN;
13133         }
13134         if (i < n) {
13135                 i = array_index_nospec(i, n);
13136                 high = cqm_config->rssi_thresholds[i] + hyst - 1;
13137         } else {
13138                 high = S32_MAX;
13139         }
13140
13141         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
13142 }
13143
13144 static int nl80211_set_cqm_rssi(struct genl_info *info,
13145                                 const s32 *thresholds, int n_thresholds,
13146                                 u32 hysteresis)
13147 {
13148         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13149         struct cfg80211_cqm_config *cqm_config = NULL, *old;
13150         struct net_device *dev = info->user_ptr[1];
13151         struct wireless_dev *wdev = dev->ieee80211_ptr;
13152         s32 prev = S32_MIN;
13153         int i, err;
13154
13155         /* Check all values negative and sorted */
13156         for (i = 0; i < n_thresholds; i++) {
13157                 if (thresholds[i] > 0 || thresholds[i] <= prev)
13158                         return -EINVAL;
13159
13160                 prev = thresholds[i];
13161         }
13162
13163         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13164             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13165                 return -EOPNOTSUPP;
13166
13167         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
13168                 n_thresholds = 0;
13169
13170         old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
13171
13172         /* if already disabled just succeed */
13173         if (!n_thresholds && !old)
13174                 return 0;
13175
13176         if (n_thresholds > 1) {
13177                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
13178                                              NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
13179                     !rdev->ops->set_cqm_rssi_range_config)
13180                         return -EOPNOTSUPP;
13181         } else {
13182                 if (!rdev->ops->set_cqm_rssi_config)
13183                         return -EOPNOTSUPP;
13184         }
13185
13186         if (n_thresholds) {
13187                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
13188                                                  n_thresholds),
13189                                      GFP_KERNEL);
13190                 if (!cqm_config)
13191                         return -ENOMEM;
13192
13193                 cqm_config->rssi_hyst = hysteresis;
13194                 cqm_config->n_rssi_thresholds = n_thresholds;
13195                 memcpy(cqm_config->rssi_thresholds, thresholds,
13196                        flex_array_size(cqm_config, rssi_thresholds,
13197                                        n_thresholds));
13198                 cqm_config->use_range_api = n_thresholds > 1 ||
13199                                             !rdev->ops->set_cqm_rssi_config;
13200
13201                 rcu_assign_pointer(wdev->cqm_config, cqm_config);
13202
13203                 if (cqm_config->use_range_api)
13204                         err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
13205                 else
13206                         err = rdev_set_cqm_rssi_config(rdev, dev,
13207                                                        thresholds[0],
13208                                                        hysteresis);
13209         } else {
13210                 RCU_INIT_POINTER(wdev->cqm_config, NULL);
13211                 /* if enabled as range also disable via range */
13212                 if (old->use_range_api)
13213                         err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
13214                 else
13215                         err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
13216         }
13217
13218         if (err) {
13219                 rcu_assign_pointer(wdev->cqm_config, old);
13220                 kfree_rcu(cqm_config, rcu_head);
13221         } else {
13222                 kfree_rcu(old, rcu_head);
13223         }
13224
13225         return err;
13226 }
13227
13228 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
13229 {
13230         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
13231         struct nlattr *cqm;
13232         int err;
13233
13234         cqm = info->attrs[NL80211_ATTR_CQM];
13235         if (!cqm)
13236                 return -EINVAL;
13237
13238         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
13239                                           nl80211_attr_cqm_policy,
13240                                           info->extack);
13241         if (err)
13242                 return err;
13243
13244         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
13245             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
13246                 const s32 *thresholds =
13247                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13248                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
13249                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
13250
13251                 if (len % 4)
13252                         return -EINVAL;
13253
13254                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
13255                                             hysteresis);
13256         }
13257
13258         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
13259             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
13260             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
13261                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
13262                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
13263                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
13264
13265                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
13266         }
13267
13268         return -EINVAL;
13269 }
13270
13271 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
13272 {
13273         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13274         struct net_device *dev = info->user_ptr[1];
13275         struct ocb_setup setup = {};
13276         int err;
13277
13278         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13279         if (err)
13280                 return err;
13281
13282         return cfg80211_join_ocb(rdev, dev, &setup);
13283 }
13284
13285 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
13286 {
13287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13288         struct net_device *dev = info->user_ptr[1];
13289
13290         return cfg80211_leave_ocb(rdev, dev);
13291 }
13292
13293 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
13294 {
13295         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13296         struct net_device *dev = info->user_ptr[1];
13297         struct mesh_config cfg;
13298         struct mesh_setup setup;
13299         int err;
13300
13301         /* start with default */
13302         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13303         memcpy(&setup, &default_mesh_setup, sizeof(setup));
13304
13305         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13306                 /* and parse parameters if given */
13307                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13308                 if (err)
13309                         return err;
13310         }
13311
13312         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13313             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13314                 return -EINVAL;
13315
13316         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13317         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13318
13319         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13320             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13321                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13322                         return -EINVAL;
13323
13324         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13325                 setup.beacon_interval =
13326                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13327
13328                 err = cfg80211_validate_beacon_int(rdev,
13329                                                    NL80211_IFTYPE_MESH_POINT,
13330                                                    setup.beacon_interval);
13331                 if (err)
13332                         return err;
13333         }
13334
13335         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13336                 setup.dtim_period =
13337                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13338                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13339                         return -EINVAL;
13340         }
13341
13342         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13343                 /* parse additional setup parameters if given */
13344                 err = nl80211_parse_mesh_setup(info, &setup);
13345                 if (err)
13346                         return err;
13347         }
13348
13349         if (setup.user_mpm)
13350                 cfg.auto_open_plinks = false;
13351
13352         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13353                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13354                 if (err)
13355                         return err;
13356         } else {
13357                 /* __cfg80211_join_mesh() will sort it out */
13358                 setup.chandef.chan = NULL;
13359         }
13360
13361         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13362                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13363                 int n_rates =
13364                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13365                 struct ieee80211_supported_band *sband;
13366
13367                 if (!setup.chandef.chan)
13368                         return -EINVAL;
13369
13370                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13371
13372                 err = ieee80211_get_ratemask(sband, rates, n_rates,
13373                                              &setup.basic_rates);
13374                 if (err)
13375                         return err;
13376         }
13377
13378         if (info->attrs[NL80211_ATTR_TX_RATES]) {
13379                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13380                                                     NL80211_ATTR_TX_RATES,
13381                                                     &setup.beacon_rate,
13382                                                     dev, false, 0);
13383                 if (err)
13384                         return err;
13385
13386                 if (!setup.chandef.chan)
13387                         return -EINVAL;
13388
13389                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13390                                               &setup.beacon_rate);
13391                 if (err)
13392                         return err;
13393         }
13394
13395         setup.userspace_handles_dfs =
13396                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13397
13398         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13399                 int r = validate_pae_over_nl80211(rdev, info);
13400
13401                 if (r < 0)
13402                         return r;
13403
13404                 setup.control_port_over_nl80211 = true;
13405         }
13406
13407         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13408         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13409                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13410
13411         return err;
13412 }
13413
13414 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13415 {
13416         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13417         struct net_device *dev = info->user_ptr[1];
13418
13419         return cfg80211_leave_mesh(rdev, dev);
13420 }
13421
13422 #ifdef CONFIG_PM
13423 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13424                                         struct cfg80211_registered_device *rdev)
13425 {
13426         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13427         struct nlattr *nl_pats, *nl_pat;
13428         int i, pat_len;
13429
13430         if (!wowlan->n_patterns)
13431                 return 0;
13432
13433         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13434         if (!nl_pats)
13435                 return -ENOBUFS;
13436
13437         for (i = 0; i < wowlan->n_patterns; i++) {
13438                 nl_pat = nla_nest_start_noflag(msg, i + 1);
13439                 if (!nl_pat)
13440                         return -ENOBUFS;
13441                 pat_len = wowlan->patterns[i].pattern_len;
13442                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13443                             wowlan->patterns[i].mask) ||
13444                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13445                             wowlan->patterns[i].pattern) ||
13446                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13447                                 wowlan->patterns[i].pkt_offset))
13448                         return -ENOBUFS;
13449                 nla_nest_end(msg, nl_pat);
13450         }
13451         nla_nest_end(msg, nl_pats);
13452
13453         return 0;
13454 }
13455
13456 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13457                                    struct cfg80211_wowlan_tcp *tcp)
13458 {
13459         struct nlattr *nl_tcp;
13460
13461         if (!tcp)
13462                 return 0;
13463
13464         nl_tcp = nla_nest_start_noflag(msg,
13465                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13466         if (!nl_tcp)
13467                 return -ENOBUFS;
13468
13469         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13470             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13471             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13472             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13473             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13474             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13475                     tcp->payload_len, tcp->payload) ||
13476             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13477                         tcp->data_interval) ||
13478             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13479                     tcp->wake_len, tcp->wake_data) ||
13480             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13481                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13482                 return -ENOBUFS;
13483
13484         if (tcp->payload_seq.len &&
13485             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13486                     sizeof(tcp->payload_seq), &tcp->payload_seq))
13487                 return -ENOBUFS;
13488
13489         if (tcp->payload_tok.len &&
13490             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13491                     sizeof(tcp->payload_tok) + tcp->tokens_size,
13492                     &tcp->payload_tok))
13493                 return -ENOBUFS;
13494
13495         nla_nest_end(msg, nl_tcp);
13496
13497         return 0;
13498 }
13499
13500 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13501                                   struct cfg80211_sched_scan_request *req)
13502 {
13503         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13504         int i;
13505
13506         if (!req)
13507                 return 0;
13508
13509         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13510         if (!nd)
13511                 return -ENOBUFS;
13512
13513         if (req->n_scan_plans == 1 &&
13514             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13515                         req->scan_plans[0].interval * 1000))
13516                 return -ENOBUFS;
13517
13518         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13519                 return -ENOBUFS;
13520
13521         if (req->relative_rssi_set) {
13522                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13523
13524                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13525                                req->relative_rssi))
13526                         return -ENOBUFS;
13527
13528                 rssi_adjust.band = req->rssi_adjust.band;
13529                 rssi_adjust.delta = req->rssi_adjust.delta;
13530                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13531                             sizeof(rssi_adjust), &rssi_adjust))
13532                         return -ENOBUFS;
13533         }
13534
13535         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13536         if (!freqs)
13537                 return -ENOBUFS;
13538
13539         for (i = 0; i < req->n_channels; i++) {
13540                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13541                         return -ENOBUFS;
13542         }
13543
13544         nla_nest_end(msg, freqs);
13545
13546         if (req->n_match_sets) {
13547                 matches = nla_nest_start_noflag(msg,
13548                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13549                 if (!matches)
13550                         return -ENOBUFS;
13551
13552                 for (i = 0; i < req->n_match_sets; i++) {
13553                         match = nla_nest_start_noflag(msg, i);
13554                         if (!match)
13555                                 return -ENOBUFS;
13556
13557                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13558                                     req->match_sets[i].ssid.ssid_len,
13559                                     req->match_sets[i].ssid.ssid))
13560                                 return -ENOBUFS;
13561                         nla_nest_end(msg, match);
13562                 }
13563                 nla_nest_end(msg, matches);
13564         }
13565
13566         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13567         if (!scan_plans)
13568                 return -ENOBUFS;
13569
13570         for (i = 0; i < req->n_scan_plans; i++) {
13571                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13572                 if (!scan_plan)
13573                         return -ENOBUFS;
13574
13575                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13576                                 req->scan_plans[i].interval) ||
13577                     (req->scan_plans[i].iterations &&
13578                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13579                                  req->scan_plans[i].iterations)))
13580                         return -ENOBUFS;
13581                 nla_nest_end(msg, scan_plan);
13582         }
13583         nla_nest_end(msg, scan_plans);
13584
13585         nla_nest_end(msg, nd);
13586
13587         return 0;
13588 }
13589
13590 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13591 {
13592         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13593         struct sk_buff *msg;
13594         void *hdr;
13595         u32 size = NLMSG_DEFAULT_SIZE;
13596
13597         if (!rdev->wiphy.wowlan)
13598                 return -EOPNOTSUPP;
13599
13600         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13601                 /* adjust size to have room for all the data */
13602                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13603                         rdev->wiphy.wowlan_config->tcp->payload_len +
13604                         rdev->wiphy.wowlan_config->tcp->wake_len +
13605                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13606         }
13607
13608         msg = nlmsg_new(size, GFP_KERNEL);
13609         if (!msg)
13610                 return -ENOMEM;
13611
13612         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13613                              NL80211_CMD_GET_WOWLAN);
13614         if (!hdr)
13615                 goto nla_put_failure;
13616
13617         if (rdev->wiphy.wowlan_config) {
13618                 struct nlattr *nl_wowlan;
13619
13620                 nl_wowlan = nla_nest_start_noflag(msg,
13621                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13622                 if (!nl_wowlan)
13623                         goto nla_put_failure;
13624
13625                 if ((rdev->wiphy.wowlan_config->any &&
13626                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13627                     (rdev->wiphy.wowlan_config->disconnect &&
13628                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13629                     (rdev->wiphy.wowlan_config->magic_pkt &&
13630                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13631                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13632                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13633                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13634                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13635                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13636                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13637                     (rdev->wiphy.wowlan_config->rfkill_release &&
13638                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13639                         goto nla_put_failure;
13640
13641                 if (nl80211_send_wowlan_patterns(msg, rdev))
13642                         goto nla_put_failure;
13643
13644                 if (nl80211_send_wowlan_tcp(msg,
13645                                             rdev->wiphy.wowlan_config->tcp))
13646                         goto nla_put_failure;
13647
13648                 if (nl80211_send_wowlan_nd(
13649                             msg,
13650                             rdev->wiphy.wowlan_config->nd_config))
13651                         goto nla_put_failure;
13652
13653                 nla_nest_end(msg, nl_wowlan);
13654         }
13655
13656         genlmsg_end(msg, hdr);
13657         return genlmsg_reply(msg, info);
13658
13659 nla_put_failure:
13660         nlmsg_free(msg);
13661         return -ENOBUFS;
13662 }
13663
13664 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13665                                     struct nlattr *attr,
13666                                     struct cfg80211_wowlan *trig)
13667 {
13668         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13669         struct cfg80211_wowlan_tcp *cfg;
13670         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13671         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13672         u32 size;
13673         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13674         int err, port;
13675
13676         if (!rdev->wiphy.wowlan->tcp)
13677                 return -EINVAL;
13678
13679         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13680                                           nl80211_wowlan_tcp_policy, NULL);
13681         if (err)
13682                 return err;
13683
13684         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13685             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13686             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13687             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13688             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13689             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13690             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13691             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13692                 return -EINVAL;
13693
13694         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13695         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13696                 return -EINVAL;
13697
13698         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13699                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13700             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13701                 return -EINVAL;
13702
13703         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13704         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13705                 return -EINVAL;
13706
13707         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13708         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13709                 return -EINVAL;
13710
13711         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13712                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13713
13714                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13715                 tokens_size = tokln - sizeof(*tok);
13716
13717                 if (!tok->len || tokens_size % tok->len)
13718                         return -EINVAL;
13719                 if (!rdev->wiphy.wowlan->tcp->tok)
13720                         return -EINVAL;
13721                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13722                         return -EINVAL;
13723                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13724                         return -EINVAL;
13725                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13726                         return -EINVAL;
13727                 if (tok->offset + tok->len > data_size)
13728                         return -EINVAL;
13729         }
13730
13731         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13732                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13733                 if (!rdev->wiphy.wowlan->tcp->seq)
13734                         return -EINVAL;
13735                 if (seq->len == 0 || seq->len > 4)
13736                         return -EINVAL;
13737                 if (seq->len + seq->offset > data_size)
13738                         return -EINVAL;
13739         }
13740
13741         size = sizeof(*cfg);
13742         size += data_size;
13743         size += wake_size + wake_mask_size;
13744         size += tokens_size;
13745
13746         cfg = kzalloc(size, GFP_KERNEL);
13747         if (!cfg)
13748                 return -ENOMEM;
13749         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13750         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13751         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13752                ETH_ALEN);
13753         port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
13754 #ifdef CONFIG_INET
13755         /* allocate a socket and port for it and use it */
13756         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13757                             IPPROTO_TCP, &cfg->sock, 1);
13758         if (err) {
13759                 kfree(cfg);
13760                 return err;
13761         }
13762         if (inet_csk_get_port(cfg->sock->sk, port)) {
13763                 sock_release(cfg->sock);
13764                 kfree(cfg);
13765                 return -EADDRINUSE;
13766         }
13767         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13768 #else
13769         if (!port) {
13770                 kfree(cfg);
13771                 return -EINVAL;
13772         }
13773         cfg->src_port = port;
13774 #endif
13775
13776         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13777         cfg->payload_len = data_size;
13778         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13779         memcpy((void *)cfg->payload,
13780                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13781                data_size);
13782         if (seq)
13783                 cfg->payload_seq = *seq;
13784         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13785         cfg->wake_len = wake_size;
13786         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13787         memcpy((void *)cfg->wake_data,
13788                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13789                wake_size);
13790         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13791                          data_size + wake_size;
13792         memcpy((void *)cfg->wake_mask,
13793                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13794                wake_mask_size);
13795         if (tok) {
13796                 cfg->tokens_size = tokens_size;
13797                 cfg->payload_tok = *tok;
13798                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13799                        tokens_size);
13800         }
13801
13802         trig->tcp = cfg;
13803
13804         return 0;
13805 }
13806
13807 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13808                                    const struct wiphy_wowlan_support *wowlan,
13809                                    struct nlattr *attr,
13810                                    struct cfg80211_wowlan *trig)
13811 {
13812         struct nlattr **tb;
13813         int err;
13814
13815         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13816         if (!tb)
13817                 return -ENOMEM;
13818
13819         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13820                 err = -EOPNOTSUPP;
13821                 goto out;
13822         }
13823
13824         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13825                                           nl80211_policy, NULL);
13826         if (err)
13827                 goto out;
13828
13829         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13830                                                    wowlan->max_nd_match_sets);
13831         err = PTR_ERR_OR_ZERO(trig->nd_config);
13832         if (err)
13833                 trig->nd_config = NULL;
13834
13835 out:
13836         kfree(tb);
13837         return err;
13838 }
13839
13840 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13841 {
13842         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13843         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13844         struct cfg80211_wowlan new_triggers = {};
13845         struct cfg80211_wowlan *ntrig;
13846         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13847         int err, i;
13848         bool prev_enabled = rdev->wiphy.wowlan_config;
13849         bool regular = false;
13850
13851         if (!wowlan)
13852                 return -EOPNOTSUPP;
13853
13854         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13855                 cfg80211_rdev_free_wowlan(rdev);
13856                 rdev->wiphy.wowlan_config = NULL;
13857                 goto set_wakeup;
13858         }
13859
13860         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13861                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13862                                           nl80211_wowlan_policy, info->extack);
13863         if (err)
13864                 return err;
13865
13866         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13867                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13868                         return -EINVAL;
13869                 new_triggers.any = true;
13870         }
13871
13872         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13873                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13874                         return -EINVAL;
13875                 new_triggers.disconnect = true;
13876                 regular = true;
13877         }
13878
13879         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13880                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13881                         return -EINVAL;
13882                 new_triggers.magic_pkt = true;
13883                 regular = true;
13884         }
13885
13886         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13887                 return -EINVAL;
13888
13889         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13890                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13891                         return -EINVAL;
13892                 new_triggers.gtk_rekey_failure = true;
13893                 regular = true;
13894         }
13895
13896         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13897                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13898                         return -EINVAL;
13899                 new_triggers.eap_identity_req = true;
13900                 regular = true;
13901         }
13902
13903         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13904                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13905                         return -EINVAL;
13906                 new_triggers.four_way_handshake = true;
13907                 regular = true;
13908         }
13909
13910         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13911                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13912                         return -EINVAL;
13913                 new_triggers.rfkill_release = true;
13914                 regular = true;
13915         }
13916
13917         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13918                 struct nlattr *pat;
13919                 int n_patterns = 0;
13920                 int rem, pat_len, mask_len, pkt_offset;
13921                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13922
13923                 regular = true;
13924
13925                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13926                                     rem)
13927                         n_patterns++;
13928                 if (n_patterns > wowlan->n_patterns)
13929                         return -EINVAL;
13930
13931                 new_triggers.patterns = kcalloc(n_patterns,
13932                                                 sizeof(new_triggers.patterns[0]),
13933                                                 GFP_KERNEL);
13934                 if (!new_triggers.patterns)
13935                         return -ENOMEM;
13936
13937                 new_triggers.n_patterns = n_patterns;
13938                 i = 0;
13939
13940                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13941                                     rem) {
13942                         u8 *mask_pat;
13943
13944                         err = nla_parse_nested_deprecated(pat_tb,
13945                                                           MAX_NL80211_PKTPAT,
13946                                                           pat,
13947                                                           nl80211_packet_pattern_policy,
13948                                                           info->extack);
13949                         if (err)
13950                                 goto error;
13951
13952                         err = -EINVAL;
13953                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13954                             !pat_tb[NL80211_PKTPAT_PATTERN])
13955                                 goto error;
13956                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13957                         mask_len = DIV_ROUND_UP(pat_len, 8);
13958                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13959                                 goto error;
13960                         if (pat_len > wowlan->pattern_max_len ||
13961                             pat_len < wowlan->pattern_min_len)
13962                                 goto error;
13963
13964                         pkt_offset =
13965                                 nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
13966                                                     0);
13967                         if (pkt_offset > wowlan->max_pkt_offset)
13968                                 goto error;
13969                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13970
13971                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13972                         if (!mask_pat) {
13973                                 err = -ENOMEM;
13974                                 goto error;
13975                         }
13976                         new_triggers.patterns[i].mask = mask_pat;
13977                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13978                                mask_len);
13979                         mask_pat += mask_len;
13980                         new_triggers.patterns[i].pattern = mask_pat;
13981                         new_triggers.patterns[i].pattern_len = pat_len;
13982                         memcpy(mask_pat,
13983                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13984                                pat_len);
13985                         i++;
13986                 }
13987         }
13988
13989         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13990                 regular = true;
13991                 err = nl80211_parse_wowlan_tcp(
13992                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13993                         &new_triggers);
13994                 if (err)
13995                         goto error;
13996         }
13997
13998         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13999                 regular = true;
14000                 err = nl80211_parse_wowlan_nd(
14001                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
14002                         &new_triggers);
14003                 if (err)
14004                         goto error;
14005         }
14006
14007         /* The 'any' trigger means the device continues operating more or less
14008          * as in its normal operation mode and wakes up the host on most of the
14009          * normal interrupts (like packet RX, ...)
14010          * It therefore makes little sense to combine with the more constrained
14011          * wakeup trigger modes.
