net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <[email protected]>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2022 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 static int validate_he_capa(const struct nlattr *attr,
 289                             struct netlink_ext_ack *extack)
 290 {
 291         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 292                 return -EINVAL;
 293
 294         return 0;
 295 }
 296
 297 /* policy for the attributes */
 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 299
 300 static const struct nla_policy
 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 302         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 303         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 304                                         .len = U8_MAX },
 305         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 306                                              .len = U8_MAX },
 307 };
 308
 309 static const struct nla_policy
 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 311         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 312         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 313         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 314                 NLA_POLICY_MAX(NLA_U8, 15),
 315         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 316         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 317                 NLA_POLICY_MAX(NLA_U8, 15),
 318         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 319                 NLA_POLICY_MAX(NLA_U8, 31),
 320         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 321         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 322         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 323         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 324         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 325         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 326 };
 327
 328 static const struct nla_policy
 329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 330         [NL80211_PMSR_TYPE_FTM] =
 331                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 332 };
 333
 334 static const struct nla_policy
 335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 336         [NL80211_PMSR_REQ_ATTR_DATA] =
 337                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 338         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 339 };
 340
 341 static const struct nla_policy
 342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 343         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 344         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 345         [NL80211_PMSR_PEER_ATTR_REQ] =
 346                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 347         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 348 };
 349
 350 static const struct nla_policy
 351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 352         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 353         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 354         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 355         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 356         [NL80211_PMSR_ATTR_PEERS] =
 357                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 358 };
 359
 360 static const struct nla_policy
 361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 362         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 363                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 364         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 365                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 366         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 367                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 368         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 369                 NLA_POLICY_EXACT_LEN(8),
 370         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 371                 NLA_POLICY_EXACT_LEN(8),
 372         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 373 };
 374
 375 static const struct nla_policy
 376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 377         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 378         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 379         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 380 };
 381
 382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 383         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 384                                     .len = NL80211_MAX_SUPP_RATES },
 385         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 386                                 .len = NL80211_MAX_SUPP_HT_RATES },
 387         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 388         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 389         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 390         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 391                                                    NL80211_RATE_INFO_HE_GI_0_8,
 392                                                    NL80211_RATE_INFO_HE_GI_3_2),
 393         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 394                                                    NL80211_RATE_INFO_HE_1XLTF,
 395                                                    NL80211_RATE_INFO_HE_4XLTF),
 396 };
 397
 398 static const struct nla_policy
 399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 400         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 401         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 402         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 403         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 404         [NL80211_TID_CONFIG_ATTR_NOACK] =
 405                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 406         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 407         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 408         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 409                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 410         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 411                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 412         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 413                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 414         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 415                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 416         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 417                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 418 };
 419
 420 static const struct nla_policy
 421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 422         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 423         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 424         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 425                         NLA_POLICY_RANGE(NLA_BINARY,
 426                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 427                                          IEEE80211_MAX_DATA_LEN),
 428 };
 429
 430 static const struct nla_policy
 431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 432         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 433         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 434                                                        .len = IEEE80211_MAX_DATA_LEN }
 435 };
 436
 437 static const struct nla_policy
 438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 439         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 440         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 441 };
 442
 443 static const struct nla_policy
 444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 445         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 446         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 447 };
 448
 449 static const struct nla_policy
 450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 451         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 452         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 453                                                 NLA_POLICY_MIN(NLA_U8, 1),
 454         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 455         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 456         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 457 };
 458
 459 static const struct nla_policy
 460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 461         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 462         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 463 };
 464
 465 static struct netlink_range_validation nl80211_punct_bitmap_range = {
 466         .min = 0,
 467         .max = 0xffff,
 468 };
 469
 470 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 471         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 472         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 473         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 474                                       .len = 20-1 },
 475         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 476
 477         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 478         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 479         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 480                                                 NL80211_EDMG_CHANNELS_MIN,
 481                                                 NL80211_EDMG_CHANNELS_MAX),
 482         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 483                                                 NL80211_EDMG_BW_CONFIG_MIN,
 484                                                 NL80211_EDMG_BW_CONFIG_MAX),
 485
 486         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 487         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 488         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 489         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 490
 491         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 492         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 493         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 494         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 496         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 497
 498         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 499         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 500         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 501
 502         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 503         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 504
 505         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 506         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 507                                     .len = WLAN_MAX_KEY_LEN },
 508         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 509         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 510         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 511         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 512         [NL80211_ATTR_KEY_TYPE] =
 513                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 514
 515         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 516         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 517         [NL80211_ATTR_BEACON_HEAD] =
 518                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 519                                        IEEE80211_MAX_DATA_LEN),
 520         [NL80211_ATTR_BEACON_TAIL] =
 521                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 522                                        IEEE80211_MAX_DATA_LEN),
 523         [NL80211_ATTR_STA_AID] =
 524                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 525         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 526         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 527         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 528                                                .len = NL80211_MAX_SUPP_RATES },
 529         [NL80211_ATTR_STA_PLINK_ACTION] =
 530                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 531         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 532                 NLA_POLICY_RANGE(NLA_U8,
 533                                  NL80211_TX_POWER_AUTOMATIC,
 534                                  NL80211_TX_POWER_FIXED),
 535         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 536         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 537         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 538         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 539                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 540         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 541
 542         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 543         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 544         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 545
 546         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 547         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 548         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 549         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 550                                            .len = NL80211_MAX_SUPP_RATES },
 551         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 552
 553         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 554         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 555
 556         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 557
 558         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 559         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 560                                                    validate_ie_attr,
 561                                                    IEEE80211_MAX_DATA_LEN),
 562         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 563         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 564
 565         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 566                                 .len = IEEE80211_MAX_SSID_LEN },
 567         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 568         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 569         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 570         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 571         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 572                                                   NL80211_MFP_NO,
 573                                                   NL80211_MFP_OPTIONAL),
 574         [NL80211_ATTR_STA_FLAGS2] =
 575                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 576         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 577         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 578         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 579         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 581         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 582         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 583         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 584         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 585         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 586         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 587         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 588         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 589         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 590         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 591                                  .len = IEEE80211_MAX_DATA_LEN },
 592         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 593         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 594                                                    NL80211_PS_DISABLED,
 595                                                    NL80211_PS_ENABLED),
 596         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 597         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 598         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 599         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 600         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 601         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 602         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 603         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 604         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 605         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 606         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 607         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 608         [NL80211_ATTR_STA_PLINK_STATE] =
 609                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 610         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 611         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 612         [NL80211_ATTR_MESH_PEER_AID] =
 613                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 614         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 615         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 616         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 617         [NL80211_ATTR_HIDDEN_SSID] =
 618                 NLA_POLICY_RANGE(NLA_U32,
 619                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 620                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 621         [NL80211_ATTR_IE_PROBE_RESP] =
 622                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 623                                        IEEE80211_MAX_DATA_LEN),
 624         [NL80211_ATTR_IE_ASSOC_RESP] =
 625                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 626                                        IEEE80211_MAX_DATA_LEN),
 627         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 628         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 629         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 630         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 631         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 632         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 633         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 634         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 635         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 636         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 637         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 638         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 639                                       .len = IEEE80211_MAX_DATA_LEN },
 640         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 641         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 642         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 643                 .len = NL80211_HT_CAPABILITY_LEN
 644         },
 645         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 646         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 647         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 648         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 649         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 650
 651         /* need to include at least Auth Transaction and Status Code */
 652         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 653
 654         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 655         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 656         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 657         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 658         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 659                 NLA_POLICY_RANGE(NLA_U32,
 660                                  NL80211_MESH_POWER_UNKNOWN + 1,
 661                                  NL80211_MESH_POWER_MAX),
 662         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 663         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 664         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 665         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 666         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 667         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 668         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 669                 .len = NL80211_VHT_CAPABILITY_LEN,
 670         },
 671         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 672         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 673                                   .len = IEEE80211_MAX_DATA_LEN },
 674         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 675         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 676                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 677         [NL80211_ATTR_PEER_AID] =
 678                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 679         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 680         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 681         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 682         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 683         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 684         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 685         /*
 686          * The value of the Length field of the Supported Operating
 687          * Classes element is between 2 and 253.
 688          */
 689         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 690                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 691         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 692         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 693         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 694         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 695         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 696         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 697                                                   IEEE80211_QOS_MAP_LEN_MIN,
 698                                                   IEEE80211_QOS_MAP_LEN_MAX),
 699         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 700         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 701         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 702         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 703         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 704         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 705         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 706         [NL80211_ATTR_USER_PRIO] =
 707                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 708         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 709         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 710         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 711         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 712         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 713         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 714         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 715         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 716         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 717         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 718         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 719                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 720         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 721                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 722         },
 723         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 724         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 725         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 726         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 727         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 728                                     .len = FILS_MAX_KEK_LEN },
 729         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 730         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 731         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 732         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 733         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 734                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 735         },
 736         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 737         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 738                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 739         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 740                                           .len = FILS_ERP_MAX_REALM_LEN },
 741         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 742         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 743                                         .len = FILS_ERP_MAX_RRK_LEN },
 744         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 745         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 746         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 747         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 748         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 749
 750         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 751         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 752         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 753         [NL80211_ATTR_HE_CAPABILITY] =
 754                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 755                                        NL80211_HE_MAX_CAPABILITY_LEN),
 756         [NL80211_ATTR_FTM_RESPONDER] =
 757                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 758         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 759         [NL80211_ATTR_PEER_MEASUREMENTS] =
 760                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 761         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 762         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 763                                         .len = SAE_PASSWORD_MAX_LEN },
 764         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 765         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 766         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 767         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 768         [NL80211_ATTR_TID_CONFIG] =
 769                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 770         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 771         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 772         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 773         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 774         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 775         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 776         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 777                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 778         [NL80211_ATTR_FILS_DISCOVERY] =
 779                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 780         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 781                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 782         [NL80211_ATTR_S1G_CAPABILITY] =
 783                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 784         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 785                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 786         [NL80211_ATTR_SAE_PWE] =
 787                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 788                                  NL80211_SAE_PWE_BOTH),
 789         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 790         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 791         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 792         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 793         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 794         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 795         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 796         [NL80211_ATTR_MBSSID_CONFIG] =
 797                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 798         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 799         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 800         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 801         [NL80211_ATTR_EHT_CAPABILITY] =
 802                 NLA_POLICY_RANGE(NLA_BINARY,
 803                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 804                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 805         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 806         [NL80211_ATTR_MLO_LINKS] =
 807                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 808         [NL80211_ATTR_MLO_LINK_ID] =
 809                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
 810         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 811         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 812         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 813         [NL80211_ATTR_PUNCT_BITMAP] =
 814                 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
 815
 816         [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
 817         [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
 818         [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
 819 };
 820
 821 /* policy for the key attributes */
 822 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 823         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 824         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 825         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 826         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 827         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 828         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 829         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 830         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 831         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 832 };
 833
 834 /* policy for the key default flags */
 835 static const struct nla_policy
 836 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 837         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 838         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 839 };
 840
 841 #ifdef CONFIG_PM
 842 /* policy for WoWLAN attributes */
 843 static const struct nla_policy
 844 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 845         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 846         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 847         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 848         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 849         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 850         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 851         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 852         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 853         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 854         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 855 };
 856
 857 static const struct nla_policy
 858 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 859         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 860         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 861         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 862         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 863         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 864         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 865         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 866                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 867         },
 868         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 869                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 870         },
 871         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 872         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 873         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 874 };
 875 #endif /* CONFIG_PM */
 876
 877 /* policy for coalesce rule attributes */
 878 static const struct nla_policy
 879 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 880         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 881         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 882                 NLA_POLICY_RANGE(NLA_U32,
 883                                  NL80211_COALESCE_CONDITION_MATCH,
 884                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 885         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 886 };
 887
 888 /* policy for GTK rekey offload attributes */
 889 static const struct nla_policy
 890 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 891         [NL80211_REKEY_DATA_KEK] = {
 892                 .type = NLA_BINARY,
 893                 .len = NL80211_KEK_EXT_LEN
 894         },
 895         [NL80211_REKEY_DATA_KCK] = {
 896                 .type = NLA_BINARY,
 897                 .len = NL80211_KCK_EXT_LEN_32
 898         },
 899         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 900         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 901 };
 902
 903 static const struct nla_policy
 904 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 905         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 906         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 907         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 908         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 909         [NL80211_BAND_LC]    = { .type = NLA_S32 },
 910 };
 911
 912 static const struct nla_policy
 913 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 914         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 915                                                  .len = IEEE80211_MAX_SSID_LEN },
 916         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 917         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 918         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 919                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 920 };
 921
 922 static const struct nla_policy
 923 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 924         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 925         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 926 };
 927
 928 static const struct nla_policy
 929 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 930         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 931         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 932         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 933                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 934         },
 935 };
 936
 937 /* policy for NAN function attributes */
 938 static const struct nla_policy
 939 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 940         [NL80211_NAN_FUNC_TYPE] =
 941                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 942         [NL80211_NAN_FUNC_SERVICE_ID] = {
 943                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 944         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 945         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 946         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 947         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 948         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 949         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 950         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 951         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 952         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 953                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 954         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 955         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 956         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 957         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 958         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 959 };
 960
 961 /* policy for Service Response Filter attributes */
 962 static const struct nla_policy
 963 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 964         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 965         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 966                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 967         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 968         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 969 };
 970
 971 /* policy for packet pattern attributes */
 972 static const struct nla_policy
 973 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 974         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 975         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 976         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 977 };
 978
 979 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 980                                      struct cfg80211_registered_device **rdev,
 981                                      struct wireless_dev **wdev,
 982                                      struct nlattr **attrbuf)
 983 {
 984         int err;
 985
 986         if (!cb->args[0]) {
 987                 struct nlattr **attrbuf_free = NULL;
 988
 989                 if (!attrbuf) {
 990                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 991                                           GFP_KERNEL);
 992                         if (!attrbuf)
 993                                 return -ENOMEM;
 994                         attrbuf_free = attrbuf;
 995                 }
 996
 997                 err = nlmsg_parse_deprecated(cb->nlh,
 998                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 999                                              attrbuf, nl80211_fam.maxattr,
1000                                              nl80211_policy, NULL);
1001                 if (err) {
1002                         kfree(attrbuf_free);
1003                         return err;
1004                 }
1005
1006                 rtnl_lock();
1007                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1008                                                    attrbuf);
1009                 kfree(attrbuf_free);
1010                 if (IS_ERR(*wdev)) {
1011                         rtnl_unlock();
1012                         return PTR_ERR(*wdev);
1013                 }
1014                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1015                 mutex_lock(&(*rdev)->wiphy.mtx);
1016                 rtnl_unlock();
1017                 /* 0 is the first index - add 1 to parse only once */
1018                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1019                 cb->args[1] = (*wdev)->identifier;
1020         } else {
1021                 /* subtract the 1 again here */
1022                 struct wiphy *wiphy;
1023                 struct wireless_dev *tmp;
1024
1025                 rtnl_lock();
1026                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1027                 if (!wiphy) {
1028                         rtnl_unlock();
1029                         return -ENODEV;
1030                 }
1031                 *rdev = wiphy_to_rdev(wiphy);
1032                 *wdev = NULL;
1033
1034                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1035                         if (tmp->identifier == cb->args[1]) {
1036                                 *wdev = tmp;
1037                                 break;
1038                         }
1039                 }
1040
1041                 if (!*wdev) {
1042                         rtnl_unlock();
1043                         return -ENODEV;
1044                 }
1045                 mutex_lock(&(*rdev)->wiphy.mtx);
1046                 rtnl_unlock();
1047         }
1048
1049         return 0;
1050 }
1051
1052 /* message building helper */
1053 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1054                      int flags, u8 cmd)
1055 {
1056         /* since there is no private header just add the generic one */
1057         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1058 }
1059
1060 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1061                                      const struct ieee80211_reg_rule *rule)
1062 {
1063         int j;
1064         struct nlattr *nl_wmm_rules =
1065                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1066
1067         if (!nl_wmm_rules)
1068                 goto nla_put_failure;
1069
1070         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1071                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1072
1073                 if (!nl_wmm_rule)
1074                         goto nla_put_failure;
1075
1076                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1077                                 rule->wmm_rule.client[j].cw_min) ||
1078                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1079                                 rule->wmm_rule.client[j].cw_max) ||
1080                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1081                                rule->wmm_rule.client[j].aifsn) ||
1082                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1083                                 rule->wmm_rule.client[j].cot))
1084                         goto nla_put_failure;
1085
1086                 nla_nest_end(msg, nl_wmm_rule);
1087         }
1088         nla_nest_end(msg, nl_wmm_rules);
1089
1090         return 0;
1091
1092 nla_put_failure:
1093         return -ENOBUFS;
1094 }
1095
1096 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1097                                    struct ieee80211_channel *chan,
1098                                    bool large)
1099 {
1100         /* Some channels must be completely excluded from the
1101          * list to protect old user-space tools from breaking
1102          */
1103         if (!large && chan->flags &
1104             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1105                 return 0;
1106         if (!large && chan->freq_offset)
1107                 return 0;
1108
1109         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1110                         chan->center_freq))
1111                 goto nla_put_failure;
1112
1113         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1114                 goto nla_put_failure;
1115
1116         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1117             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1118                 goto nla_put_failure;
1119         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1120                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1121                         goto nla_put_failure;
1122                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1123                         goto nla_put_failure;
1124         }
1125         if (chan->flags & IEEE80211_CHAN_RADAR) {
1126                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1127                         goto nla_put_failure;
1128                 if (large) {
1129                         u32 time;
1130
1131                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1132
1133                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1134                                         chan->dfs_state))
1135                                 goto nla_put_failure;
1136                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1137                                         time))
1138                                 goto nla_put_failure;
1139                         if (nla_put_u32(msg,
1140                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1141                                         chan->dfs_cac_ms))
1142                                 goto nla_put_failure;
1143                 }
1144         }
1145
1146         if (large) {
1147                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1148                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1149                         goto nla_put_failure;
1150                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1151                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1152                         goto nla_put_failure;
1153                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1154                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1155                         goto nla_put_failure;
1156                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1157                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1158                         goto nla_put_failure;
1159                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1160                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1161                         goto nla_put_failure;
1162                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1163                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1164                         goto nla_put_failure;
1165                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1166                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1167                         goto nla_put_failure;
1168                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1169                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1170                         goto nla_put_failure;
1171                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1172                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1173                         goto nla_put_failure;
1174                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1175                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1176                         goto nla_put_failure;
1177                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1178                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1179                         goto nla_put_failure;
1180                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1181                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1182                         goto nla_put_failure;
1183                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1184                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1185                         goto nla_put_failure;
1186                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1187                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1188                         goto nla_put_failure;
1189                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1190                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1191                         goto nla_put_failure;
1192                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1193                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1194                         goto nla_put_failure;
1195         }
1196
1197         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1198                         DBM_TO_MBM(chan->max_power)))
1199                 goto nla_put_failure;
1200
1201         if (large) {
1202                 const struct ieee80211_reg_rule *rule =
1203                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1204
1205                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1206                         if (nl80211_msg_put_wmm_rules(msg, rule))
1207                                 goto nla_put_failure;
1208                 }
1209         }
1210
1211         return 0;
1212
1213  nla_put_failure:
1214         return -ENOBUFS;
1215 }
1216
1217 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1218                                   struct cfg80211_txq_stats *txqstats,
1219                                   int attrtype)
1220 {
1221         struct nlattr *txqattr;
1222
1223 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1224         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1225             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1226                 return false;                                             \
1227         } while (0)
1228
1229         txqattr = nla_nest_start_noflag(msg, attrtype);
1230         if (!txqattr)
1231                 return false;
1232
1233         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1234         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1235         PUT_TXQVAL_U32(FLOWS, flows);
1236         PUT_TXQVAL_U32(DROPS, drops);
1237         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1238         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1239         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1240         PUT_TXQVAL_U32(COLLISIONS, collisions);
1241         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1242         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1243         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1244         nla_nest_end(msg, txqattr);
1245
1246 #undef PUT_TXQVAL_U32
1247         return true;
1248 }
1249
1250 /* netlink command implementations */
1251
1252 /**
1253  * nl80211_link_id - return link ID
1254  * @attrs: attributes to look at
1255  *
1256  * Returns: the link ID or 0 if not given
1257  *
1258  * Note this function doesn't do any validation of the link
1259  * ID validity wrt. links that were actually added, so it must
1260  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1261  * or if additional validation is done.