14012          */
14013         if (new_triggers.any && regular) {
14014                 err = -EINVAL;
14015                 goto error;
14016         }
14017
14018         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
14019         if (!ntrig) {
14020                 err = -ENOMEM;
14021                 goto error;
14022         }
14023         cfg80211_rdev_free_wowlan(rdev);
14024         rdev->wiphy.wowlan_config = ntrig;
14025
14026  set_wakeup:
14027         if (rdev->ops->set_wakeup &&
14028             prev_enabled != !!rdev->wiphy.wowlan_config)
14029                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
14030
14031         return 0;
14032  error:
14033         for (i = 0; i < new_triggers.n_patterns; i++)
14034                 kfree(new_triggers.patterns[i].mask);
14035         kfree(new_triggers.patterns);
14036         if (new_triggers.tcp && new_triggers.tcp->sock)
14037                 sock_release(new_triggers.tcp->sock);
14038         kfree(new_triggers.tcp);
14039         kfree(new_triggers.nd_config);
14040         return err;
14041 }
14042 #endif
14043
14044 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
14045                                        struct cfg80211_registered_device *rdev)
14046 {
14047         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
14048         int i, j, pat_len;
14049         struct cfg80211_coalesce_rules *rule;
14050
14051         if (!rdev->coalesce->n_rules)
14052                 return 0;
14053
14054         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
14055         if (!nl_rules)
14056                 return -ENOBUFS;
14057
14058         for (i = 0; i < rdev->coalesce->n_rules; i++) {
14059                 nl_rule = nla_nest_start_noflag(msg, i + 1);
14060                 if (!nl_rule)
14061                         return -ENOBUFS;
14062
14063                 rule = &rdev->coalesce->rules[i];
14064                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
14065                                 rule->delay))
14066                         return -ENOBUFS;
14067
14068                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
14069                                 rule->condition))
14070                         return -ENOBUFS;
14071
14072                 nl_pats = nla_nest_start_noflag(msg,
14073                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
14074                 if (!nl_pats)
14075                         return -ENOBUFS;
14076
14077                 for (j = 0; j < rule->n_patterns; j++) {
14078                         nl_pat = nla_nest_start_noflag(msg, j + 1);
14079                         if (!nl_pat)
14080                                 return -ENOBUFS;
14081                         pat_len = rule->patterns[j].pattern_len;
14082                         if (nla_put(msg, NL80211_PKTPAT_MASK,
14083                                     DIV_ROUND_UP(pat_len, 8),
14084                                     rule->patterns[j].mask) ||
14085                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14086                                     rule->patterns[j].pattern) ||
14087                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14088                                         rule->patterns[j].pkt_offset))
14089                                 return -ENOBUFS;
14090                         nla_nest_end(msg, nl_pat);
14091                 }
14092                 nla_nest_end(msg, nl_pats);
14093                 nla_nest_end(msg, nl_rule);
14094         }
14095         nla_nest_end(msg, nl_rules);
14096
14097         return 0;
14098 }
14099
14100 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
14101 {
14102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14103         struct sk_buff *msg;
14104         void *hdr;
14105
14106         if (!rdev->wiphy.coalesce)
14107                 return -EOPNOTSUPP;
14108
14109         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14110         if (!msg)
14111                 return -ENOMEM;
14112
14113         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14114                              NL80211_CMD_GET_COALESCE);
14115         if (!hdr)
14116                 goto nla_put_failure;
14117
14118         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
14119                 goto nla_put_failure;
14120
14121         genlmsg_end(msg, hdr);
14122         return genlmsg_reply(msg, info);
14123
14124 nla_put_failure:
14125         nlmsg_free(msg);
14126         return -ENOBUFS;
14127 }
14128
14129 void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
14130 {
14131         int i, j;
14132         struct cfg80211_coalesce_rules *rule;
14133
14134         if (!coalesce)
14135                 return;
14136
14137         for (i = 0; i < coalesce->n_rules; i++) {
14138                 rule = &coalesce->rules[i];
14139                 for (j = 0; j < rule->n_patterns; j++)
14140                         kfree(rule->patterns[j].mask);
14141                 kfree(rule->patterns);
14142         }
14143         kfree(coalesce);
14144 }
14145
14146 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
14147                                        struct nlattr *rule,
14148                                        struct cfg80211_coalesce_rules *new_rule)
14149 {
14150         int err, i;
14151         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14152         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
14153         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
14154         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14155
14156         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
14157                                           rule, nl80211_coalesce_policy, NULL);
14158         if (err)
14159                 return err;
14160
14161         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
14162                 new_rule->delay =
14163                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
14164         if (new_rule->delay > coalesce->max_delay)
14165                 return -EINVAL;
14166
14167         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
14168                 new_rule->condition =
14169                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
14170
14171         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
14172                 return -EINVAL;
14173
14174         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14175                             rem)
14176                 n_patterns++;
14177         if (n_patterns > coalesce->n_patterns)
14178                 return -EINVAL;
14179
14180         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
14181                                      GFP_KERNEL);
14182         if (!new_rule->patterns)
14183                 return -ENOMEM;
14184
14185         new_rule->n_patterns = n_patterns;
14186         i = 0;
14187
14188         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
14189                             rem) {
14190                 u8 *mask_pat;
14191
14192                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
14193                                                   pat,
14194                                                   nl80211_packet_pattern_policy,
14195                                                   NULL);
14196                 if (err)
14197                         return err;
14198
14199                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
14200                     !pat_tb[NL80211_PKTPAT_PATTERN])
14201                         return -EINVAL;
14202                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14203                 mask_len = DIV_ROUND_UP(pat_len, 8);
14204                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14205                         return -EINVAL;
14206                 if (pat_len > coalesce->pattern_max_len ||
14207                     pat_len < coalesce->pattern_min_len)
14208                         return -EINVAL;
14209
14210                 pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14211                                                  0);
14212                 if (pkt_offset > coalesce->max_pkt_offset)
14213                         return -EINVAL;
14214                 new_rule->patterns[i].pkt_offset = pkt_offset;
14215
14216                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14217                 if (!mask_pat)
14218                         return -ENOMEM;
14219
14220                 new_rule->patterns[i].mask = mask_pat;
14221                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14222                        mask_len);
14223
14224                 mask_pat += mask_len;
14225                 new_rule->patterns[i].pattern = mask_pat;
14226                 new_rule->patterns[i].pattern_len = pat_len;
14227                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14228                        pat_len);
14229                 i++;
14230         }
14231
14232         return 0;
14233 }
14234
14235 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
14236 {
14237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14238         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
14239         struct cfg80211_coalesce *new_coalesce;
14240         int err, rem_rule, n_rules = 0, i;
14241         struct nlattr *rule;
14242
14243         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
14244                 return -EOPNOTSUPP;
14245
14246         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
14247                 cfg80211_free_coalesce(rdev->coalesce);
14248                 rdev->coalesce = NULL;
14249                 rdev_set_coalesce(rdev, NULL);
14250                 return 0;
14251         }
14252
14253         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14254                             rem_rule)
14255                 n_rules++;
14256         if (n_rules > coalesce->n_rules)
14257                 return -EINVAL;
14258
14259         new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
14260                                GFP_KERNEL);
14261         if (!new_coalesce)
14262                 return -ENOMEM;
14263
14264         new_coalesce->n_rules = n_rules;
14265         i = 0;
14266
14267         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
14268                             rem_rule) {
14269                 err = nl80211_parse_coalesce_rule(rdev, rule,
14270                                                   &new_coalesce->rules[i]);
14271                 if (err)
14272                         goto error;
14273
14274                 i++;
14275         }
14276
14277         err = rdev_set_coalesce(rdev, new_coalesce);
14278         if (err)
14279                 goto error;
14280
14281         cfg80211_free_coalesce(rdev->coalesce);
14282         rdev->coalesce = new_coalesce;
14283
14284         return 0;
14285 error:
14286         cfg80211_free_coalesce(new_coalesce);
14287
14288         return err;
14289 }
14290
14291 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14292 {
14293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14294         struct net_device *dev = info->user_ptr[1];
14295         struct wireless_dev *wdev = dev->ieee80211_ptr;
14296         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14297         struct cfg80211_gtk_rekey_data rekey_data = {};
14298         int err;
14299
14300         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14301                 return -EINVAL;
14302
14303         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14304                                           info->attrs[NL80211_ATTR_REKEY_DATA],
14305                                           nl80211_rekey_policy, info->extack);
14306         if (err)
14307                 return err;
14308
14309         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14310             !tb[NL80211_REKEY_DATA_KCK])
14311                 return -EINVAL;
14312         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14313             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14314               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14315                 return -ERANGE;
14316         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14317             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14318               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14319              !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14320                nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14321                 return -ERANGE;
14322
14323         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14324         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14325         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14326         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14327         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14328         if (tb[NL80211_REKEY_DATA_AKM])
14329                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14330
14331         if (!wdev->connected)
14332                 return -ENOTCONN;
14333
14334         if (!rdev->ops->set_rekey_data)
14335                 return -EOPNOTSUPP;
14336
14337         return rdev_set_rekey_data(rdev, dev, &rekey_data);
14338 }
14339
14340 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14341                                              struct genl_info *info)
14342 {
14343         struct net_device *dev = info->user_ptr[1];
14344         struct wireless_dev *wdev = dev->ieee80211_ptr;
14345
14346         if (wdev->iftype != NL80211_IFTYPE_AP &&
14347             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14348                 return -EINVAL;
14349
14350         if (wdev->ap_unexpected_nlportid)
14351                 return -EBUSY;
14352
14353         wdev->ap_unexpected_nlportid = info->snd_portid;
14354         return 0;
14355 }
14356
14357 static int nl80211_probe_client(struct sk_buff *skb,
14358                                 struct genl_info *info)
14359 {
14360         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14361         struct net_device *dev = info->user_ptr[1];
14362         struct wireless_dev *wdev = dev->ieee80211_ptr;
14363         struct sk_buff *msg;
14364         void *hdr;
14365         const u8 *addr;
14366         u64 cookie;
14367         int err;
14368
14369         if (wdev->iftype != NL80211_IFTYPE_AP &&
14370             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14371                 return -EOPNOTSUPP;
14372
14373         if (!info->attrs[NL80211_ATTR_MAC])
14374                 return -EINVAL;
14375
14376         if (!rdev->ops->probe_client)
14377                 return -EOPNOTSUPP;
14378
14379         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14380         if (!msg)
14381                 return -ENOMEM;
14382
14383         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14384                              NL80211_CMD_PROBE_CLIENT);
14385         if (!hdr) {
14386                 err = -ENOBUFS;
14387                 goto free_msg;
14388         }
14389
14390         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14391
14392         err = rdev_probe_client(rdev, dev, addr, &cookie);
14393         if (err)
14394                 goto free_msg;
14395
14396         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14397                               NL80211_ATTR_PAD))
14398                 goto nla_put_failure;
14399
14400         genlmsg_end(msg, hdr);
14401
14402         return genlmsg_reply(msg, info);
14403
14404  nla_put_failure:
14405         err = -ENOBUFS;
14406  free_msg:
14407         nlmsg_free(msg);
14408         return err;
14409 }
14410
14411 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14412 {
14413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14414         struct cfg80211_beacon_registration *reg, *nreg;
14415         int rv;
14416
14417         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14418                 return -EOPNOTSUPP;
14419
14420         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14421         if (!nreg)
14422                 return -ENOMEM;
14423
14424         /* First, check if already registered. */
14425         spin_lock_bh(&rdev->beacon_registrations_lock);
14426         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14427                 if (reg->nlportid == info->snd_portid) {
14428                         rv = -EALREADY;
14429                         goto out_err;
14430                 }
14431         }
14432         /* Add it to the list */
14433         nreg->nlportid = info->snd_portid;
14434         list_add(&nreg->list, &rdev->beacon_registrations);
14435
14436         spin_unlock_bh(&rdev->beacon_registrations_lock);
14437
14438         return 0;
14439 out_err:
14440         spin_unlock_bh(&rdev->beacon_registrations_lock);
14441         kfree(nreg);
14442         return rv;
14443 }
14444
14445 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14446 {
14447         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14448         struct wireless_dev *wdev = info->user_ptr[1];
14449         int err;
14450
14451         if (!rdev->ops->start_p2p_device)
14452                 return -EOPNOTSUPP;
14453
14454         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14455                 return -EOPNOTSUPP;
14456
14457         if (wdev_running(wdev))
14458                 return 0;
14459
14460         if (rfkill_blocked(rdev->wiphy.rfkill))
14461                 return -ERFKILL;
14462
14463         err = rdev_start_p2p_device(rdev, wdev);
14464         if (err)
14465                 return err;
14466
14467         wdev->is_running = true;
14468         rdev->opencount++;
14469
14470         return 0;
14471 }
14472
14473 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14474 {
14475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14476         struct wireless_dev *wdev = info->user_ptr[1];
14477
14478         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14479                 return -EOPNOTSUPP;
14480
14481         if (!rdev->ops->stop_p2p_device)
14482                 return -EOPNOTSUPP;
14483
14484         cfg80211_stop_p2p_device(rdev, wdev);
14485
14486         return 0;
14487 }
14488
14489 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14490 {
14491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14492         struct wireless_dev *wdev = info->user_ptr[1];
14493         struct cfg80211_nan_conf conf = {};
14494         int err;
14495
14496         if (wdev->iftype != NL80211_IFTYPE_NAN)
14497                 return -EOPNOTSUPP;
14498
14499         if (wdev_running(wdev))
14500                 return -EEXIST;
14501
14502         if (rfkill_blocked(rdev->wiphy.rfkill))
14503                 return -ERFKILL;
14504
14505         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14506                 return -EINVAL;
14507
14508         conf.master_pref =
14509                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14510
14511         if (info->attrs[NL80211_ATTR_BANDS]) {
14512                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14513
14514                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14515                         return -EOPNOTSUPP;
14516
14517                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14518                         return -EINVAL;
14519
14520                 conf.bands = bands;
14521         }
14522
14523         err = rdev_start_nan(rdev, wdev, &conf);
14524         if (err)
14525                 return err;
14526
14527         wdev->is_running = true;
14528         rdev->opencount++;
14529
14530         return 0;
14531 }
14532
14533 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14534 {
14535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14536         struct wireless_dev *wdev = info->user_ptr[1];
14537
14538         if (wdev->iftype != NL80211_IFTYPE_NAN)
14539                 return -EOPNOTSUPP;
14540
14541         cfg80211_stop_nan(rdev, wdev);
14542
14543         return 0;
14544 }
14545
14546 static int validate_nan_filter(struct nlattr *filter_attr)
14547 {
14548         struct nlattr *attr;
14549         int len = 0, n_entries = 0, rem;
14550
14551         nla_for_each_nested(attr, filter_attr, rem) {
14552                 len += nla_len(attr);
14553                 n_entries++;
14554         }
14555
14556         if (len >= U8_MAX)
14557                 return -EINVAL;
14558
14559         return n_entries;
14560 }
14561
14562 static int handle_nan_filter(struct nlattr *attr_filter,
14563                              struct cfg80211_nan_func *func,
14564                              bool tx)
14565 {
14566         struct nlattr *attr;
14567         int n_entries, rem, i;
14568         struct cfg80211_nan_func_filter *filter;
14569
14570         n_entries = validate_nan_filter(attr_filter);
14571         if (n_entries < 0)
14572                 return n_entries;
14573
14574         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14575
14576         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14577         if (!filter)
14578                 return -ENOMEM;
14579
14580         i = 0;
14581         nla_for_each_nested(attr, attr_filter, rem) {
14582                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14583                 if (!filter[i].filter)
14584                         goto err;
14585
14586                 filter[i].len = nla_len(attr);
14587                 i++;
14588         }
14589         if (tx) {
14590                 func->num_tx_filters = n_entries;
14591                 func->tx_filters = filter;
14592         } else {
14593                 func->num_rx_filters = n_entries;
14594                 func->rx_filters = filter;
14595         }
14596
14597         return 0;
14598
14599 err:
14600         i = 0;
14601         nla_for_each_nested(attr, attr_filter, rem) {
14602                 kfree(filter[i].filter);
14603                 i++;
14604         }
14605         kfree(filter);
14606         return -ENOMEM;
14607 }
14608
14609 static int nl80211_nan_add_func(struct sk_buff *skb,
14610                                 struct genl_info *info)
14611 {
14612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14613         struct wireless_dev *wdev = info->user_ptr[1];
14614         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14615         struct cfg80211_nan_func *func;
14616         struct sk_buff *msg = NULL;
14617         void *hdr = NULL;
14618         int err = 0;
14619
14620         if (wdev->iftype != NL80211_IFTYPE_NAN)
14621                 return -EOPNOTSUPP;
14622
14623         if (!wdev_running(wdev))
14624                 return -ENOTCONN;
14625
14626         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14627                 return -EINVAL;
14628
14629         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14630                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14631                                           nl80211_nan_func_policy,
14632                                           info->extack);
14633         if (err)
14634                 return err;
14635
14636         func = kzalloc(sizeof(*func), GFP_KERNEL);
14637         if (!func)
14638                 return -ENOMEM;
14639
14640         func->cookie = cfg80211_assign_cookie(rdev);
14641
14642         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14643                 err = -EINVAL;
14644                 goto out;
14645         }
14646
14647
14648         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14649
14650         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14651                 err = -EINVAL;
14652                 goto out;
14653         }
14654
14655         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14656                sizeof(func->service_id));
14657
14658         func->close_range =
14659                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14660
14661         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14662                 func->serv_spec_info_len =
14663                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14664                 func->serv_spec_info =
14665                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14666                                 func->serv_spec_info_len,
14667                                 GFP_KERNEL);
14668                 if (!func->serv_spec_info) {
14669                         err = -ENOMEM;
14670                         goto out;
14671                 }
14672         }
14673
14674         if (tb[NL80211_NAN_FUNC_TTL])
14675                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14676
14677         switch (func->type) {
14678         case NL80211_NAN_FUNC_PUBLISH:
14679                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14680                         err = -EINVAL;
14681                         goto out;
14682                 }
14683
14684                 func->publish_type =
14685                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14686                 func->publish_bcast =
14687                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14688
14689                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14690                         func->publish_bcast) {
14691                         err = -EINVAL;
14692                         goto out;
14693                 }
14694                 break;
14695         case NL80211_NAN_FUNC_SUBSCRIBE:
14696                 func->subscribe_active =
14697                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14698                 break;
14699         case NL80211_NAN_FUNC_FOLLOW_UP:
14700                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14701                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14702                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14703                         err = -EINVAL;
14704                         goto out;
14705                 }
14706
14707                 func->followup_id =
14708                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14709                 func->followup_reqid =
14710                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14711                 memcpy(func->followup_dest.addr,
14712                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14713                        sizeof(func->followup_dest.addr));
14714                 if (func->ttl) {
14715                         err = -EINVAL;
14716                         goto out;
14717                 }
14718                 break;
14719         default:
14720                 err = -EINVAL;
14721                 goto out;
14722         }
14723
14724         if (tb[NL80211_NAN_FUNC_SRF]) {
14725                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14726
14727                 err = nla_parse_nested_deprecated(srf_tb,
14728                                                   NL80211_NAN_SRF_ATTR_MAX,
14729                                                   tb[NL80211_NAN_FUNC_SRF],
14730                                                   nl80211_nan_srf_policy,
14731                                                   info->extack);
14732                 if (err)
14733                         goto out;
14734
14735                 func->srf_include =
14736                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14737
14738                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14739                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14740                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14741                                 err = -EINVAL;
14742                                 goto out;
14743                         }
14744
14745                         func->srf_bf_len =
14746                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14747                         func->srf_bf =
14748                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14749                                         func->srf_bf_len, GFP_KERNEL);
14750                         if (!func->srf_bf) {
14751                                 err = -ENOMEM;
14752                                 goto out;
14753                         }
14754
14755                         func->srf_bf_idx =
14756                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14757                 } else {
14758                         struct nlattr *attr, *mac_attr =
14759                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14760                         int n_entries, rem, i = 0;
14761
14762                         if (!mac_attr) {
14763                                 err = -EINVAL;
14764                                 goto out;
14765                         }
14766
14767                         n_entries = validate_acl_mac_addrs(mac_attr);
14768                         if (n_entries <= 0) {
14769                                 err = -EINVAL;
14770                                 goto out;
14771                         }
14772
14773                         func->srf_num_macs = n_entries;
14774                         func->srf_macs =
14775                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14776                                         GFP_KERNEL);
14777                         if (!func->srf_macs) {
14778                                 err = -ENOMEM;
14779                                 goto out;
14780                         }
14781
14782                         nla_for_each_nested(attr, mac_attr, rem)
14783                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14784                                        sizeof(*func->srf_macs));
14785                 }
14786         }
14787
14788         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14789                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14790                                         func, true);
14791                 if (err)
14792                         goto out;
14793         }
14794
14795         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14796                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14797                                         func, false);
14798                 if (err)
14799                         goto out;
14800         }
14801
14802         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14803         if (!msg) {
14804                 err = -ENOMEM;
14805                 goto out;
14806         }
14807
14808         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14809                              NL80211_CMD_ADD_NAN_FUNCTION);
14810         /* This can't really happen - we just allocated 4KB */
14811         if (WARN_ON(!hdr)) {
14812                 err = -ENOMEM;
14813                 goto out;
14814         }
14815
14816         err = rdev_add_nan_func(rdev, wdev, func);
14817 out:
14818         if (err < 0) {
14819                 cfg80211_free_nan_func(func);
14820                 nlmsg_free(msg);
14821                 return err;
14822         }
14823
14824         /* propagate the instance id and cookie to userspace  */
14825         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14826                               NL80211_ATTR_PAD))
14827                 goto nla_put_failure;
14828
14829         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14830         if (!func_attr)
14831                 goto nla_put_failure;
14832
14833         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14834                        func->instance_id))
14835                 goto nla_put_failure;
14836
14837         nla_nest_end(msg, func_attr);
14838
14839         genlmsg_end(msg, hdr);
14840         return genlmsg_reply(msg, info);
14841
14842 nla_put_failure:
14843         nlmsg_free(msg);
14844         return -ENOBUFS;
14845 }
14846
14847 static int nl80211_nan_del_func(struct sk_buff *skb,
14848                                struct genl_info *info)
14849 {
14850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14851         struct wireless_dev *wdev = info->user_ptr[1];
14852         u64 cookie;
14853
14854         if (wdev->iftype != NL80211_IFTYPE_NAN)
14855                 return -EOPNOTSUPP;
14856
14857         if (!wdev_running(wdev))
14858                 return -ENOTCONN;
14859
14860         if (!info->attrs[NL80211_ATTR_COOKIE])
14861                 return -EINVAL;
14862
14863         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14864
14865         rdev_del_nan_func(rdev, wdev, cookie);
14866
14867         return 0;
14868 }
14869
14870 static int nl80211_nan_change_config(struct sk_buff *skb,
14871                                      struct genl_info *info)
14872 {
14873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14874         struct wireless_dev *wdev = info->user_ptr[1];
14875         struct cfg80211_nan_conf conf = {};
14876         u32 changed = 0;
14877
14878         if (wdev->iftype != NL80211_IFTYPE_NAN)
14879                 return -EOPNOTSUPP;
14880
14881         if (!wdev_running(wdev))
14882                 return -ENOTCONN;
14883
14884         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14885                 conf.master_pref =
14886                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14887                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14888                         return -EINVAL;
14889
14890                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14891         }
14892
14893         if (info->attrs[NL80211_ATTR_BANDS]) {
14894                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14895
14896                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14897                         return -EOPNOTSUPP;
14898
14899                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14900                         return -EINVAL;
14901
14902                 conf.bands = bands;
14903                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14904         }
14905
14906         if (!changed)
14907                 return -EINVAL;
14908
14909         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14910 }
14911
14912 void cfg80211_nan_match(struct wireless_dev *wdev,
14913                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14914 {
14915         struct wiphy *wiphy = wdev->wiphy;
14916         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14917         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14918         struct sk_buff *msg;
14919         void *hdr;
14920
14921         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14922                 return;
14923
14924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14925         if (!msg)
14926                 return;
14927
14928         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14929         if (!hdr) {
14930                 nlmsg_free(msg);
14931                 return;
14932         }
14933
14934         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14935             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14936                                          wdev->netdev->ifindex)) ||
14937             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14938                               NL80211_ATTR_PAD))
14939                 goto nla_put_failure;
14940
14941         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14942                               NL80211_ATTR_PAD) ||
14943             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14944                 goto nla_put_failure;
14945
14946         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14947         if (!match_attr)
14948                 goto nla_put_failure;
14949
14950         local_func_attr = nla_nest_start_noflag(msg,
14951                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14952         if (!local_func_attr)
14953                 goto nla_put_failure;
14954
14955         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14956                 goto nla_put_failure;
14957
14958         nla_nest_end(msg, local_func_attr);
14959
14960         peer_func_attr = nla_nest_start_noflag(msg,
14961                                                NL80211_NAN_MATCH_FUNC_PEER);
14962         if (!peer_func_attr)
14963                 goto nla_put_failure;
14964
14965         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14966             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14967                 goto nla_put_failure;
14968
14969         if (match->info && match->info_len &&
14970             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14971                     match->info))
14972                 goto nla_put_failure;
14973
14974         nla_nest_end(msg, peer_func_attr);
14975         nla_nest_end(msg, match_attr);
14976         genlmsg_end(msg, hdr);
14977
14978         if (!wdev->owner_nlportid)
14979                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14980                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14981         else
14982                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14983                                 wdev->owner_nlportid);
14984
14985         return;
14986
14987 nla_put_failure:
14988         nlmsg_free(msg);
14989 }
14990 EXPORT_SYMBOL(cfg80211_nan_match);
14991
14992 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14993                                   u8 inst_id,
14994                                   enum nl80211_nan_func_term_reason reason,