1262  */
1263 static unsigned int nl80211_link_id(struct nlattr **attrs)
1264 {
1265         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1266
1267         if (!linkid)
1268                 return 0;
1269
1270         return nla_get_u8(linkid);
1271 }
1272
1273 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1274 {
1275         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1276
1277         if (!linkid)
1278                 return -1;
1279
1280         return nla_get_u8(linkid);
1281 }
1282
1283 struct key_parse {
1284         struct key_params p;
1285         int idx;
1286         int type;
1287         bool def, defmgmt, defbeacon;
1288         bool def_uni, def_multi;
1289 };
1290
1291 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1292                                  struct key_parse *k)
1293 {
1294         struct nlattr *tb[NL80211_KEY_MAX + 1];
1295         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1296                                               nl80211_key_policy,
1297                                               info->extack);
1298         if (err)
1299                 return err;
1300
1301         k->def = !!tb[NL80211_KEY_DEFAULT];
1302         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1303         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1304
1305         if (k->def) {
1306                 k->def_uni = true;
1307                 k->def_multi = true;
1308         }
1309         if (k->defmgmt || k->defbeacon)
1310                 k->def_multi = true;
1311
1312         if (tb[NL80211_KEY_IDX])
1313                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1314
1315         if (tb[NL80211_KEY_DATA]) {
1316                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1317                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1318         }
1319
1320         if (tb[NL80211_KEY_SEQ]) {
1321                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1322                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1323         }
1324
1325         if (tb[NL80211_KEY_CIPHER])
1326                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1327
1328         if (tb[NL80211_KEY_TYPE])
1329                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1330
1331         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1332                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1333
1334                 err = nla_parse_nested_deprecated(kdt,
1335                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1336                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1337                                                   nl80211_key_default_policy,
1338                                                   info->extack);
1339                 if (err)
1340                         return err;
1341
1342                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1343                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1344         }
1345
1346         if (tb[NL80211_KEY_MODE])
1347                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1348
1349         return 0;
1350 }
1351
1352 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1353 {
1354         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1355                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1356                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1357         }
1358
1359         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1360                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1361                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1362         }
1363
1364         if (info->attrs[NL80211_ATTR_KEY_IDX])
1365                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1366
1367         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1368                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1369
1370         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1371         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1372
1373         if (k->def) {
1374                 k->def_uni = true;
1375                 k->def_multi = true;
1376         }
1377         if (k->defmgmt)
1378                 k->def_multi = true;
1379
1380         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1381                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1382
1383         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1384                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1385                 int err = nla_parse_nested_deprecated(kdt,
1386                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1387                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1388                                                       nl80211_key_default_policy,
1389                                                       info->extack);
1390                 if (err)
1391                         return err;
1392
1393                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1394                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1395         }
1396
1397         return 0;
1398 }
1399
1400 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1401 {
1402         int err;
1403
1404         memset(k, 0, sizeof(*k));
1405         k->idx = -1;
1406         k->type = -1;
1407
1408         if (info->attrs[NL80211_ATTR_KEY])
1409                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1410         else
1411                 err = nl80211_parse_key_old(info, k);
1412
1413         if (err)
1414                 return err;
1415
1416         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1417             (k->defbeacon ? 1 : 0) > 1) {
1418                 GENL_SET_ERR_MSG(info,
1419                                  "key with multiple default flags is invalid");
1420                 return -EINVAL;
1421         }
1422
1423         if (k->defmgmt || k->defbeacon) {
1424                 if (k->def_uni || !k->def_multi) {
1425                         GENL_SET_ERR_MSG(info,
1426                                          "defmgmt/defbeacon key must be mcast");
1427                         return -EINVAL;
1428                 }
1429         }
1430
1431         if (k->idx != -1) {
1432                 if (k->defmgmt) {
1433                         if (k->idx < 4 || k->idx > 5) {
1434                                 GENL_SET_ERR_MSG(info,
1435                                                  "defmgmt key idx not 4 or 5");
1436                                 return -EINVAL;
1437                         }
1438                 } else if (k->defbeacon) {
1439                         if (k->idx < 6 || k->idx > 7) {
1440                                 GENL_SET_ERR_MSG(info,
1441                                                  "defbeacon key idx not 6 or 7");
1442                                 return -EINVAL;
1443                         }
1444                 } else if (k->def) {
1445                         if (k->idx < 0 || k->idx > 3) {
1446                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1447                                 return -EINVAL;
1448                         }
1449                 } else {
1450                         if (k->idx < 0 || k->idx > 7) {
1451                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1452                                 return -EINVAL;
1453                         }
1454                 }
1455         }
1456
1457         return 0;
1458 }
1459
1460 static struct cfg80211_cached_keys *
1461 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1462                        struct genl_info *info, bool *no_ht)
1463 {
1464         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1465         struct key_parse parse;
1466         struct nlattr *key;
1467         struct cfg80211_cached_keys *result;
1468         int rem, err, def = 0;
1469         bool have_key = false;
1470
1471         nla_for_each_nested(key, keys, rem) {
1472                 have_key = true;
1473                 break;
1474         }
1475
1476         if (!have_key)
1477                 return NULL;
1478
1479         result = kzalloc(sizeof(*result), GFP_KERNEL);
1480         if (!result)
1481                 return ERR_PTR(-ENOMEM);
1482
1483         result->def = -1;
1484
1485         nla_for_each_nested(key, keys, rem) {
1486                 memset(&parse, 0, sizeof(parse));
1487                 parse.idx = -1;
1488
1489                 err = nl80211_parse_key_new(info, key, &parse);
1490                 if (err)
1491                         goto error;
1492                 err = -EINVAL;
1493                 if (!parse.p.key)
1494                         goto error;
1495                 if (parse.idx < 0 || parse.idx > 3) {
1496                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1497                         goto error;
1498                 }
1499                 if (parse.def) {
1500                         if (def) {
1501                                 GENL_SET_ERR_MSG(info,
1502                                                  "only one key can be default");
1503                                 goto error;
1504                         }
1505                         def = 1;
1506                         result->def = parse.idx;
1507                         if (!parse.def_uni || !parse.def_multi)
1508                                 goto error;
1509                 } else if (parse.defmgmt)
1510                         goto error;
1511                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1512                                                      parse.idx, false, NULL);
1513                 if (err)
1514                         goto error;
1515                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1516                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1517                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1518                         err = -EINVAL;
1519                         goto error;
1520                 }
1521                 result->params[parse.idx].cipher = parse.p.cipher;
1522                 result->params[parse.idx].key_len = parse.p.key_len;
1523                 result->params[parse.idx].key = result->data[parse.idx];
1524                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1525
1526                 /* must be WEP key if we got here */
1527                 if (no_ht)
1528                         *no_ht = true;
1529         }
1530
1531         if (result->def < 0) {
1532                 err = -EINVAL;
1533                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1534                 goto error;
1535         }
1536
1537         return result;
1538  error:
1539         kfree(result);
1540         return ERR_PTR(err);
1541 }
1542
1543 static int nl80211_key_allowed(struct wireless_dev *wdev)
1544 {
1545         ASSERT_WDEV_LOCK(wdev);
1546
1547         switch (wdev->iftype) {
1548         case NL80211_IFTYPE_AP:
1549         case NL80211_IFTYPE_AP_VLAN:
1550         case NL80211_IFTYPE_P2P_GO:
1551         case NL80211_IFTYPE_MESH_POINT:
1552                 break;
1553         case NL80211_IFTYPE_ADHOC:
1554                 if (wdev->u.ibss.current_bss)
1555                         return 0;
1556                 return -ENOLINK;
1557         case NL80211_IFTYPE_STATION:
1558         case NL80211_IFTYPE_P2P_CLIENT:
1559                 if (wdev->connected)
1560                         return 0;
1561                 return -ENOLINK;
1562         case NL80211_IFTYPE_NAN:
1563                 if (wiphy_ext_feature_isset(wdev->wiphy,
1564                                             NL80211_EXT_FEATURE_SECURE_NAN))
1565                         return 0;
1566                 return -EINVAL;
1567         case NL80211_IFTYPE_UNSPECIFIED:
1568         case NL80211_IFTYPE_OCB:
1569         case NL80211_IFTYPE_MONITOR:
1570         case NL80211_IFTYPE_P2P_DEVICE:
1571         case NL80211_IFTYPE_WDS:
1572         case NUM_NL80211_IFTYPES:
1573                 return -EINVAL;
1574         }
1575
1576         return 0;
1577 }
1578
1579 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1580                                                         u32 freq)
1581 {
1582         struct ieee80211_channel *chan;
1583
1584         chan = ieee80211_get_channel_khz(wiphy, freq);
1585         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1586                 return NULL;
1587         return chan;
1588 }
1589
1590 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1591 {
1592         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1593         int i;
1594
1595         if (!nl_modes)
1596                 goto nla_put_failure;
1597
1598         i = 0;
1599         while (ifmodes) {
1600                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1601                         goto nla_put_failure;
1602                 ifmodes >>= 1;
1603                 i++;
1604         }
1605
1606         nla_nest_end(msg, nl_modes);
1607         return 0;
1608
1609 nla_put_failure:
1610         return -ENOBUFS;
1611 }
1612
1613 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1614                                           struct sk_buff *msg,
1615                                           bool large)
1616 {
1617         struct nlattr *nl_combis;
1618         int i, j;
1619
1620         nl_combis = nla_nest_start_noflag(msg,
1621                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1622         if (!nl_combis)
1623                 goto nla_put_failure;
1624
1625         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1626                 const struct ieee80211_iface_combination *c;
1627                 struct nlattr *nl_combi, *nl_limits;
1628
1629                 c = &wiphy->iface_combinations[i];
1630
1631                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1632                 if (!nl_combi)
1633                         goto nla_put_failure;
1634
1635                 nl_limits = nla_nest_start_noflag(msg,
1636                                                   NL80211_IFACE_COMB_LIMITS);
1637                 if (!nl_limits)
1638                         goto nla_put_failure;
1639
1640                 for (j = 0; j < c->n_limits; j++) {
1641                         struct nlattr *nl_limit;
1642
1643                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1644                         if (!nl_limit)
1645                                 goto nla_put_failure;
1646                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1647                                         c->limits[j].max))
1648                                 goto nla_put_failure;
1649                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1650                                                 c->limits[j].types))
1651                                 goto nla_put_failure;
1652                         nla_nest_end(msg, nl_limit);
1653                 }
1654
1655                 nla_nest_end(msg, nl_limits);
1656
1657                 if (c->beacon_int_infra_match &&
1658                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1659                         goto nla_put_failure;
1660                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1661                                 c->num_different_channels) ||
1662                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1663                                 c->max_interfaces))
1664                         goto nla_put_failure;
1665                 if (large &&
1666                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1667                                 c->radar_detect_widths) ||
1668                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1669                                 c->radar_detect_regions)))
1670                         goto nla_put_failure;
1671                 if (c->beacon_int_min_gcd &&
1672                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1673                                 c->beacon_int_min_gcd))
1674                         goto nla_put_failure;
1675
1676                 nla_nest_end(msg, nl_combi);
1677         }
1678
1679         nla_nest_end(msg, nl_combis);
1680
1681         return 0;
1682 nla_put_failure:
1683         return -ENOBUFS;
1684 }
1685
1686 #ifdef CONFIG_PM
1687 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1688                                         struct sk_buff *msg)
1689 {
1690         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1691         struct nlattr *nl_tcp;
1692
1693         if (!tcp)
1694                 return 0;
1695
1696         nl_tcp = nla_nest_start_noflag(msg,
1697                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1698         if (!nl_tcp)
1699                 return -ENOBUFS;
1700
1701         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1702                         tcp->data_payload_max))
1703                 return -ENOBUFS;
1704
1705         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1706                         tcp->data_payload_max))
1707                 return -ENOBUFS;
1708
1709         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1710                 return -ENOBUFS;
1711
1712         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1713                                 sizeof(*tcp->tok), tcp->tok))
1714                 return -ENOBUFS;
1715
1716         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1717                         tcp->data_interval_max))
1718                 return -ENOBUFS;
1719
1720         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1721                         tcp->wake_payload_max))
1722                 return -ENOBUFS;
1723
1724         nla_nest_end(msg, nl_tcp);
1725         return 0;
1726 }
1727
1728 static int nl80211_send_wowlan(struct sk_buff *msg,
1729                                struct cfg80211_registered_device *rdev,
1730                                bool large)
1731 {
1732         struct nlattr *nl_wowlan;
1733
1734         if (!rdev->wiphy.wowlan)
1735                 return 0;
1736
1737         nl_wowlan = nla_nest_start_noflag(msg,
1738                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1739         if (!nl_wowlan)
1740                 return -ENOBUFS;
1741
1742         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1743              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1744             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1745              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1746             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1747              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1748             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1749              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1750             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1751              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1752             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1753              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1754             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1755              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1756             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1757              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1758                 return -ENOBUFS;
1759
1760         if (rdev->wiphy.wowlan->n_patterns) {
1761                 struct nl80211_pattern_support pat = {
1762                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1763                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1764                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1765                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1766                 };
1767
1768                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1769                             sizeof(pat), &pat))
1770                         return -ENOBUFS;
1771         }
1772
1773         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1774             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1775                         rdev->wiphy.wowlan->max_nd_match_sets))
1776                 return -ENOBUFS;
1777
1778         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1779                 return -ENOBUFS;
1780
1781         nla_nest_end(msg, nl_wowlan);
1782
1783         return 0;
1784 }
1785 #endif
1786
1787 static int nl80211_send_coalesce(struct sk_buff *msg,
1788                                  struct cfg80211_registered_device *rdev)
1789 {
1790         struct nl80211_coalesce_rule_support rule;
1791
1792         if (!rdev->wiphy.coalesce)
1793                 return 0;
1794
1795         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1796         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1797         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1798         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1799         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1800         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1801
1802         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1803                 return -ENOBUFS;
1804
1805         return 0;
1806 }
1807
1808 static int
1809 nl80211_send_iftype_data(struct sk_buff *msg,
1810                          const struct ieee80211_supported_band *sband,
1811                          const struct ieee80211_sband_iftype_data *iftdata)
1812 {
1813         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1814         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1815
1816         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1817                                 iftdata->types_mask))
1818                 return -ENOBUFS;
1819
1820         if (he_cap->has_he) {
1821                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1822                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1823                             he_cap->he_cap_elem.mac_cap_info) ||
1824                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1825                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1826                             he_cap->he_cap_elem.phy_cap_info) ||
1827                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1828                             sizeof(he_cap->he_mcs_nss_supp),
1829                             &he_cap->he_mcs_nss_supp) ||
1830                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1831                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1832                         return -ENOBUFS;
1833         }
1834
1835         if (eht_cap->has_eht && he_cap->has_he) {
1836                 u8 mcs_nss_size, ppe_thresh_size;
1837                 u16 ppe_thres_hdr;
1838                 bool is_ap;
1839
1840                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1841                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1842
1843                 mcs_nss_size =
1844                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1845                                                    &eht_cap->eht_cap_elem,
1846                                                    is_ap);
1847
1848                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1849                 ppe_thresh_size =
1850                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1851                                                eht_cap->eht_cap_elem.phy_cap_info);
1852
1853                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1854                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1855                             eht_cap->eht_cap_elem.mac_cap_info) ||
1856                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1857                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1858                             eht_cap->eht_cap_elem.phy_cap_info) ||
1859                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1860                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1861                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1862                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1863                         return -ENOBUFS;
1864         }
1865
1866         if (sband->band == NL80211_BAND_6GHZ &&
1867             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1868                     sizeof(iftdata->he_6ghz_capa),
1869                     &iftdata->he_6ghz_capa))
1870                 return -ENOBUFS;
1871
1872         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1873             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1874                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1875                 return -ENOBUFS;
1876
1877         return 0;
1878 }
1879
1880 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1881                                       struct ieee80211_supported_band *sband,
1882                                       bool large)
1883 {
1884         struct nlattr *nl_rates, *nl_rate;
1885         struct ieee80211_rate *rate;
1886         int i;
1887
1888         /* add HT info */
1889         if (sband->ht_cap.ht_supported &&
1890             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1891                      sizeof(sband->ht_cap.mcs),
1892                      &sband->ht_cap.mcs) ||
1893              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1894                          sband->ht_cap.cap) ||
1895              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1896                         sband->ht_cap.ampdu_factor) ||
1897              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1898                         sband->ht_cap.ampdu_density)))
1899                 return -ENOBUFS;
1900
1901         /* add VHT info */
1902         if (sband->vht_cap.vht_supported &&
1903             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1904                      sizeof(sband->vht_cap.vht_mcs),
1905                      &sband->vht_cap.vht_mcs) ||
1906              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1907                          sband->vht_cap.cap)))
1908                 return -ENOBUFS;
1909
1910         if (large && sband->n_iftype_data) {
1911                 struct nlattr *nl_iftype_data =
1912                         nla_nest_start_noflag(msg,
1913                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1914                 int err;
1915
1916                 if (!nl_iftype_data)
1917                         return -ENOBUFS;
1918
1919                 for (i = 0; i < sband->n_iftype_data; i++) {
1920                         struct nlattr *iftdata;
1921
1922                         iftdata = nla_nest_start_noflag(msg, i + 1);
1923                         if (!iftdata)
1924                                 return -ENOBUFS;
1925
1926                         err = nl80211_send_iftype_data(msg, sband,
1927                                                        &sband->iftype_data[i]);
1928                         if (err)
1929                                 return err;
1930
1931                         nla_nest_end(msg, iftdata);
1932                 }
1933
1934                 nla_nest_end(msg, nl_iftype_data);
1935         }
1936
1937         /* add EDMG info */
1938         if (large && sband->edmg_cap.channels &&
1939             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1940                        sband->edmg_cap.channels) ||
1941             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1942                        sband->edmg_cap.bw_config)))
1943
1944                 return -ENOBUFS;
1945
1946         /* add bitrates */
1947         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1948         if (!nl_rates)
1949                 return -ENOBUFS;
1950
1951         for (i = 0; i < sband->n_bitrates; i++) {
1952                 nl_rate = nla_nest_start_noflag(msg, i);
1953                 if (!nl_rate)
1954                         return -ENOBUFS;
1955
1956                 rate = &sband->bitrates[i];
1957                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1958                                 rate->bitrate))
1959                         return -ENOBUFS;
1960                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1961                     nla_put_flag(msg,
1962                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1963                         return -ENOBUFS;
1964
1965                 nla_nest_end(msg, nl_rate);
1966         }
1967
1968         nla_nest_end(msg, nl_rates);
1969
1970         /* S1G capabilities */
1971         if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
1972             (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
1973                      sizeof(sband->s1g_cap.cap),
1974                      sband->s1g_cap.cap) ||
1975              nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
1976                      sizeof(sband->s1g_cap.nss_mcs),
1977                      sband->s1g_cap.nss_mcs)))
1978                 return -ENOBUFS;
1979
1980         return 0;
1981 }
1982
1983 static int
1984 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1985                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1986 {
1987         u16 stypes;
1988         struct nlattr *nl_ftypes, *nl_ifs;
1989         enum nl80211_iftype ift;
1990         int i;
1991
1992         if (!mgmt_stypes)
1993                 return 0;
1994
1995         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1996         if (!nl_ifs)
1997                 return -ENOBUFS;
1998
1999         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2000                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2001                 if (!nl_ftypes)
2002                         return -ENOBUFS;
2003                 i = 0;
2004                 stypes = mgmt_stypes[ift].tx;
2005                 while (stypes) {
2006                         if ((stypes & 1) &&
2007                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2008                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2009                                 return -ENOBUFS;
2010                         stypes >>= 1;
2011                         i++;
2012                 }
2013                 nla_nest_end(msg, nl_ftypes);
2014         }
2015
2016         nla_nest_end(msg, nl_ifs);
2017
2018         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2019         if (!nl_ifs)
2020                 return -ENOBUFS;
2021
2022         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2023                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2024                 if (!nl_ftypes)
2025                         return -ENOBUFS;
2026                 i = 0;
2027                 stypes = mgmt_stypes[ift].rx;
2028                 while (stypes) {
2029                         if ((stypes & 1) &&
2030                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2031                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2032                                 return -ENOBUFS;
2033                         stypes >>= 1;
2034                         i++;
2035                 }
2036                 nla_nest_end(msg, nl_ftypes);
2037         }
2038         nla_nest_end(msg, nl_ifs);
2039
2040         return 0;
2041 }
2042
2043 #define CMD(op, n)                                                      \
2044          do {                                                           \
2045                 if (rdev->ops->op) {                                    \
2046                         i++;                                            \
2047                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2048                                 goto nla_put_failure;                   \
2049                 }                                                       \
2050         } while (0)
2051
2052 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2053                                         struct sk_buff *msg)
2054 {
2055         int i = 0;
2056
2057         /*
2058          * do *NOT* add anything into this function, new things need to be
2059          * advertised only to new versions of userspace that can deal with
2060          * the split (and they can't possibly care about new features...