14995                                   u64 cookie, gfp_t gfp)
14996 {
14997         struct wiphy *wiphy = wdev->wiphy;
14998         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14999         struct sk_buff *msg;
15000         struct nlattr *func_attr;
15001         void *hdr;
15002
15003         if (WARN_ON(!inst_id))
15004                 return;
15005
15006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15007         if (!msg)
15008                 return;
15009
15010         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
15011         if (!hdr) {
15012                 nlmsg_free(msg);
15013                 return;
15014         }
15015
15016         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15017             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15018                                          wdev->netdev->ifindex)) ||
15019             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15020                               NL80211_ATTR_PAD))
15021                 goto nla_put_failure;
15022
15023         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15024                               NL80211_ATTR_PAD))
15025                 goto nla_put_failure;
15026
15027         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
15028         if (!func_attr)
15029                 goto nla_put_failure;
15030
15031         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
15032             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
15033                 goto nla_put_failure;
15034
15035         nla_nest_end(msg, func_attr);
15036         genlmsg_end(msg, hdr);
15037
15038         if (!wdev->owner_nlportid)
15039                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
15040                                         msg, 0, NL80211_MCGRP_NAN, gfp);
15041         else
15042                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
15043                                 wdev->owner_nlportid);
15044
15045         return;
15046
15047 nla_put_failure:
15048         nlmsg_free(msg);
15049 }
15050 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
15051
15052 static int nl80211_get_protocol_features(struct sk_buff *skb,
15053                                          struct genl_info *info)
15054 {
15055         void *hdr;
15056         struct sk_buff *msg;
15057
15058         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15059         if (!msg)
15060                 return -ENOMEM;
15061
15062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15063                              NL80211_CMD_GET_PROTOCOL_FEATURES);
15064         if (!hdr)
15065                 goto nla_put_failure;
15066
15067         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
15068                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
15069                 goto nla_put_failure;
15070
15071         genlmsg_end(msg, hdr);
15072         return genlmsg_reply(msg, info);
15073
15074  nla_put_failure:
15075         kfree_skb(msg);
15076         return -ENOBUFS;
15077 }
15078
15079 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
15080 {
15081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15082         struct cfg80211_update_ft_ies_params ft_params;
15083         struct net_device *dev = info->user_ptr[1];
15084
15085         if (!rdev->ops->update_ft_ies)
15086                 return -EOPNOTSUPP;
15087
15088         if (!info->attrs[NL80211_ATTR_MDID] ||
15089             !info->attrs[NL80211_ATTR_IE])
15090                 return -EINVAL;
15091
15092         memset(&ft_params, 0, sizeof(ft_params));
15093         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
15094         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15095         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15096
15097         return rdev_update_ft_ies(rdev, dev, &ft_params);
15098 }
15099
15100 static int nl80211_crit_protocol_start(struct sk_buff *skb,
15101                                        struct genl_info *info)
15102 {
15103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15104         struct wireless_dev *wdev = info->user_ptr[1];
15105         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
15106         u16 duration;
15107         int ret;
15108
15109         if (!rdev->ops->crit_proto_start)
15110                 return -EOPNOTSUPP;
15111
15112         if (WARN_ON(!rdev->ops->crit_proto_stop))
15113                 return -EINVAL;
15114
15115         if (rdev->crit_proto_nlportid)
15116                 return -EBUSY;
15117
15118         /* determine protocol if provided */
15119         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
15120                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
15121
15122         if (proto >= NUM_NL80211_CRIT_PROTO)
15123                 return -EINVAL;
15124
15125         /* timeout must be provided */
15126         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
15127                 return -EINVAL;
15128
15129         duration =
15130                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
15131
15132         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
15133         if (!ret)
15134                 rdev->crit_proto_nlportid = info->snd_portid;
15135
15136         return ret;
15137 }
15138
15139 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
15140                                       struct genl_info *info)
15141 {
15142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15143         struct wireless_dev *wdev = info->user_ptr[1];
15144
15145         if (!rdev->ops->crit_proto_stop)
15146                 return -EOPNOTSUPP;
15147
15148         if (rdev->crit_proto_nlportid) {
15149                 rdev->crit_proto_nlportid = 0;
15150                 rdev_crit_proto_stop(rdev, wdev);
15151         }
15152         return 0;
15153 }
15154
15155 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
15156                                        struct nlattr *attr,
15157                                        struct netlink_ext_ack *extack)
15158 {
15159         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
15160                 if (attr->nla_type & NLA_F_NESTED) {
15161                         NL_SET_ERR_MSG_ATTR(extack, attr,
15162                                             "unexpected nested data");
15163                         return -EINVAL;
15164                 }
15165
15166                 return 0;
15167         }
15168
15169         if (!(attr->nla_type & NLA_F_NESTED)) {
15170                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
15171                 return -EINVAL;
15172         }
15173
15174         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
15175 }
15176
15177 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
15178 {
15179         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15180         struct wireless_dev *wdev =
15181                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
15182                                            info->attrs);
15183         int i, err;
15184         u32 vid, subcmd;
15185
15186         if (!rdev->wiphy.vendor_commands)
15187                 return -EOPNOTSUPP;
15188
15189         if (IS_ERR(wdev)) {
15190                 err = PTR_ERR(wdev);
15191                 if (err != -EINVAL)
15192                         return err;
15193                 wdev = NULL;
15194         } else if (wdev->wiphy != &rdev->wiphy) {
15195                 return -EINVAL;
15196         }
15197
15198         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
15199             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
15200                 return -EINVAL;
15201
15202         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
15203         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
15204         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
15205                 const struct wiphy_vendor_command *vcmd;
15206                 void *data = NULL;
15207                 int len = 0;
15208
15209                 vcmd = &rdev->wiphy.vendor_commands[i];
15210
15211                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15212                         continue;
15213
15214                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15215                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15216                         if (!wdev)
15217                                 return -EINVAL;
15218                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15219                             !wdev->netdev)
15220                                 return -EINVAL;
15221
15222                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15223                                 if (!wdev_running(wdev))
15224                                         return -ENETDOWN;
15225                         }
15226                 } else {
15227                         wdev = NULL;
15228                 }
15229
15230                 if (!vcmd->doit)
15231                         return -EOPNOTSUPP;
15232
15233                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
15234                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15235                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
15236
15237                         err = nl80211_vendor_check_policy(vcmd,
15238                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
15239                                         info->extack);
15240                         if (err)
15241                                 return err;
15242                 }
15243
15244                 rdev->cur_cmd_info = info;
15245                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
15246                 rdev->cur_cmd_info = NULL;
15247                 return err;
15248         }
15249
15250         return -EOPNOTSUPP;
15251 }
15252
15253 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
15254                                        struct netlink_callback *cb,
15255                                        struct cfg80211_registered_device **rdev,
15256                                        struct wireless_dev **wdev)
15257 {
15258         struct nlattr **attrbuf;
15259         u32 vid, subcmd;
15260         unsigned int i;
15261         int vcmd_idx = -1;
15262         int err;
15263         void *data = NULL;
15264         unsigned int data_len = 0;
15265
15266         if (cb->args[0]) {
15267                 /* subtract the 1 again here */
15268                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15269                 struct wireless_dev *tmp;
15270
15271                 if (!wiphy)
15272                         return -ENODEV;
15273                 *rdev = wiphy_to_rdev(wiphy);
15274                 *wdev = NULL;
15275
15276                 if (cb->args[1]) {
15277                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15278                                 if (tmp->identifier == cb->args[1] - 1) {
15279                                         *wdev = tmp;
15280                                         break;
15281                                 }
15282                         }
15283                 }
15284
15285                 /* keep rtnl locked in successful case */
15286                 return 0;
15287         }
15288
15289         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15290         if (!attrbuf)
15291                 return -ENOMEM;
15292
15293         err = nlmsg_parse_deprecated(cb->nlh,
15294                                      GENL_HDRLEN + nl80211_fam.hdrsize,
15295                                      attrbuf, nl80211_fam.maxattr,
15296                                      nl80211_policy, NULL);
15297         if (err)
15298                 goto out;
15299
15300         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15301             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15302                 err = -EINVAL;
15303                 goto out;
15304         }
15305
15306         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15307         if (IS_ERR(*wdev))
15308                 *wdev = NULL;
15309
15310         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15311         if (IS_ERR(*rdev)) {
15312                 err = PTR_ERR(*rdev);
15313                 goto out;
15314         }
15315
15316         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15317         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15318
15319         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15320                 const struct wiphy_vendor_command *vcmd;
15321
15322                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15323
15324                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15325                         continue;
15326
15327                 if (!vcmd->dumpit) {
15328                         err = -EOPNOTSUPP;
15329                         goto out;
15330                 }
15331
15332                 vcmd_idx = i;
15333                 break;
15334         }
15335
15336         if (vcmd_idx < 0) {
15337                 err = -EOPNOTSUPP;
15338                 goto out;
15339         }
15340
15341         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15342                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15343                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15344
15345                 err = nl80211_vendor_check_policy(
15346                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15347                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
15348                                 cb->extack);
15349                 if (err)
15350                         goto out;
15351         }
15352
15353         /* 0 is the first index - add 1 to parse only once */
15354         cb->args[0] = (*rdev)->wiphy_idx + 1;
15355         /* add 1 to know if it was NULL */
15356         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15357         cb->args[2] = vcmd_idx;
15358         cb->args[3] = (unsigned long)data;
15359         cb->args[4] = data_len;
15360
15361         /* keep rtnl locked in successful case */
15362         err = 0;
15363 out:
15364         kfree(attrbuf);
15365         return err;
15366 }
15367
15368 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15369                                    struct netlink_callback *cb)
15370 {
15371         struct cfg80211_registered_device *rdev;
15372         struct wireless_dev *wdev;
15373         unsigned int vcmd_idx;
15374         const struct wiphy_vendor_command *vcmd;
15375         void *data;
15376         int data_len;
15377         int err;
15378         struct nlattr *vendor_data;
15379
15380         rtnl_lock();
15381         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15382         if (err)
15383                 goto out;
15384
15385         vcmd_idx = cb->args[2];
15386         data = (void *)cb->args[3];
15387         data_len = cb->args[4];
15388         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15389
15390         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15391                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15392                 if (!wdev) {
15393                         err = -EINVAL;
15394                         goto out;
15395                 }
15396                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15397                     !wdev->netdev) {
15398                         err = -EINVAL;
15399                         goto out;
15400                 }
15401
15402                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15403                         if (!wdev_running(wdev)) {
15404                                 err = -ENETDOWN;
15405                                 goto out;
15406                         }
15407                 }
15408         }
15409
15410         while (1) {
15411                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15412                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
15413                                            NL80211_CMD_VENDOR);
15414                 if (!hdr)
15415                         break;
15416
15417                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15418                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15419                                                wdev_id(wdev),
15420                                                NL80211_ATTR_PAD))) {
15421                         genlmsg_cancel(skb, hdr);
15422                         break;
15423                 }
15424
15425                 vendor_data = nla_nest_start_noflag(skb,
15426                                                     NL80211_ATTR_VENDOR_DATA);
15427                 if (!vendor_data) {
15428                         genlmsg_cancel(skb, hdr);
15429                         break;
15430                 }
15431
15432                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15433                                    (unsigned long *)&cb->args[5]);
15434                 nla_nest_end(skb, vendor_data);
15435
15436                 if (err == -ENOBUFS || err == -ENOENT) {
15437                         genlmsg_cancel(skb, hdr);
15438                         break;
15439                 } else if (err <= 0) {
15440                         genlmsg_cancel(skb, hdr);
15441                         goto out;
15442                 }
15443
15444                 genlmsg_end(skb, hdr);
15445         }
15446
15447         err = skb->len;
15448  out:
15449         rtnl_unlock();
15450         return err;
15451 }
15452
15453 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15454                                            enum nl80211_commands cmd,
15455                                            enum nl80211_attrs attr,
15456                                            int approxlen)
15457 {
15458         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15459
15460         if (WARN_ON(!rdev->cur_cmd_info))
15461                 return NULL;
15462
15463         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15464                                            rdev->cur_cmd_info->snd_portid,
15465                                            rdev->cur_cmd_info->snd_seq,
15466                                            cmd, attr, NULL, GFP_KERNEL);
15467 }
15468 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15469
15470 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15471 {
15472         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15473         void *hdr = ((void **)skb->cb)[1];
15474         struct nlattr *data = ((void **)skb->cb)[2];
15475
15476         /* clear CB data for netlink core to own from now on */
15477         memset(skb->cb, 0, sizeof(skb->cb));
15478
15479         if (WARN_ON(!rdev->cur_cmd_info)) {
15480                 kfree_skb(skb);
15481                 return -EINVAL;
15482         }
15483
15484         nla_nest_end(skb, data);
15485         genlmsg_end(skb, hdr);
15486         return genlmsg_reply(skb, rdev->cur_cmd_info);
15487 }
15488 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15489
15490 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15491 {
15492         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15493
15494         if (WARN_ON(!rdev->cur_cmd_info))
15495                 return 0;
15496
15497         return rdev->cur_cmd_info->snd_portid;
15498 }
15499 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15500
15501 static int nl80211_set_qos_map(struct sk_buff *skb,
15502                                struct genl_info *info)
15503 {
15504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15505         struct cfg80211_qos_map *qos_map = NULL;
15506         struct net_device *dev = info->user_ptr[1];
15507         u8 *pos, len, num_des, des_len, des;
15508         int ret;
15509
15510         if (!rdev->ops->set_qos_map)
15511                 return -EOPNOTSUPP;
15512
15513         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15514                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15515                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15516
15517                 if (len % 2)
15518                         return -EINVAL;
15519
15520                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15521                 if (!qos_map)
15522                         return -ENOMEM;
15523
15524                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15525                 if (num_des) {
15526                         des_len = num_des *
15527                                 sizeof(struct cfg80211_dscp_exception);
15528                         memcpy(qos_map->dscp_exception, pos, des_len);
15529                         qos_map->num_des = num_des;
15530                         for (des = 0; des < num_des; des++) {
15531                                 if (qos_map->dscp_exception[des].up > 7) {
15532                                         kfree(qos_map);
15533                                         return -EINVAL;
15534                                 }
15535                         }
15536                         pos += des_len;
15537                 }
15538                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15539         }
15540
15541         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15542         if (!ret)
15543                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15544
15545         kfree(qos_map);
15546         return ret;
15547 }
15548
15549 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15550 {
15551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15552         struct net_device *dev = info->user_ptr[1];
15553         struct wireless_dev *wdev = dev->ieee80211_ptr;
15554         const u8 *peer;
15555         u8 tsid, up;
15556         u16 admitted_time = 0;
15557
15558         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15559                 return -EOPNOTSUPP;
15560
15561         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15562             !info->attrs[NL80211_ATTR_USER_PRIO])
15563                 return -EINVAL;
15564
15565         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15566         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15567
15568         /* WMM uses TIDs 0-7 even for TSPEC */
15569         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15570                 /* TODO: handle 802.11 TSPEC/admission control
15571                  * need more attributes for that (e.g. BA session requirement);
15572                  * change the WMM admission test above to allow both then
15573                  */
15574                 return -EINVAL;
15575         }
15576
15577         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15578
15579         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15580                 admitted_time =
15581                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15582                 if (!admitted_time)
15583                         return -EINVAL;
15584         }
15585
15586         switch (wdev->iftype) {
15587         case NL80211_IFTYPE_STATION:
15588         case NL80211_IFTYPE_P2P_CLIENT:
15589                 if (wdev->connected)
15590                         break;
15591                 return -ENOTCONN;
15592         default:
15593                 return -EOPNOTSUPP;
15594         }
15595
15596         return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15597 }
15598
15599 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15600 {
15601         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15602         struct net_device *dev = info->user_ptr[1];
15603         const u8 *peer;
15604         u8 tsid;
15605
15606         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15607                 return -EINVAL;
15608
15609         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15610         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15611
15612         return rdev_del_tx_ts(rdev, dev, tsid, peer);
15613 }
15614
15615 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15616                                        struct genl_info *info)
15617 {
15618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15619         struct net_device *dev = info->user_ptr[1];
15620         struct wireless_dev *wdev = dev->ieee80211_ptr;
15621         struct cfg80211_chan_def chandef = {};
15622         const u8 *addr;
15623         u8 oper_class;
15624         int err;
15625
15626         if (!rdev->ops->tdls_channel_switch ||
15627             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15628                 return -EOPNOTSUPP;
15629
15630         switch (dev->ieee80211_ptr->iftype) {
15631         case NL80211_IFTYPE_STATION:
15632         case NL80211_IFTYPE_P2P_CLIENT:
15633                 break;
15634         default:
15635                 return -EOPNOTSUPP;
15636         }
15637
15638         if (!info->attrs[NL80211_ATTR_MAC] ||
15639             !info->attrs[NL80211_ATTR_OPER_CLASS])
15640                 return -EINVAL;
15641
15642         err = nl80211_parse_chandef(rdev, info, &chandef);
15643         if (err)
15644                 return err;
15645
15646         /*
15647          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15648          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15649          * specification is not defined for them.
15650          */
15651         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15652             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15653             chandef.width != NL80211_CHAN_WIDTH_20)
15654                 return -EINVAL;
15655
15656         /* we will be active on the TDLS link */
15657         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15658                                            wdev->iftype))
15659                 return -EINVAL;
15660
15661         /* don't allow switching to DFS channels */
15662         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15663                 return -EINVAL;
15664
15665         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15666         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15667
15668         return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15669 }
15670
15671 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15672                                               struct genl_info *info)
15673 {
15674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15675         struct net_device *dev = info->user_ptr[1];
15676         const u8 *addr;
15677
15678         if (!rdev->ops->tdls_channel_switch ||
15679             !rdev->ops->tdls_cancel_channel_switch ||
15680             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15681                 return -EOPNOTSUPP;
15682
15683         switch (dev->ieee80211_ptr->iftype) {
15684         case NL80211_IFTYPE_STATION:
15685         case NL80211_IFTYPE_P2P_CLIENT:
15686                 break;
15687         default:
15688                 return -EOPNOTSUPP;
15689         }
15690
15691         if (!info->attrs[NL80211_ATTR_MAC])
15692                 return -EINVAL;
15693
15694         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15695
15696         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15697
15698         return 0;
15699 }
15700
15701 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15702                                             struct genl_info *info)
15703 {
15704         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15705         struct net_device *dev = info->user_ptr[1];
15706         struct wireless_dev *wdev = dev->ieee80211_ptr;
15707         const struct nlattr *nla;
15708         bool enabled;
15709
15710         if (!rdev->ops->set_multicast_to_unicast)
15711                 return -EOPNOTSUPP;
15712
15713         if (wdev->iftype != NL80211_IFTYPE_AP &&
15714             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15715                 return -EOPNOTSUPP;
15716
15717         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15718         enabled = nla_get_flag(nla);
15719
15720         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15721 }
15722
15723 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15724 {
15725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15726         struct net_device *dev = info->user_ptr[1];
15727         struct wireless_dev *wdev = dev->ieee80211_ptr;
15728         struct cfg80211_pmk_conf pmk_conf = {};
15729
15730         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15731             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15732                 return -EOPNOTSUPP;
15733
15734         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15735                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15736                 return -EOPNOTSUPP;
15737
15738         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15739                 return -EINVAL;
15740
15741         if (!wdev->connected)
15742                 return -ENOTCONN;
15743
15744         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15745         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
15746                 return -EINVAL;
15747
15748         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15749         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15750         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15751             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
15752                 return -EINVAL;
15753
15754         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15755                 pmk_conf.pmk_r0_name =
15756                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15757
15758         return rdev_set_pmk(rdev, dev, &pmk_conf);
15759 }
15760
15761 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15762 {
15763         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15764         struct net_device *dev = info->user_ptr[1];
15765         struct wireless_dev *wdev = dev->ieee80211_ptr;
15766         const u8 *aa;
15767
15768         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15769             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15770                 return -EOPNOTSUPP;
15771
15772         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15773                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15774                 return -EOPNOTSUPP;
15775
15776         if (!info->attrs[NL80211_ATTR_MAC])
15777                 return -EINVAL;
15778
15779         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15780         return rdev_del_pmk(rdev, dev, aa);
15781 }
15782
15783 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15784 {
15785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15786         struct net_device *dev = info->user_ptr[1];
15787         struct cfg80211_external_auth_params params;
15788
15789         if (!rdev->ops->external_auth)
15790                 return -EOPNOTSUPP;
15791
15792         if (!info->attrs[NL80211_ATTR_SSID] &&
15793             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15794             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15795                 return -EINVAL;
15796
15797         if (!info->attrs[NL80211_ATTR_BSSID])
15798                 return -EINVAL;
15799
15800         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15801                 return -EINVAL;
15802
15803         memset(&params, 0, sizeof(params));
15804
15805         if (info->attrs[NL80211_ATTR_SSID]) {
15806                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15807                 if (params.ssid.ssid_len == 0)
15808                         return -EINVAL;
15809                 memcpy(params.ssid.ssid,
15810                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15811                        params.ssid.ssid_len);
15812         }
15813
15814         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15815                ETH_ALEN);
15816
15817         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15818
15819         if (info->attrs[NL80211_ATTR_PMKID])
15820                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15821
15822         return rdev_external_auth(rdev, dev, &params);
15823 }
15824
15825 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15826 {
15827         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15828         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15829         struct net_device *dev = info->user_ptr[1];
15830         struct wireless_dev *wdev = dev->ieee80211_ptr;
15831         const u8 *buf;
15832         size_t len;
15833         u8 *dest;
15834         u16 proto;
15835         bool noencrypt;
15836         u64 cookie = 0;
15837         int link_id;
15838         int err;
15839
15840         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15841                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15842                 return -EOPNOTSUPP;
15843
15844         if (!rdev->ops->tx_control_port)
15845                 return -EOPNOTSUPP;
15846
15847         if (!info->attrs[NL80211_ATTR_FRAME] ||
15848             !info->attrs[NL80211_ATTR_MAC] ||
15849             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15850                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15851                 return -EINVAL;
15852         }
15853
15854         switch (wdev->iftype) {
15855         case NL80211_IFTYPE_AP:
15856         case NL80211_IFTYPE_P2P_GO:
15857         case NL80211_IFTYPE_MESH_POINT:
15858                 break;
15859         case NL80211_IFTYPE_ADHOC:
15860                 if (wdev->u.ibss.current_bss)
15861                         break;
15862                 return -ENOTCONN;
15863         case NL80211_IFTYPE_STATION:
15864         case NL80211_IFTYPE_P2P_CLIENT:
15865                 if (wdev->connected)
15866                         break;
15867                 return -ENOTCONN;
15868         default:
15869                 return -EOPNOTSUPP;
15870         }
15871
15872         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15873         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15874         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15875         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15876         noencrypt =
15877                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15878
15879         link_id = nl80211_link_id_or_invalid(info->attrs);
15880
15881         err = rdev_tx_control_port(rdev, dev, buf, len,
15882                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15883                                    dont_wait_for_ack ? NULL : &cookie);
15884         if (!err && !dont_wait_for_ack)
15885                 nl_set_extack_cookie_u64(info->extack, cookie);
15886         return err;
15887 }
15888
15889 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15890                                            struct genl_info *info)
15891 {
15892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15893         struct net_device *dev = info->user_ptr[1];
15894         struct wireless_dev *wdev = dev->ieee80211_ptr;
15895         struct cfg80211_ftm_responder_stats ftm_stats = {};
15896         unsigned int link_id = nl80211_link_id(info->attrs);
15897         struct sk_buff *msg;
15898         void *hdr;
15899         struct nlattr *ftm_stats_attr;
15900         int err;
15901
15902         if (wdev->iftype != NL80211_IFTYPE_AP ||
15903             !wdev->links[link_id].ap.beacon_interval)
15904                 return -EOPNOTSUPP;
15905
15906         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15907         if (err)
15908                 return err;
15909
15910         if (!ftm_stats.filled)
15911                 return -ENODATA;
15912
15913         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15914         if (!msg)
15915                 return -ENOMEM;
15916
15917         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15918                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15919         if (!hdr)
15920                 goto nla_put_failure;
15921
15922         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15923                 goto nla_put_failure;
15924
15925         ftm_stats_attr = nla_nest_start_noflag(msg,
15926                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15927         if (!ftm_stats_attr)
15928                 goto nla_put_failure;
15929
15930 #define SET_FTM(field, name, type)                                       \
15931         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15932             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15933                              ftm_stats.field))                           \
15934                 goto nla_put_failure; } while (0)
15935 #define SET_FTM_U64(field, name)                                         \
15936         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15937             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15938                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15939                 goto nla_put_failure; } while (0)
15940
15941         SET_FTM(success_num, SUCCESS_NUM, u32);
15942         SET_FTM(partial_num, PARTIAL_NUM, u32);
15943         SET_FTM(failed_num, FAILED_NUM, u32);
15944         SET_FTM(asap_num, ASAP_NUM, u32);