2061          */
2062         CMD(add_virtual_intf, NEW_INTERFACE);
2063         CMD(change_virtual_intf, SET_INTERFACE);
2064         CMD(add_key, NEW_KEY);
2065         CMD(start_ap, START_AP);
2066         CMD(add_station, NEW_STATION);
2067         CMD(add_mpath, NEW_MPATH);
2068         CMD(update_mesh_config, SET_MESH_CONFIG);
2069         CMD(change_bss, SET_BSS);
2070         CMD(auth, AUTHENTICATE);
2071         CMD(assoc, ASSOCIATE);
2072         CMD(deauth, DEAUTHENTICATE);
2073         CMD(disassoc, DISASSOCIATE);
2074         CMD(join_ibss, JOIN_IBSS);
2075         CMD(join_mesh, JOIN_MESH);
2076         CMD(set_pmksa, SET_PMKSA);
2077         CMD(del_pmksa, DEL_PMKSA);
2078         CMD(flush_pmksa, FLUSH_PMKSA);
2079         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2080                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2081         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2082         CMD(mgmt_tx, FRAME);
2083         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2084         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2085                 i++;
2086                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2087                         goto nla_put_failure;
2088         }
2089         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2090             rdev->ops->join_mesh) {
2091                 i++;
2092                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2093                         goto nla_put_failure;
2094         }
2095         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2096                 CMD(tdls_mgmt, TDLS_MGMT);
2097                 CMD(tdls_oper, TDLS_OPER);
2098         }
2099         if (rdev->wiphy.max_sched_scan_reqs)
2100                 CMD(sched_scan_start, START_SCHED_SCAN);
2101         CMD(probe_client, PROBE_CLIENT);
2102         CMD(set_noack_map, SET_NOACK_MAP);
2103         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2104                 i++;
2105                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2106                         goto nla_put_failure;
2107         }
2108         CMD(start_p2p_device, START_P2P_DEVICE);
2109         CMD(set_mcast_rate, SET_MCAST_RATE);
2110 #ifdef CONFIG_NL80211_TESTMODE
2111         CMD(testmode_cmd, TESTMODE);
2112 #endif
2113
2114         if (rdev->ops->connect || rdev->ops->auth) {
2115                 i++;
2116                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2117                         goto nla_put_failure;
2118         }
2119
2120         if (rdev->ops->disconnect || rdev->ops->deauth) {
2121                 i++;
2122                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2123                         goto nla_put_failure;
2124         }
2125
2126         return i;
2127  nla_put_failure:
2128         return -ENOBUFS;
2129 }
2130
2131 static int
2132 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2133                            struct sk_buff *msg)
2134 {
2135         struct nlattr *ftm;
2136
2137         if (!cap->ftm.supported)
2138                 return 0;
2139
2140         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2141         if (!ftm)
2142                 return -ENOBUFS;
2143
2144         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2145                 return -ENOBUFS;
2146         if (cap->ftm.non_asap &&
2147             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2148                 return -ENOBUFS;
2149         if (cap->ftm.request_lci &&
2150             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2151                 return -ENOBUFS;
2152         if (cap->ftm.request_civicloc &&
2153             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2154                 return -ENOBUFS;
2155         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2156                         cap->ftm.preambles))
2157                 return -ENOBUFS;
2158         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2159                         cap->ftm.bandwidths))
2160                 return -ENOBUFS;
2161         if (cap->ftm.max_bursts_exponent >= 0 &&
2162             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2163                         cap->ftm.max_bursts_exponent))
2164                 return -ENOBUFS;
2165         if (cap->ftm.max_ftms_per_burst &&
2166             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2167                         cap->ftm.max_ftms_per_burst))
2168                 return -ENOBUFS;
2169         if (cap->ftm.trigger_based &&
2170             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2171                 return -ENOBUFS;
2172         if (cap->ftm.non_trigger_based &&
2173             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2174                 return -ENOBUFS;
2175
2176         nla_nest_end(msg, ftm);
2177         return 0;
2178 }
2179
2180 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2181                                   struct sk_buff *msg)
2182 {
2183         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2184         struct nlattr *pmsr, *caps;
2185
2186         if (!cap)
2187                 return 0;
2188
2189         /*
2190          * we don't need to clean up anything here since the caller
2191          * will genlmsg_cancel() if we fail
2192          */
2193
2194         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2195         if (!pmsr)
2196                 return -ENOBUFS;
2197
2198         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2199                 return -ENOBUFS;
2200
2201         if (cap->report_ap_tsf &&
2202             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2203                 return -ENOBUFS;
2204
2205         if (cap->randomize_mac_addr &&
2206             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2207                 return -ENOBUFS;
2208
2209         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2210         if (!caps)
2211                 return -ENOBUFS;
2212
2213         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2214                 return -ENOBUFS;
2215
2216         nla_nest_end(msg, caps);
2217         nla_nest_end(msg, pmsr);
2218
2219         return 0;
2220 }
2221
2222 static int
2223 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2224                               struct sk_buff *msg)
2225 {
2226         int i;
2227         struct nlattr *nested, *nested_akms;
2228         const struct wiphy_iftype_akm_suites *iftype_akms;
2229
2230         if (!rdev->wiphy.num_iftype_akm_suites ||
2231             !rdev->wiphy.iftype_akm_suites)
2232                 return 0;
2233
2234         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2235         if (!nested)
2236                 return -ENOBUFS;
2237
2238         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2239                 nested_akms = nla_nest_start(msg, i + 1);
2240                 if (!nested_akms)
2241                         return -ENOBUFS;
2242
2243                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2244
2245                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2246                                         iftype_akms->iftypes_mask))
2247                         return -ENOBUFS;
2248
2249                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2250                             sizeof(u32) * iftype_akms->n_akm_suites,
2251                             iftype_akms->akm_suites)) {
2252                         return -ENOBUFS;
2253                 }
2254                 nla_nest_end(msg, nested_akms);
2255         }
2256
2257         nla_nest_end(msg, nested);
2258
2259         return 0;
2260 }
2261
2262 static int
2263 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2264                                struct sk_buff *msg)
2265 {
2266         struct nlattr *supp;
2267
2268         if (!rdev->wiphy.tid_config_support.vif &&
2269             !rdev->wiphy.tid_config_support.peer)
2270                 return 0;
2271
2272         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2273         if (!supp)
2274                 return -ENOSPC;
2275
2276         if (rdev->wiphy.tid_config_support.vif &&
2277             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2278                               rdev->wiphy.tid_config_support.vif,
2279                               NL80211_TID_CONFIG_ATTR_PAD))
2280                 goto fail;
2281
2282         if (rdev->wiphy.tid_config_support.peer &&
2283             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2284                               rdev->wiphy.tid_config_support.peer,
2285                               NL80211_TID_CONFIG_ATTR_PAD))
2286                 goto fail;
2287
2288         /* for now we just use the same value ... makes more sense */
2289         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2290                        rdev->wiphy.tid_config_support.max_retry))
2291                 goto fail;
2292         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2293                        rdev->wiphy.tid_config_support.max_retry))
2294                 goto fail;
2295
2296         nla_nest_end(msg, supp);
2297
2298         return 0;
2299 fail:
2300         nla_nest_cancel(msg, supp);
2301         return -ENOBUFS;
2302 }
2303
2304 static int
2305 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2306                       struct sk_buff *msg)
2307 {
2308         struct nlattr *sar_capa, *specs, *sub_freq_range;
2309         u8 num_freq_ranges;
2310         int i;
2311
2312         if (!rdev->wiphy.sar_capa)
2313                 return 0;
2314
2315         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2316
2317         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2318         if (!sar_capa)
2319                 return -ENOSPC;
2320
2321         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2322                 goto fail;
2323
2324         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2325         if (!specs)
2326                 goto fail;
2327
2328         /* report supported freq_ranges */
2329         for (i = 0; i < num_freq_ranges; i++) {
2330                 sub_freq_range = nla_nest_start(msg, i + 1);
2331                 if (!sub_freq_range)
2332                         goto fail;
2333
2334                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2335                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2336                         goto fail;
2337
2338                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2339                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2340                         goto fail;
2341
2342                 nla_nest_end(msg, sub_freq_range);
2343         }
2344
2345         nla_nest_end(msg, specs);
2346         nla_nest_end(msg, sar_capa);
2347
2348         return 0;
2349 fail:
2350         nla_nest_cancel(msg, sar_capa);
2351         return -ENOBUFS;
2352 }
2353
2354 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2355 {
2356         struct nlattr *config;
2357
2358         if (!wiphy->mbssid_max_interfaces)
2359                 return 0;
2360
2361         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2362         if (!config)
2363                 return -ENOBUFS;
2364
2365         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2366                        wiphy->mbssid_max_interfaces))
2367                 goto fail;
2368
2369         if (wiphy->ema_max_profile_periodicity &&
2370             nla_put_u8(msg,
2371                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2372                        wiphy->ema_max_profile_periodicity))
2373                 goto fail;
2374
2375         nla_nest_end(msg, config);
2376         return 0;
2377
2378 fail:
2379         nla_nest_cancel(msg, config);
2380         return -ENOBUFS;
2381 }
2382
2383 struct nl80211_dump_wiphy_state {
2384         s64 filter_wiphy;
2385         long start;
2386         long split_start, band_start, chan_start, capa_start;
2387         bool split;
2388 };
2389
2390 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2391                               enum nl80211_commands cmd,
2392                               struct sk_buff *msg, u32 portid, u32 seq,
2393                               int flags, struct nl80211_dump_wiphy_state *state)
2394 {
2395         void *hdr;
2396         struct nlattr *nl_bands, *nl_band;
2397         struct nlattr *nl_freqs, *nl_freq;
2398         struct nlattr *nl_cmds;
2399         enum nl80211_band band;
2400         struct ieee80211_channel *chan;
2401         int i;
2402         const struct ieee80211_txrx_stypes *mgmt_stypes =
2403                                 rdev->wiphy.mgmt_stypes;
2404         u32 features;
2405
2406         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2407         if (!hdr)
2408                 return -ENOBUFS;
2409
2410         if (WARN_ON(!state))
2411                 return -EINVAL;
2412
2413         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2414             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2415                            wiphy_name(&rdev->wiphy)) ||
2416             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2417                         cfg80211_rdev_list_generation))
2418                 goto nla_put_failure;
2419
2420         if (cmd != NL80211_CMD_NEW_WIPHY)
2421                 goto finish;
2422
2423         switch (state->split_start) {
2424         case 0:
2425                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2426                                rdev->wiphy.retry_short) ||
2427                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2428                                rdev->wiphy.retry_long) ||
2429                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2430                                 rdev->wiphy.frag_threshold) ||
2431                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2432                                 rdev->wiphy.rts_threshold) ||
2433                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2434                                rdev->wiphy.coverage_class) ||
2435                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2436                                rdev->wiphy.max_scan_ssids) ||
2437                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2438                                rdev->wiphy.max_sched_scan_ssids) ||
2439                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2440                                 rdev->wiphy.max_scan_ie_len) ||
2441                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2442                                 rdev->wiphy.max_sched_scan_ie_len) ||
2443                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2444                                rdev->wiphy.max_match_sets))
2445                         goto nla_put_failure;
2446
2447                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2448                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2449                         goto nla_put_failure;
2450                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2451                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2452                         goto nla_put_failure;
2453                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2454                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2455                         goto nla_put_failure;
2456                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2457                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2458                         goto nla_put_failure;
2459                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2460                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2461                         goto nla_put_failure;
2462                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2463                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2464                         goto nla_put_failure;
2465                 state->split_start++;
2466                 if (state->split)
2467                         break;
2468                 fallthrough;
2469         case 1:
2470                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2471                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2472                             rdev->wiphy.cipher_suites))
2473                         goto nla_put_failure;
2474
2475                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2476                                rdev->wiphy.max_num_pmkids))
2477                         goto nla_put_failure;
2478
2479                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2480                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2481                         goto nla_put_failure;
2482
2483                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2484                                 rdev->wiphy.available_antennas_tx) ||
2485                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2486                                 rdev->wiphy.available_antennas_rx))
2487                         goto nla_put_failure;
2488
2489                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2490                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2491                                 rdev->wiphy.probe_resp_offload))
2492                         goto nla_put_failure;
2493
2494                 if ((rdev->wiphy.available_antennas_tx ||
2495                      rdev->wiphy.available_antennas_rx) &&
2496                     rdev->ops->get_antenna) {
2497                         u32 tx_ant = 0, rx_ant = 0;
2498                         int res;
2499
2500                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2501                         if (!res) {
2502                                 if (nla_put_u32(msg,
2503                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2504                                                 tx_ant) ||
2505                                     nla_put_u32(msg,
2506                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2507                                                 rx_ant))
2508                                         goto nla_put_failure;
2509                         }
2510                 }
2511
2512                 state->split_start++;
2513                 if (state->split)
2514                         break;
2515                 fallthrough;
2516         case 2:
2517                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2518                                         rdev->wiphy.interface_modes))
2519                                 goto nla_put_failure;
2520                 state->split_start++;
2521                 if (state->split)
2522                         break;
2523                 fallthrough;
2524         case 3:
2525                 nl_bands = nla_nest_start_noflag(msg,
2526                                                  NL80211_ATTR_WIPHY_BANDS);
2527                 if (!nl_bands)
2528                         goto nla_put_failure;
2529
2530                 for (band = state->band_start;
2531                      band < (state->split ?