15945         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15946         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15947         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15948         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15949         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15950 #undef SET_FTM
15951
15952         nla_nest_end(msg, ftm_stats_attr);
15953
15954         genlmsg_end(msg, hdr);
15955         return genlmsg_reply(msg, info);
15956
15957 nla_put_failure:
15958         nlmsg_free(msg);
15959         return -ENOBUFS;
15960 }
15961
15962 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15963 {
15964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15965         struct cfg80211_update_owe_info owe_info;
15966         struct net_device *dev = info->user_ptr[1];
15967
15968         if (!rdev->ops->update_owe_info)
15969                 return -EOPNOTSUPP;
15970
15971         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15972             !info->attrs[NL80211_ATTR_MAC])
15973                 return -EINVAL;
15974
15975         memset(&owe_info, 0, sizeof(owe_info));
15976         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15977         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15978
15979         if (info->attrs[NL80211_ATTR_IE]) {
15980                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15981                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15982         }
15983
15984         return rdev_update_owe_info(rdev, dev, &owe_info);
15985 }
15986
15987 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15988 {
15989         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15990         struct net_device *dev = info->user_ptr[1];
15991         struct wireless_dev *wdev = dev->ieee80211_ptr;
15992         struct station_info sinfo = {};
15993         const u8 *buf;
15994         size_t len;
15995         u8 *dest;
15996         int err;
15997
15998         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15999                 return -EOPNOTSUPP;
16000
16001         if (!info->attrs[NL80211_ATTR_MAC] ||
16002             !info->attrs[NL80211_ATTR_FRAME]) {
16003                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
16004                 return -EINVAL;
16005         }
16006
16007         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
16008                 return -EOPNOTSUPP;
16009
16010         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
16011         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
16012         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
16013
16014         if (len < sizeof(struct ethhdr))
16015                 return -EINVAL;
16016
16017         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
16018             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
16019                 return -EINVAL;
16020
16021         err = rdev_get_station(rdev, dev, dest, &sinfo);
16022         if (err)
16023                 return err;
16024
16025         cfg80211_sinfo_release_content(&sinfo);
16026
16027         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
16028 }
16029
16030 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
16031                           struct nlattr *attrs[], struct net_device *dev,
16032                           struct cfg80211_tid_cfg *tid_conf,
16033                           struct genl_info *info, const u8 *peer,
16034                           unsigned int link_id)
16035 {
16036         struct netlink_ext_ack *extack = info->extack;
16037         u64 mask;
16038         int err;
16039
16040         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
16041                 return -EINVAL;
16042
16043         tid_conf->config_override =
16044                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
16045         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
16046
16047         if (tid_conf->config_override) {
16048                 if (rdev->ops->reset_tid_config) {
16049                         err = rdev_reset_tid_config(rdev, dev, peer,
16050                                                     tid_conf->tids);
16051                         if (err)
16052                                 return err;
16053                 } else {
16054                         return -EINVAL;
16055                 }
16056         }
16057
16058         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
16059                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
16060                 tid_conf->noack =
16061                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
16062         }
16063
16064         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
16065                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
16066                 tid_conf->retry_short =
16067                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
16068
16069                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
16070                         return -EINVAL;
16071         }
16072
16073         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
16074                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
16075                 tid_conf->retry_long =
16076                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
16077
16078                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
16079                         return -EINVAL;
16080         }
16081
16082         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
16083                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
16084                 tid_conf->ampdu =
16085                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
16086         }
16087
16088         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
16089                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
16090                 tid_conf->rtscts =
16091                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
16092         }
16093
16094         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
16095                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
16096                 tid_conf->amsdu =
16097                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
16098         }
16099
16100         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
16101                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
16102
16103                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
16104
16105                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
16106                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
16107                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
16108                                                     &tid_conf->txrate_mask, dev,
16109                                                     true, link_id);
16110                         if (err)
16111                                 return err;
16112
16113                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
16114                 }
16115                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
16116         }
16117
16118         if (peer)
16119                 mask = rdev->wiphy.tid_config_support.peer;
16120         else
16121                 mask = rdev->wiphy.tid_config_support.vif;
16122
16123         if (tid_conf->mask & ~mask) {
16124                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
16125                 return -EOPNOTSUPP;
16126         }
16127
16128         return 0;
16129 }
16130
16131 static int nl80211_set_tid_config(struct sk_buff *skb,
16132                                   struct genl_info *info)
16133 {
16134         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16135         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
16136         unsigned int link_id = nl80211_link_id(info->attrs);
16137         struct net_device *dev = info->user_ptr[1];
16138         struct cfg80211_tid_config *tid_config;
16139         struct nlattr *tid;
16140         int conf_idx = 0, rem_conf;
16141         int ret = -EINVAL;
16142         u32 num_conf = 0;
16143
16144         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
16145                 return -EINVAL;
16146
16147         if (!rdev->ops->set_tid_config)
16148                 return -EOPNOTSUPP;
16149
16150         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16151                             rem_conf)
16152                 num_conf++;
16153
16154         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
16155                              GFP_KERNEL);
16156         if (!tid_config)
16157                 return -ENOMEM;
16158
16159         tid_config->n_tid_conf = num_conf;
16160
16161         if (info->attrs[NL80211_ATTR_MAC])
16162                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16163
16164         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
16165                             rem_conf) {
16166                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
16167                                        tid, NULL, NULL);
16168
16169                 if (ret)
16170                         goto bad_tid_conf;
16171
16172                 ret = parse_tid_conf(rdev, attrs, dev,
16173                                      &tid_config->tid_conf[conf_idx],
16174                                      info, tid_config->peer, link_id);
16175                 if (ret)
16176                         goto bad_tid_conf;
16177
16178                 conf_idx++;
16179         }
16180
16181         ret = rdev_set_tid_config(rdev, dev, tid_config);
16182
16183 bad_tid_conf:
16184         kfree(tid_config);
16185         return ret;
16186 }
16187
16188 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
16189 {
16190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16191         struct cfg80211_color_change_settings params = {};
16192         struct net_device *dev = info->user_ptr[1];
16193         struct wireless_dev *wdev = dev->ieee80211_ptr;
16194         struct nlattr **tb;
16195         u16 offset;
16196         int err;
16197
16198         if (!rdev->ops->color_change)
16199                 return -EOPNOTSUPP;
16200
16201         if (!wiphy_ext_feature_isset(&rdev->wiphy,
16202                                      NL80211_EXT_FEATURE_BSS_COLOR))
16203                 return -EOPNOTSUPP;
16204
16205         if (wdev->iftype != NL80211_IFTYPE_AP)
16206                 return -EOPNOTSUPP;
16207
16208         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
16209             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
16210             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
16211                 return -EINVAL;
16212
16213         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16214         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16215
16216         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
16217                                    info->extack);
16218         if (err)
16219                 return err;
16220
16221         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16222         if (!tb)
16223                 return -ENOMEM;
16224
16225         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16226                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16227                                nl80211_policy, info->extack);
16228         if (err)
16229                 goto out;
16230
16231         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
16232                                    info->extack);
16233         if (err)
16234                 goto out;
16235
16236         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16237                 err = -EINVAL;
16238                 goto out;
16239         }
16240
16241         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16242                 err = -EINVAL;
16243                 goto out;
16244         }
16245
16246         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16247         if (offset >= params.beacon_color_change.tail_len) {
16248                 err = -EINVAL;
16249                 goto out;
16250         }
16251
16252         if (params.beacon_color_change.tail[offset] != params.count) {
16253                 err = -EINVAL;
16254                 goto out;
16255         }
16256
16257         params.counter_offset_beacon = offset;
16258
16259         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16260                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16261                     sizeof(u16)) {
16262                         err = -EINVAL;
16263                         goto out;
16264                 }
16265
16266                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16267                 if (offset >= params.beacon_color_change.probe_resp_len) {
16268                         err = -EINVAL;
16269                         goto out;
16270                 }
16271
16272                 if (params.beacon_color_change.probe_resp[offset] !=
16273                     params.count) {
16274                         err = -EINVAL;
16275                         goto out;
16276                 }
16277
16278                 params.counter_offset_presp = offset;
16279         }
16280
16281         params.link_id = nl80211_link_id(info->attrs);
16282         err = rdev_color_change(rdev, dev, &params);
16283
16284 out:
16285         kfree(params.beacon_next.mbssid_ies);
16286         kfree(params.beacon_color_change.mbssid_ies);
16287         kfree(params.beacon_next.rnr_ies);
16288         kfree(params.beacon_color_change.rnr_ies);
16289         kfree(tb);
16290         return err;
16291 }
16292
16293 static int nl80211_set_fils_aad(struct sk_buff *skb,
16294                                 struct genl_info *info)
16295 {
16296         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16297         struct net_device *dev = info->user_ptr[1];
16298         struct cfg80211_fils_aad fils_aad = {};
16299         u8 *nonces;
16300
16301         if (!info->attrs[NL80211_ATTR_MAC] ||
16302             !info->attrs[NL80211_ATTR_FILS_KEK] ||
16303             !info->attrs[NL80211_ATTR_FILS_NONCES])
16304                 return -EINVAL;
16305
16306         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16307         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16308         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16309         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16310         fils_aad.snonce = nonces;
16311         fils_aad.anonce = nonces + FILS_NONCE_LEN;
16312
16313         return rdev_set_fils_aad(rdev, dev, &fils_aad);
16314 }
16315
16316 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16317 {
16318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16319         unsigned int link_id = nl80211_link_id(info->attrs);
16320         struct net_device *dev = info->user_ptr[1];
16321         struct wireless_dev *wdev = dev->ieee80211_ptr;
16322         int ret;
16323
16324         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16325                 return -EINVAL;
16326
16327         switch (wdev->iftype) {
16328         case NL80211_IFTYPE_AP:
16329                 break;
16330         default:
16331                 return -EINVAL;
16332         }
16333
16334         if (!info->attrs[NL80211_ATTR_MAC] ||
16335             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16336                 return -EINVAL;
16337
16338         wdev->valid_links |= BIT(link_id);
16339         ether_addr_copy(wdev->links[link_id].addr,
16340                         nla_data(info->attrs[NL80211_ATTR_MAC]));
16341
16342         ret = rdev_add_intf_link(rdev, wdev, link_id);
16343         if (ret) {
16344                 wdev->valid_links &= ~BIT(link_id);
16345                 eth_zero_addr(wdev->links[link_id].addr);
16346         }
16347
16348         return ret;
16349 }
16350
16351 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16352 {
16353         unsigned int link_id = nl80211_link_id(info->attrs);
16354         struct net_device *dev = info->user_ptr[1];
16355         struct wireless_dev *wdev = dev->ieee80211_ptr;
16356
16357         /* cannot remove if there's no link */
16358         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16359                 return -EINVAL;
16360
16361         switch (wdev->iftype) {
16362         case NL80211_IFTYPE_AP:
16363                 break;
16364         default:
16365                 return -EINVAL;
16366         }
16367
16368         cfg80211_remove_link(wdev, link_id);
16369
16370         return 0;
16371 }
16372
16373 static int
16374 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16375                              bool add)
16376 {
16377         struct link_station_parameters params = {};
16378         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16379         struct net_device *dev = info->user_ptr[1];
16380         int err;
16381
16382         if ((add && !rdev->ops->add_link_station) ||
16383             (!add && !rdev->ops->mod_link_station))
16384                 return -EOPNOTSUPP;
16385
16386         if (add && !info->attrs[NL80211_ATTR_MAC])
16387                 return -EINVAL;
16388
16389         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16390                 return -EINVAL;
16391
16392         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16393                 return -EINVAL;
16394
16395         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16396
16397         if (info->attrs[NL80211_ATTR_MAC]) {
16398                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16399                 if (!is_valid_ether_addr(params.link_mac))
16400                         return -EINVAL;
16401         }
16402
16403         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16404                 return -EINVAL;
16405
16406         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16407
16408         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16409                 params.supported_rates =
16410                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16411                 params.supported_rates_len =
16412                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16413         }
16414
16415         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16416                 params.ht_capa =
16417                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16418
16419         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16420                 params.vht_capa =
16421                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16422
16423         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16424                 params.he_capa =
16425                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16426                 params.he_capa_len =
16427                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16428
16429                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16430                         params.eht_capa =
16431                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16432                         params.eht_capa_len =
16433                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16434
16435                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16436                                                         (const u8 *)params.eht_capa,
16437                                                         params.eht_capa_len,
16438                                                         false))
16439                                 return -EINVAL;
16440                 }
16441         }
16442
16443         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16444                 params.he_6ghz_capa =
16445                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16446
16447         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16448                 params.opmode_notif_used = true;
16449                 params.opmode_notif =
16450                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16451         }
16452
16453         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16454                                                 &params.txpwr_set);
16455         if (err)
16456                 return err;
16457
16458         if (add)
16459                 return rdev_add_link_station(rdev, dev, &params);
16460
16461         return rdev_mod_link_station(rdev, dev, &params);
16462 }
16463
16464 static int
16465 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16466 {
16467         return nl80211_add_mod_link_station(skb, info, true);
16468 }
16469
16470 static int
16471 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16472 {
16473         return nl80211_add_mod_link_station(skb, info, false);
16474 }
16475
16476 static int
16477 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16478 {
16479         struct link_station_del_parameters params = {};
16480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16481         struct net_device *dev = info->user_ptr[1];
16482
16483         if (!rdev->ops->del_link_station)
16484                 return -EOPNOTSUPP;
16485
16486         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16487             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16488                 return -EINVAL;
16489
16490         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16491         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16492
16493         return rdev_del_link_station(rdev, dev, &params);
16494 }
16495
16496 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16497                                     struct genl_info *info)
16498 {
16499         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16500         struct net_device *dev = info->user_ptr[1];
16501         struct cfg80211_set_hw_timestamp hwts = {};
16502
16503         if (!rdev->wiphy.hw_timestamp_max_peers)
16504                 return -EOPNOTSUPP;
16505
16506         if (!info->attrs[NL80211_ATTR_MAC] &&
16507             rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16508                 return -EOPNOTSUPP;
16509
16510         if (info->attrs[NL80211_ATTR_MAC])
16511                 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16512
16513         hwts.enable =
16514                 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16515
16516         return rdev_set_hw_timestamp(rdev, dev, &hwts);
16517 }
16518
16519 static int
16520 nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
16521 {
16522         struct cfg80211_ttlm_params params = {};
16523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16524         struct net_device *dev = info->user_ptr[1];
16525         struct wireless_dev *wdev = dev->ieee80211_ptr;
16526
16527         if (wdev->iftype != NL80211_IFTYPE_STATION &&
16528             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16529                 return -EOPNOTSUPP;
16530
16531         if (!wdev->connected)
16532                 return -ENOLINK;
16533
16534         if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
16535             !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
16536                 return -EINVAL;
16537
16538         nla_memcpy(params.dlink,
16539                    info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
16540                    sizeof(params.dlink));
16541         nla_memcpy(params.ulink,
16542                    info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
16543                    sizeof(params.ulink));
16544
16545         return rdev_set_ttlm(rdev, dev, &params);
16546 }
16547
16548 static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
16549 {
16550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16551         struct net_device *dev = info->user_ptr[1];
16552         struct wireless_dev *wdev = dev->ieee80211_ptr;
16553         struct cfg80211_ml_reconf_req req = {};
16554         unsigned int link_id;
16555         u16 add_links;
16556         int err;
16557
16558         if (!wdev->valid_links)
16559                 return -EINVAL;
16560
16561         if (dev->ieee80211_ptr->conn_owner_nlportid &&
16562             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
16563                 return -EPERM;
16564
16565         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
16566             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
16567                 return -EOPNOTSUPP;
16568
16569         add_links = 0;
16570         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
16571                 err = nl80211_process_links(rdev, req.add_links,
16572                                             /* mark as MLO, but not assoc */
16573                                             IEEE80211_MLD_MAX_NUM_LINKS,
16574                                             NULL, 0, info);
16575                 if (err)
16576                         return err;
16577
16578                 for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
16579                      link_id++) {
16580                         if (!req.add_links[link_id].bss)
16581                                 continue;
16582                         add_links |= BIT(link_id);
16583                 }
16584         }
16585
16586         if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
16587                 req.rem_links =
16588                         nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
16589
16590         /* Validate that existing links are not added, removed links are valid
16591          * and don't allow adding and removing the same links
16592          */
16593         if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
16594             (wdev->valid_links & add_links) ||
16595             ((wdev->valid_links & req.rem_links) != req.rem_links)) {
16596                 err = -EINVAL;
16597                 goto out;
16598         }
16599
16600         if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
16601                 req.ext_mld_capa_ops =
16602                         nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
16603
16604         err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
16605
16606 out:
16607         for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
16608                 cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
16609
16610         return err;
16611 }
16612
16613 static int
16614 nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
16615 {
16616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16617         struct net_device *dev = info->user_ptr[1];
16618         struct wireless_dev *wdev = dev->ieee80211_ptr;
16619         bool val;
16620
16621         if (wdev->iftype != NL80211_IFTYPE_STATION &&
16622             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16623                 return -EOPNOTSUPP;
16624
16625         if (!wdev->connected)
16626                 return -ENOLINK;
16627
16628         val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
16629
16630         return rdev_set_epcs(rdev, dev, val);
16631 }
16632
16633 #define NL80211_FLAG_NEED_WIPHY         0x01
16634 #define NL80211_FLAG_NEED_NETDEV        0x02
16635 #define NL80211_FLAG_NEED_RTNL          0x04
16636 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16637 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16638                                          NL80211_FLAG_CHECK_NETDEV_UP)
16639 #define NL80211_FLAG_NEED_WDEV          0x10
16640 /* If a netdev is associated, it must be UP, P2P must be started */
16641 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16642                                          NL80211_FLAG_CHECK_NETDEV_UP)
16643 #define NL80211_FLAG_CLEAR_SKB          0x20
16644 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16645 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16646 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16647
16648 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16649         SELECTOR(__sel, NONE, 0) /* must be first */    \
16650         SELECTOR(__sel, WIPHY,                          \
16651                  NL80211_FLAG_NEED_WIPHY)               \
16652         SELECTOR(__sel, WDEV,                           \
16653                  NL80211_FLAG_NEED_WDEV)                \
16654         SELECTOR(__sel, NETDEV,                         \
16655                  NL80211_FLAG_NEED_NETDEV)              \
16656         SELECTOR(__sel, NETDEV_LINK,                    \
16657                  NL80211_FLAG_NEED_NETDEV |             \
16658                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16659         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16660                  NL80211_FLAG_NEED_NETDEV |             \
16661                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16662         SELECTOR(__sel, WIPHY_RTNL,                     \
16663                  NL80211_FLAG_NEED_WIPHY |              \
16664                  NL80211_FLAG_NEED_RTNL)                \
16665         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16666                  NL80211_FLAG_NEED_WIPHY |              \
16667                  NL80211_FLAG_NEED_RTNL |               \
16668                  NL80211_FLAG_NO_WIPHY_MTX)             \
16669         SELECTOR(__sel, WDEV_RTNL,                      \
16670                  NL80211_FLAG_NEED_WDEV |               \
16671                  NL80211_FLAG_NEED_RTNL)                \
16672         SELECTOR(__sel, NETDEV_RTNL,                    \
16673                  NL80211_FLAG_NEED_NETDEV |             \
16674                  NL80211_FLAG_NEED_RTNL)                \
16675         SELECTOR(__sel, NETDEV_UP,                      \
16676                  NL80211_FLAG_NEED_NETDEV_UP)           \
16677         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16678                  NL80211_FLAG_NEED_NETDEV_UP |          \
16679                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16680         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16681                  NL80211_FLAG_NEED_NETDEV_UP |          \
16682                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16683         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16684                  NL80211_FLAG_NEED_NETDEV_UP |          \
16685                  NL80211_FLAG_CLEAR_SKB |               \
16686                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16687         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16688                  NL80211_FLAG_NEED_NETDEV_UP |          \
16689                  NL80211_FLAG_NO_WIPHY_MTX)             \
16690         SELECTOR(__sel, NETDEV_UP_NOTMX_MLO,            \
16691                  NL80211_FLAG_NEED_NETDEV_UP |          \
16692                  NL80211_FLAG_NO_WIPHY_MTX |            \
16693                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16694         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16695                  NL80211_FLAG_NEED_NETDEV_UP |          \
16696                  NL80211_FLAG_CLEAR_SKB)                \
16697         SELECTOR(__sel, WDEV_UP,                        \
16698                  NL80211_FLAG_NEED_WDEV_UP)             \
16699         SELECTOR(__sel, WDEV_UP_LINK,                   \
16700                  NL80211_FLAG_NEED_WDEV_UP |            \
16701                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16702         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16703                  NL80211_FLAG_NEED_WDEV_UP |            \
16704                  NL80211_FLAG_NEED_RTNL)                \
16705         SELECTOR(__sel, WIPHY_CLEAR,                    \
16706                  NL80211_FLAG_NEED_WIPHY |              \
16707                  NL80211_FLAG_CLEAR_SKB)
16708
16709 enum nl80211_internal_flags_selector {
16710 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16711         INTERNAL_FLAG_SELECTORS(_)
16712 #undef SELECTOR
16713 };
16714
16715 static u32 nl80211_internal_flags[] = {
16716 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16717         INTERNAL_FLAG_SELECTORS(_)
16718 #undef SELECTOR
16719 };
16720
16721 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16722                             struct sk_buff *skb,
16723                             struct genl_info *info)
16724 {
16725         struct cfg80211_registered_device *rdev = NULL;
16726         struct wireless_dev *wdev = NULL;
16727         struct net_device *dev = NULL;
16728         u32 internal_flags;
16729         int err;
16730
16731         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16732                 return -EINVAL;
16733
16734         internal_flags = nl80211_internal_flags[ops->internal_flags];
16735
16736         rtnl_lock();
16737         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16738                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16739                 if (IS_ERR(rdev)) {
16740                         err = PTR_ERR(rdev);
16741                         goto out_unlock;
16742                 }
16743                 info->user_ptr[0] = rdev;
16744         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16745                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16746                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16747                                                   info->attrs);
16748                 if (IS_ERR(wdev)) {
16749                         err = PTR_ERR(wdev);
16750                         goto out_unlock;
16751                 }
16752
16753                 dev = wdev->netdev;
16754                 dev_hold(dev);
16755                 rdev = wiphy_to_rdev(wdev->wiphy);
16756
16757                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16758                         if (!dev) {
16759                                 err = -EINVAL;
16760                                 goto out_unlock;
16761                         }
16762
16763                         info->user_ptr[1] = dev;
16764                 } else {
16765                         info->user_ptr[1] = wdev;
16766                 }
16767
16768                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16769                     !wdev_running(wdev)) {
16770                         err = -ENETDOWN;
16771                         goto out_unlock;
16772                 }
16773
16774                 info->user_ptr[0] = rdev;
16775         }
16776
16777         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16778                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16779
16780                 if (!wdev) {
16781                         err = -EINVAL;
16782                         goto out_unlock;
16783                 }
16784
16785                 /* MLO -> require valid link ID */
16786                 if (wdev->valid_links &&
16787                     (!link_id ||
16788                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16789                         err = -EINVAL;
16790                         goto out_unlock;
16791                 }
16792
16793                 /* non-MLO -> no link ID attribute accepted */
16794                 if (!wdev->valid_links && link_id) {
16795                         err = -EINVAL;
16796                         goto out_unlock;
16797                 }
16798         }
16799
16800         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16801                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16802                     (wdev && wdev->valid_links)) {
16803                         err = -EINVAL;
16804                         goto out_unlock;
16805                 }
16806         }
16807
16808         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16809                 wiphy_lock(&rdev->wiphy);
16810                 /* we keep the mutex locked until post_doit */
16811                 __release(&rdev->wiphy.mtx);
16812         }
16813         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16814                 rtnl_unlock();
16815
16816         return 0;
16817 out_unlock:
16818         rtnl_unlock();
16819         dev_put(dev);
16820         return err;
16821 }
16822
16823 static void nl80211_post_doit(const struct genl_split_ops *ops,
16824                               struct sk_buff *skb,
16825                               struct genl_info *info)
16826 {
16827         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16828
16829         if (info->user_ptr[1]) {
16830                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16831                         struct wireless_dev *wdev = info->user_ptr[1];
16832
16833                         dev_put(wdev->netdev);
16834                 } else {
16835                         dev_put(info->user_ptr[1]);
16836                 }
16837         }
16838
16839         if (info->user_ptr[0] &&
16840             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16841                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16842
16843                 /* we kept the mutex locked since pre_doit */
16844                 __acquire(&rdev->wiphy.mtx);
16845                 wiphy_unlock(&rdev->wiphy);
16846         }
16847
16848         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16849                 rtnl_unlock();
16850
16851         /* If needed, clear the netlink message payload from the SKB
16852          * as it might contain key data that shouldn't stick around on
16853          * the heap after the SKB is freed. The netlink message header
16854          * is still needed for further processing, so leave it intact.
16855          */
16856         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16857                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16858
16859                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16860         }
16861 }
16862
16863 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16864                                      struct cfg80211_sar_specs *sar_specs,
16865                                      struct nlattr *spec[], int index)
16866 {
16867         u32 range_index, i;
16868
16869         if (!sar_specs || !spec)
16870                 return -EINVAL;
16871
16872         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16873             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16874                 return -EINVAL;
16875
16876         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16877
16878         /* check if range_index exceeds num_freq_ranges */
16879         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16880                 return -EINVAL;
16881
16882         /* check if range_index duplicates */
16883         for (i = 0; i < index; i++) {
16884                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16885                         return -EINVAL;
16886         }
16887
16888         sar_specs->sub_specs[index].power =
16889                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16890
16891         sar_specs->sub_specs[index].freq_range_index = range_index;
16892
16893         return 0;
16894 }
16895
16896 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16897 {
16898         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16899         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16900         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16901         struct cfg80211_sar_specs *sar_spec;
16902         enum nl80211_sar_type type;
16903         struct nlattr *spec_list;
16904         u32 specs;
16905         int rem, err;
16906
16907         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16908                 return -EOPNOTSUPP;
16909
16910         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16911                 return -EINVAL;
16912
16913         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16914                          info->attrs[NL80211_ATTR_SAR_SPEC],
16915                          NULL, NULL);
16916
16917         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16918                 return -EINVAL;
16919
16920         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16921         if (type != rdev->wiphy.sar_capa->type)
16922                 return -EINVAL;
16923
16924         specs = 0;
16925         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16926                 specs++;
16927
16928         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16929                 return -EINVAL;
16930
16931         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16932         if (!sar_spec)
16933                 return -ENOMEM;
16934
16935         sar_spec->type = type;
16936         specs = 0;
16937         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16938                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16939                                  spec_list, NULL, NULL);
16940
16941                 switch (type) {
16942                 case NL80211_SAR_TYPE_POWER:
16943                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16944                                                       spec, specs)) {
16945                                 err = -EINVAL;
16946                                 goto error;
16947                         }
16948                         break;
16949                 default:
16950                         err = -EINVAL;
16951                         goto error;
16952                 }
16953                 specs++;
16954         }
16955
16956         sar_spec->num_sub_specs = specs;
16957
16958         rdev->cur_cmd_info = info;
16959         err = rdev_set_sar_specs(rdev, sar_spec);
16960         rdev->cur_cmd_info = NULL;
16961 error:
16962         kfree(sar_spec);
16963         return err;
16964 }
16965
16966 #define SELECTOR(__sel, name, value) \
16967         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16968 int __missing_selector(void);
16969 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16970
16971 static const struct genl_ops nl80211_ops[] = {
16972         {
16973                 .cmd = NL80211_CMD_GET_WIPHY,
16974                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16975                 .doit = nl80211_get_wiphy,
16976                 .dumpit = nl80211_dump_wiphy,
16977                 .done = nl80211_dump_wiphy_done,
16978                 /* can be retrieved by unprivileged users */
16979                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16980         },
16981 };
16982
16983 static const struct genl_small_ops nl80211_small_ops[] = {
16984         {
16985                 .cmd = NL80211_CMD_SET_WIPHY,
16986                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16987                 .doit = nl80211_set_wiphy,
16988                 .flags = GENL_UNS_ADMIN_PERM,
16989         },
16990         {
16991                 .cmd = NL80211_CMD_GET_INTERFACE,
16992                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16993                 .doit = nl80211_get_interface,
16994                 .dumpit = nl80211_dump_interface,
16995                 /* can be retrieved by unprivileged users */
16996                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16997         },
16998         {
16999                 .cmd = NL80211_CMD_SET_INTERFACE,
17000                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17001                 .doit = nl80211_set_interface,
17002                 .flags = GENL_UNS_ADMIN_PERM,
17003                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17004                                          NL80211_FLAG_NEED_RTNL),
17005         },
17006         {
17007                 .cmd = NL80211_CMD_NEW_INTERFACE,
17008                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17009                 .doit = nl80211_new_interface,
17010                 .flags = GENL_UNS_ADMIN_PERM,
17011                 .internal_flags =
17012                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
17013                                NL80211_FLAG_NEED_RTNL |
17014                                /* we take the wiphy mutex later ourselves */
17015                                NL80211_FLAG_NO_WIPHY_MTX),
17016         },
17017         {
17018                 .cmd = NL80211_CMD_DEL_INTERFACE,
17019                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17020                 .doit = nl80211_del_interface,
17021                 .flags = GENL_UNS_ADMIN_PERM,
17022                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17023                                          NL80211_FLAG_NEED_RTNL),
17024         },
17025         {
17026                 .cmd = NL80211_CMD_GET_KEY,
17027                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17028                 .doit = nl80211_get_key,
17029                 .flags = GENL_UNS_ADMIN_PERM,
17030                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17031         },
17032         {
17033                 .cmd = NL80211_CMD_SET_KEY,
17034                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17035                 .doit = nl80211_set_key,
17036                 .flags = GENL_UNS_ADMIN_PERM,
17037                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
17038                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17039                                          NL80211_FLAG_CLEAR_SKB),
17040         },
17041         {
17042                 .cmd = NL80211_CMD_NEW_KEY,
17043                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17044                 .doit = nl80211_new_key,
17045                 .flags = GENL_UNS_ADMIN_PERM,
17046                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17047                                          NL80211_FLAG_CLEAR_SKB),
17048         },
17049         {
17050                 .cmd = NL80211_CMD_DEL_KEY,
17051                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17052                 .doit = nl80211_del_key,
17053                 .flags = GENL_UNS_ADMIN_PERM,
17054                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17055         },
17056         {
17057                 .cmd = NL80211_CMD_SET_BEACON,
17058                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17059                 .flags = GENL_UNS_ADMIN_PERM,
17060                 .doit = nl80211_set_beacon,
17061                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17062                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17063         },
17064         {
17065                 .cmd = NL80211_CMD_START_AP,
17066                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17067                 .flags = GENL_UNS_ADMIN_PERM,
17068                 .doit = nl80211_start_ap,
17069                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17070                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17071         },
17072         {
17073                 .cmd = NL80211_CMD_STOP_AP,
17074                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17075                 .flags = GENL_UNS_ADMIN_PERM,
17076                 .doit = nl80211_stop_ap,
17077                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17078                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17079         },
17080         {
17081                 .cmd = NL80211_CMD_GET_STATION,
17082                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17083                 .doit = nl80211_get_station,
17084                 .dumpit = nl80211_dump_station,
17085                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17086         },
17087         {
17088                 .cmd = NL80211_CMD_SET_STATION,
17089                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17090                 .doit = nl80211_set_station,
17091                 .flags = GENL_UNS_ADMIN_PERM,
17092                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17093         },
17094         {
17095                 .cmd = NL80211_CMD_NEW_STATION,
17096                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17097                 .doit = nl80211_new_station,
17098                 .flags = GENL_UNS_ADMIN_PERM,
17099                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17100         },
17101         {
17102                 .cmd = NL80211_CMD_DEL_STATION,
17103                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17104                 .doit = nl80211_del_station,
17105                 .flags = GENL_UNS_ADMIN_PERM,
17106                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
17107                  * whether MAC address is passed or not. If MAC address is
17108                  * passed, then even during MLO, link ID is not required.
17109                  */
17110                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17111         },
17112         {
17113                 .cmd = NL80211_CMD_GET_MPATH,
17114                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115                 .doit = nl80211_get_mpath,
17116                 .dumpit = nl80211_dump_mpath,
17117                 .flags = GENL_UNS_ADMIN_PERM,
17118                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17119         },
17120         {
17121                 .cmd = NL80211_CMD_GET_MPP,
17122                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17123                 .doit = nl80211_get_mpp,
17124                 .dumpit = nl80211_dump_mpp,
17125                 .flags = GENL_UNS_ADMIN_PERM,
17126                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17127         },
17128         {
17129                 .cmd = NL80211_CMD_SET_MPATH,
17130                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17131                 .doit = nl80211_set_mpath,
17132                 .flags = GENL_UNS_ADMIN_PERM,
17133                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17134         },
17135         {
17136                 .cmd = NL80211_CMD_NEW_MPATH,
17137                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17138                 .doit = nl80211_new_mpath,
17139                 .flags = GENL_UNS_ADMIN_PERM,
17140                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17141         },
17142         {
17143                 .cmd = NL80211_CMD_DEL_MPATH,
17144                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17145                 .doit = nl80211_del_mpath,
17146                 .flags = GENL_UNS_ADMIN_PERM,
17147                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17148         },
17149         {
17150                 .cmd = NL80211_CMD_SET_BSS,
17151                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17152                 .doit = nl80211_set_bss,
17153                 .flags = GENL_UNS_ADMIN_PERM,
17154                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17155                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17156         },
17157         {
17158                 .cmd = NL80211_CMD_GET_REG,
17159                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17160                 .doit = nl80211_get_reg_do,
17161                 .dumpit = nl80211_get_reg_dump,
17162                 /* can be retrieved by unprivileged users */
17163         },
17164 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
17165         {
17166                 .cmd = NL80211_CMD_SET_REG,
17167                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17168                 .doit = nl80211_set_reg,
17169                 .flags = GENL_ADMIN_PERM,
17170         },
17171 #endif
17172         {
17173                 .cmd = NL80211_CMD_REQ_SET_REG,
17174                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17175                 .doit = nl80211_req_set_reg,
17176                 .flags = GENL_ADMIN_PERM,
17177         },
17178         {
17179                 .cmd = NL80211_CMD_RELOAD_REGDB,
17180                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17181                 .doit = nl80211_reload_regdb,
17182                 .flags = GENL_ADMIN_PERM,
17183         },
17184         {
17185                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
17186                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17187                 .doit = nl80211_get_mesh_config,
17188                 /* can be retrieved by unprivileged users */
17189                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17190         },
17191         {
17192                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
17193                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17194                 .doit = nl80211_update_mesh_config,
17195                 .flags = GENL_UNS_ADMIN_PERM,
17196                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17197         },
17198         {
17199                 .cmd = NL80211_CMD_TRIGGER_SCAN,
17200                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17201                 .doit = nl80211_trigger_scan,
17202                 .flags = GENL_UNS_ADMIN_PERM,
17203                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17204         },
17205         {
17206                 .cmd = NL80211_CMD_ABORT_SCAN,
17207                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17208                 .doit = nl80211_abort_scan,
17209                 .flags = GENL_UNS_ADMIN_PERM,
17210                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17211         },
17212         {
17213                 .cmd = NL80211_CMD_GET_SCAN,
17214                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17215                 .dumpit = nl80211_dump_scan,
17216         },
17217         {
17218                 .cmd = NL80211_CMD_START_SCHED_SCAN,
17219                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17220                 .doit = nl80211_start_sched_scan,
17221                 .flags = GENL_UNS_ADMIN_PERM,
17222                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17223         },
17224         {
17225                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
17226                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17227                 .doit = nl80211_stop_sched_scan,
17228                 .flags = GENL_UNS_ADMIN_PERM,
17229                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17230         },
17231         {
17232                 .cmd = NL80211_CMD_AUTHENTICATE,
17233                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17234                 .doit = nl80211_authenticate,
17235                 .flags = GENL_UNS_ADMIN_PERM,
17236                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17237                                          NL80211_FLAG_CLEAR_SKB),
17238         },
17239         {
17240                 .cmd = NL80211_CMD_ASSOCIATE,
17241                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17242                 .doit = nl80211_associate,
17243                 .flags = GENL_UNS_ADMIN_PERM,
17244                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17245                                          NL80211_FLAG_CLEAR_SKB),
17246         },
17247         {
17248                 .cmd = NL80211_CMD_DEAUTHENTICATE,
17249                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17250                 .doit = nl80211_deauthenticate,
17251                 .flags = GENL_UNS_ADMIN_PERM,
17252                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17253         },
17254         {
17255                 .cmd = NL80211_CMD_DISASSOCIATE,
17256                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17257                 .doit = nl80211_disassociate,
17258                 .flags = GENL_UNS_ADMIN_PERM,
17259                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17260         },
17261         {
17262                 .cmd = NL80211_CMD_JOIN_IBSS,
17263                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17264                 .doit = nl80211_join_ibss,
17265                 .flags = GENL_UNS_ADMIN_PERM,
17266                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17267         },
17268         {
17269                 .cmd = NL80211_CMD_LEAVE_IBSS,
17270                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17271                 .doit = nl80211_leave_ibss,
17272                 .flags = GENL_UNS_ADMIN_PERM,
17273                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17274         },
17275 #ifdef CONFIG_NL80211_TESTMODE
17276         {
17277                 .cmd = NL80211_CMD_TESTMODE,
17278                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17279                 .doit = nl80211_testmode_do,
17280                 .dumpit = nl80211_testmode_dump,
17281                 .flags = GENL_UNS_ADMIN_PERM,
17282                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17283         },
17284 #endif
17285         {
17286                 .cmd = NL80211_CMD_CONNECT,
17287                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17288                 .doit = nl80211_connect,
17289                 .flags = GENL_UNS_ADMIN_PERM,
17290                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17291                                          NL80211_FLAG_CLEAR_SKB),
17292         },
17293         {
17294                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
17295                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17296                 .doit = nl80211_update_connect_params,
17297                 .flags = GENL_ADMIN_PERM,
17298                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17299                                          NL80211_FLAG_CLEAR_SKB),
17300         },
17301         {
17302                 .cmd = NL80211_CMD_DISCONNECT,
17303                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17304                 .doit = nl80211_disconnect,
17305                 .flags = GENL_UNS_ADMIN_PERM,
17306                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17307         },
17308         {
17309                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
17310                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17311                 .doit = nl80211_wiphy_netns,
17312                 .flags = GENL_UNS_ADMIN_PERM,
17313                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17314                                          NL80211_FLAG_NEED_RTNL |
17315                                          NL80211_FLAG_NO_WIPHY_MTX),
17316         },
17317         {
17318                 .cmd = NL80211_CMD_GET_SURVEY,
17319                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17320                 .dumpit = nl80211_dump_survey,
17321         },
17322         {
17323                 .cmd = NL80211_CMD_SET_PMKSA,
17324                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17325                 .doit = nl80211_set_pmksa,
17326                 .flags = GENL_UNS_ADMIN_PERM,
17327                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17328                                          NL80211_FLAG_CLEAR_SKB),
17329         },
17330         {
17331                 .cmd = NL80211_CMD_DEL_PMKSA,
17332                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17333                 .doit = nl80211_del_pmksa,
17334                 .flags = GENL_UNS_ADMIN_PERM,
17335                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17336         },
17337         {
17338                 .cmd = NL80211_CMD_FLUSH_PMKSA,
17339                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17340                 .doit = nl80211_flush_pmksa,
17341                 .flags = GENL_UNS_ADMIN_PERM,
17342                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17343         },
17344         {
17345                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17346                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17347                 .doit = nl80211_remain_on_channel,
17348                 .flags = GENL_UNS_ADMIN_PERM,
17349                 /* FIXME: requiring a link ID here is probably not good */
17350                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17351                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17352         },
17353         {
17354                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17355                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17356                 .doit = nl80211_cancel_remain_on_channel,
17357                 .flags = GENL_UNS_ADMIN_PERM,
17358                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17359         },
17360         {
17361                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17362                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17363                 .doit = nl80211_set_tx_bitrate_mask,
17364                 .flags = GENL_UNS_ADMIN_PERM,
17365                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17366                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17367         },
17368         {
17369                 .cmd = NL80211_CMD_REGISTER_FRAME,
17370                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17371                 .doit = nl80211_register_mgmt,
17372                 .flags = GENL_UNS_ADMIN_PERM,
17373                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17374         },
17375         {
17376                 .cmd = NL80211_CMD_FRAME,
17377                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17378                 .doit = nl80211_tx_mgmt,
17379                 .flags = GENL_UNS_ADMIN_PERM,
17380                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17381         },
17382         {
17383                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17384                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17385                 .doit = nl80211_tx_mgmt_cancel_wait,
17386                 .flags = GENL_UNS_ADMIN_PERM,
17387                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17388         },
17389         {
17390                 .cmd = NL80211_CMD_SET_POWER_SAVE,
17391                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17392                 .doit = nl80211_set_power_save,
17393                 .flags = GENL_UNS_ADMIN_PERM,
17394                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17395         },
17396         {
17397                 .cmd = NL80211_CMD_GET_POWER_SAVE,
17398                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17399                 .doit = nl80211_get_power_save,
17400                 /* can be retrieved by unprivileged users */
17401                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17402         },
17403         {
17404                 .cmd = NL80211_CMD_SET_CQM,
17405                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17406                 .doit = nl80211_set_cqm,
17407                 .flags = GENL_UNS_ADMIN_PERM,
17408                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17409         },
17410         {
17411                 .cmd = NL80211_CMD_SET_CHANNEL,
17412                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17413                 .doit = nl80211_set_channel,
17414                 .flags = GENL_UNS_ADMIN_PERM,
17415                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17416                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17417         },
17418         {
17419                 .cmd = NL80211_CMD_JOIN_MESH,
17420                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17421                 .doit = nl80211_join_mesh,
17422                 .flags = GENL_UNS_ADMIN_PERM,
17423                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17424         },
17425         {
17426                 .cmd = NL80211_CMD_LEAVE_MESH,
17427                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17428                 .doit = nl80211_leave_mesh,
17429                 .flags = GENL_UNS_ADMIN_PERM,
17430                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17431         },
17432         {
17433                 .cmd = NL80211_CMD_JOIN_OCB,
17434                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17435                 .doit = nl80211_join_ocb,
17436                 .flags = GENL_UNS_ADMIN_PERM,
17437                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17438         },
17439         {
17440                 .cmd = NL80211_CMD_LEAVE_OCB,
17441                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17442                 .doit = nl80211_leave_ocb,
17443                 .flags = GENL_UNS_ADMIN_PERM,
17444                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17445         },
17446 #ifdef CONFIG_PM
17447         {
17448                 .cmd = NL80211_CMD_GET_WOWLAN,
17449                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17450                 .doit = nl80211_get_wowlan,
17451                 /* can be retrieved by unprivileged users */
17452                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17453         },
17454         {
17455                 .cmd = NL80211_CMD_SET_WOWLAN,
17456                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17457                 .doit = nl80211_set_wowlan,
17458                 .flags = GENL_UNS_ADMIN_PERM,
17459                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17460         },
17461 #endif
17462         {
17463                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17464                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17465                 .doit = nl80211_set_rekey_data,
17466                 .flags = GENL_UNS_ADMIN_PERM,
17467                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17468                                          NL80211_FLAG_CLEAR_SKB),
17469         },
17470         {
17471                 .cmd = NL80211_CMD_TDLS_MGMT,
17472                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17473                 .doit = nl80211_tdls_mgmt,
17474                 .flags = GENL_UNS_ADMIN_PERM,
17475                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17476                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17477         },
17478         {
17479                 .cmd = NL80211_CMD_TDLS_OPER,
17480                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17481                 .doit = nl80211_tdls_oper,
17482                 .flags = GENL_UNS_ADMIN_PERM,
17483                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17484         },
17485         {
17486                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17487                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17488                 .doit = nl80211_register_unexpected_frame,
17489                 .flags = GENL_UNS_ADMIN_PERM,
17490                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17491         },
17492         {
17493                 .cmd = NL80211_CMD_PROBE_CLIENT,
17494                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17495                 .doit = nl80211_probe_client,
17496                 .flags = GENL_UNS_ADMIN_PERM,
17497                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17498         },
17499         {
17500                 .cmd = NL80211_CMD_REGISTER_BEACONS,
17501                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17502                 .doit = nl80211_register_beacons,
17503                 .flags = GENL_UNS_ADMIN_PERM,
17504                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17505         },
17506         {
17507                 .cmd = NL80211_CMD_SET_NOACK_MAP,
17508                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17509                 .doit = nl80211_set_noack_map,
17510                 .flags = GENL_UNS_ADMIN_PERM,
17511                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17512         },
17513         {
17514                 .cmd = NL80211_CMD_START_P2P_DEVICE,
17515                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17516                 .doit = nl80211_start_p2p_device,
17517                 .flags = GENL_UNS_ADMIN_PERM,
17518                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17519                                          NL80211_FLAG_NEED_RTNL),
17520         },
17521         {
17522                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17523                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17524                 .doit = nl80211_stop_p2p_device,
17525                 .flags = GENL_UNS_ADMIN_PERM,
17526                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17527                                          NL80211_FLAG_NEED_RTNL),
17528         },
17529         {
17530                 .cmd = NL80211_CMD_START_NAN,
17531                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17532                 .doit = nl80211_start_nan,
17533                 .flags = GENL_ADMIN_PERM,
17534                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17535                                          NL80211_FLAG_NEED_RTNL),
17536         },
17537         {
17538                 .cmd = NL80211_CMD_STOP_NAN,
17539                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17540                 .doit = nl80211_stop_nan,
17541                 .flags = GENL_ADMIN_PERM,
17542                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17543                                          NL80211_FLAG_NEED_RTNL),
17544         },
17545         {
17546                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17547                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17548                 .doit = nl80211_nan_add_func,
17549                 .flags = GENL_ADMIN_PERM,
17550                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17551         },
17552         {
17553                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17554                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17555                 .doit = nl80211_nan_del_func,
17556                 .flags = GENL_ADMIN_PERM,
17557                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17558         },
17559         {
17560                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17561                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17562                 .doit = nl80211_nan_change_config,
17563                 .flags = GENL_ADMIN_PERM,
17564                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17565         },
17566         {
17567                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17568                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17569                 .doit = nl80211_set_mcast_rate,
17570                 .flags = GENL_UNS_ADMIN_PERM,
17571                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17572         },
17573         {
17574                 .cmd = NL80211_CMD_SET_MAC_ACL,
17575                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17576                 .doit = nl80211_set_mac_acl,
17577                 .flags = GENL_UNS_ADMIN_PERM,
17578                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17579                                          NL80211_FLAG_MLO_UNSUPPORTED),
17580         },
17581         {
17582                 .cmd = NL80211_CMD_RADAR_DETECT,
17583                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17584                 .doit = nl80211_start_radar_detection,
17585                 .flags = GENL_UNS_ADMIN_PERM,
17586                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17587                                          NL80211_FLAG_NO_WIPHY_MTX |
17588                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17589         },
17590         {
17591                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17592                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17593                 .doit = nl80211_get_protocol_features,
17594         },
17595         {
17596                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17597                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17598                 .doit = nl80211_update_ft_ies,
17599                 .flags = GENL_UNS_ADMIN_PERM,
17600                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17601         },
17602         {
17603                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17604                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17605                 .doit = nl80211_crit_protocol_start,
17606                 .flags = GENL_UNS_ADMIN_PERM,
17607                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17608         },
17609         {
17610                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17611                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17612                 .doit = nl80211_crit_protocol_stop,
17613                 .flags = GENL_UNS_ADMIN_PERM,
17614                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17615         },
17616         {
17617                 .cmd = NL80211_CMD_GET_COALESCE,
17618                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17619                 .doit = nl80211_get_coalesce,
17620                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17621         },
17622         {
17623                 .cmd = NL80211_CMD_SET_COALESCE,
17624                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17625                 .doit = nl80211_set_coalesce,
17626                 .flags = GENL_UNS_ADMIN_PERM,
17627                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17628         },
17629         {
17630                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17631                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17632                 .doit = nl80211_channel_switch,
17633                 .flags = GENL_UNS_ADMIN_PERM,
17634                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17635                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17636         },
17637         {
17638                 .cmd = NL80211_CMD_VENDOR,
17639                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17640                 .doit = nl80211_vendor_cmd,
17641                 .dumpit = nl80211_vendor_cmd_dump,
17642                 .flags = GENL_UNS_ADMIN_PERM,
17643                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17644                                          NL80211_FLAG_CLEAR_SKB),
17645         },
17646         {
17647                 .cmd = NL80211_CMD_SET_QOS_MAP,
17648                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17649                 .doit = nl80211_set_qos_map,
17650                 .flags = GENL_UNS_ADMIN_PERM,
17651                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17652         },
17653         {
17654                 .cmd = NL80211_CMD_ADD_TX_TS,
17655                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17656                 .doit = nl80211_add_tx_ts,
17657                 .flags = GENL_UNS_ADMIN_PERM,
17658                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17659                                          NL80211_FLAG_MLO_UNSUPPORTED),