2532                                 NUM_NL80211_BANDS :
2533                                 NL80211_BAND_60GHZ + 1);
2534                      band++) {
2535                         struct ieee80211_supported_band *sband;
2536
2537                         /* omit higher bands for ancient software */
2538                         if (band > NL80211_BAND_5GHZ && !state->split)
2539                                 break;
2540
2541                         sband = rdev->wiphy.bands[band];
2542
2543                         if (!sband)
2544                                 continue;
2545
2546                         nl_band = nla_nest_start_noflag(msg, band);
2547                         if (!nl_band)
2548                                 goto nla_put_failure;
2549
2550                         switch (state->chan_start) {
2551                         case 0:
2552                                 if (nl80211_send_band_rateinfo(msg, sband,
2553                                                                state->split))
2554                                         goto nla_put_failure;
2555                                 state->chan_start++;
2556                                 if (state->split)
2557                                         break;
2558                                 fallthrough;
2559                         default:
2560                                 /* add frequencies */
2561                                 nl_freqs = nla_nest_start_noflag(msg,
2562                                                                  NL80211_BAND_ATTR_FREQS);
2563                                 if (!nl_freqs)
2564                                         goto nla_put_failure;
2565
2566                                 for (i = state->chan_start - 1;
2567                                      i < sband->n_channels;
2568                                      i++) {
2569                                         nl_freq = nla_nest_start_noflag(msg,
2570                                                                         i);
2571                                         if (!nl_freq)
2572                                                 goto nla_put_failure;
2573
2574                                         chan = &sband->channels[i];
2575
2576                                         if (nl80211_msg_put_channel(
2577                                                         msg, &rdev->wiphy, chan,
2578                                                         state->split))
2579                                                 goto nla_put_failure;
2580
2581                                         nla_nest_end(msg, nl_freq);
2582                                         if (state->split)
2583                                                 break;
2584                                 }
2585                                 if (i < sband->n_channels)
2586                                         state->chan_start = i + 2;
2587                                 else
2588                                         state->chan_start = 0;
2589                                 nla_nest_end(msg, nl_freqs);
2590                         }
2591
2592                         nla_nest_end(msg, nl_band);
2593
2594                         if (state->split) {
2595                                 /* start again here */
2596                                 if (state->chan_start)
2597                                         band--;
2598                                 break;
2599                         }
2600                 }
2601                 nla_nest_end(msg, nl_bands);
2602
2603                 if (band < NUM_NL80211_BANDS)
2604                         state->band_start = band + 1;
2605                 else
2606                         state->band_start = 0;
2607
2608                 /* if bands & channels are done, continue outside */
2609                 if (state->band_start == 0 && state->chan_start == 0)
2610                         state->split_start++;
2611                 if (state->split)
2612                         break;
2613                 fallthrough;
2614         case 4:
2615                 nl_cmds = nla_nest_start_noflag(msg,
2616                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2617                 if (!nl_cmds)
2618                         goto nla_put_failure;
2619
2620                 i = nl80211_add_commands_unsplit(rdev, msg);
2621                 if (i < 0)
2622                         goto nla_put_failure;
2623                 if (state->split) {
2624                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2625                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2626                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2627                                 CMD(channel_switch, CHANNEL_SWITCH);
2628                         CMD(set_qos_map, SET_QOS_MAP);
2629                         if (rdev->wiphy.features &
2630                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2631                                 CMD(add_tx_ts, ADD_TX_TS);
2632                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2633                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2634                         CMD(update_ft_ies, UPDATE_FT_IES);
2635                         if (rdev->wiphy.sar_capa)
2636                                 CMD(set_sar_specs, SET_SAR_SPECS);
2637                 }
2638 #undef CMD
2639
2640                 nla_nest_end(msg, nl_cmds);
2641                 state->split_start++;
2642                 if (state->split)
2643                         break;
2644                 fallthrough;
2645         case 5:
2646                 if (rdev->ops->remain_on_channel &&
2647                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2648                     nla_put_u32(msg,
2649                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2650                                 rdev->wiphy.max_remain_on_channel_duration))
2651                         goto nla_put_failure;
2652
2653                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2654                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2655                         goto nla_put_failure;
2656
2657                 state->split_start++;
2658                 if (state->split)
2659                         break;
2660                 fallthrough;
2661         case 6:
2662 #ifdef CONFIG_PM
2663                 if (nl80211_send_wowlan(msg, rdev, state->split))
2664                         goto nla_put_failure;
2665                 state->split_start++;
2666                 if (state->split)
2667                         break;
2668 #else
2669                 state->split_start++;
2670 #endif
2671                 fallthrough;
2672         case 7:
2673                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2674                                         rdev->wiphy.software_iftypes))
2675                         goto nla_put_failure;
2676
2677                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2678                                                    state->split))
2679                         goto nla_put_failure;
2680
2681                 state->split_start++;
2682                 if (state->split)
2683                         break;
2684                 fallthrough;
2685         case 8:
2686                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2687                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2688                                 rdev->wiphy.ap_sme_capa))
2689                         goto nla_put_failure;
2690
2691                 features = rdev->wiphy.features;
2692                 /*
2693                  * We can only add the per-channel limit information if the
2694                  * dump is split, otherwise it makes it too big. Therefore
2695                  * only advertise it in that case.
2696                  */
2697                 if (state->split)
2698                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2699                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2700                         goto nla_put_failure;
2701
2702                 if (rdev->wiphy.ht_capa_mod_mask &&
2703                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2704                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2705                             rdev->wiphy.ht_capa_mod_mask))
2706                         goto nla_put_failure;
2707
2708                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2709                     rdev->wiphy.max_acl_mac_addrs &&
2710                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2711                                 rdev->wiphy.max_acl_mac_addrs))
2712                         goto nla_put_failure;
2713
2714                 /*
2715                  * Any information below this point is only available to
2716                  * applications that can deal with it being split. This
2717                  * helps ensure that newly added capabilities don't break
2718                  * older tools by overrunning their buffers.
2719                  *
2720                  * We still increment split_start so that in the split
2721                  * case we'll continue with more data in the next round,
2722                  * but break unconditionally so unsplit data stops here.
2723                  */
2724                 if (state->split)
2725                         state->split_start++;
2726                 else
2727                         state->split_start = 0;
2728                 break;
2729         case 9:
2730                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2731                         goto nla_put_failure;
2732
2733                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2734                                 rdev->wiphy.max_sched_scan_plans) ||
2735                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2736                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2737                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2738                                 rdev->wiphy.max_sched_scan_plan_iterations))
2739                         goto nla_put_failure;
2740
2741                 if (rdev->wiphy.extended_capabilities &&
2742                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2743                              rdev->wiphy.extended_capabilities_len,
2744                              rdev->wiphy.extended_capabilities) ||
2745                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2746                              rdev->wiphy.extended_capabilities_len,
2747                              rdev->wiphy.extended_capabilities_mask)))
2748                         goto nla_put_failure;
2749
2750                 if (rdev->wiphy.vht_capa_mod_mask &&
2751                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2752                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2753                             rdev->wiphy.vht_capa_mod_mask))
2754                         goto nla_put_failure;
2755
2756                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2757                             rdev->wiphy.perm_addr))
2758                         goto nla_put_failure;
2759
2760                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2761                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2762                             rdev->wiphy.addr_mask))
2763                         goto nla_put_failure;
2764
2765                 if (rdev->wiphy.n_addresses > 1) {
2766                         void *attr;
2767
2768                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2769                         if (!attr)
2770                                 goto nla_put_failure;
2771
2772                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2773                                 if (nla_put(msg, i + 1, ETH_ALEN,
2774                                             rdev->wiphy.addresses[i].addr))
2775                                         goto nla_put_failure;
2776
2777                         nla_nest_end(msg, attr);
2778                 }
2779
2780                 state->split_start++;
2781                 break;
2782         case 10:
2783                 if (nl80211_send_coalesce(msg, rdev))
2784                         goto nla_put_failure;
2785
2786                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2787                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2788                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2789                         goto nla_put_failure;
2790
2791                 if (rdev->wiphy.max_ap_assoc_sta &&
2792                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2793                                 rdev->wiphy.max_ap_assoc_sta))
2794                         goto nla_put_failure;
2795
2796                 state->split_start++;
2797                 break;
2798         case 11:
2799                 if (rdev->wiphy.n_vendor_commands) {
2800                         const struct nl80211_vendor_cmd_info *info;
2801                         struct nlattr *nested;
2802
2803                         nested = nla_nest_start_noflag(msg,
2804                                                        NL80211_ATTR_VENDOR_DATA);
2805                         if (!nested)
2806                                 goto nla_put_failure;
2807
2808                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2809                                 info = &rdev->wiphy.vendor_commands[i].info;
2810                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2811                                         goto nla_put_failure;
2812                         }
2813                         nla_nest_end(msg, nested);
2814                 }
2815
2816                 if (rdev->wiphy.n_vendor_events) {
2817                         const struct nl80211_vendor_cmd_info *info;
2818                         struct nlattr *nested;
2819
2820                         nested = nla_nest_start_noflag(msg,
2821                                                        NL80211_ATTR_VENDOR_EVENTS);
2822                         if (!nested)
2823                                 goto nla_put_failure;
2824
2825                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2826                                 info = &rdev->wiphy.vendor_events[i];
2827                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2828                                         goto nla_put_failure;
2829                         }
2830                         nla_nest_end(msg, nested);
2831                 }
2832                 state->split_start++;
2833                 break;
2834         case 12:
2835                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2836                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2837                                rdev->wiphy.max_num_csa_counters))
2838                         goto nla_put_failure;
2839
2840                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2841                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2842                         goto nla_put_failure;
2843
2844                 if (rdev->wiphy.max_sched_scan_reqs &&
2845                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2846                                 rdev->wiphy.max_sched_scan_reqs))
2847                         goto nla_put_failure;
2848
2849                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2850                             sizeof(rdev->wiphy.ext_features),
2851                             rdev->wiphy.ext_features))
2852                         goto nla_put_failure;
2853
2854                 if (rdev->wiphy.bss_select_support) {
2855                         struct nlattr *nested;
2856                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2857
2858                         nested = nla_nest_start_noflag(msg,
2859                                                        NL80211_ATTR_BSS_SELECT);
2860                         if (!nested)
2861                                 goto nla_put_failure;
2862
2863                         i = 0;
2864                         while (bss_select_support) {
2865                                 if ((bss_select_support & 1) &&
2866                                     nla_put_flag(msg, i))
2867                                         goto nla_put_failure;
2868                                 i++;
2869                                 bss_select_support >>= 1;
2870                         }
2871                         nla_nest_end(msg, nested);
2872                 }
2873
2874                 state->split_start++;
2875                 break;
2876         case 13:
2877                 if (rdev->wiphy.num_iftype_ext_capab &&
2878                     rdev->wiphy.iftype_ext_capab) {
2879                         struct nlattr *nested_ext_capab, *nested;
2880
2881                         nested = nla_nest_start_noflag(msg,
2882                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2883                         if (!nested)
2884                                 goto nla_put_failure;
2885
2886                         for (i = state->capa_start;
2887                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2888                                 const struct wiphy_iftype_ext_capab *capab;
2889
2890                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2891
2892                                 nested_ext_capab = nla_nest_start_noflag(msg,
2893                                                                          i);
2894                                 if (!nested_ext_capab ||
2895                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2896                                                 capab->iftype) ||
2897                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2898                                             capab->extended_capabilities_len,
2899                                             capab->extended_capabilities) ||
2900                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2901                                             capab->extended_capabilities_len,
2902                                             capab->extended_capabilities_mask))
2903                                         goto nla_put_failure;
2904
2905                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2906                                     (nla_put_u16(msg,
2907                                                  NL80211_ATTR_EML_CAPABILITY,
2908                                                  capab->eml_capabilities) ||
2909                                      nla_put_u16(msg,
2910                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
2911                                                  capab->mld_capa_and_ops)))
2912                                         goto nla_put_failure;
2913
2914                                 nla_nest_end(msg, nested_ext_capab);
2915                                 if (state->split)
2916                                         break;
2917                         }
2918                         nla_nest_end(msg, nested);
2919                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2920                                 state->capa_start = i + 1;
2921                                 break;
2922                         }
2923                 }
2924
2925                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2926                                 rdev->wiphy.nan_supported_bands))
2927                         goto nla_put_failure;
2928
2929                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2930                                             NL80211_EXT_FEATURE_TXQS)) {
2931                         struct cfg80211_txq_stats txqstats = {};
2932                         int res;
2933
2934                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2935                         if (!res &&
2936                             !nl80211_put_txq_stats(msg, &txqstats,
2937                                                    NL80211_ATTR_TXQ_STATS))
2938                                 goto nla_put_failure;
2939
2940                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2941                                         rdev->wiphy.txq_limit))
2942                                 goto nla_put_failure;
2943                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2944                                         rdev->wiphy.txq_memory_limit))
2945                                 goto nla_put_failure;
2946                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2947                                         rdev->wiphy.txq_quantum))
2948                                 goto nla_put_failure;
2949                 }
2950
2951                 state->split_start++;
2952                 break;
2953         case 14:
2954                 if (nl80211_send_pmsr_capa(rdev, msg))
2955                         goto nla_put_failure;
2956
2957                 state->split_start++;
2958                 break;
2959         case 15:
2960                 if (rdev->wiphy.akm_suites &&
2961                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2962                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2963                             rdev->wiphy.akm_suites))
2964                         goto nla_put_failure;
2965
2966                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2967                         goto nla_put_failure;
2968
2969                 if (nl80211_put_tid_config_support(rdev, msg))
2970                         goto nla_put_failure;
2971                 state->split_start++;
2972                 break;
2973         case 16:
2974                 if (nl80211_put_sar_specs(rdev, msg))
2975                         goto nla_put_failure;
2976
2977                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2978                         goto nla_put_failure;
2979
2980                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2981                                 rdev->wiphy.max_num_akm_suites))
2982                         goto nla_put_failure;
2983
2984                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2985                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2986
2987                 if (rdev->wiphy.hw_timestamp_max_peers &&
2988                     nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
2989                                 rdev->wiphy.hw_timestamp_max_peers))
2990                         goto nla_put_failure;
2991
2992                 /* done */
2993                 state->split_start = 0;
2994                 break;
2995         }
2996  finish:
2997         genlmsg_end(msg, hdr);
2998         return 0;
2999
3000  nla_put_failure:
3001         genlmsg_cancel(msg, hdr);
3002         return -EMSGSIZE;
3003 }
3004
3005 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3006                                     struct netlink_callback *cb,
3007                                     struct nl80211_dump_wiphy_state *state)
3008 {
3009         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3010         int ret;
3011
3012         if (!tb)
3013                 return -ENOMEM;
3014
3015         ret = nlmsg_parse_deprecated(cb->nlh,
3016                                      GENL_HDRLEN + nl80211_fam.hdrsize,
3017                                      tb, nl80211_fam.maxattr,
3018                                      nl80211_policy, NULL);
3019         /* ignore parse errors for backward compatibility */
3020         if (ret) {
3021                 ret = 0;
3022                 goto out;
3023         }
3024
3025         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3026         if (tb[NL80211_ATTR_WIPHY])
3027                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3028         if (tb[NL80211_ATTR_WDEV])
3029                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3030         if (tb[NL80211_ATTR_IFINDEX]) {
3031                 struct net_device *netdev;
3032                 struct cfg80211_registered_device *rdev;
3033                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3034
3035                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3036                 if (!netdev) {
3037                         ret = -ENODEV;
3038                         goto out;
3039                 }
3040                 if (netdev->ieee80211_ptr) {
3041                         rdev = wiphy_to_rdev(
3042                                 netdev->ieee80211_ptr->wiphy);
3043                         state->filter_wiphy = rdev->wiphy_idx;
3044                 }
3045         }
3046
3047         ret = 0;
3048 out:
3049         kfree(tb);
3050         return ret;
3051 }
3052
3053 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3054 {
3055         int idx = 0, ret;
3056         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3057         struct cfg80211_registered_device *rdev;
3058
3059         rtnl_lock();
3060         if (!state) {
3061                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3062                 if (!state) {
3063                         rtnl_unlock();
3064                         return -ENOMEM;
3065                 }
3066                 state->filter_wiphy = -1;
3067                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3068                 if (ret) {
3069                         kfree(state);
3070                         rtnl_unlock();
3071                         return ret;
3072                 }
3073                 cb->args[0] = (long)state;
3074         }
3075
3076         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3077                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3078                         continue;
3079                 if (++idx <= state->start)
3080                         continue;
3081                 if (state->filter_wiphy != -1 &&
3082                     state->filter_wiphy != rdev->wiphy_idx)
3083                         continue;
3084                 /* attempt to fit multiple wiphy data chunks into the skb */
3085                 do {
3086                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3087                                                  skb,
3088                                                  NETLINK_CB(cb->skb).portid,
3089                                                  cb->nlh->nlmsg_seq,
3090                                                  NLM_F_MULTI, state);
3091                         if (ret < 0) {
3092                                 /*
3093                                  * If sending the wiphy data didn't fit (ENOBUFS
3094                                  * or EMSGSIZE returned), this SKB is still
3095                                  * empty (so it's not too big because another
3096                                  * wiphy dataset is already in the skb) and
3097                                  * we've not tried to adjust the dump allocation
3098                                  * yet ... then adjust the alloc size to be
3099                                  * bigger, and return 1 but with the empty skb.
3100                                  * This results in an empty message being RX'ed
3101                                  * in userspace, but that is ignored.
3102                                  *
3103                                  * We can then retry with the larger buffer.
3104                                  */
3105                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3106                                     !skb->len && !state->split &&
3107                                     cb->min_dump_alloc < 4096) {
3108                                         cb->min_dump_alloc = 4096;
3109                                         state->split_start = 0;
3110                                         rtnl_unlock();
3111                                         return 1;
3112                                 }
3113                                 idx--;
3114                                 break;
3115                         }
3116                 } while (state->split_start > 0);
3117                 break;
3118         }
3119         rtnl_unlock();
3120
3121         state->start = idx;
3122
3123         return skb->len;
3124 }
3125
3126 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3127 {
3128         kfree((void *)cb->args[0]);
3129         return 0;
3130 }
3131
3132 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3133 {
3134         struct sk_buff *msg;
3135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3136         struct nl80211_dump_wiphy_state state = {};
3137
3138         msg = nlmsg_new(4096, GFP_KERNEL);
3139         if (!msg)
3140                 return -ENOMEM;
3141
3142         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3143                                info->snd_portid, info->snd_seq, 0,
3144                                &state) < 0) {
3145                 nlmsg_free(msg);
3146                 return -ENOBUFS;
3147         }
3148
3149         return genlmsg_reply(msg, info);
3150 }
3151
3152 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3153         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3154         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3155         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3156         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3157         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3158 };
3159
3160 static int parse_txq_params(struct nlattr *tb[],
3161                             struct ieee80211_txq_params *txq_params)
3162 {
3163         u8 ac;
3164
3165         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3166             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3167             !tb[NL80211_TXQ_ATTR_AIFS])
3168                 return -EINVAL;
3169
3170         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3171         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3172         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3173         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3174         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3175
3176         if (ac >= NL80211_NUM_ACS)
3177                 return -EINVAL;
3178         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3179         return 0;
3180 }
3181
3182 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3183 {
3184         /*
3185          * You can only set the channel explicitly for some interfaces,
3186          * most have their channel managed via their respective
3187          * "establish a connection" command (connect, join, ...)
3188          *
3189          * For AP/GO and mesh mode, the channel can be set with the
3190          * channel userspace API, but is only stored and passed to the
3191          * low-level driver when the AP starts or the mesh is joined.
3192          * This is for backward compatibility, userspace can also give
3193          * the channel in the start-ap or join-mesh commands instead.
3194          *
3195          * Monitors are special as they are normally slaved to
3196          * whatever else is going on, so they have their own special
3197          * operation to set the monitor channel if possible.
3198          */
3199         return !wdev ||
3200                 wdev->iftype == NL80211_IFTYPE_AP ||
3201                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3202                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3203                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3204 }
3205
3206 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3207                                       struct genl_info *info,
3208                                       const struct cfg80211_chan_def *chandef,
3209                                       u16 *punct_bitmap)
3210 {
3211         if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3212                 return -EINVAL;
3213
3214         *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3215         if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3216                 return -EINVAL;
3217
3218         return 0;
3219 }
3220
3221 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3222                           struct genl_info *info,
3223                           struct cfg80211_chan_def *chandef)
3224 {
3225         struct netlink_ext_ack *extack = info->extack;
3226         struct nlattr **attrs = info->attrs;
3227         u32 control_freq;
3228
3229         if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3230                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3231                                     "Frequency is missing");
3232                 return -EINVAL;
3233         }
3234
3235         control_freq = MHZ_TO_KHZ(
3236                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3237         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3238                 control_freq +=
3239                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3240
3241         memset(chandef, 0, sizeof(*chandef));
3242         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3243         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3244         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3245         chandef->freq1_offset = control_freq % 1000;
3246         chandef->center_freq2 = 0;
3247
3248         /* Primary channel not allowed */
3249         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3250                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3251                                     "Channel is disabled");
3252                 return -EINVAL;
3253         }
3254
3255         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3256                 enum nl80211_channel_type chantype;
3257
3258                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3259
3260                 switch (chantype) {
3261                 case NL80211_CHAN_NO_HT:
3262                 case NL80211_CHAN_HT20:
3263                 case NL80211_CHAN_HT40PLUS:
3264                 case NL80211_CHAN_HT40MINUS:
3265                         cfg80211_chandef_create(chandef, chandef->chan,
3266                                                 chantype);
3267                         /* user input for center_freq is incorrect */
3268                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3269                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3270                                 NL_SET_ERR_MSG_ATTR(extack,
3271                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3272                                                     "bad center frequency 1");
3273                                 return -EINVAL;
3274                         }
3275                         /* center_freq2 must be zero */
3276                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3277                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3278                                 NL_SET_ERR_MSG_ATTR(extack,
3279                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3280                                                     "center frequency 2 can't be used");
3281                                 return -EINVAL;
3282                         }
3283                         break;
3284                 default:
3285                         NL_SET_ERR_MSG_ATTR(extack,
3286                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3287                                             "invalid channel type");
3288                         return -EINVAL;
3289                 }
3290         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3291                 chandef->width =
3292                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3293                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3294                         /* User input error for channel width doesn't match channel  */
3295                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3296                                 NL_SET_ERR_MSG_ATTR(extack,
3297                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3298                                                     "bad channel width");
3299                                 return -EINVAL;
3300                         }
3301                 }
3302                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3303                         chandef->center_freq1 =
3304                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3305                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3306                                 chandef->freq1_offset = nla_get_u32(
3307                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3308                         else
3309                                 chandef->freq1_offset = 0;
3310                 }
3311                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3312                         chandef->center_freq2 =
3313                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3314         }
3315
3316         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3317                 chandef->edmg.channels =
3318                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3319
3320                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3321                         chandef->edmg.bw_config =
3322                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3323         } else {
3324                 chandef->edmg.bw_config = 0;
3325                 chandef->edmg.channels = 0;
3326         }
3327
3328         if (!cfg80211_chandef_valid(chandef)) {
3329                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3330                 return -EINVAL;
3331         }
3332
3333         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3334                                      IEEE80211_CHAN_DISABLED)) {
3335                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3336                 return -EINVAL;
3337         }
3338
3339         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3340              chandef->width == NL80211_CHAN_WIDTH_10) &&
3341             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3342                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3343                 return -EINVAL;
3344         }
3345
3346         return 0;
3347 }
3348
3349 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3350                                  struct net_device *dev,
3351                                  struct genl_info *info,
3352                                  int _link_id)
3353 {
3354         struct cfg80211_chan_def chandef;
3355         int result;
3356         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3357         struct wireless_dev *wdev = NULL;
3358         int link_id = _link_id;
3359
3360         if (dev)
3361                 wdev = dev->ieee80211_ptr;
3362         if (!nl80211_can_set_dev_channel(wdev))
3363                 return -EOPNOTSUPP;
3364         if (wdev)
3365                 iftype = wdev->iftype;
3366
3367         if (link_id < 0) {
3368                 if (wdev && wdev->valid_links)
3369                         return -EINVAL;
3370                 link_id = 0;
3371         }
3372
3373         result = nl80211_parse_chandef(rdev, info, &chandef);
3374         if (result)
3375                 return result;
3376
3377         switch (iftype) {
3378         case NL80211_IFTYPE_AP:
3379         case NL80211_IFTYPE_P2P_GO:
3380                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3381                                                    iftype))
3382                         return -EINVAL;
3383                 if (wdev->links[link_id].ap.beacon_interval) {
3384                         struct ieee80211_channel *cur_chan;
3385
3386                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3387                             !(rdev->wiphy.features &
3388                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3389                                 return -EBUSY;
3390
3391                         /* Only allow dynamic channel width changes */
3392                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3393                         if (chandef.chan != cur_chan)
3394                                 return -EBUSY;
3395
3396                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3397                                                        &chandef);
3398                         if (result)
3399                                 return result;
3400                         wdev->links[link_id].ap.chandef = chandef;
3401                 } else {
3402                         wdev->u.ap.preset_chandef = chandef;
3403                 }
3404                 return 0;
3405         case NL80211_IFTYPE_MESH_POINT:
3406                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3407         case NL80211_IFTYPE_MONITOR:
3408                 return cfg80211_set_monitor_channel(rdev, &chandef);
3409         default:
3410                 break;
3411         }
3412
3413         return -EINVAL;
3414 }
3415
3416 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3417 {
3418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3419         int link_id = nl80211_link_id_or_invalid(info->attrs);
3420         struct net_device *netdev = info->user_ptr[1];
3421         int ret;
3422
3423         wdev_lock(netdev->ieee80211_ptr);
3424         ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3425         wdev_unlock(netdev->ieee80211_ptr);
3426
3427         return ret;
3428 }
3429
3430 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3431 {
3432         struct cfg80211_registered_device *rdev = NULL;
3433         struct net_device *netdev = NULL;
3434         struct wireless_dev *wdev;
3435         int result = 0, rem_txq_params = 0;
3436         struct nlattr *nl_txq_params;
3437         u32 changed;
3438         u8 retry_short = 0, retry_long = 0;
3439         u32 frag_threshold = 0, rts_threshold = 0;
3440         u8 coverage_class = 0;
3441         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3442
3443         rtnl_lock();
3444         /*
3445          * Try to find the wiphy and netdev. Normally this
3446          * function shouldn't need the netdev, but this is
3447          * done for backward compatibility -- previously
3448          * setting the channel was done per wiphy, but now
3449          * it is per netdev. Previous userland like hostapd
3450          * also passed a netdev to set_wiphy, so that it is
3451          * possible to let that go to the right netdev!
3452          */
3453
3454         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3455                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3456
3457                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3458                 if (netdev && netdev->ieee80211_ptr)
3459                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3460                 else
3461                         netdev = NULL;
3462         }
3463
3464         if (!netdev) {
3465                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3466                                                   info->attrs);
3467                 if (IS_ERR(rdev)) {
3468                         rtnl_unlock();
3469                         return PTR_ERR(rdev);
3470                 }
3471                 wdev = NULL;
3472                 netdev = NULL;
3473                 result = 0;
3474         } else
3475                 wdev = netdev->ieee80211_ptr;
3476
3477         wiphy_lock(&rdev->wiphy);
3478
3479         /*
3480          * end workaround code, by now the rdev is available
3481          * and locked, and wdev may or may not be NULL.
3482          */
3483
3484         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3485                 result = cfg80211_dev_rename(
3486                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3487         rtnl_unlock();
3488
3489         if (result)
3490                 goto out;
3491
3492         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3493                 struct ieee80211_txq_params txq_params;
3494                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3495
3496                 if (!rdev->ops->set_txq_params) {
3497                         result = -EOPNOTSUPP;
3498                         goto out;
3499                 }
3500
3501                 if (!netdev) {
3502                         result = -EINVAL;
3503                         goto out;
3504                 }
3505
3506                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3507                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3508                         result = -EINVAL;
3509                         goto out;
3510                 }
3511
3512                 if (!netif_running(netdev)) {
3513                         result = -ENETDOWN;
3514                         goto out;
3515                 }
3516
3517                 nla_for_each_nested(nl_txq_params,
3518                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3519                                     rem_txq_params) {
3520                         result = nla_parse_nested_deprecated(tb,
3521                                                              NL80211_TXQ_ATTR_MAX,
3522                                                              nl_txq_params,
3523                                                              txq_params_policy,
3524                                                              info->extack);
3525                         if (result)
3526                                 goto out;
3527                         result = parse_txq_params(tb, &txq_params);
3528                         if (result)
3529                                 goto out;
3530
3531                         txq_params.link_id =
3532                                 nl80211_link_id_or_invalid(info->attrs);
3533
3534                         wdev_lock(netdev->ieee80211_ptr);
3535                         if (txq_params.link_id >= 0 &&
3536                             !(netdev->ieee80211_ptr->valid_links &
3537                               BIT(txq_params.link_id)))
3538                                 result = -ENOLINK;
3539                         else if (txq_params.link_id >= 0 &&
3540                                  !netdev->ieee80211_ptr->valid_links)
3541                                 result = -EINVAL;
3542                         else
3543                                 result = rdev_set_txq_params(rdev, netdev,
3544                                                              &txq_params);
3545                         wdev_unlock(netdev->ieee80211_ptr);
3546                         if (result)
3547                                 goto out;
3548                 }
3549         }
3550
3551         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3552                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3553
3554                 if (wdev) {
3555                         wdev_lock(wdev);
3556                         result = __nl80211_set_channel(
3557                                 rdev,
3558                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3559                                 info, link_id);
3560                         wdev_unlock(wdev);
3561                 } else {
3562                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3563                 }
3564
3565                 if (result)
3566                         goto out;
3567         }
3568
3569         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3570                 struct wireless_dev *txp_wdev = wdev;
3571                 enum nl80211_tx_power_setting type;
3572                 int idx, mbm = 0;
3573
3574                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3575                         txp_wdev = NULL;
3576
3577                 if (!rdev->ops->set_tx_power) {
3578                         result = -EOPNOTSUPP;
3579                         goto out;
3580                 }
3581
3582                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3583                 type = nla_get_u32(info->attrs[idx]);
3584
3585                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3586                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3587                         result = -EINVAL;
3588                         goto out;
3589                 }
3590
3591                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3592                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3593                         mbm = nla_get_u32(info->attrs[idx]);
3594                 }
3595
3596                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3597                 if (result)
3598                         goto out;
3599         }
3600
3601         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3602             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3603                 u32 tx_ant, rx_ant;
3604
3605                 if ((!rdev->wiphy.available_antennas_tx &&
3606                      !rdev->wiphy.available_antennas_rx) ||
3607                     !rdev->ops->set_antenna) {
3608                         result = -EOPNOTSUPP;
3609                         goto out;
3610                 }
3611
3612                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3613                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3614
3615                 /* reject antenna configurations which don't match the
3616                  * available antenna masks, except for the "all" mask */
3617                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3618                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3619                         result = -EINVAL;
3620                         goto out;
3621                 }
3622
3623                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3624                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3625
3626                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3627                 if (result)
3628                         goto out;
3629         }
3630
3631         changed = 0;
3632
3633         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3634                 retry_short = nla_get_u8(
3635                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3636
3637                 changed |= WIPHY_PARAM_RETRY_SHORT;
3638         }
3639
3640         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3641                 retry_long = nla_get_u8(
3642                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3643
3644                 changed |= WIPHY_PARAM_RETRY_LONG;
3645         }
3646
3647         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3648                 frag_threshold = nla_get_u32(
3649                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3650                 if (frag_threshold < 256) {
3651                         result = -EINVAL;
3652                         goto out;
3653                 }
3654
3655                 if (frag_threshold != (u32) -1) {
3656                         /*
3657                          * Fragments (apart from the last one) are required to
3658                          * have even length. Make the fragmentation code
3659                          * simpler by stripping LSB should someone try to use
3660                          * odd threshold value.
3661                          */
3662                         frag_threshold &= ~0x1;
3663                 }
3664                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3665         }
3666
3667         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3668                 rts_threshold = nla_get_u32(
3669                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3670                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3671         }
3672
3673         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3674                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3675                         result = -EINVAL;
3676                         goto out;
3677                 }
3678
3679                 coverage_class = nla_get_u8(
3680                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3681                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3682         }
3683
3684         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3685                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3686                         result = -EOPNOTSUPP;
3687                         goto out;
3688                 }
3689
3690                 changed |= WIPHY_PARAM_DYN_ACK;
3691         }
3692
3693         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3694                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3695                                              NL80211_EXT_FEATURE_TXQS)) {
3696                         result = -EOPNOTSUPP;
3697                         goto out;
3698                 }
3699                 txq_limit = nla_get_u32(
3700                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3701                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3702         }
3703
3704         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3705                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3706                                              NL80211_EXT_FEATURE_TXQS)) {
3707                         result = -EOPNOTSUPP;
3708                         goto out;
3709                 }
3710                 txq_memory_limit = nla_get_u32(
3711                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3712                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3713         }
3714
3715         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3716                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3717                                              NL80211_EXT_FEATURE_TXQS)) {
3718                         result = -EOPNOTSUPP;
3719                         goto out;
3720                 }
3721                 txq_quantum = nla_get_u32(
3722                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3723                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3724         }
3725
3726         if (changed) {
3727                 u8 old_retry_short, old_retry_long;
3728                 u32 old_frag_threshold, old_rts_threshold;
3729                 u8 old_coverage_class;
3730                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3731
3732                 if (!rdev->ops->set_wiphy_params) {
3733                         result = -EOPNOTSUPP;
3734                         goto out;
3735                 }
3736
3737                 old_retry_short = rdev->wiphy.retry_short;
3738                 old_retry_long = rdev->wiphy.retry_long;
3739                 old_frag_threshold = rdev->wiphy.frag_threshold;
3740                 old_rts_threshold = rdev->wiphy.rts_threshold;
3741                 old_coverage_class = rdev->wiphy.coverage_class;
3742                 old_txq_limit = rdev->wiphy.txq_limit;
3743                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3744                 old_txq_quantum = rdev->wiphy.txq_quantum;
3745
3746                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3747                         rdev->wiphy.retry_short = retry_short;
3748                 if (changed & WIPHY_PARAM_RETRY_LONG)
3749                         rdev->wiphy.retry_long = retry_long;
3750                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3751                         rdev->wiphy.frag_threshold = frag_threshold;
3752                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3753                         rdev->wiphy.rts_threshold = rts_threshold;
3754                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3755                         rdev->wiphy.coverage_class = coverage_class;
3756                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3757                         rdev->wiphy.txq_limit = txq_limit;
3758                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3759                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3760                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3761                         rdev->wiphy.txq_quantum = txq_quantum;
3762
3763                 result = rdev_set_wiphy_params(rdev, changed);
3764                 if (result) {
3765                         rdev->wiphy.retry_short = old_retry_short;
3766                         rdev->wiphy.retry_long = old_retry_long;
3767                         rdev->wiphy.frag_threshold = old_frag_threshold;
3768                         rdev->wiphy.rts_threshold = old_rts_threshold;
3769                         rdev->wiphy.coverage_class = old_coverage_class;
3770                         rdev->wiphy.txq_limit = old_txq_limit;
3771                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3772                         rdev->wiphy.txq_quantum = old_txq_quantum;
3773                         goto out;
3774                 }
3775         }
3776
3777         result = 0;
3778
3779 out:
3780         wiphy_unlock(&rdev->wiphy);
3781         return result;
3782 }
3783
3784 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3785 {
3786         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3787                 return -EINVAL;
3788
3789         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3790                         chandef->chan->center_freq))
3791                 return -ENOBUFS;
3792         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3793                         chandef->chan->freq_offset))
3794                 return -ENOBUFS;
3795         switch (chandef->width) {
3796         case NL80211_CHAN_WIDTH_20_NOHT:
3797         case NL80211_CHAN_WIDTH_20:
3798         case NL80211_CHAN_WIDTH_40:
3799                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3800                                 cfg80211_get_chandef_type(chandef)))
3801                         return -ENOBUFS;
3802                 break;
3803         default:
3804                 break;
3805         }
3806         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3807                 return -ENOBUFS;
3808         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3809                 return -ENOBUFS;
3810         if (chandef->center_freq2 &&
3811             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3812                 return -ENOBUFS;
3813         return 0;
3814 }
3815 EXPORT_SYMBOL(nl80211_send_chandef);
3816
3817 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3818                               struct cfg80211_registered_device *rdev,
3819                               struct wireless_dev *wdev,
3820                               enum nl80211_commands cmd)
3821 {
3822         struct net_device *dev = wdev->netdev;
3823         void *hdr;
3824
3825         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3826                 cmd != NL80211_CMD_DEL_INTERFACE &&
3827                 cmd != NL80211_CMD_SET_INTERFACE);
3828
3829         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3830         if (!hdr)
3831                 return -1;
3832
3833         if (dev &&
3834             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3835              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3836                 goto nla_put_failure;
3837
3838         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3839             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3840             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3841                               NL80211_ATTR_PAD) ||
3842             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3843             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3844                         rdev->devlist_generation ^
3845                         (cfg80211_rdev_list_generation << 2)) ||
3846             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3847                 goto nla_put_failure;
3848
3849         if (rdev->ops->get_channel && !wdev->valid_links) {
3850                 struct cfg80211_chan_def chandef = {};
3851                 int ret;
3852
3853                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3854                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3855                         goto nla_put_failure;
3856         }
3857
3858         if (rdev->ops->get_tx_power) {
3859                 int dbm, ret;
3860
3861                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3862                 if (ret == 0 &&
3863                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3864                                 DBM_TO_MBM(dbm)))
3865                         goto nla_put_failure;
3866         }
3867
3868         wdev_lock(wdev);
3869         switch (wdev->iftype) {
3870         case NL80211_IFTYPE_AP:
3871         case NL80211_IFTYPE_P2P_GO:
3872                 if (wdev->u.ap.ssid_len &&
3873                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3874                             wdev->u.ap.ssid))
3875                         goto nla_put_failure_locked;
3876                 break;
3877         case NL80211_IFTYPE_STATION:
3878         case NL80211_IFTYPE_P2P_CLIENT:
3879                 if (wdev->u.client.ssid_len &&
3880                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3881                             wdev->u.client.ssid))
3882                         goto nla_put_failure_locked;
3883                 break;
3884         case NL80211_IFTYPE_ADHOC:
3885                 if (wdev->u.ibss.ssid_len &&
3886                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3887                             wdev->u.ibss.ssid))
3888                         goto nla_put_failure_locked;
3889                 break;
3890         default:
3891                 /* nothing */
3892                 break;
3893         }
3894         wdev_unlock(wdev);
3895
3896         if (rdev->ops->get_txq_stats) {
3897                 struct cfg80211_txq_stats txqstats = {};
3898                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3899
3900                 if (ret == 0 &&
3901                     !nl80211_put_txq_stats(msg, &txqstats,
3902                                            NL80211_ATTR_TXQ_STATS))
3903                         goto nla_put_failure;
3904         }
3905
3906         if (wdev->valid_links) {
3907                 unsigned int link_id;
3908                 struct nlattr *links = nla_nest_start(msg,
3909                                                       NL80211_ATTR_MLO_LINKS);
3910
3911                 if (!links)
3912                         goto nla_put_failure;
3913
3914                 for_each_valid_link(wdev, link_id) {
3915                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
3916                         struct cfg80211_chan_def chandef = {};
3917                         int ret;
3918
3919                         if (!link)
3920                                 goto nla_put_failure;
3921
3922                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3923                                 goto nla_put_failure;
3924                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3925                                     wdev->links[link_id].addr))
3926                                 goto nla_put_failure;
3927
3928                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3929                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3930                                 goto nla_put_failure;
3931
3932                         nla_nest_end(msg, link);
3933                 }
3934
3935                 nla_nest_end(msg, links);
3936         }
3937
3938         genlmsg_end(msg, hdr);
3939         return 0;
3940
3941  nla_put_failure_locked:
3942         wdev_unlock(wdev);
3943  nla_put_failure:
3944         genlmsg_cancel(msg, hdr);
3945         return -EMSGSIZE;
3946 }
3947
3948 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3949 {
3950         int wp_idx = 0;
3951         int if_idx = 0;
3952         int wp_start = cb->args[0];
3953         int if_start = cb->args[1];
3954         int filter_wiphy = -1;
3955         struct cfg80211_registered_device *rdev;
3956         struct wireless_dev *wdev;
3957         int ret;
3958
3959         rtnl_lock();
3960         if (!cb->args[2]) {
3961                 struct nl80211_dump_wiphy_state state = {
3962                         .filter_wiphy = -1,
3963                 };
3964
3965                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3966                 if (ret)
3967                         goto out_unlock;
3968
3969                 filter_wiphy = state.filter_wiphy;
3970
3971                 /*
3972                  * if filtering, set cb->args[2] to +1 since 0 is the default
3973                  * value needed to determine that parsing is necessary.