17660         },
17661         {
17662                 .cmd = NL80211_CMD_DEL_TX_TS,
17663                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17664                 .doit = nl80211_del_tx_ts,
17665                 .flags = GENL_UNS_ADMIN_PERM,
17666                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17667         },
17668         {
17669                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17670                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17671                 .doit = nl80211_tdls_channel_switch,
17672                 .flags = GENL_UNS_ADMIN_PERM,
17673                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17674         },
17675         {
17676                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17677                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17678                 .doit = nl80211_tdls_cancel_channel_switch,
17679                 .flags = GENL_UNS_ADMIN_PERM,
17680                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17681         },
17682         {
17683                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17684                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17685                 .doit = nl80211_set_multicast_to_unicast,
17686                 .flags = GENL_UNS_ADMIN_PERM,
17687                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17688         },
17689         {
17690                 .cmd = NL80211_CMD_SET_PMK,
17691                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17692                 .doit = nl80211_set_pmk,
17693                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17694                                          NL80211_FLAG_CLEAR_SKB),
17695         },
17696         {
17697                 .cmd = NL80211_CMD_DEL_PMK,
17698                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17699                 .doit = nl80211_del_pmk,
17700                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17701         },
17702         {
17703                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17704                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17705                 .doit = nl80211_external_auth,
17706                 .flags = GENL_ADMIN_PERM,
17707                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17708         },
17709         {
17710                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17711                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17712                 .doit = nl80211_tx_control_port,
17713                 .flags = GENL_UNS_ADMIN_PERM,
17714                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17715         },
17716         {
17717                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17718                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17719                 .doit = nl80211_get_ftm_responder_stats,
17720                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17721                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17722         },
17723         {
17724                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17725                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17726                 .doit = nl80211_pmsr_start,
17727                 .flags = GENL_UNS_ADMIN_PERM,
17728                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17729         },
17730         {
17731                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17732                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17733                 .doit = nl80211_notify_radar_detection,
17734                 .flags = GENL_UNS_ADMIN_PERM,
17735                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17736         },
17737         {
17738                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17739                 .doit = nl80211_update_owe_info,
17740                 .flags = GENL_ADMIN_PERM,
17741                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17742         },
17743         {
17744                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17745                 .doit = nl80211_probe_mesh_link,
17746                 .flags = GENL_UNS_ADMIN_PERM,
17747                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17748         },
17749         {
17750                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17751                 .doit = nl80211_set_tid_config,
17752                 .flags = GENL_UNS_ADMIN_PERM,
17753                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17754                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17755         },
17756         {
17757                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17758                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17759                 .doit = nl80211_set_sar_specs,
17760                 .flags = GENL_UNS_ADMIN_PERM,
17761                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17762                                          NL80211_FLAG_NEED_RTNL),
17763         },
17764         {
17765                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17766                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17767                 .doit = nl80211_color_change,
17768                 .flags = GENL_UNS_ADMIN_PERM,
17769                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17770                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17771         },
17772         {
17773                 .cmd = NL80211_CMD_SET_FILS_AAD,
17774                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17775                 .doit = nl80211_set_fils_aad,
17776                 .flags = GENL_UNS_ADMIN_PERM,
17777                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17778         },
17779         {
17780                 .cmd = NL80211_CMD_ADD_LINK,
17781                 .doit = nl80211_add_link,
17782                 .flags = GENL_UNS_ADMIN_PERM,
17783                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17784         },
17785         {
17786                 .cmd = NL80211_CMD_REMOVE_LINK,
17787                 .doit = nl80211_remove_link,
17788                 .flags = GENL_UNS_ADMIN_PERM,
17789                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17790                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17791         },
17792         {
17793                 .cmd = NL80211_CMD_ADD_LINK_STA,
17794                 .doit = nl80211_add_link_station,
17795                 .flags = GENL_UNS_ADMIN_PERM,
17796                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17797                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17798         },
17799         {
17800                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17801                 .doit = nl80211_modify_link_station,
17802                 .flags = GENL_UNS_ADMIN_PERM,
17803                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17804                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17805         },
17806         {
17807                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17808                 .doit = nl80211_remove_link_station,
17809                 .flags = GENL_UNS_ADMIN_PERM,
17810                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17811                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17812         },
17813         {
17814                 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17815                 .doit = nl80211_set_hw_timestamp,
17816                 .flags = GENL_UNS_ADMIN_PERM,
17817                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17818         },
17819         {
17820                 .cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
17821                 .doit = nl80211_set_ttlm,
17822                 .flags = GENL_UNS_ADMIN_PERM,
17823                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17824         },
17825         {
17826                 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
17827                 .doit = nl80211_assoc_ml_reconf,
17828                 .flags = GENL_UNS_ADMIN_PERM,
17829                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17830         },
17831         {
17832                 .cmd = NL80211_CMD_EPCS_CFG,
17833                 .doit = nl80211_epcs_cfg,
17834                 .flags = GENL_UNS_ADMIN_PERM,
17835                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17836         },
17837 };
17838
17839 static struct genl_family nl80211_fam __ro_after_init = {
17840         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17841         .hdrsize = 0,                   /* no private header */
17842         .version = 1,                   /* no particular meaning now */
17843         .maxattr = NL80211_ATTR_MAX,
17844         .policy = nl80211_policy,
17845         .netnsok = true,
17846         .pre_doit = nl80211_pre_doit,
17847         .post_doit = nl80211_post_doit,
17848         .module = THIS_MODULE,
17849         .ops = nl80211_ops,
17850         .n_ops = ARRAY_SIZE(nl80211_ops),
17851         .small_ops = nl80211_small_ops,
17852         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17853         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17854         .mcgrps = nl80211_mcgrps,
17855         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17856         .parallel_ops = true,
17857 };
17858
17859 /* notification functions */
17860
17861 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17862                           enum nl80211_commands cmd)
17863 {
17864         struct sk_buff *msg;
17865         struct nl80211_dump_wiphy_state state = {};
17866
17867         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17868                 cmd != NL80211_CMD_DEL_WIPHY);
17869
17870         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17871         if (!msg)
17872                 return;
17873
17874         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17875                 nlmsg_free(msg);
17876                 return;
17877         }
17878
17879         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17880                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17881 }
17882
17883 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17884                                 struct wireless_dev *wdev,
17885                                 enum nl80211_commands cmd)
17886 {
17887         struct sk_buff *msg;
17888
17889         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17890         if (!msg)
17891                 return;
17892
17893         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17894                 nlmsg_free(msg);
17895                 return;
17896         }
17897
17898         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17899                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17900 }
17901
17902 static int nl80211_add_scan_req(struct sk_buff *msg,
17903                                 struct cfg80211_registered_device *rdev)
17904 {
17905         struct cfg80211_scan_request *req = rdev->scan_req;
17906         struct nlattr *nest;
17907         int i;
17908         struct cfg80211_scan_info *info;
17909
17910         if (WARN_ON(!req))
17911                 return 0;
17912
17913         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17914         if (!nest)
17915                 goto nla_put_failure;
17916         for (i = 0; i < req->n_ssids; i++) {
17917                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17918                         goto nla_put_failure;
17919         }
17920         nla_nest_end(msg, nest);
17921
17922         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17923                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17924                 if (!nest)
17925                         goto nla_put_failure;
17926                 for (i = 0; i < req->n_channels; i++) {
17927                         if (nla_put_u32(msg, i,
17928                                    ieee80211_channel_to_khz(req->channels[i])))
17929                                 goto nla_put_failure;
17930                 }
17931                 nla_nest_end(msg, nest);
17932         } else {
17933                 nest = nla_nest_start_noflag(msg,
17934                                              NL80211_ATTR_SCAN_FREQUENCIES);
17935                 if (!nest)
17936                         goto nla_put_failure;
17937                 for (i = 0; i < req->n_channels; i++) {
17938                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17939                                 goto nla_put_failure;
17940                 }
17941                 nla_nest_end(msg, nest);
17942         }
17943
17944         if (req->ie &&
17945             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17946                 goto nla_put_failure;
17947
17948         if (req->flags &&
17949             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17950                 goto nla_put_failure;
17951
17952         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17953                 &rdev->scan_req->info;
17954         if (info->scan_start_tsf &&
17955             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17956                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17957              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17958                      info->tsf_bssid)))
17959                 goto nla_put_failure;
17960
17961         return 0;
17962  nla_put_failure:
17963         return -ENOBUFS;
17964 }
17965
17966 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17967                                  struct cfg80211_registered_device *rdev,
17968                                  struct wireless_dev *wdev,
17969                                  u32 portid, u32 seq, int flags,
17970                                  u32 cmd)
17971 {
17972         void *hdr;
17973
17974         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17975         if (!hdr)
17976                 return -1;
17977
17978         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17979             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17980                                          wdev->netdev->ifindex)) ||
17981             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17982                               NL80211_ATTR_PAD))
17983                 goto nla_put_failure;
17984
17985         /* ignore errors and send incomplete event anyway */
17986         nl80211_add_scan_req(msg, rdev);
17987
17988         genlmsg_end(msg, hdr);
17989         return 0;
17990
17991  nla_put_failure:
17992         genlmsg_cancel(msg, hdr);
17993         return -EMSGSIZE;
17994 }
17995
17996 static int
17997 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17998                             struct cfg80211_sched_scan_request *req, u32 cmd)
17999 {
18000         void *hdr;
18001
18002         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18003         if (!hdr)
18004                 return -1;
18005
18006         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
18007                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
18008             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
18009             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
18010                               NL80211_ATTR_PAD))
18011                 goto nla_put_failure;
18012
18013         genlmsg_end(msg, hdr);
18014         return 0;
18015
18016  nla_put_failure:
18017         genlmsg_cancel(msg, hdr);
18018         return -EMSGSIZE;
18019 }
18020
18021 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
18022                              struct wireless_dev *wdev)
18023 {
18024         struct sk_buff *msg;
18025
18026         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18027         if (!msg)
18028                 return;
18029
18030         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
18031                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
18032                 nlmsg_free(msg);
18033                 return;
18034         }
18035
18036         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18037                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
18038 }
18039
18040 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
18041                                        struct wireless_dev *wdev, bool aborted)
18042 {
18043         struct sk_buff *msg;
18044
18045         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18046         if (!msg)
18047                 return NULL;
18048
18049         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
18050                                   aborted ? NL80211_CMD_SCAN_ABORTED :
18051                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
18052                 nlmsg_free(msg);
18053                 return NULL;
18054         }
18055
18056         return msg;
18057 }
18058
18059 /* send message created by nl80211_build_scan_msg() */
18060 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
18061                            struct sk_buff *msg)
18062 {
18063         if (!msg)
18064                 return;
18065
18066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18067                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
18068 }
18069
18070 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
18071 {
18072         struct sk_buff *msg;
18073
18074         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18075         if (!msg)
18076                 return;
18077
18078         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
18079                 nlmsg_free(msg);
18080                 return;
18081         }
18082
18083         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
18084                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
18085 }
18086
18087 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
18088                                           struct regulatory_request *request)
18089 {
18090         /* Userspace can always count this one always being set */
18091         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
18092                 goto nla_put_failure;
18093
18094         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
18095                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18096                                NL80211_REGDOM_TYPE_WORLD))
18097                         goto nla_put_failure;
18098         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
18099                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18100                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
18101                         goto nla_put_failure;
18102         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
18103                    request->intersect) {
18104                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18105                                NL80211_REGDOM_TYPE_INTERSECTION))
18106                         goto nla_put_failure;
18107         } else {
18108                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
18109                                NL80211_REGDOM_TYPE_COUNTRY) ||
18110                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
18111                                    request->alpha2))
18112                         goto nla_put_failure;
18113         }
18114
18115         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
18116                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
18117
18118                 if (wiphy &&
18119                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
18120                         goto nla_put_failure;
18121
18122                 if (wiphy &&
18123                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
18124                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
18125                         goto nla_put_failure;
18126         }
18127
18128         return true;
18129
18130 nla_put_failure:
18131         return false;
18132 }
18133
18134 /*
18135  * This can happen on global regulatory changes or device specific settings
18136  * based on custom regulatory domains.
18137  */
18138 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
18139                                      struct regulatory_request *request)
18140 {
18141         struct sk_buff *msg;
18142         void *hdr;
18143
18144         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18145         if (!msg)
18146                 return;
18147
18148         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
18149         if (!hdr)
18150                 goto nla_put_failure;
18151
18152         if (!nl80211_reg_change_event_fill(msg, request))
18153                 goto nla_put_failure;
18154
18155         genlmsg_end(msg, hdr);
18156
18157         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18158                                 NL80211_MCGRP_REGULATORY);
18159
18160         return;
18161
18162 nla_put_failure:
18163         nlmsg_free(msg);
18164 }
18165
18166 struct nl80211_mlme_event {
18167         enum nl80211_commands cmd;
18168         const u8 *buf;
18169         size_t buf_len;
18170         int uapsd_queues;
18171         const u8 *req_ies;
18172         size_t req_ies_len;
18173         bool reconnect;
18174 };
18175
18176 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
18177                                     struct net_device *netdev,
18178                                     const struct nl80211_mlme_event *event,
18179                                     gfp_t gfp)
18180 {
18181         struct sk_buff *msg;
18182         void *hdr;
18183
18184         msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
18185         if (!msg)
18186                 return;
18187
18188         hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
18189         if (!hdr) {
18190                 nlmsg_free(msg);
18191                 return;
18192         }
18193
18194         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18195             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18196             nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
18197             (event->req_ies &&
18198              nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
18199                      event->req_ies)))
18200                 goto nla_put_failure;
18201
18202         if (event->reconnect &&
18203             nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
18204                 goto nla_put_failure;
18205
18206         if (event->uapsd_queues >= 0) {
18207                 struct nlattr *nla_wmm =
18208                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
18209                 if (!nla_wmm)
18210                         goto nla_put_failure;
18211
18212                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
18213                                event->uapsd_queues))
18214                         goto nla_put_failure;
18215
18216                 nla_nest_end(msg, nla_wmm);
18217         }
18218
18219         genlmsg_end(msg, hdr);
18220
18221         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18222                                 NL80211_MCGRP_MLME, gfp);
18223         return;
18224
18225  nla_put_failure:
18226         nlmsg_free(msg);
18227 }
18228
18229 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
18230                           struct net_device *netdev, const u8 *buf,
18231                           size_t len, gfp_t gfp)
18232 {
18233         struct nl80211_mlme_event event = {
18234                 .cmd = NL80211_CMD_AUTHENTICATE,
18235                 .buf = buf,
18236                 .buf_len = len,
18237                 .uapsd_queues = -1,
18238         };
18239
18240         nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18241 }
18242
18243 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
18244                            struct net_device *netdev,
18245                            const struct cfg80211_rx_assoc_resp_data *data)
18246 {
18247         struct nl80211_mlme_event event = {
18248                 .cmd = NL80211_CMD_ASSOCIATE,
18249                 .buf = data->buf,
18250                 .buf_len = data->len,
18251                 .uapsd_queues = data->uapsd_queues,
18252                 .req_ies = data->req_ies,
18253                 .req_ies_len = data->req_ies_len,
18254         };
18255
18256         nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
18257 }
18258
18259 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
18260                          struct net_device *netdev, const u8 *buf,
18261                          size_t len, bool reconnect, gfp_t gfp)
18262 {
18263         struct nl80211_mlme_event event = {
18264                 .cmd = NL80211_CMD_DEAUTHENTICATE,
18265                 .buf = buf,
18266                 .buf_len = len,
18267                 .reconnect = reconnect,
18268                 .uapsd_queues = -1,
18269         };
18270
18271         nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18272 }
18273
18274 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
18275                            struct net_device *netdev, const u8 *buf,
18276                            size_t len, bool reconnect, gfp_t gfp)
18277 {
18278         struct nl80211_mlme_event event = {
18279                 .cmd = NL80211_CMD_DISASSOCIATE,
18280                 .buf = buf,
18281                 .buf_len = len,
18282                 .reconnect = reconnect,
18283                 .uapsd_queues = -1,
18284         };
18285
18286         nl80211_send_mlme_event(rdev, netdev, &event, gfp);
18287 }
18288
18289 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
18290                                   size_t len)
18291 {
18292         struct wireless_dev *wdev = dev->ieee80211_ptr;
18293         struct wiphy *wiphy = wdev->wiphy;
18294         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18295         const struct ieee80211_mgmt *mgmt = (void *)buf;
18296         struct nl80211_mlme_event event = {
18297                 .buf = buf,
18298                 .buf_len = len,
18299                 .uapsd_queues = -1,
18300         };
18301
18302         if (WARN_ON(len < 2))
18303                 return;
18304
18305         if (ieee80211_is_deauth(mgmt->frame_control)) {
18306                 event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
18307         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
18308                 event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
18309         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
18310                 if (wdev->unprot_beacon_reported &&
18311                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
18312                         return;
18313                 event.cmd = NL80211_CMD_UNPROT_BEACON;
18314                 wdev->unprot_beacon_reported = jiffies;
18315         } else {
18316                 return;
18317         }
18318
18319         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
18320         nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
18321 }
18322 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
18323
18324 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
18325                                       struct net_device *netdev, int cmd,
18326                                       const u8 *addr, gfp_t gfp)
18327 {
18328         struct sk_buff *msg;
18329         void *hdr;
18330
18331         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18332         if (!msg)
18333                 return;
18334
18335         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18336         if (!hdr) {
18337                 nlmsg_free(msg);
18338                 return;
18339         }
18340
18341         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18342             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18343             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18344             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18345                 goto nla_put_failure;
18346
18347         genlmsg_end(msg, hdr);
18348
18349         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18350                                 NL80211_MCGRP_MLME, gfp);
18351         return;
18352
18353  nla_put_failure:
18354         nlmsg_free(msg);
18355 }
18356
18357 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
18358                                struct net_device *netdev, const u8 *addr,
18359                                gfp_t gfp)
18360 {
18361         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
18362                                   addr, gfp);
18363 }
18364
18365 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
18366                                 struct net_device *netdev, const u8 *addr,
18367                                 gfp_t gfp)
18368 {
18369         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18370                                   addr, gfp);
18371 }
18372
18373 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18374                                  struct net_device *netdev,
18375                                  struct cfg80211_connect_resp_params *cr,
18376                                  gfp_t gfp)
18377 {
18378         struct sk_buff *msg;
18379         void *hdr;
18380         unsigned int link;
18381         size_t link_info_size = 0;
18382         const u8 *connected_addr = cr->valid_links ?
18383                                    cr->ap_mld_addr : cr->links[0].bssid;
18384
18385         if (cr->valid_links) {
18386                 for_each_valid_link(cr, link) {
18387                         /* Nested attribute header */
18388                         link_info_size += NLA_HDRLEN;
18389                         /* Link ID */
18390                         link_info_size += nla_total_size(sizeof(u8));
18391                         link_info_size += cr->links[link].addr ?
18392                                           nla_total_size(ETH_ALEN) : 0;
18393                         link_info_size += (cr->links[link].bssid ||
18394                                            cr->links[link].bss) ?
18395                                           nla_total_size(ETH_ALEN) : 0;
18396                         link_info_size += nla_total_size(sizeof(u16));
18397                 }
18398         }
18399
18400         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18401                         cr->fils.kek_len + cr->fils.pmk_len +
18402                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18403                         gfp);
18404         if (!msg)
18405                 return;
18406
18407         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18408         if (!hdr) {
18409                 nlmsg_free(msg);
18410                 return;
18411         }
18412
18413         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18414             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18415             (connected_addr &&
18416              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18417             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18418                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18419                         cr->status) ||
18420             (cr->status < 0 &&
18421              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18422               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18423                           cr->timeout_reason))) ||
18424             (cr->req_ie &&
18425              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18426             (cr->resp_ie &&
18427              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18428                      cr->resp_ie)) ||
18429             (cr->fils.update_erp_next_seq_num &&
18430              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18431                          cr->fils.erp_next_seq_num)) ||
18432             (cr->status == WLAN_STATUS_SUCCESS &&
18433              ((cr->fils.kek &&
18434                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18435                        cr->fils.kek)) ||
18436               (cr->fils.pmk &&
18437                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18438               (cr->fils.pmkid &&
18439                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18440                 goto nla_put_failure;
18441
18442         if (cr->valid_links) {
18443                 int i = 1;
18444                 struct nlattr *nested;
18445
18446                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18447                 if (!nested)
18448                         goto nla_put_failure;
18449
18450                 for_each_valid_link(cr, link) {
18451                         struct nlattr *nested_mlo_links;
18452                         const u8 *bssid = cr->links[link].bss ?
18453                                           cr->links[link].bss->bssid :
18454                                           cr->links[link].bssid;
18455
18456                         nested_mlo_links = nla_nest_start(msg, i);
18457                         if (!nested_mlo_links)
18458                                 goto nla_put_failure;
18459
18460                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18461                             (bssid &&
18462                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18463                             (cr->links[link].addr &&
18464                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18465                                      cr->links[link].addr)) ||
18466                             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18467                                         cr->links[link].status))
18468                                 goto nla_put_failure;
18469
18470                         nla_nest_end(msg, nested_mlo_links);
18471                         i++;
18472                 }
18473                 nla_nest_end(msg, nested);
18474         }
18475
18476         genlmsg_end(msg, hdr);
18477
18478         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18479                                 NL80211_MCGRP_MLME, gfp);
18480         return;
18481
18482  nla_put_failure:
18483         nlmsg_free(msg);
18484 }
18485
18486 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18487                          struct net_device *netdev,
18488                          struct cfg80211_roam_info *info, gfp_t gfp)
18489 {
18490         struct sk_buff *msg;
18491         void *hdr;
18492         size_t link_info_size = 0;
18493         unsigned int link;
18494         const u8 *connected_addr = info->ap_mld_addr ?
18495                                    info->ap_mld_addr :
18496                                    (info->links[0].bss ?
18497                                     info->links[0].bss->bssid :
18498                                     info->links[0].bssid);
18499
18500         if (info->valid_links) {
18501                 for_each_valid_link(info, link) {
18502                         /* Nested attribute header */
18503                         link_info_size += NLA_HDRLEN;
18504                         /* Link ID */
18505                         link_info_size += nla_total_size(sizeof(u8));
18506                         link_info_size += info->links[link].addr ?
18507                                           nla_total_size(ETH_ALEN) : 0;
18508                         link_info_size += (info->links[link].bssid ||
18509                                            info->links[link].bss) ?
18510                                           nla_total_size(ETH_ALEN) : 0;
18511                 }
18512         }
18513
18514         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18515                         info->fils.kek_len + info->fils.pmk_len +
18516                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18517                         link_info_size, gfp);
18518         if (!msg)
18519                 return;
18520
18521         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18522         if (!hdr) {
18523                 nlmsg_free(msg);
18524                 return;
18525         }
18526
18527         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18528             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18529             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18530             (info->req_ie &&
18531              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18532                      info->req_ie)) ||
18533             (info->resp_ie &&
18534              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18535                      info->resp_ie)) ||
18536             (info->fils.update_erp_next_seq_num &&
18537              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18538                          info->fils.erp_next_seq_num)) ||
18539             (info->fils.kek &&
18540              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18541                      info->fils.kek)) ||
18542             (info->fils.pmk &&
18543              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18544             (info->fils.pmkid &&
18545              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18546                 goto nla_put_failure;
18547
18548         if (info->valid_links) {
18549                 int i = 1;
18550                 struct nlattr *nested;
18551
18552                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18553                 if (!nested)
18554                         goto nla_put_failure;
18555
18556                 for_each_valid_link(info, link) {
18557                         struct nlattr *nested_mlo_links;
18558                         const u8 *bssid = info->links[link].bss ?
18559                                           info->links[link].bss->bssid :
18560                                           info->links[link].bssid;
18561
18562                         nested_mlo_links = nla_nest_start(msg, i);
18563                         if (!nested_mlo_links)
18564                                 goto nla_put_failure;
18565
18566                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18567                             (bssid &&
18568                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18569                             (info->links[link].addr &&
18570                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18571                                      info->links[link].addr)))
18572                                 goto nla_put_failure;
18573
18574                         nla_nest_end(msg, nested_mlo_links);
18575                         i++;
18576                 }
18577                 nla_nest_end(msg, nested);
18578         }
18579
18580         genlmsg_end(msg, hdr);
18581
18582         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18583                                 NL80211_MCGRP_MLME, gfp);
18584         return;
18585
18586  nla_put_failure:
18587         nlmsg_free(msg);
18588 }
18589
18590 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18591                                   struct net_device *netdev, const u8 *peer_addr,
18592                                   const u8 *td_bitmap, u8 td_bitmap_len)
18593 {
18594         struct sk_buff *msg;
18595         void *hdr;
18596
18597         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18598         if (!msg)
18599                 return;
18600
18601         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18602         if (!hdr) {
18603                 nlmsg_free(msg);
18604                 return;
18605         }
18606
18607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18608             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18609             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
18610                 goto nla_put_failure;
18611
18612         if (td_bitmap_len > 0 && td_bitmap &&
18613             nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
18614                 goto nla_put_failure;
18615
18616         genlmsg_end(msg, hdr);
18617
18618         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18619                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18620         return;
18621
18622  nla_put_failure:
18623         nlmsg_free(msg);
18624 }
18625
18626 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18627                                struct net_device *netdev, u16 reason,
18628                                const u8 *ie, size_t ie_len, bool from_ap)
18629 {
18630         struct sk_buff *msg;
18631         void *hdr;
18632
18633         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18634         if (!msg)
18635                 return;
18636
18637         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18638         if (!hdr) {
18639                 nlmsg_free(msg);
18640                 return;
18641         }
18642
18643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18644             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18645             (reason &&
18646              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18647             (from_ap &&
18648              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18649             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18650                 goto nla_put_failure;
18651
18652         genlmsg_end(msg, hdr);
18653
18654         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18655                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18656         return;
18657
18658  nla_put_failure:
18659         nlmsg_free(msg);
18660 }
18661
18662 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18663 {
18664         struct wireless_dev *wdev = dev->ieee80211_ptr;
18665         struct wiphy *wiphy = wdev->wiphy;
18666         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18667         struct sk_buff *msg;
18668         struct nlattr *links;
18669         void *hdr;
18670
18671         lockdep_assert_wiphy(wdev->wiphy);
18672         trace_cfg80211_links_removed(dev, link_mask);
18673
18674         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18675                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18676                 return;
18677
18678         if (WARN_ON(!wdev->valid_links || !link_mask ||
18679                     (wdev->valid_links & link_mask) != link_mask ||
18680                     wdev->valid_links == link_mask))
18681                 return;
18682
18683         cfg80211_wdev_release_link_bsses(wdev, link_mask);
18684         wdev->valid_links &= ~link_mask;
18685
18686         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18687         if (!msg)
18688                 return;
18689
18690         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18691         if (!hdr) {
18692                 nlmsg_free(msg);
18693                 return;
18694         }
18695
18696         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18697             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18698                 goto nla_put_failure;
18699
18700         links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18701         if (!links)
18702                 goto nla_put_failure;
18703
18704         while (link_mask) {
18705                 struct nlattr *link;
18706                 int link_id = __ffs(link_mask);
18707
18708                 link = nla_nest_start(msg, link_id + 1);
18709                 if (!link)
18710                         goto nla_put_failure;
18711
18712                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18713                         goto nla_put_failure;
18714
18715                 nla_nest_end(msg, link);
18716                 link_mask &= ~(1 << link_id);
18717         }
18718
18719         nla_nest_end(msg, links);
18720
18721         genlmsg_end(msg, hdr);
18722
18723         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18724                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18725         return;
18726
18727  nla_put_failure:
18728         nlmsg_free(msg);
18729 }
18730 EXPORT_SYMBOL(cfg80211_links_removed);
18731
18732 void nl80211_mlo_reconf_add_done(struct net_device *dev,
18733                                  struct cfg80211_mlo_reconf_done_data *data)
18734 {
18735         struct wireless_dev *wdev = dev->ieee80211_ptr;
18736         struct wiphy *wiphy = wdev->wiphy;
18737         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18738         struct nl80211_mlme_event event = {
18739                 .cmd = NL80211_CMD_ASSOC_MLO_RECONF,
18740                 .buf = data->buf,
18741                 .buf_len = data->len,
18742                 .uapsd_queues = -1,
18743         };
18744
18745         nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
18746 }
18747 EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
18748
18749 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18750                              struct net_device *netdev, const u8 *bssid,
18751                              gfp_t gfp)
18752 {
18753         struct sk_buff *msg;
18754         void *hdr;
18755
18756         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18757         if (!msg)
18758                 return;
18759
18760         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18761         if (!hdr) {
18762                 nlmsg_free(msg);
18763                 return;
18764         }
18765
18766         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18767             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18768             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18769                 goto nla_put_failure;
18770
18771         genlmsg_end(msg, hdr);
18772
18773         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18774                                 NL80211_MCGRP_MLME, gfp);
18775         return;
18776
18777  nla_put_failure:
18778         nlmsg_free(msg);
18779 }
18780
18781 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18782                                         const u8 *ie, u8 ie_len,
18783                                         int sig_dbm, gfp_t gfp)
18784 {
18785         struct wireless_dev *wdev = dev->ieee80211_ptr;
18786         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18787         struct sk_buff *msg;
18788         void *hdr;
18789
18790         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18791                 return;
18792
18793         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18794
18795         msg = nlmsg_new(100 + ie_len, gfp);
18796         if (!msg)
18797                 return;
18798
18799         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18800         if (!hdr) {
18801                 nlmsg_free(msg);
18802                 return;
18803         }
18804
18805         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18806             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18807             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18808             (ie_len && ie &&
18809              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18810             (sig_dbm &&
18811              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18812                 goto nla_put_failure;
18813
18814         genlmsg_end(msg, hdr);
18815
18816         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18817                                 NL80211_MCGRP_MLME, gfp);
18818         return;
18819
18820  nla_put_failure:
18821         nlmsg_free(msg);
18822 }
18823 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18824
18825 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18826                                  struct net_device *netdev, const u8 *addr,
18827                                  enum nl80211_key_type key_type, int key_id,
18828                                  const u8 *tsc, gfp_t gfp)
18829 {
18830         struct sk_buff *msg;
18831         void *hdr;
18832
18833         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18834         if (!msg)
18835                 return;
18836
18837         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18838         if (!hdr) {
18839                 nlmsg_free(msg);
18840                 return;
18841         }
18842
18843         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18844             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18845             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18846             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18847             (key_id != -1 &&
18848              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18849             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18850                 goto nla_put_failure;
18851
18852         genlmsg_end(msg, hdr);
18853
18854         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18855                                 NL80211_MCGRP_MLME, gfp);
18856         return;
18857
18858  nla_put_failure:
18859         nlmsg_free(msg);
18860 }
18861
18862 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18863                                     struct ieee80211_channel *channel_before,
18864                                     struct ieee80211_channel *channel_after)
18865 {
18866         struct sk_buff *msg;
18867         void *hdr;
18868         struct nlattr *nl_freq;
18869
18870         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18871         if (!msg)
18872                 return;
18873
18874         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18875         if (!hdr) {
18876                 nlmsg_free(msg);
18877                 return;
18878         }
18879
18880         /*
18881          * Since we are applying the beacon hint to a wiphy we know its
18882          * wiphy_idx is valid
18883          */
18884         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18885                 goto nla_put_failure;
18886
18887         /* Before */
18888         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18889         if (!nl_freq)
18890                 goto nla_put_failure;
18891
18892         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18893                 goto nla_put_failure;
18894         nla_nest_end(msg, nl_freq);
18895
18896         /* After */
18897         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18898         if (!nl_freq)
18899                 goto nla_put_failure;
18900
18901         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18902                 goto nla_put_failure;
18903         nla_nest_end(msg, nl_freq);
18904
18905         genlmsg_end(msg, hdr);
18906
18907         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18908                                 NL80211_MCGRP_REGULATORY);
18909
18910         return;
18911
18912 nla_put_failure:
18913         nlmsg_free(msg);
18914 }
18915
18916 static void nl80211_send_remain_on_chan_event(
18917         int cmd, struct cfg80211_registered_device *rdev,
18918         struct wireless_dev *wdev, u64 cookie,
18919         struct ieee80211_channel *chan,
18920         unsigned int duration, gfp_t gfp)
18921 {
18922         struct sk_buff *msg;
18923         void *hdr;
18924
18925         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18926         if (!msg)
18927                 return;
18928
18929         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18930         if (!hdr) {
18931                 nlmsg_free(msg);
18932                 return;
18933         }
18934
18935         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18936             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18937                                          wdev->netdev->ifindex)) ||
18938             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18939                               NL80211_ATTR_PAD) ||
18940             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18941             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18942                         NL80211_CHAN_NO_HT) ||
18943             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18944                               NL80211_ATTR_PAD))
18945                 goto nla_put_failure;
18946
18947         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18948             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18949                 goto nla_put_failure;
18950
18951         genlmsg_end(msg, hdr);
18952
18953         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18954                                 NL80211_MCGRP_MLME, gfp);
18955         return;
18956
18957  nla_put_failure:
18958         nlmsg_free(msg);
18959 }
18960
18961 void cfg80211_assoc_comeback(struct net_device *netdev,
18962                              const u8 *ap_addr, u32 timeout)
18963 {
18964         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18965         struct wiphy *wiphy = wdev->wiphy;
18966         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18967         struct sk_buff *msg;
18968         void *hdr;
18969
18970         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18971
18972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18973         if (!msg)
18974                 return;
18975
18976         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18977         if (!hdr) {
18978                 nlmsg_free(msg);
18979                 return;
18980         }
18981
18982         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18983             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18984             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18985             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18986                 goto nla_put_failure;
18987
18988         genlmsg_end(msg, hdr);
18989
18990         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18991                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18992         return;
18993
18994  nla_put_failure:
18995         nlmsg_free(msg);
18996 }
18997 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18998
18999 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
19000                                struct ieee80211_channel *chan,
19001                                unsigned int duration, gfp_t gfp)
19002 {
19003         struct wiphy *wiphy = wdev->wiphy;
19004         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19005
19006         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
19007         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
19008                                           rdev, wdev, cookie, chan,
19009                                           duration, gfp);
19010 }
19011 EXPORT_SYMBOL(cfg80211_ready_on_channel);
19012
19013 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
19014                                         struct ieee80211_channel *chan,
19015                                         gfp_t gfp)
19016 {
19017         struct wiphy *wiphy = wdev->wiphy;
19018         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19019
19020         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
19021         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
19022                                           rdev, wdev, cookie, chan, 0, gfp);
19023 }
19024 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
19025
19026 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
19027                                         struct ieee80211_channel *chan,
19028                                         gfp_t gfp)
19029 {
19030         struct wiphy *wiphy = wdev->wiphy;
19031         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19032
19033         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
19034         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
19035                                           rdev, wdev, cookie, chan, 0, gfp);
19036 }
19037 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
19038
19039 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
19040                       struct station_info *sinfo, gfp_t gfp)
19041 {
19042         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19043         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19044         struct sk_buff *msg;
19045
19046         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
19047
19048         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19049         if (!msg)
19050                 return;
19051
19052         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
19053                                  rdev, dev, mac_addr, sinfo) < 0) {
19054                 nlmsg_free(msg);
19055                 return;
19056         }
19057
19058         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19059                                 NL80211_MCGRP_MLME, gfp);
19060 }
19061 EXPORT_SYMBOL(cfg80211_new_sta);
19062
19063 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
19064                             struct station_info *sinfo, gfp_t gfp)
19065 {
19066         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19067         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19068         struct sk_buff *msg;
19069         struct station_info empty_sinfo = {};
19070
19071         if (!sinfo)
19072                 sinfo = &empty_sinfo;
19073
19074         trace_cfg80211_del_sta(dev, mac_addr);
19075
19076         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19077         if (!msg) {
19078                 cfg80211_sinfo_release_content(sinfo);
19079                 return;
19080         }
19081
19082         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
19083                                  rdev, dev, mac_addr, sinfo) < 0) {
19084                 nlmsg_free(msg);
19085                 return;
19086         }
19087
19088         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19089                                 NL80211_MCGRP_MLME, gfp);
19090 }
19091 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
19092
19093 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
19094                           enum nl80211_connect_failed_reason reason,
19095                           gfp_t gfp)
19096 {
19097         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
19098         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19099         struct sk_buff *msg;
19100         void *hdr;
19101
19102         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
19103         if (!msg)
19104                 return;
19105
19106         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
19107         if (!hdr) {
19108                 nlmsg_free(msg);
19109                 return;
19110         }
19111
19112         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19113             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
19114             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
19115                 goto nla_put_failure;
19116
19117         genlmsg_end(msg, hdr);
19118
19119         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19120                                 NL80211_MCGRP_MLME, gfp);
19121         return;
19122
19123  nla_put_failure:
19124         nlmsg_free(msg);
19125 }
19126 EXPORT_SYMBOL(cfg80211_conn_failed);
19127
19128 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
19129                                        const u8 *addr, gfp_t gfp)
19130 {
19131         struct wireless_dev *wdev = dev->ieee80211_ptr;
19132         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19133         struct sk_buff *msg;
19134         void *hdr;
19135         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
19136
19137         if (!nlportid)
19138                 return false;
19139
19140         msg = nlmsg_new(100, gfp);
19141         if (!msg)
19142                 return true;
19143
19144         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19145         if (!hdr) {
19146                 nlmsg_free(msg);
19147                 return true;
19148         }
19149
19150         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19151             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19152             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19153                 goto nla_put_failure;
19154
19155         genlmsg_end(msg, hdr);
19156         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19157         return true;
19158
19159  nla_put_failure:
19160         nlmsg_free(msg);
19161         return true;
19162 }
19163
19164 bool cfg80211_rx_spurious_frame(struct net_device *dev,
19165                                 const u8 *addr, gfp_t gfp)
19166 {
19167         struct wireless_dev *wdev = dev->ieee80211_ptr;
19168         bool ret;
19169
19170         trace_cfg80211_rx_spurious_frame(dev, addr);
19171
19172         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19173                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
19174                 trace_cfg80211_return_bool(false);
19175                 return false;
19176         }
19177         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
19178                                          addr, gfp);
19179         trace_cfg80211_return_bool(ret);
19180         return ret;
19181 }
19182 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
19183
19184 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
19185                                         const u8 *addr, gfp_t gfp)
19186 {
19187         struct wireless_dev *wdev = dev->ieee80211_ptr;
19188         bool ret;
19189
19190         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
19191
19192         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
19193                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
19194                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
19195                 trace_cfg80211_return_bool(false);
19196                 return false;
19197         }
19198         ret = __nl80211_unexpected_frame(dev,
19199                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
19200                                          addr, gfp);
19201         trace_cfg80211_return_bool(ret);
19202         return ret;
19203 }
19204 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
19205
19206 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
19207                       struct wireless_dev *wdev, u32 nlportid,
19208                       struct cfg80211_rx_info *info, gfp_t gfp)
19209 {
19210         struct net_device *netdev = wdev->netdev;
19211         struct sk_buff *msg;
19212         void *hdr;
19213
19214         msg = nlmsg_new(100 + info->len, gfp);
19215         if (!msg)
19216                 return -ENOMEM;
19217
19218         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19219         if (!hdr) {
19220                 nlmsg_free(msg);
19221                 return -ENOMEM;
19222         }
19223
19224         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19225             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19226                                         netdev->ifindex)) ||
19227             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19228                               NL80211_ATTR_PAD) ||
19229             (info->have_link_id &&
19230              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
19231             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
19232             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
19233             (info->sig_dbm &&
19234              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
19235             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
19236             (info->flags &&
19237              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
19238             (info->rx_tstamp && nla_put_u64_64bit(msg,
19239                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
19240                                                   info->rx_tstamp,
19241                                                   NL80211_ATTR_PAD)) ||
19242             (info->ack_tstamp && nla_put_u64_64bit(msg,
19243                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
19244                                                    info->ack_tstamp,
19245                                                    NL80211_ATTR_PAD)))
19246                 goto nla_put_failure;
19247
19248         genlmsg_end(msg, hdr);
19249
19250         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19251
19252  nla_put_failure:
19253         nlmsg_free(msg);
19254         return -ENOBUFS;
19255 }
19256
19257 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
19258                                     struct cfg80211_tx_status *status,
19259                                     gfp_t gfp, enum nl80211_commands command)
19260 {
19261         struct wiphy *wiphy = wdev->wiphy;
19262         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19263         struct net_device *netdev = wdev->netdev;
19264         struct sk_buff *msg;
19265         void *hdr;
19266
19267         if (command == NL80211_CMD_FRAME_TX_STATUS)
19268                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
19269                                               status->ack);
19270         else
19271                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
19272                                                       status->ack);
19273
19274         msg = nlmsg_new(100 + status->len, gfp);
19275         if (!msg)
19276                 return;
19277
19278         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
19279         if (!hdr) {
19280                 nlmsg_free(msg);
19281                 return;
19282         }
19283
19284         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19285             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19286                                    netdev->ifindex)) ||
19287             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19288                               NL80211_ATTR_PAD) ||
19289             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
19290             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
19291                               NL80211_ATTR_PAD) ||
19292             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19293             (status->tx_tstamp &&
19294              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
19295                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
19296             (status->ack_tstamp &&
19297              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
19298                                status->ack_tstamp, NL80211_ATTR_PAD)))
19299                 goto nla_put_failure;
19300
19301         genlmsg_end(msg, hdr);
19302
19303         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19304                                 NL80211_MCGRP_MLME, gfp);
19305         return;
19306
19307 nla_put_failure:
19308         nlmsg_free(msg);
19309 }
19310
19311 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
19312                                      const u8 *buf, size_t len, bool ack,
19313                                      gfp_t gfp)
19314 {
19315         struct cfg80211_tx_status status = {
19316                 .cookie = cookie,
19317                 .buf = buf,
19318                 .len = len,
19319                 .ack = ack
19320         };
19321
19322         nl80211_frame_tx_status(wdev, &status, gfp,
19323                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
19324 }
19325 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
19326
19327 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
19328                                  struct cfg80211_tx_status *status, gfp_t gfp)
19329 {
19330         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
19331 }
19332 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
19333
19334 static int __nl80211_rx_control_port(struct net_device *dev,
19335                                      struct sk_buff *skb,
19336                                      bool unencrypted,
19337                                      int link_id,
19338                                      gfp_t gfp)
19339 {
19340         struct wireless_dev *wdev = dev->ieee80211_ptr;
19341         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19342         struct ethhdr *ehdr = eth_hdr(skb);
19343         const u8 *addr = ehdr->h_source;
19344         u16 proto = be16_to_cpu(skb->protocol);
19345         struct sk_buff *msg;
19346         void *hdr;
19347         struct nlattr *frame;
19348
19349         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
19350
19351         if (!nlportid)
19352                 return -ENOENT;
19353
19354         msg = nlmsg_new(100 + skb->len, gfp);
19355         if (!msg)
19356                 return -ENOMEM;
19357
19358         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
19359         if (!hdr) {
19360                 nlmsg_free(msg);
19361                 return -ENOBUFS;
19362         }
19363
19364         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19365             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19366             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19367                               NL80211_ATTR_PAD) ||
19368             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19369             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
19370             (link_id >= 0 &&
19371              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
19372             (unencrypted && nla_put_flag(msg,
19373                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
19374                 goto nla_put_failure;
19375
19376         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
19377         if (!frame)
19378                 goto nla_put_failure;
19379
19380         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
19381         genlmsg_end(msg, hdr);
19382
19383         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19384
19385  nla_put_failure:
19386         nlmsg_free(msg);
19387         return -ENOBUFS;
19388 }
19389
19390 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19391                               bool unencrypted, int link_id)
19392 {
19393         int ret;
19394
19395         trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19396         ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19397                                         GFP_ATOMIC);
19398         trace_cfg80211_return_bool(ret == 0);
19399         return ret == 0;
19400 }
19401 EXPORT_SYMBOL(cfg80211_rx_control_port);
19402
19403 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19404                                             const char *mac, gfp_t gfp)
19405 {
19406         struct wireless_dev *wdev = dev->ieee80211_ptr;
19407         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19408         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19409         void **cb;
19410
19411         if (!msg)
19412                 return NULL;
19413
19414         cb = (void **)msg->cb;
19415
19416         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19417         if (!cb[0]) {
19418                 nlmsg_free(msg);
19419                 return NULL;
19420         }
19421
19422         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19423             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19424                 goto nla_put_failure;
19425
19426         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19427                 goto nla_put_failure;
19428
19429         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19430         if (!cb[1])
19431                 goto nla_put_failure;
19432
19433         cb[2] = rdev;
19434
19435         return msg;
19436  nla_put_failure:
19437         nlmsg_free(msg);
19438         return NULL;
19439 }
19440
19441 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19442 {
19443         void **cb = (void **)msg->cb;
19444         struct cfg80211_registered_device *rdev = cb[2];
19445
19446         nla_nest_end(msg, cb[1]);
19447         genlmsg_end(msg, cb[0]);
19448
19449         memset(msg->cb, 0, sizeof(msg->cb));
19450
19451         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19452                                 NL80211_MCGRP_MLME, gfp);
19453 }
19454
19455 void cfg80211_cqm_rssi_notify(struct net_device *dev,
19456                               enum nl80211_cqm_rssi_threshold_event rssi_event,
19457                               s32 rssi_level, gfp_t gfp)
19458 {
19459         struct wireless_dev *wdev = dev->ieee80211_ptr;
19460         struct cfg80211_cqm_config *cqm_config;
19461
19462         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19463
19464         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19465                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19466                 return;
19467
19468         rcu_read_lock();
19469         cqm_config = rcu_dereference(wdev->cqm_config);
19470         if (cqm_config) {
19471                 cqm_config->last_rssi_event_value = rssi_level;
19472                 cqm_config->last_rssi_event_type = rssi_event;
19473                 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19474         }
19475         rcu_read_unlock();
19476 }
19477 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19478
19479 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19480 {
19481         struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19482                                                  cqm_rssi_work);
19483         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19484         enum nl80211_cqm_rssi_threshold_event rssi_event;
19485         struct cfg80211_cqm_config *cqm_config;
19486         struct sk_buff *msg;
19487         s32 rssi_level;
19488
19489         cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
19490         if (!cqm_config)
19491                 return;
19492
19493         if (cqm_config->use_range_api)
19494                 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19495
19496         rssi_level = cqm_config->last_rssi_event_value;
19497         rssi_event = cqm_config->last_rssi_event_type;
19498
19499         msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19500         if (!msg)
19501                 return;
19502
19503         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19504                         rssi_event))
19505                 goto nla_put_failure;
19506
19507         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19508                                       rssi_level))
19509                 goto nla_put_failure;
19510
19511         cfg80211_send_cqm(msg, GFP_KERNEL);
19512
19513         return;
19514
19515  nla_put_failure:
19516         nlmsg_free(msg);
19517 }
19518
19519 void cfg80211_cqm_txe_notify(struct net_device *dev,
19520                              const u8 *peer, u32 num_packets,
19521                              u32 rate, u32 intvl, gfp_t gfp)
19522 {
19523         struct sk_buff *msg;
19524
19525         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19526         if (!msg)
19527                 return;
19528
19529         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19530                 goto nla_put_failure;
19531
19532         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19533                 goto nla_put_failure;
19534
19535         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19536                 goto nla_put_failure;
19537
19538         cfg80211_send_cqm(msg, gfp);
19539         return;
19540
19541  nla_put_failure:
19542         nlmsg_free(msg);
19543 }
19544 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19545
19546 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19547                                  const u8 *peer, u32 num_packets, gfp_t gfp)
19548 {
19549         struct sk_buff *msg;
19550
19551         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19552
19553         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19554         if (!msg)
19555                 return;
19556
19557         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19558                 goto nla_put_failure;
19559
19560         cfg80211_send_cqm(msg, gfp);
19561         return;
19562
19563  nla_put_failure:
19564         nlmsg_free(msg);
19565 }
19566 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19567
19568 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19569 {
19570         struct sk_buff *msg;
19571
19572         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19573         if (!msg)
19574                 return;
19575
19576         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19577                 goto nla_put_failure;
19578
19579         cfg80211_send_cqm(msg, gfp);
19580         return;
19581
19582  nla_put_failure:
19583         nlmsg_free(msg);
19584 }
19585 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19586
19587 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19588                                      struct net_device *netdev, const u8 *bssid,
19589                                      const u8 *replay_ctr, gfp_t gfp)
19590 {
19591         struct sk_buff *msg;
19592         struct nlattr *rekey_attr;
19593         void *hdr;
19594
19595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19596         if (!msg)
19597                 return;
19598
19599         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19600         if (!hdr) {
19601                 nlmsg_free(msg);
19602                 return;
19603         }
19604
19605         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19606             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19607             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19608                 goto nla_put_failure;
19609
19610         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19611         if (!rekey_attr)
19612                 goto nla_put_failure;
19613
19614         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19615                     NL80211_REPLAY_CTR_LEN, replay_ctr))
19616                 goto nla_put_failure;