3974                  */
3975                 if (filter_wiphy >= 0)
3976                         cb->args[2] = filter_wiphy + 1;
3977                 else
3978                         cb->args[2] = -1;
3979         } else if (cb->args[2] > 0) {
3980                 filter_wiphy = cb->args[2] - 1;
3981         }
3982
3983         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3984                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3985                         continue;
3986                 if (wp_idx < wp_start) {
3987                         wp_idx++;
3988                         continue;
3989                 }
3990
3991                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3992                         continue;
3993
3994                 if_idx = 0;
3995
3996                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3997                         if (if_idx < if_start) {
3998                                 if_idx++;
3999                                 continue;
4000                         }
4001                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4002                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
4003                                                rdev, wdev,
4004                                                NL80211_CMD_NEW_INTERFACE) < 0) {
4005                                 goto out;
4006                         }
4007                         if_idx++;
4008                 }
4009
4010                 wp_idx++;
4011         }
4012  out:
4013         cb->args[0] = wp_idx;
4014         cb->args[1] = if_idx;
4015
4016         ret = skb->len;
4017  out_unlock:
4018         rtnl_unlock();
4019
4020         return ret;
4021 }
4022
4023 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4024 {
4025         struct sk_buff *msg;
4026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4027         struct wireless_dev *wdev = info->user_ptr[1];
4028
4029         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4030         if (!msg)
4031                 return -ENOMEM;
4032
4033         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4034                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4035                 nlmsg_free(msg);
4036                 return -ENOBUFS;
4037         }
4038
4039         return genlmsg_reply(msg, info);
4040 }
4041
4042 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4043         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4044         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4045         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4046         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4047         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4048         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4049 };
4050
4051 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4052 {
4053         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4054         int flag;
4055
4056         *mntrflags = 0;
4057
4058         if (!nla)
4059                 return -EINVAL;
4060
4061         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4062                 return -EINVAL;
4063
4064         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4065                 if (flags[flag])
4066                         *mntrflags |= (1<<flag);
4067
4068         *mntrflags |= MONITOR_FLAG_CHANGED;
4069
4070         return 0;
4071 }
4072
4073 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4074                                      enum nl80211_iftype type,
4075                                      struct genl_info *info,
4076                                      struct vif_params *params)
4077 {
4078         bool change = false;
4079         int err;
4080
4081         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4082                 if (type != NL80211_IFTYPE_MONITOR)
4083                         return -EINVAL;
4084
4085                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4086                                           &params->flags);
4087                 if (err)
4088                         return err;
4089
4090                 change = true;
4091         }
4092
4093         if (params->flags & MONITOR_FLAG_ACTIVE &&
4094             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4095                 return -EOPNOTSUPP;
4096
4097         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4098                 const u8 *mumimo_groups;
4099                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4100
4101                 if (type != NL80211_IFTYPE_MONITOR)
4102                         return -EINVAL;
4103
4104                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4105                         return -EOPNOTSUPP;
4106
4107                 mumimo_groups =
4108                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4109
4110                 /* bits 0 and 63 are reserved and must be zero */
4111                 if ((mumimo_groups[0] & BIT(0)) ||
4112                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4113                         return -EINVAL;
4114
4115                 params->vht_mumimo_groups = mumimo_groups;
4116                 change = true;
4117         }
4118
4119         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4120                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4121
4122                 if (type != NL80211_IFTYPE_MONITOR)
4123                         return -EINVAL;
4124
4125                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4126                         return -EOPNOTSUPP;
4127
4128                 params->vht_mumimo_follow_addr =
4129                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4130                 change = true;
4131         }
4132
4133         return change ? 1 : 0;
4134 }
4135
4136 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4137                                struct net_device *netdev, u8 use_4addr,
4138                                enum nl80211_iftype iftype)
4139 {
4140         if (!use_4addr) {
4141                 if (netdev && netif_is_bridge_port(netdev))
4142                         return -EBUSY;
4143                 return 0;
4144         }
4145
4146         switch (iftype) {
4147         case NL80211_IFTYPE_AP_VLAN:
4148                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4149                         return 0;
4150                 break;
4151         case NL80211_IFTYPE_STATION:
4152                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4153                         return 0;
4154                 break;
4155         default:
4156                 break;
4157         }
4158
4159         return -EOPNOTSUPP;
4160 }
4161
4162 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4163 {
4164         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4165         struct vif_params params;
4166         int err;
4167         enum nl80211_iftype otype, ntype;
4168         struct net_device *dev = info->user_ptr[1];
4169         bool change = false;
4170
4171         memset(&params, 0, sizeof(params));
4172
4173         otype = ntype = dev->ieee80211_ptr->iftype;
4174
4175         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4176                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4177                 if (otype != ntype)
4178                         change = true;
4179         }
4180
4181         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4182                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4183
4184                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4185                         return -EINVAL;
4186                 if (netif_running(dev))
4187                         return -EBUSY;
4188
4189                 wdev_lock(wdev);
4190                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4191                              IEEE80211_MAX_MESH_ID_LEN);
4192                 wdev->u.mesh.id_up_len =
4193                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4194                 memcpy(wdev->u.mesh.id,
4195                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4196                        wdev->u.mesh.id_up_len);
4197                 wdev_unlock(wdev);
4198         }
4199
4200         if (info->attrs[NL80211_ATTR_4ADDR]) {
4201                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4202                 change = true;
4203                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4204                 if (err)
4205                         return err;
4206         } else {
4207                 params.use_4addr = -1;
4208         }
4209
4210         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4211         if (err < 0)
4212                 return err;
4213         if (err > 0)
4214                 change = true;
4215
4216         if (change)
4217                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4218         else
4219                 err = 0;
4220
4221         if (!err && params.use_4addr != -1)
4222                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4223
4224         if (change && !err) {
4225                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4226
4227                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4228         }
4229
4230         return err;
4231 }
4232
4233 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4234 {
4235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4236         struct vif_params params;
4237         struct wireless_dev *wdev;
4238         struct sk_buff *msg;
4239         int err;
4240         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4241
4242         memset(&params, 0, sizeof(params));
4243
4244         if (!info->attrs[NL80211_ATTR_IFNAME])
4245                 return -EINVAL;
4246
4247         if (info->attrs[NL80211_ATTR_IFTYPE])
4248                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4249
4250         if (!rdev->ops->add_virtual_intf)
4251                 return -EOPNOTSUPP;
4252
4253         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4254              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4255             info->attrs[NL80211_ATTR_MAC]) {
4256                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4257                            ETH_ALEN);
4258                 if (!is_valid_ether_addr(params.macaddr))
4259                         return -EADDRNOTAVAIL;
4260         }
4261
4262         if (info->attrs[NL80211_ATTR_4ADDR]) {
4263                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4264                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4265                 if (err)
4266                         return err;
4267         }
4268
4269         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4270                 return -EOPNOTSUPP;
4271
4272         err = nl80211_parse_mon_options(rdev, type, info, &params);
4273         if (err < 0)
4274                 return err;
4275
4276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4277         if (!msg)
4278                 return -ENOMEM;
4279
4280         wdev = rdev_add_virtual_intf(rdev,
4281                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4282                                 NET_NAME_USER, type, &params);
4283         if (WARN_ON(!wdev)) {
4284                 nlmsg_free(msg);
4285                 return -EPROTO;
4286         } else if (IS_ERR(wdev)) {
4287                 nlmsg_free(msg);
4288                 return PTR_ERR(wdev);
4289         }
4290
4291         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4292                 wdev->owner_nlportid = info->snd_portid;
4293
4294         switch (type) {
4295         case NL80211_IFTYPE_MESH_POINT:
4296                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4297                         break;
4298                 wdev_lock(wdev);
4299                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4300                              IEEE80211_MAX_MESH_ID_LEN);
4301                 wdev->u.mesh.id_up_len =
4302                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4303                 memcpy(wdev->u.mesh.id,
4304                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4305                        wdev->u.mesh.id_up_len);
4306                 wdev_unlock(wdev);
4307                 break;
4308         case NL80211_IFTYPE_NAN:
4309         case NL80211_IFTYPE_P2P_DEVICE:
4310                 /*
4311                  * P2P Device and NAN do not have a netdev, so don't go
4312                  * through the netdev notifier and must be added here
4313                  */
4314                 cfg80211_init_wdev(wdev);
4315                 cfg80211_register_wdev(rdev, wdev);
4316                 break;
4317         default:
4318                 break;
4319         }
4320
4321         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4322                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4323                 nlmsg_free(msg);
4324                 return -ENOBUFS;
4325         }
4326
4327         return genlmsg_reply(msg, info);
4328 }
4329
4330 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4331 {
4332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4333         int ret;
4334
4335         /* to avoid failing a new interface creation due to pending removal */
4336         cfg80211_destroy_ifaces(rdev);
4337
4338         wiphy_lock(&rdev->wiphy);
4339         ret = _nl80211_new_interface(skb, info);
4340         wiphy_unlock(&rdev->wiphy);
4341
4342         return ret;
4343 }
4344
4345 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4346 {
4347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4348         struct wireless_dev *wdev = info->user_ptr[1];
4349
4350         if (!rdev->ops->del_virtual_intf)
4351                 return -EOPNOTSUPP;
4352
4353         /*
4354          * We hold RTNL, so this is safe, without RTNL opencount cannot
4355          * reach 0, and thus the rdev cannot be deleted.
4356          *
4357          * We need to do it for the dev_close(), since that will call
4358          * the netdev notifiers, and we need to acquire the mutex there
4359          * but don't know if we get there from here or from some other
4360          * place (e.g. "ip link set ... down").
4361          */
4362         mutex_unlock(&rdev->wiphy.mtx);
4363
4364         /*
4365          * If we remove a wireless device without a netdev then clear
4366          * user_ptr[1] so that nl80211_post_doit won't dereference it
4367          * to check if it needs to do dev_put(). Otherwise it crashes
4368          * since the wdev has been freed, unlike with a netdev where
4369          * we need the dev_put() for the netdev to really be freed.
4370          */
4371         if (!wdev->netdev)
4372                 info->user_ptr[1] = NULL;
4373         else
4374                 dev_close(wdev->netdev);
4375
4376         mutex_lock(&rdev->wiphy.mtx);
4377
4378         return cfg80211_remove_virtual_intf(rdev, wdev);
4379 }
4380
4381 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4382 {
4383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4384         struct net_device *dev = info->user_ptr[1];
4385         u16 noack_map;
4386
4387         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4388                 return -EINVAL;
4389
4390         if (!rdev->ops->set_noack_map)
4391                 return -EOPNOTSUPP;
4392
4393         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4394
4395         return rdev_set_noack_map(rdev, dev, noack_map);
4396 }
4397
4398 static int nl80211_validate_key_link_id(struct genl_info *info,
4399                                         struct wireless_dev *wdev,
4400                                         int link_id, bool pairwise)
4401 {
4402         if (pairwise) {
4403                 if (link_id != -1) {
4404                         GENL_SET_ERR_MSG(info,
4405                                          "link ID not allowed for pairwise key");
4406                         return -EINVAL;
4407                 }
4408
4409                 return 0;
4410         }
4411
4412         if (wdev->valid_links) {
4413                 if (link_id == -1) {
4414                         GENL_SET_ERR_MSG(info,
4415                                          "link ID must for MLO group key");
4416                         return -EINVAL;
4417                 }
4418                 if (!(wdev->valid_links & BIT(link_id))) {
4419                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4420                         return -EINVAL;
4421                 }
4422         } else if (link_id != -1) {
4423                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4424                 return -EINVAL;
4425         }
4426
4427         return 0;
4428 }
4429
4430 struct get_key_cookie {
4431         struct sk_buff *msg;
4432         int error;
4433         int idx;
4434 };
4435
4436 static void get_key_callback(void *c, struct key_params *params)
4437 {
4438         struct nlattr *key;
4439         struct get_key_cookie *cookie = c;
4440
4441         if ((params->key &&
4442              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4443                      params->key_len, params->key)) ||
4444             (params->seq &&
4445              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4446                      params->seq_len, params->seq)) ||
4447             (params->cipher &&
4448              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4449                          params->cipher)))
4450                 goto nla_put_failure;
4451
4452         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4453         if (!key)
4454                 goto nla_put_failure;
4455
4456         if ((params->key &&
4457              nla_put(cookie->msg, NL80211_KEY_DATA,
4458                      params->key_len, params->key)) ||
4459             (params->seq &&
4460              nla_put(cookie->msg, NL80211_KEY_SEQ,
4461                      params->seq_len, params->seq)) ||
4462             (params->cipher &&
4463              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4464                          params->cipher)))
4465                 goto nla_put_failure;
4466
4467         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4468                 goto nla_put_failure;
4469
4470         nla_nest_end(cookie->msg, key);
4471
4472         return;
4473  nla_put_failure:
4474         cookie->error = 1;
4475 }
4476
4477 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4478 {
4479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4480         int err;
4481         struct net_device *dev = info->user_ptr[1];
4482         u8 key_idx = 0;
4483         const u8 *mac_addr = NULL;
4484         bool pairwise;
4485         struct get_key_cookie cookie = {
4486                 .error = 0,
4487         };
4488         void *hdr;
4489         struct sk_buff *msg;
4490         bool bigtk_support = false;
4491         int link_id = nl80211_link_id_or_invalid(info->attrs);
4492         struct wireless_dev *wdev = dev->ieee80211_ptr;
4493
4494         if (wiphy_ext_feature_isset(&rdev->wiphy,
4495                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4496                 bigtk_support = true;
4497
4498         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4499              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4500             wiphy_ext_feature_isset(&rdev->wiphy,
4501                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4502                 bigtk_support = true;
4503
4504         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4505                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4506
4507                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4508                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4509                         return -EINVAL;
4510                 }
4511         }
4512
4513         if (info->attrs[NL80211_ATTR_MAC])
4514                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4515
4516         pairwise = !!mac_addr;
4517         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4518                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4519
4520                 if (kt != NL80211_KEYTYPE_GROUP &&
4521                     kt != NL80211_KEYTYPE_PAIRWISE)
4522                         return -EINVAL;
4523                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4524         }
4525
4526         if (!rdev->ops->get_key)
4527                 return -EOPNOTSUPP;
4528
4529         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4530                 return -ENOENT;
4531
4532         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4533         if (!msg)
4534                 return -ENOMEM;
4535
4536         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4537                              NL80211_CMD_NEW_KEY);
4538         if (!hdr)
4539                 goto nla_put_failure;
4540
4541         cookie.msg = msg;
4542         cookie.idx = key_idx;
4543
4544         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4545             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4546                 goto nla_put_failure;
4547         if (mac_addr &&
4548             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4549                 goto nla_put_failure;
4550
4551         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4552         if (err)
4553                 goto free_msg;
4554
4555         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4556                            &cookie, get_key_callback);
4557
4558         if (err)
4559                 goto free_msg;
4560
4561         if (cookie.error)
4562                 goto nla_put_failure;
4563
4564         genlmsg_end(msg, hdr);
4565         return genlmsg_reply(msg, info);
4566
4567  nla_put_failure:
4568         err = -ENOBUFS;
4569  free_msg:
4570         nlmsg_free(msg);
4571         return err;
4572 }
4573
4574 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4575 {
4576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4577         struct key_parse key;
4578         int err;
4579         struct net_device *dev = info->user_ptr[1];
4580         int link_id = nl80211_link_id_or_invalid(info->attrs);
4581         struct wireless_dev *wdev = dev->ieee80211_ptr;
4582
4583         err = nl80211_parse_key(info, &key);
4584         if (err)
4585                 return err;
4586
4587         if (key.idx < 0)
4588                 return -EINVAL;
4589
4590         /* Only support setting default key and
4591          * Extended Key ID action NL80211_KEY_SET_TX.
4592          */
4593         if (!key.def && !key.defmgmt && !key.defbeacon &&
4594             !(key.p.mode == NL80211_KEY_SET_TX))
4595                 return -EINVAL;
4596
4597         wdev_lock(wdev);
4598
4599         if (key.def) {
4600                 if (!rdev->ops->set_default_key) {
4601                         err = -EOPNOTSUPP;
4602                         goto out;
4603                 }
4604
4605                 err = nl80211_key_allowed(wdev);
4606                 if (err)
4607                         goto out;
4608
4609                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4610                 if (err)
4611                         goto out;
4612
4613                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4614                                            key.def_uni, key.def_multi);
4615
4616                 if (err)
4617                         goto out;
4618
4619 #ifdef CONFIG_CFG80211_WEXT
4620                 wdev->wext.default_key = key.idx;
4621 #endif
4622         } else if (key.defmgmt) {
4623                 if (key.def_uni || !key.def_multi) {
4624                         err = -EINVAL;
4625                         goto out;
4626                 }
4627
4628                 if (!rdev->ops->set_default_mgmt_key) {
4629                         err = -EOPNOTSUPP;
4630                         goto out;
4631                 }
4632
4633                 err = nl80211_key_allowed(wdev);
4634                 if (err)
4635                         goto out;
4636
4637                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4638                 if (err)
4639                         goto out;
4640
4641                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4642                 if (err)
4643                         goto out;
4644
4645 #ifdef CONFIG_CFG80211_WEXT
4646                 wdev->wext.default_mgmt_key = key.idx;
4647 #endif
4648         } else if (key.defbeacon) {
4649                 if (key.def_uni || !key.def_multi) {
4650                         err = -EINVAL;
4651                         goto out;
4652                 }
4653
4654                 if (!rdev->ops->set_default_beacon_key) {
4655                         err = -EOPNOTSUPP;
4656                         goto out;
4657                 }
4658
4659                 err = nl80211_key_allowed(wdev);
4660                 if (err)
4661                         goto out;
4662
4663                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4664                 if (err)
4665                         goto out;
4666
4667                 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4668                 if (err)
4669                         goto out;
4670         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4671                    wiphy_ext_feature_isset(&rdev->wiphy,
4672                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4673                 u8 *mac_addr = NULL;
4674
4675                 if (info->attrs[NL80211_ATTR_MAC])
4676                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4677
4678                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4679                         err = -EINVAL;
4680                         goto out;
4681                 }
4682
4683                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4684                 if (err)
4685                         goto out;
4686
4687                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4688                                    NL80211_KEYTYPE_PAIRWISE,
4689                                    mac_addr, &key.p);
4690         } else {
4691                 err = -EINVAL;
4692         }
4693  out:
4694         wdev_unlock(wdev);
4695
4696         return err;
4697 }
4698
4699 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4700 {
4701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4702         int err;
4703         struct net_device *dev = info->user_ptr[1];
4704         struct key_parse key;
4705         const u8 *mac_addr = NULL;
4706         int link_id = nl80211_link_id_or_invalid(info->attrs);
4707         struct wireless_dev *wdev = dev->ieee80211_ptr;
4708
4709         err = nl80211_parse_key(info, &key);
4710         if (err)
4711                 return err;
4712
4713         if (!key.p.key) {
4714                 GENL_SET_ERR_MSG(info, "no key");
4715                 return -EINVAL;
4716         }
4717
4718         if (info->attrs[NL80211_ATTR_MAC])
4719                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4720
4721         if (key.type == -1) {
4722                 if (mac_addr)
4723                         key.type = NL80211_KEYTYPE_PAIRWISE;
4724                 else
4725                         key.type = NL80211_KEYTYPE_GROUP;
4726         }
4727
4728         /* for now */
4729         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4730             key.type != NL80211_KEYTYPE_GROUP) {
4731                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4732                 return -EINVAL;
4733         }
4734
4735         if (key.type == NL80211_KEYTYPE_GROUP &&
4736             info->attrs[NL80211_ATTR_VLAN_ID])
4737                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4738
4739         if (!rdev->ops->add_key)
4740                 return -EOPNOTSUPP;
4741
4742         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4743                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4744                                            mac_addr)) {
4745                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4746                 return -EINVAL;
4747         }
4748
4749         wdev_lock(wdev);
4750         err = nl80211_key_allowed(wdev);
4751         if (err)
4752                 GENL_SET_ERR_MSG(info, "key not allowed");
4753
4754         if (!err)
4755                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4756                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4757
4758         if (!err) {
4759                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4760                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4761                                     mac_addr, &key.p);
4762                 if (err)
4763                         GENL_SET_ERR_MSG(info, "key addition failed");
4764         }
4765         wdev_unlock(wdev);
4766
4767         return err;
4768 }
4769
4770 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4771 {
4772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4773         int err;
4774         struct net_device *dev = info->user_ptr[1];
4775         u8 *mac_addr = NULL;
4776         struct key_parse key;
4777         int link_id = nl80211_link_id_or_invalid(info->attrs);
4778         struct wireless_dev *wdev = dev->ieee80211_ptr;
4779
4780         err = nl80211_parse_key(info, &key);
4781         if (err)
4782                 return err;
4783
4784         if (info->attrs[NL80211_ATTR_MAC])
4785                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4786
4787         if (key.type == -1) {
4788                 if (mac_addr)
4789                         key.type = NL80211_KEYTYPE_PAIRWISE;
4790                 else
4791                         key.type = NL80211_KEYTYPE_GROUP;
4792         }
4793
4794         /* for now */
4795         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4796             key.type != NL80211_KEYTYPE_GROUP)
4797                 return -EINVAL;
4798
4799         if (!cfg80211_valid_key_idx(rdev, key.idx,
4800                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4801                 return -EINVAL;
4802
4803         if (!rdev->ops->del_key)
4804                 return -EOPNOTSUPP;
4805
4806         wdev_lock(wdev);
4807         err = nl80211_key_allowed(wdev);
4808
4809         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4810             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4811                 err = -ENOENT;
4812
4813         if (!err)
4814                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4815                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4816
4817         if (!err)
4818                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4819                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4820                                    mac_addr);
4821
4822 #ifdef CONFIG_CFG80211_WEXT
4823         if (!err) {
4824                 if (key.idx == wdev->wext.default_key)
4825                         wdev->wext.default_key = -1;
4826                 else if (key.idx == wdev->wext.default_mgmt_key)
4827                         wdev->wext.default_mgmt_key = -1;
4828         }
4829 #endif
4830         wdev_unlock(wdev);
4831
4832         return err;
4833 }
4834
4835 /* This function returns an error or the number of nested attributes */
4836 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4837 {
4838         struct nlattr *attr;
4839         int n_entries = 0, tmp;
4840
4841         nla_for_each_nested(attr, nl_attr, tmp) {
4842                 if (nla_len(attr) != ETH_ALEN)
4843                         return -EINVAL;
4844
4845                 n_entries++;
4846         }
4847
4848         return n_entries;
4849 }
4850
4851 /*
4852  * This function parses ACL information and allocates memory for ACL data.
4853  * On successful return, the calling function is responsible to free the
4854  * ACL buffer returned by this function.
4855  */
4856 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4857                                                 struct genl_info *info)
4858 {
4859         enum nl80211_acl_policy acl_policy;
4860         struct nlattr *attr;
4861         struct cfg80211_acl_data *acl;
4862         int i = 0, n_entries, tmp;
4863
4864         if (!wiphy->max_acl_mac_addrs)
4865                 return ERR_PTR(-EOPNOTSUPP);
4866
4867         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4868                 return ERR_PTR(-EINVAL);
4869
4870         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4871         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4872             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4873                 return ERR_PTR(-EINVAL);
4874
4875         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4876                 return ERR_PTR(-EINVAL);
4877
4878         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4879         if (n_entries < 0)
4880                 return ERR_PTR(n_entries);
4881
4882         if (n_entries > wiphy->max_acl_mac_addrs)
4883                 return ERR_PTR(-ENOTSUPP);
4884
4885         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4886         if (!acl)
4887                 return ERR_PTR(-ENOMEM);
4888
4889         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4890                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4891                 i++;
4892         }
4893
4894         acl->n_acl_entries = n_entries;
4895         acl->acl_policy = acl_policy;
4896
4897         return acl;
4898 }
4899
4900 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4901 {
4902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4903         struct net_device *dev = info->user_ptr[1];
4904         struct cfg80211_acl_data *acl;
4905         int err;
4906
4907         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4908             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4909                 return -EOPNOTSUPP;
4910
4911         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4912                 return -EINVAL;
4913
4914         acl = parse_acl_data(&rdev->wiphy, info);
4915         if (IS_ERR(acl))
4916                 return PTR_ERR(acl);
4917
4918         err = rdev_set_mac_acl(rdev, dev, acl);
4919
4920         kfree(acl);
4921
4922         return err;
4923 }
4924
4925 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4926                            u8 *rates, u8 rates_len)
4927 {
4928         u8 i;
4929         u32 mask = 0;
4930
4931         for (i = 0; i < rates_len; i++) {
4932                 int rate = (rates[i] & 0x7f) * 5;
4933                 int ridx;
4934
4935                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4936                         struct ieee80211_rate *srate =
4937                                 &sband->bitrates[ridx];
4938                         if (rate == srate->bitrate) {
4939                                 mask |= 1 << ridx;
4940                                 break;
4941                         }
4942                 }
4943                 if (ridx == sband->n_bitrates)
4944                         return 0; /* rate not found */
4945         }
4946
4947         return mask;
4948 }
4949
4950 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4951                                u8 *rates, u8 rates_len,
4952                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4953 {
4954         u8 i;
4955
4956         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4957
4958         for (i = 0; i < rates_len; i++) {
4959                 int ridx, rbit;
4960
4961                 ridx = rates[i] / 8;
4962                 rbit = BIT(rates[i] % 8);
4963
4964                 /* check validity */
4965                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4966                         return false;
4967
4968                 /* check availability */
4969                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4970                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4971                         mcs[ridx] |= rbit;
4972                 else
4973                         return false;
4974         }
4975
4976         return true;
4977 }
4978
4979 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4980 {
4981         u16 mcs_mask = 0;
4982
4983         switch (vht_mcs_map) {
4984         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4985                 break;
4986         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4987                 mcs_mask = 0x00FF;
4988                 break;
4989         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4990                 mcs_mask = 0x01FF;
4991                 break;
4992         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4993                 mcs_mask = 0x03FF;
4994                 break;
4995         default:
4996                 break;
4997         }
4998
4999         return mcs_mask;
5000 }
5001
5002 static void vht_build_mcs_mask(u16 vht_mcs_map,
5003                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5004 {
5005         u8 nss;
5006
5007         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5008                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5009                 vht_mcs_map >>= 2;
5010         }
5011 }
5012
5013 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5014                              struct nl80211_txrate_vht *txrate,
5015                              u16 mcs[NL80211_VHT_NSS_MAX])
5016 {
5017         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5018         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5019         u8 i;
5020
5021         if (!sband->vht_cap.vht_supported)
5022                 return false;
5023
5024         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5025
5026         /* Build vht_mcs_mask from VHT capabilities */
5027         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5028
5029         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5030                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5031                         mcs[i] = txrate->mcs[i];
5032                 else
5033                         return false;
5034         }
5035
5036         return true;
5037 }
5038
5039 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5040 {
5041         switch (he_mcs_map) {
5042         case IEEE80211_HE_MCS_NOT_SUPPORTED:
5043                 return 0;
5044         case IEEE80211_HE_MCS_SUPPORT_0_7:
5045                 return 0x00FF;
5046         case IEEE80211_HE_MCS_SUPPORT_0_9:
5047                 return 0x03FF;
5048         case IEEE80211_HE_MCS_SUPPORT_0_11:
5049                 return 0xFFF;
5050         default:
5051                 break;
5052         }
5053         return 0;
5054 }
5055
5056 static void he_build_mcs_mask(u16 he_mcs_map,
5057                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5058 {
5059         u8 nss;
5060
5061         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5062                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5063                 he_mcs_map >>= 2;
5064         }
5065 }
5066
5067 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5068                            const struct ieee80211_sta_he_cap *he_cap)
5069 {
5070         struct net_device *dev = info->user_ptr[1];
5071         struct wireless_dev *wdev = dev->ieee80211_ptr;
5072         struct cfg80211_chan_def *chandef;
5073         __le16 tx_mcs;
5074
5075         chandef = wdev_chandef(wdev, link_id);
5076         if (!chandef) {
5077                 /*
5078                  * This is probably broken, but we never maintained
5079                  * a chandef in these cases, so it always was.
5080                  */
5081                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5082         }
5083
5084         switch (chandef->width) {
5085         case NL80211_CHAN_WIDTH_80P80:
5086                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5087                 break;
5088         case NL80211_CHAN_WIDTH_160:
5089                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5090                 break;
5091         default:
5092                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5093                 break;
5094         }
5095
5096         return le16_to_cpu(tx_mcs);
5097 }
5098
5099 static bool he_set_mcs_mask(struct genl_info *info,
5100                             struct wireless_dev *wdev,
5101                             struct ieee80211_supported_band *sband,
5102                             struct nl80211_txrate_he *txrate,
5103                             u16 mcs[NL80211_HE_NSS_MAX],
5104                             unsigned int link_id)
5105 {
5106         const struct ieee80211_sta_he_cap *he_cap;
5107         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5108         u16 tx_mcs_map = 0;
5109         u8 i;
5110
5111         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5112         if (!he_cap)
5113                 return false;
5114
5115         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5116
5117         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5118
5119         /* Build he_mcs_mask from HE capabilities */
5120         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5121
5122         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5123                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5124                         mcs[i] = txrate->mcs[i];
5125                 else
5126                         return false;
5127         }
5128
5129         return true;
5130 }
5131
5132 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5133                                          struct nlattr *attrs[],
5134                                          enum nl80211_attrs attr,
5135                                          struct cfg80211_bitrate_mask *mask,
5136                                          struct net_device *dev,
5137                                          bool default_all_enabled,
5138                                          unsigned int link_id)
5139 {
5140         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5142         struct wireless_dev *wdev = dev->ieee80211_ptr;
5143         int rem, i;
5144         struct nlattr *tx_rates;
5145         struct ieee80211_supported_band *sband;
5146         u16 vht_tx_mcs_map, he_tx_mcs_map;
5147
5148         memset(mask, 0, sizeof(*mask));
5149         /* Default to all rates enabled */
5150         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5151                 const struct ieee80211_sta_he_cap *he_cap;
5152
5153                 if (!default_all_enabled)
5154                         break;
5155
5156                 sband = rdev->wiphy.bands[i];
5157
5158                 if (!sband)
5159                         continue;
5160
5161                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5162                 memcpy(mask->control[i].ht_mcs,
5163                        sband->ht_cap.mcs.rx_mask,
5164                        sizeof(mask->control[i].ht_mcs));
5165
5166                 if (sband->vht_cap.vht_supported) {
5167                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5168                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5169                 }
5170
5171                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5172                 if (!he_cap)
5173                         continue;
5174
5175                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5176                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5177
5178                 mask->control[i].he_gi = 0xFF;
5179                 mask->control[i].he_ltf = 0xFF;
5180         }
5181
5182         /* if no rates are given set it back to the defaults */
5183         if (!attrs[attr])
5184                 goto out;
5185
5186         /* The nested attribute uses enum nl80211_band as the index. This maps
5187          * directly to the enum nl80211_band values used in cfg80211.
5188          */
5189         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5190         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5191                 enum nl80211_band band = nla_type(tx_rates);
5192                 int err;
5193
5194                 if (band < 0 || band >= NUM_NL80211_BANDS)
5195                         return -EINVAL;
5196                 sband = rdev->wiphy.bands[band];
5197                 if (sband == NULL)
5198                         return -EINVAL;
5199                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5200                                                   tx_rates,
5201                                                   nl80211_txattr_policy,
5202                                                   info->extack);
5203                 if (err)
5204                         return err;
5205                 if (tb[NL80211_TXRATE_LEGACY]) {
5206                         mask->control[band].legacy = rateset_to_mask(
5207                                 sband,
5208                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5209                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5210                         if ((mask->control[band].legacy == 0) &&
5211                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5212                                 return -EINVAL;
5213                 }
5214                 if (tb[NL80211_TXRATE_HT]) {
5215                         if (!ht_rateset_to_mask(
5216                                         sband,
5217                                         nla_data(tb[NL80211_TXRATE_HT]),
5218                                         nla_len(tb[NL80211_TXRATE_HT]),
5219                                         mask->control[band].ht_mcs))
5220                                 return -EINVAL;
5221                 }
5222
5223                 if (tb[NL80211_TXRATE_VHT]) {
5224                         if (!vht_set_mcs_mask(
5225                                         sband,
5226                                         nla_data(tb[NL80211_TXRATE_VHT]),
5227                                         mask->control[band].vht_mcs))
5228                                 return -EINVAL;
5229                 }
5230
5231                 if (tb[NL80211_TXRATE_GI]) {
5232                         mask->control[band].gi =
5233                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5234                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5235                                 return -EINVAL;
5236                 }
5237                 if (tb[NL80211_TXRATE_HE] &&
5238                     !he_set_mcs_mask(info, wdev, sband,
5239                                      nla_data(tb[NL80211_TXRATE_HE]),
5240                                      mask->control[band].he_mcs,
5241                                      link_id))
5242                         return -EINVAL;
5243
5244                 if (tb[NL80211_TXRATE_HE_GI])
5245                         mask->control[band].he_gi =
5246                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5247                 if (tb[NL80211_TXRATE_HE_LTF])
5248                         mask->control[band].he_ltf =
5249                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5250
5251                 if (mask->control[band].legacy == 0) {
5252                         /* don't allow empty legacy rates if HT, VHT or HE
5253                          * are not even supported.