19617
19618         nla_nest_end(msg, rekey_attr);
19619
19620         genlmsg_end(msg, hdr);
19621
19622         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19623                                 NL80211_MCGRP_MLME, gfp);
19624         return;
19625
19626  nla_put_failure:
19627         nlmsg_free(msg);
19628 }
19629
19630 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19631                                const u8 *replay_ctr, gfp_t gfp)
19632 {
19633         struct wireless_dev *wdev = dev->ieee80211_ptr;
19634         struct wiphy *wiphy = wdev->wiphy;
19635         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19636
19637         trace_cfg80211_gtk_rekey_notify(dev, bssid);
19638         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19639 }
19640 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19641
19642 static void
19643 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19644                                struct net_device *netdev, int index,
19645                                const u8 *bssid, bool preauth, gfp_t gfp)
19646 {
19647         struct sk_buff *msg;
19648         struct nlattr *attr;
19649         void *hdr;
19650
19651         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19652         if (!msg)
19653                 return;
19654
19655         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19656         if (!hdr) {
19657                 nlmsg_free(msg);
19658                 return;
19659         }
19660
19661         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19662             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19663                 goto nla_put_failure;
19664
19665         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19666         if (!attr)
19667                 goto nla_put_failure;
19668
19669         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19670             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19671             (preauth &&
19672              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19673                 goto nla_put_failure;
19674
19675         nla_nest_end(msg, attr);
19676
19677         genlmsg_end(msg, hdr);
19678
19679         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19680                                 NL80211_MCGRP_MLME, gfp);
19681         return;
19682
19683  nla_put_failure:
19684         nlmsg_free(msg);
19685 }
19686
19687 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19688                                      const u8 *bssid, bool preauth, gfp_t gfp)
19689 {
19690         struct wireless_dev *wdev = dev->ieee80211_ptr;
19691         struct wiphy *wiphy = wdev->wiphy;
19692         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19693
19694         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19695         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19696 }
19697 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19698
19699 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19700                                      struct net_device *netdev,
19701                                      unsigned int link_id,
19702                                      struct cfg80211_chan_def *chandef,
19703                                      gfp_t gfp,
19704                                      enum nl80211_commands notif,
19705                                      u8 count, bool quiet)
19706 {
19707         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19708         struct sk_buff *msg;
19709         void *hdr;
19710
19711         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19712         if (!msg)
19713                 return;
19714
19715         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19716         if (!hdr) {
19717                 nlmsg_free(msg);
19718                 return;
19719         }
19720
19721         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19722                 goto nla_put_failure;
19723
19724         if (wdev->valid_links &&
19725             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19726                 goto nla_put_failure;
19727
19728         if (nl80211_send_chandef(msg, chandef))
19729                 goto nla_put_failure;
19730
19731         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19732                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19733                         goto nla_put_failure;
19734                 if (quiet &&
19735                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19736                         goto nla_put_failure;
19737         }
19738
19739         genlmsg_end(msg, hdr);
19740
19741         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19742                                 NL80211_MCGRP_MLME, gfp);
19743         return;
19744
19745  nla_put_failure:
19746         nlmsg_free(msg);
19747 }
19748
19749 void cfg80211_ch_switch_notify(struct net_device *dev,
19750                                struct cfg80211_chan_def *chandef,
19751                                unsigned int link_id)
19752 {
19753         struct wireless_dev *wdev = dev->ieee80211_ptr;
19754         struct wiphy *wiphy = wdev->wiphy;
19755         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19756
19757         lockdep_assert_wiphy(wdev->wiphy);
19758         WARN_INVALID_LINK_ID(wdev, link_id);
19759
19760         trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
19761
19762         switch (wdev->iftype) {
19763         case NL80211_IFTYPE_STATION:
19764         case NL80211_IFTYPE_P2P_CLIENT:
19765                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19766                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19767                                                         chandef->chan);
19768                 break;
19769         case NL80211_IFTYPE_MESH_POINT:
19770                 wdev->u.mesh.chandef = *chandef;
19771                 wdev->u.mesh.preset_chandef = *chandef;
19772                 break;
19773         case NL80211_IFTYPE_AP:
19774         case NL80211_IFTYPE_P2P_GO:
19775                 wdev->links[link_id].ap.chandef = *chandef;
19776                 break;
19777         case NL80211_IFTYPE_ADHOC:
19778                 wdev->u.ibss.chandef = *chandef;
19779                 break;
19780         default:
19781                 WARN_ON(1);
19782                 break;
19783         }
19784
19785         cfg80211_schedule_channels_check(wdev);
19786         cfg80211_sched_dfs_chan_update(rdev);
19787
19788         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19789                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
19790 }
19791 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19792
19793 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19794                                        struct cfg80211_chan_def *chandef,
19795                                        unsigned int link_id, u8 count,
19796                                        bool quiet)
19797 {
19798         struct wireless_dev *wdev = dev->ieee80211_ptr;
19799         struct wiphy *wiphy = wdev->wiphy;
19800         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19801
19802         lockdep_assert_wiphy(wdev->wiphy);
19803         WARN_INVALID_LINK_ID(wdev, link_id);
19804
19805         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
19806
19807
19808         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19809                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19810                                  count, quiet);
19811 }
19812 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19813
19814 int cfg80211_bss_color_notify(struct net_device *dev,
19815                               enum nl80211_commands cmd, u8 count,
19816                               u64 color_bitmap, u8 link_id)
19817 {
19818         struct wireless_dev *wdev = dev->ieee80211_ptr;
19819         struct wiphy *wiphy = wdev->wiphy;
19820         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19821         struct sk_buff *msg;
19822         void *hdr;
19823
19824         lockdep_assert_wiphy(wdev->wiphy);
19825
19826         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19827
19828         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19829         if (!msg)
19830                 return -ENOMEM;
19831
19832         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19833         if (!hdr)
19834                 goto nla_put_failure;
19835
19836         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19837                 goto nla_put_failure;
19838
19839         if (wdev->valid_links &&
19840             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19841                 goto nla_put_failure;
19842
19843         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19844             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19845                 goto nla_put_failure;
19846
19847         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19848             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19849                               color_bitmap, NL80211_ATTR_PAD))
19850                 goto nla_put_failure;
19851
19852         genlmsg_end(msg, hdr);
19853
19854         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19855                                        msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19856
19857 nla_put_failure:
19858         nlmsg_free(msg);
19859         return -EINVAL;
19860 }
19861 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19862
19863 void
19864 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19865                      const struct cfg80211_chan_def *chandef,
19866                      enum nl80211_radar_event event,
19867                      struct net_device *netdev, gfp_t gfp)
19868 {
19869         struct sk_buff *msg;
19870         void *hdr;
19871
19872         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19873         if (!msg)
19874                 return;
19875
19876         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19877         if (!hdr) {
19878                 nlmsg_free(msg);
19879                 return;
19880         }
19881
19882         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19883                 goto nla_put_failure;
19884
19885         /* NOP and radar events don't need a netdev parameter */
19886         if (netdev) {
19887                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19888
19889                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19890                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19891                                       NL80211_ATTR_PAD))
19892                         goto nla_put_failure;
19893         }
19894
19895         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19896                 goto nla_put_failure;
19897
19898         if (nl80211_send_chandef(msg, chandef))
19899                 goto nla_put_failure;
19900
19901         genlmsg_end(msg, hdr);
19902
19903         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19904                                 NL80211_MCGRP_MLME, gfp);
19905         return;
19906
19907  nla_put_failure:
19908         nlmsg_free(msg);
19909 }
19910
19911 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19912                                        struct sta_opmode_info *sta_opmode,
19913                                        gfp_t gfp)
19914 {
19915         struct sk_buff *msg;
19916         struct wireless_dev *wdev = dev->ieee80211_ptr;
19917         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19918         void *hdr;
19919
19920         if (WARN_ON(!mac))
19921                 return;
19922
19923         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19924         if (!msg)
19925                 return;
19926
19927         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19928         if (!hdr) {
19929                 nlmsg_free(msg);
19930                 return;
19931         }
19932
19933         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19934                 goto nla_put_failure;
19935
19936         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19937                 goto nla_put_failure;
19938
19939         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19940                 goto nla_put_failure;
19941
19942         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19943             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19944                 goto nla_put_failure;
19945
19946         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19947             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19948                 goto nla_put_failure;
19949
19950         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19951             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19952                 goto nla_put_failure;
19953
19954         genlmsg_end(msg, hdr);
19955
19956         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19957                                 NL80211_MCGRP_MLME, gfp);
19958
19959         return;
19960
19961 nla_put_failure:
19962         nlmsg_free(msg);
19963 }
19964 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19965
19966 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19967                            u64 cookie, bool acked, s32 ack_signal,
19968                            bool is_valid_ack_signal, gfp_t gfp)
19969 {
19970         struct wireless_dev *wdev = dev->ieee80211_ptr;
19971         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19972         struct sk_buff *msg;
19973         void *hdr;
19974
19975         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19976
19977         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19978
19979         if (!msg)
19980                 return;
19981
19982         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19983         if (!hdr) {
19984                 nlmsg_free(msg);
19985                 return;
19986         }
19987
19988         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19989             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19990             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19991             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19992                               NL80211_ATTR_PAD) ||
19993             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19994             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19995                                                 ack_signal)))
19996                 goto nla_put_failure;
19997
19998         genlmsg_end(msg, hdr);
19999
20000         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20001                                 NL80211_MCGRP_MLME, gfp);
20002         return;
20003
20004  nla_put_failure:
20005         nlmsg_free(msg);
20006 }
20007 EXPORT_SYMBOL(cfg80211_probe_status);
20008
20009 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
20010                                      size_t len, int freq, int sig_dbm)
20011 {
20012         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20013         struct sk_buff *msg;
20014         void *hdr;
20015         struct cfg80211_beacon_registration *reg;
20016
20017         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
20018
20019         spin_lock_bh(&rdev->beacon_registrations_lock);
20020         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
20021                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
20022                 if (!msg) {
20023                         spin_unlock_bh(&rdev->beacon_registrations_lock);
20024                         return;
20025                 }
20026
20027                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20028                 if (!hdr)
20029                         goto nla_put_failure;
20030
20031                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20032                     (freq &&
20033                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
20034                                   KHZ_TO_MHZ(freq)) ||
20035                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
20036                                   freq % 1000))) ||
20037                     (sig_dbm &&
20038                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
20039                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
20040                         goto nla_put_failure;
20041
20042                 genlmsg_end(msg, hdr);
20043
20044                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
20045         }
20046         spin_unlock_bh(&rdev->beacon_registrations_lock);
20047         return;
20048
20049  nla_put_failure:
20050         spin_unlock_bh(&rdev->beacon_registrations_lock);
20051         nlmsg_free(msg);
20052 }
20053 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
20054
20055 #ifdef CONFIG_PM
20056 static int cfg80211_net_detect_results(struct sk_buff *msg,
20057                                        struct cfg80211_wowlan_wakeup *wakeup)
20058 {
20059         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
20060         struct nlattr *nl_results, *nl_match, *nl_freqs;
20061         int i, j;
20062
20063         nl_results = nla_nest_start_noflag(msg,
20064                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
20065         if (!nl_results)
20066                 return -EMSGSIZE;
20067
20068         for (i = 0; i < nd->n_matches; i++) {
20069                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
20070
20071                 nl_match = nla_nest_start_noflag(msg, i);
20072                 if (!nl_match)
20073                         break;
20074
20075                 /* The SSID attribute is optional in nl80211, but for
20076                  * simplicity reasons it's always present in the
20077                  * cfg80211 structure.  If a driver can't pass the
20078                  * SSID, that needs to be changed.  A zero length SSID
20079                  * is still a valid SSID (wildcard), so it cannot be
20080                  * used for this purpose.
20081                  */
20082                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
20083                             match->ssid.ssid)) {
20084                         nla_nest_cancel(msg, nl_match);
20085                         goto out;
20086                 }
20087
20088                 if (match->n_channels) {
20089                         nl_freqs = nla_nest_start_noflag(msg,
20090                                                          NL80211_ATTR_SCAN_FREQUENCIES);
20091                         if (!nl_freqs) {
20092                                 nla_nest_cancel(msg, nl_match);
20093                                 goto out;
20094                         }
20095
20096                         for (j = 0; j < match->n_channels; j++) {
20097                                 if (nla_put_u32(msg, j, match->channels[j])) {
20098                                         nla_nest_cancel(msg, nl_freqs);
20099                                         nla_nest_cancel(msg, nl_match);
20100                                         goto out;
20101                                 }
20102                         }
20103
20104                         nla_nest_end(msg, nl_freqs);
20105                 }
20106
20107                 nla_nest_end(msg, nl_match);
20108         }
20109
20110 out:
20111         nla_nest_end(msg, nl_results);
20112         return 0;
20113 }
20114
20115 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
20116                                    struct cfg80211_wowlan_wakeup *wakeup,
20117                                    gfp_t gfp)
20118 {
20119         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20120         struct sk_buff *msg;
20121         void *hdr;
20122         int size = 200;
20123
20124         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
20125
20126         if (wakeup)
20127                 size += wakeup->packet_present_len;
20128
20129         msg = nlmsg_new(size, gfp);
20130         if (!msg)
20131                 return;
20132
20133         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
20134         if (!hdr)
20135                 goto free_msg;
20136
20137         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20138             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20139                               NL80211_ATTR_PAD))
20140                 goto free_msg;
20141
20142         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20143                                         wdev->netdev->ifindex))
20144                 goto free_msg;
20145
20146         if (wakeup) {
20147                 struct nlattr *reasons;
20148
20149                 reasons = nla_nest_start_noflag(msg,
20150                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
20151                 if (!reasons)
20152                         goto free_msg;
20153
20154                 if (wakeup->disconnect &&
20155                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
20156                         goto free_msg;
20157                 if (wakeup->magic_pkt &&
20158                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
20159                         goto free_msg;
20160                 if (wakeup->gtk_rekey_failure &&
20161                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
20162                         goto free_msg;
20163                 if (wakeup->eap_identity_req &&
20164                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
20165                         goto free_msg;
20166                 if (wakeup->four_way_handshake &&
20167                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
20168                         goto free_msg;
20169                 if (wakeup->rfkill_release &&
20170                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
20171                         goto free_msg;
20172
20173                 if (wakeup->pattern_idx >= 0 &&
20174                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
20175                                 wakeup->pattern_idx))
20176                         goto free_msg;
20177
20178                 if (wakeup->tcp_match &&
20179                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
20180                         goto free_msg;
20181
20182                 if (wakeup->tcp_connlost &&
20183                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
20184                         goto free_msg;
20185
20186                 if (wakeup->tcp_nomoretokens &&
20187                     nla_put_flag(msg,
20188                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
20189                         goto free_msg;
20190
20191                 if (wakeup->unprot_deauth_disassoc &&
20192                     nla_put_flag(msg,
20193                                  NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
20194                         goto free_msg;
20195
20196                 if (wakeup->packet) {
20197                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
20198                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
20199
20200                         if (!wakeup->packet_80211) {
20201                                 pkt_attr =
20202                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
20203                                 len_attr =
20204                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
20205                         }
20206
20207                         if (wakeup->packet_len &&
20208                             nla_put_u32(msg, len_attr, wakeup->packet_len))
20209                                 goto free_msg;
20210
20211                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
20212                                     wakeup->packet))
20213                                 goto free_msg;
20214                 }
20215
20216                 if (wakeup->net_detect &&
20217                     cfg80211_net_detect_results(msg, wakeup))
20218                                 goto free_msg;
20219
20220                 nla_nest_end(msg, reasons);
20221         }
20222
20223         genlmsg_end(msg, hdr);
20224
20225         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20226                                 NL80211_MCGRP_MLME, gfp);
20227         return;
20228
20229  free_msg:
20230         nlmsg_free(msg);
20231 }
20232 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
20233 #endif
20234
20235 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
20236                                 enum nl80211_tdls_operation oper,
20237                                 u16 reason_code, gfp_t gfp)
20238 {
20239         struct wireless_dev *wdev = dev->ieee80211_ptr;
20240         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20241         struct sk_buff *msg;
20242         void *hdr;
20243
20244         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
20245                                          reason_code);
20246
20247         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20248         if (!msg)
20249                 return;
20250
20251         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
20252         if (!hdr) {
20253                 nlmsg_free(msg);
20254                 return;
20255         }
20256
20257         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20258             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20259             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
20260             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
20261             (reason_code > 0 &&
20262              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
20263                 goto nla_put_failure;
20264
20265         genlmsg_end(msg, hdr);
20266
20267         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20268                                 NL80211_MCGRP_MLME, gfp);
20269         return;
20270
20271  nla_put_failure:
20272         nlmsg_free(msg);
20273 }
20274 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
20275
20276 static int nl80211_netlink_notify(struct notifier_block * nb,
20277                                   unsigned long state,
20278                                   void *_notify)
20279 {
20280         struct netlink_notify *notify = _notify;
20281         struct cfg80211_registered_device *rdev;
20282         struct wireless_dev *wdev;
20283         struct cfg80211_beacon_registration *reg, *tmp;
20284
20285         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
20286                 return NOTIFY_DONE;
20287
20288         rcu_read_lock();
20289
20290         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
20291                 struct cfg80211_sched_scan_request *sched_scan_req;
20292
20293                 list_for_each_entry_rcu(sched_scan_req,
20294                                         &rdev->sched_scan_req_list,
20295                                         list) {
20296                         if (sched_scan_req->owner_nlportid == notify->portid) {
20297                                 sched_scan_req->nl_owner_dead = true;
20298                                 wiphy_work_queue(&rdev->wiphy,
20299                                                  &rdev->sched_scan_stop_wk);
20300                         }
20301                 }
20302
20303                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
20304                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
20305
20306                         if (wdev->owner_nlportid == notify->portid) {
20307                                 wdev->nl_owner_dead = true;
20308                                 schedule_work(&rdev->destroy_work);
20309                         } else if (wdev->conn_owner_nlportid == notify->portid) {
20310                                 schedule_work(&wdev->disconnect_wk);
20311                         }
20312
20313                         cfg80211_release_pmsr(wdev, notify->portid);
20314                 }
20315
20316                 spin_lock_bh(&rdev->beacon_registrations_lock);
20317                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
20318                                          list) {
20319                         if (reg->nlportid == notify->portid) {
20320                                 list_del(&reg->list);
20321                                 kfree(reg);
20322                                 break;
20323                         }
20324                 }
20325                 spin_unlock_bh(&rdev->beacon_registrations_lock);
20326         }
20327
20328         rcu_read_unlock();
20329
20330         /*
20331          * It is possible that the user space process that is controlling the
20332          * indoor setting disappeared, so notify the regulatory core.
20333          */
20334         regulatory_netlink_notify(notify->portid);
20335         return NOTIFY_OK;
20336 }
20337
20338 static struct notifier_block nl80211_netlink_notifier = {
20339         .notifier_call = nl80211_netlink_notify,
20340 };
20341
20342 void cfg80211_ft_event(struct net_device *netdev,
20343                        struct cfg80211_ft_event_params *ft_event)
20344 {
20345         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20346         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20347         struct sk_buff *msg;
20348         void *hdr;
20349
20350         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
20351
20352         if (!ft_event->target_ap)
20353                 return;
20354
20355         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
20356                         GFP_KERNEL);
20357         if (!msg)
20358                 return;
20359
20360         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
20361         if (!hdr)
20362                 goto out;
20363
20364         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20365             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20366             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
20367                 goto out;
20368
20369         if (ft_event->ies &&
20370             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
20371                 goto out;
20372         if (ft_event->ric_ies &&
20373             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
20374                     ft_event->ric_ies))
20375                 goto out;
20376
20377         genlmsg_end(msg, hdr);
20378
20379         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20380                                 NL80211_MCGRP_MLME, GFP_KERNEL);
20381         return;
20382  out:
20383         nlmsg_free(msg);
20384 }
20385 EXPORT_SYMBOL(cfg80211_ft_event);
20386
20387 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
20388 {
20389         struct cfg80211_registered_device *rdev;
20390         struct sk_buff *msg;
20391         void *hdr;
20392         u32 nlportid;
20393
20394         rdev = wiphy_to_rdev(wdev->wiphy);
20395         if (!rdev->crit_proto_nlportid)
20396                 return;
20397
20398         nlportid = rdev->crit_proto_nlportid;
20399         rdev->crit_proto_nlportid = 0;
20400
20401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20402         if (!msg)
20403                 return;
20404
20405         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
20406         if (!hdr)
20407                 goto nla_put_failure;
20408
20409         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20410             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20411                               NL80211_ATTR_PAD))
20412                 goto nla_put_failure;
20413
20414         genlmsg_end(msg, hdr);
20415
20416         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20417         return;
20418
20419  nla_put_failure:
20420         nlmsg_free(msg);
20421 }
20422 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20423
20424 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20425 {
20426         struct wiphy *wiphy = wdev->wiphy;
20427         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20428         struct sk_buff *msg;
20429         void *hdr;
20430
20431         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20432         if (!msg)
20433                 return;
20434
20435         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20436         if (!hdr)
20437                 goto out;
20438
20439         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20440             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20441             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20442                               NL80211_ATTR_PAD) ||
20443             (wdev->valid_links &&
20444              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20445                 goto out;
20446
20447         genlmsg_end(msg, hdr);
20448
20449         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20450                                 NL80211_MCGRP_MLME, GFP_KERNEL);
20451         return;
20452  out:
20453         nlmsg_free(msg);
20454 }
20455
20456 int cfg80211_external_auth_request(struct net_device *dev,
20457                                    struct cfg80211_external_auth_params *params,
20458                                    gfp_t gfp)
20459 {
20460         struct wireless_dev *wdev = dev->ieee80211_ptr;
20461         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20462         struct sk_buff *msg;
20463         void *hdr;
20464
20465         if (!wdev->conn_owner_nlportid)
20466                 return -EINVAL;
20467
20468         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20469         if (!msg)
20470                 return -ENOMEM;
20471
20472         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20473         if (!hdr)
20474                 goto nla_put_failure;
20475
20476         /* Some historical mistakes in drivers <-> userspace interface (notably
20477          * between drivers and wpa_supplicant) led to a big-endian conversion
20478          * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
20479          * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
20480          * benefit of older wpa_supplicant versions, send this particular value
20481          * in big-endian. Note that newer wpa_supplicant will also detect this
20482          * particular value in big endian still, so it all continues to work.
20483          */
20484         if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
20485                 if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
20486                                  cpu_to_be32(WLAN_AKM_SUITE_SAE)))
20487                         goto nla_put_failure;
20488         } else {
20489                 if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
20490                                 params->key_mgmt_suite))
20491                         goto nla_put_failure;
20492         }
20493
20494         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20495             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20496             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20497                         params->action) ||
20498             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20499             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20500                     params->ssid.ssid) ||
20501             (!is_zero_ether_addr(params->mld_addr) &&
20502              nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20503                 goto nla_put_failure;
20504
20505         genlmsg_end(msg, hdr);
20506         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20507                         wdev->conn_owner_nlportid);
20508         return 0;
20509
20510  nla_put_failure:
20511         nlmsg_free(msg);
20512         return -ENOBUFS;
20513 }
20514 EXPORT_SYMBOL(cfg80211_external_auth_request);
20515
20516 void cfg80211_update_owe_info_event(struct net_device *netdev,
20517                                     struct cfg80211_update_owe_info *owe_info,
20518                                     gfp_t gfp)
20519 {
20520         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20521         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20522         struct sk_buff *msg;
20523         void *hdr;
20524
20525         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20526
20527         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20528         if (!msg)
20529                 return;
20530
20531         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20532         if (!hdr)
20533                 goto nla_put_failure;
20534
20535         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20536             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20537             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20538                 goto nla_put_failure;
20539
20540         if (!owe_info->ie_len ||
20541             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20542                 goto nla_put_failure;
20543
20544         if (owe_info->assoc_link_id != -1) {
20545                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20546                                owe_info->assoc_link_id))
20547                         goto nla_put_failure;
20548
20549                 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20550                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20551                             owe_info->peer_mld_addr))
20552                         goto nla_put_failure;
20553         }
20554
20555         genlmsg_end(msg, hdr);
20556
20557         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20558                                 NL80211_MCGRP_MLME, gfp);
20559         return;
20560
20561 nla_put_failure:
20562         genlmsg_cancel(msg, hdr);
20563         nlmsg_free(msg);
20564 }
20565 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20566
20567 void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
20568 {
20569         struct wiphy *wiphy = wdev->wiphy;
20570
20571         /* Schedule channels check if NO_IR or DFS relaxations are supported */
20572         if (wdev->iftype == NL80211_IFTYPE_STATION &&
20573             (wiphy_ext_feature_isset(wiphy,
20574                                      NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
20575             (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
20576              wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
20577                 reg_check_channels();
20578 }
20579 EXPORT_SYMBOL(cfg80211_schedule_channels_check);
20580
20581 void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
20582 {
20583         struct wireless_dev *wdev = netdev->ieee80211_ptr;
20584         struct wiphy *wiphy = wdev->wiphy;
20585         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20586         struct sk_buff *msg;
20587         void *hdr;
20588
20589         trace_cfg80211_epcs_changed(wdev, enabled);
20590
20591         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20592         if (!msg)
20593                 return;
20594
20595         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
20596         if (!hdr) {
20597                 nlmsg_free(msg);
20598                 return;
20599         }
20600
20601         if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
20602                 goto nla_put_failure;
20603
20604         genlmsg_end(msg, hdr);
20605         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20606                                 NL80211_MCGRP_MLME, GFP_KERNEL);
20607         return;
20608
20609  nla_put_failure:
20610         nlmsg_free(msg);
20611 }
20612 EXPORT_SYMBOL(cfg80211_epcs_changed);
20613
20614 /* initialisation/exit functions */
20615
20616 int __init nl80211_init(void)
20617 {
20618         int err;
20619
20620         err = genl_register_family(&nl80211_fam);
20621         if (err)
20622                 return err;
20623
20624         err = netlink_register_notifier(&nl80211_netlink_notifier);
20625         if (err)
20626                 goto err_out;
20627
20628         return 0;
20629  err_out:
20630         genl_unregister_family(&nl80211_fam);
20631         return err;
20632 }
20633
20634 void nl80211_exit(void)
20635 {
20636         netlink_unregister_notifier(&nl80211_netlink_notifier);
20637         genl_unregister_family(&nl80211_fam);
20638 }