5254                          */
5255                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5256                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5257                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5258                                 return -EINVAL;
5259
5260                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5261                                 if (mask->control[band].ht_mcs[i])
5262                                         goto out;
5263
5264                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5265                                 if (mask->control[band].vht_mcs[i])
5266                                         goto out;
5267
5268                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5269                                 if (mask->control[band].he_mcs[i])
5270                                         goto out;
5271
5272                         /* legacy and mcs rates may not be both empty */
5273                         return -EINVAL;
5274                 }
5275         }
5276
5277 out:
5278         return 0;
5279 }
5280
5281 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5282                                    enum nl80211_band band,
5283                                    struct cfg80211_bitrate_mask *beacon_rate)
5284 {
5285         u32 count_ht, count_vht, count_he, i;
5286         u32 rate = beacon_rate->control[band].legacy;
5287
5288         /* Allow only one rate */
5289         if (hweight32(rate) > 1)
5290                 return -EINVAL;
5291
5292         count_ht = 0;
5293         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5294                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5295                         return -EINVAL;
5296                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5297                         count_ht++;
5298                         if (count_ht > 1)
5299                                 return -EINVAL;
5300                 }
5301                 if (count_ht && rate)
5302                         return -EINVAL;
5303         }
5304
5305         count_vht = 0;
5306         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5307                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5308                         return -EINVAL;
5309                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5310                         count_vht++;
5311                         if (count_vht > 1)
5312                                 return -EINVAL;
5313                 }
5314                 if (count_vht && rate)
5315                         return -EINVAL;
5316         }
5317
5318         count_he = 0;
5319         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5320                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5321                         return -EINVAL;
5322                 } else if (beacon_rate->control[band].he_mcs[i]) {
5323                         count_he++;
5324                         if (count_he > 1)
5325                                 return -EINVAL;
5326                 }
5327                 if (count_he && rate)
5328                         return -EINVAL;
5329         }
5330
5331         if ((count_ht && count_vht && count_he) ||
5332             (!rate && !count_ht && !count_vht && !count_he))
5333                 return -EINVAL;
5334
5335         if (rate &&
5336             !wiphy_ext_feature_isset(&rdev->wiphy,
5337                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5338                 return -EINVAL;
5339         if (count_ht &&
5340             !wiphy_ext_feature_isset(&rdev->wiphy,
5341                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5342                 return -EINVAL;
5343         if (count_vht &&
5344             !wiphy_ext_feature_isset(&rdev->wiphy,
5345                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5346                 return -EINVAL;
5347         if (count_he &&
5348             !wiphy_ext_feature_isset(&rdev->wiphy,
5349                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5350                 return -EINVAL;
5351
5352         return 0;
5353 }
5354
5355 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5356                                        struct net_device *dev,
5357                                        struct nlattr *attrs,
5358                                        struct cfg80211_mbssid_config *config,
5359                                        u8 num_elems)
5360 {
5361         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5362
5363         if (!wiphy->mbssid_max_interfaces)
5364                 return -EOPNOTSUPP;
5365
5366         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5367                              NULL) ||
5368             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5369                 return -EINVAL;
5370
5371         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5372         if (config->ema) {
5373                 if (!wiphy->ema_max_profile_periodicity)
5374                         return -EOPNOTSUPP;
5375
5376                 if (num_elems > wiphy->ema_max_profile_periodicity)
5377                         return -EINVAL;
5378         }
5379
5380         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5381         if (config->index >= wiphy->mbssid_max_interfaces ||
5382             (!config->index && !num_elems))
5383                 return -EINVAL;
5384
5385         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5386                 u32 tx_ifindex =
5387                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5388
5389                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5390                     (config->index && tx_ifindex == dev->ifindex))
5391                         return -EINVAL;
5392
5393                 if (tx_ifindex != dev->ifindex) {
5394                         struct net_device *tx_netdev =
5395                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5396
5397                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5398                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5399                             tx_netdev->ieee80211_ptr->iftype !=
5400                                                         NL80211_IFTYPE_AP) {
5401                                 dev_put(tx_netdev);
5402                                 return -EINVAL;
5403                         }
5404
5405                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5406                 } else {
5407                         config->tx_wdev = dev->ieee80211_ptr;
5408                 }
5409         } else if (!config->index) {
5410                 config->tx_wdev = dev->ieee80211_ptr;
5411         } else {
5412                 return -EINVAL;
5413         }
5414
5415         return 0;
5416 }
5417
5418 static struct cfg80211_mbssid_elems *
5419 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5420 {
5421         struct nlattr *nl_elems;
5422         struct cfg80211_mbssid_elems *elems;
5423         int rem_elems;
5424         u8 i = 0, num_elems = 0;
5425
5426         if (!wiphy->mbssid_max_interfaces)
5427                 return ERR_PTR(-EINVAL);
5428
5429         nla_for_each_nested(nl_elems, attrs, rem_elems)
5430                 num_elems++;
5431
5432         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5433         if (!elems)
5434                 return ERR_PTR(-ENOMEM);
5435
5436         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5437                 elems->elem[i].data = nla_data(nl_elems);
5438                 elems->elem[i].len = nla_len(nl_elems);
5439                 i++;
5440         }
5441         elems->cnt = num_elems;
5442         return elems;
5443 }
5444
5445 static struct cfg80211_rnr_elems *
5446 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5447                         struct netlink_ext_ack *extack)
5448 {
5449         struct nlattr *nl_elems;
5450         struct cfg80211_rnr_elems *elems;
5451         int rem_elems;
5452         u8 i = 0, num_elems = 0;
5453
5454         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5455                 int ret;
5456
5457                 ret = validate_ie_attr(nl_elems, extack);
5458                 if (ret)
5459                         return ERR_PTR(ret);
5460
5461                 num_elems++;
5462         }
5463
5464         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5465         if (!elems)
5466                 return ERR_PTR(-ENOMEM);
5467
5468         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5469                 elems->elem[i].data = nla_data(nl_elems);
5470                 elems->elem[i].len = nla_len(nl_elems);
5471                 i++;
5472         }
5473         elems->cnt = num_elems;
5474         return elems;
5475 }
5476
5477 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5478                                       struct cfg80211_he_bss_color *he_bss_color)
5479 {
5480         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5481         int err;
5482
5483         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5484                                he_bss_color_policy, NULL);
5485         if (err)
5486                 return err;
5487
5488         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5489                 return -EINVAL;
5490
5491         he_bss_color->color =
5492                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5493         he_bss_color->enabled =
5494                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5495         he_bss_color->partial =
5496                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5497
5498         return 0;
5499 }
5500
5501 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5502                                 struct nlattr *attrs[],
5503                                 struct cfg80211_beacon_data *bcn,
5504                                 struct netlink_ext_ack *extack)
5505 {
5506         bool haveinfo = false;
5507         int err;
5508
5509         memset(bcn, 0, sizeof(*bcn));
5510
5511         bcn->link_id = nl80211_link_id(attrs);
5512
5513         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5514                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5515                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5516                 if (!bcn->head_len)
5517                         return -EINVAL;
5518                 haveinfo = true;
5519         }
5520
5521         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5522                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5523                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5524                 haveinfo = true;
5525         }
5526
5527         if (!haveinfo)
5528                 return -EINVAL;
5529
5530         if (attrs[NL80211_ATTR_IE]) {
5531                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5532                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5533         }
5534
5535         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5536                 bcn->proberesp_ies =
5537                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5538                 bcn->proberesp_ies_len =
5539                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5540         }
5541
5542         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5543                 bcn->assocresp_ies =
5544                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5545                 bcn->assocresp_ies_len =
5546                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5547         }
5548
5549         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5550                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5551                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5552         }
5553
5554         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5555                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5556
5557                 err = nla_parse_nested_deprecated(tb,
5558                                                   NL80211_FTM_RESP_ATTR_MAX,
5559                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5560                                                   NULL, NULL);
5561                 if (err)
5562                         return err;
5563
5564                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5565                     wiphy_ext_feature_isset(&rdev->wiphy,
5566                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5567                         bcn->ftm_responder = 1;
5568                 else
5569                         return -EOPNOTSUPP;
5570
5571                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5572                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5573                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5574                 }
5575
5576                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5577                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5578                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5579                 }
5580         } else {
5581                 bcn->ftm_responder = -1;
5582         }
5583
5584         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5585                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5586                                                  &bcn->he_bss_color);
5587                 if (err)
5588                         return err;
5589                 bcn->he_bss_color_valid = true;
5590         }
5591
5592         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5593                 struct cfg80211_mbssid_elems *mbssid =
5594                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5595                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5596
5597                 if (IS_ERR(mbssid))
5598                         return PTR_ERR(mbssid);
5599
5600                 bcn->mbssid_ies = mbssid;
5601
5602                 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5603                         struct cfg80211_rnr_elems *rnr =
5604                                 nl80211_parse_rnr_elems(&rdev->wiphy,
5605                                                         attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5606                                                         extack);
5607
5608                         if (IS_ERR(rnr))
5609                                 return PTR_ERR(rnr);
5610
5611                         if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5612                                 return -EINVAL;
5613
5614                         bcn->rnr_ies = rnr;
5615                 }
5616         }
5617
5618         return 0;
5619 }
5620
5621 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5622                                     struct ieee80211_he_obss_pd *he_obss_pd)
5623 {
5624         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5625         int err;
5626
5627         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5628                                he_obss_pd_policy, NULL);
5629         if (err)
5630                 return err;
5631
5632         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5633                 return -EINVAL;
5634
5635         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5636
5637         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5638                 he_obss_pd->min_offset =
5639                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5640         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5641                 he_obss_pd->max_offset =
5642                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5643         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5644                 he_obss_pd->non_srg_max_offset =
5645                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5646
5647         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5648                 return -EINVAL;
5649
5650         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5651                 memcpy(he_obss_pd->bss_color_bitmap,
5652                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5653                        sizeof(he_obss_pd->bss_color_bitmap));
5654
5655         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5656                 memcpy(he_obss_pd->partial_bssid_bitmap,
5657                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5658                        sizeof(he_obss_pd->partial_bssid_bitmap));
5659
5660         he_obss_pd->enable = true;
5661
5662         return 0;
5663 }
5664
5665 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5666                                         struct nlattr *attrs,
5667                                         struct cfg80211_ap_settings *params)
5668 {
5669         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5670         int ret;
5671         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5672
5673         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5674                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5675                 return -EINVAL;
5676
5677         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5678                                NULL, NULL);
5679         if (ret)
5680                 return ret;
5681
5682         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5683             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5684             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5685                 return -EINVAL;
5686
5687         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5688         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5689         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5690         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5691
5692         return 0;
5693 }
5694
5695 static int
5696 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5697                                      struct nlattr *attrs,
5698                                      struct cfg80211_ap_settings *params)
5699 {
5700         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5701         int ret;
5702         struct cfg80211_unsol_bcast_probe_resp *presp =
5703                                         &params->unsol_bcast_probe_resp;
5704
5705         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5706                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5707                 return -EINVAL;
5708
5709         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5710                                attrs, NULL, NULL);
5711         if (ret)
5712                 return ret;
5713
5714         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5715             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5716                 return -EINVAL;
5717
5718         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5719         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5720         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5721         return 0;
5722 }
5723
5724 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5725                                             const struct element *rates)
5726 {
5727         int i;
5728
5729         if (!rates)
5730                 return;
5731
5732         for (i = 0; i < rates->datalen; i++) {
5733                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5734                         params->ht_required = true;
5735                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5736                         params->vht_required = true;
5737                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5738                         params->he_required = true;
5739                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5740                         params->sae_h2e_required = true;
5741         }
5742 }
5743
5744 /*
5745  * Since the nl80211 API didn't include, from the beginning, attributes about
5746  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5747  * benefit of drivers that rebuild IEs in the firmware.
5748  */
5749 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5750 {
5751         const struct cfg80211_beacon_data *bcn = &params->beacon;
5752         size_t ies_len = bcn->tail_len;
5753         const u8 *ies = bcn->tail;
5754         const struct element *rates;
5755         const struct element *cap;
5756
5757         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5758         nl80211_check_ap_rate_selectors(params, rates);
5759
5760         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5761         nl80211_check_ap_rate_selectors(params, rates);
5762
5763         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5764         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5765                 params->ht_cap = (void *)cap->data;
5766         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5767         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5768                 params->vht_cap = (void *)cap->data;
5769         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5770         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5771                 params->he_cap = (void *)(cap->data + 1);
5772         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5773         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5774                 params->he_oper = (void *)(cap->data + 1);
5775         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5776         if (cap) {
5777                 if (!cap->datalen)
5778                         return -EINVAL;
5779                 params->eht_cap = (void *)(cap->data + 1);
5780                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5781                                                 (const u8 *)params->eht_cap,
5782                                                 cap->datalen - 1, true))
5783                         return -EINVAL;
5784         }
5785         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5786         if (cap) {
5787                 if (!cap->datalen)
5788                         return -EINVAL;
5789                 params->eht_oper = (void *)(cap->data + 1);
5790                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5791                                                 cap->datalen - 1))
5792                         return -EINVAL;
5793         }
5794         return 0;
5795 }
5796
5797 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5798                                    struct cfg80211_ap_settings *params)
5799 {
5800         struct wireless_dev *wdev;
5801
5802         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5803                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5804                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5805                         continue;
5806
5807                 if (!wdev->u.ap.preset_chandef.chan)
5808                         continue;
5809
5810                 params->chandef = wdev->u.ap.preset_chandef;
5811                 return true;
5812         }
5813
5814         return false;
5815 }
5816
5817 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5818                                     enum nl80211_auth_type auth_type,
5819                                     enum nl80211_commands cmd)
5820 {
5821         if (auth_type > NL80211_AUTHTYPE_MAX)
5822                 return false;
5823
5824         switch (cmd) {
5825         case NL80211_CMD_AUTHENTICATE:
5826                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5827                     auth_type == NL80211_AUTHTYPE_SAE)
5828                         return false;
5829                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5830                                              NL80211_EXT_FEATURE_FILS_STA) &&
5831                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5832                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5833                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5834                         return false;
5835                 return true;
5836         case NL80211_CMD_CONNECT:
5837                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5838                     !wiphy_ext_feature_isset(&rdev->wiphy,
5839                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5840                     auth_type == NL80211_AUTHTYPE_SAE)
5841                         return false;
5842
5843                 /* FILS with SK PFS or PK not supported yet */
5844                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5845                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5846                         return false;
5847                 if (!wiphy_ext_feature_isset(
5848                             &rdev->wiphy,
5849                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5850                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5851                         return false;
5852                 return true;
5853         case NL80211_CMD_START_AP:
5854                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5855                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5856                     auth_type == NL80211_AUTHTYPE_SAE)
5857                         return false;
5858                 /* FILS not supported yet */
5859                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5860                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5861                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5862                         return false;
5863                 return true;
5864         default:
5865                 return false;
5866         }
5867 }
5868
5869 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5870                                     unsigned int link_id)
5871 {
5872         struct wiphy *wiphy = wdev->wiphy;
5873         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5874         struct sk_buff *msg;
5875         void *hdr;
5876
5877         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5878         if (!msg)
5879                 return;
5880
5881         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5882         if (!hdr)
5883                 goto out;
5884
5885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5886             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5887             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5888                               NL80211_ATTR_PAD) ||
5889             (wdev->u.ap.ssid_len &&
5890              nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5891                      wdev->u.ap.ssid)) ||
5892             (wdev->valid_links &&
5893              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5894                 goto out;
5895
5896         genlmsg_end(msg, hdr);
5897
5898         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5899                                 NL80211_MCGRP_MLME, GFP_KERNEL);
5900         return;
5901 out:
5902         nlmsg_free(msg);
5903 }
5904
5905 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5906 {
5907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5908         unsigned int link_id = nl80211_link_id(info->attrs);
5909         struct net_device *dev = info->user_ptr[1];
5910         struct wireless_dev *wdev = dev->ieee80211_ptr;
5911         struct cfg80211_ap_settings *params;
5912         int err;
5913
5914         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5915             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5916                 return -EOPNOTSUPP;
5917
5918         if (!rdev->ops->start_ap)
5919                 return -EOPNOTSUPP;
5920
5921         if (wdev->links[link_id].ap.beacon_interval)
5922                 return -EALREADY;
5923
5924         /* these are required for START_AP */
5925         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5926             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5927             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5928                 return -EINVAL;
5929
5930         params = kzalloc(sizeof(*params), GFP_KERNEL);
5931         if (!params)
5932                 return -ENOMEM;
5933
5934         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
5935                                    info->extack);
5936         if (err)
5937                 goto out;
5938
5939         params->beacon_interval =
5940                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5941         params->dtim_period =
5942                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5943
5944         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5945                                            params->beacon_interval);
5946         if (err)
5947                 goto out;
5948
5949         /*
5950          * In theory, some of these attributes should be required here
5951          * but since they were not used when the command was originally
5952          * added, keep them optional for old user space programs to let
5953          * them continue to work with drivers that do not need the
5954          * additional information -- drivers must check!
5955          */
5956         if (info->attrs[NL80211_ATTR_SSID]) {
5957                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5958                 params->ssid_len =
5959                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5960                 if (params->ssid_len == 0) {
5961                         err = -EINVAL;
5962                         goto out;
5963                 }
5964
5965                 if (wdev->u.ap.ssid_len &&
5966                     (wdev->u.ap.ssid_len != params->ssid_len ||
5967                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5968                         /* require identical SSID for MLO */
5969                         err = -EINVAL;
5970                         goto out;
5971                 }
5972         } else if (wdev->valid_links) {
5973                 /* require SSID for MLO */
5974                 err = -EINVAL;
5975                 goto out;
5976         }
5977
5978         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5979                 params->hidden_ssid = nla_get_u32(
5980                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5981
5982         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5983
5984         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5985                 params->auth_type = nla_get_u32(
5986                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5987                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5988                                              NL80211_CMD_START_AP)) {
5989                         err = -EINVAL;
5990                         goto out;
5991                 }
5992         } else
5993                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5994
5995         err = nl80211_crypto_settings(rdev, info, &params->crypto,
5996                                       NL80211_MAX_NR_CIPHER_SUITES);
5997         if (err)
5998                 goto out;
5999
6000         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6001                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6002                         err = -EOPNOTSUPP;
6003                         goto out;
6004                 }
6005                 params->inactivity_timeout = nla_get_u16(
6006                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6007         }
6008
6009         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6010                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6011                         err = -EINVAL;
6012                         goto out;
6013                 }
6014                 params->p2p_ctwindow =
6015                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6016                 if (params->p2p_ctwindow != 0 &&
6017                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6018                         err = -EINVAL;
6019                         goto out;
6020                 }
6021         }
6022
6023         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6024                 u8 tmp;
6025
6026                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6027                         err = -EINVAL;
6028                         goto out;
6029                 }
6030                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6031                 params->p2p_opp_ps = tmp;
6032                 if (params->p2p_opp_ps != 0 &&
6033                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6034                         err = -EINVAL;
6035                         goto out;
6036                 }
6037         }
6038
6039         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6040                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6041                 if (err)
6042                         goto out;
6043         } else if (wdev->valid_links) {
6044                 /* with MLD need to specify the channel configuration */
6045                 err = -EINVAL;
6046                 goto out;
6047         } else if (wdev->u.ap.preset_chandef.chan) {
6048                 params->chandef = wdev->u.ap.preset_chandef;
6049         } else if (!nl80211_get_ap_channel(rdev, params)) {
6050                 err = -EINVAL;
6051                 goto out;
6052         }
6053
6054         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
6055                 err = nl80211_parse_punct_bitmap(rdev, info,
6056                                                  &params->chandef,
6057                                                  &params->punct_bitmap);
6058                 if (err)
6059                         goto out;
6060         }
6061
6062         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
6063                                            wdev->iftype)) {
6064                 err = -EINVAL;
6065                 goto out;
6066         }
6067
6068         wdev_lock(wdev);
6069
6070         if (info->attrs[NL80211_ATTR_TX_RATES]) {
6071                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6072                                                     NL80211_ATTR_TX_RATES,
6073                                                     &params->beacon_rate,
6074                                                     dev, false, link_id);
6075                 if (err)
6076                         goto out_unlock;
6077
6078                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6079                                               &params->beacon_rate);
6080                 if (err)
6081                         goto out_unlock;
6082         }
6083
6084         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6085                 params->smps_mode =
6086                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6087                 switch (params->smps_mode) {
6088                 case NL80211_SMPS_OFF:
6089                         break;
6090                 case NL80211_SMPS_STATIC:
6091                         if (!(rdev->wiphy.features &
6092                               NL80211_FEATURE_STATIC_SMPS)) {
6093                                 err = -EINVAL;
6094                                 goto out_unlock;
6095                         }
6096                         break;
6097                 case NL80211_SMPS_DYNAMIC:
6098                         if (!(rdev->wiphy.features &
6099                               NL80211_FEATURE_DYNAMIC_SMPS)) {
6100                                 err = -EINVAL;
6101                                 goto out_unlock;
6102                         }
6103                         break;
6104                 default:
6105                         err = -EINVAL;
6106                         goto out_unlock;
6107                 }
6108         } else {
6109                 params->smps_mode = NL80211_SMPS_OFF;
6110         }
6111
6112         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6113         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6114                 err = -EOPNOTSUPP;
6115                 goto out_unlock;
6116         }
6117
6118         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6119                 params->acl = parse_acl_data(&rdev->wiphy, info);
6120                 if (IS_ERR(params->acl)) {
6121                         err = PTR_ERR(params->acl);
6122                         params->acl = NULL;
6123                         goto out_unlock;
6124                 }
6125         }
6126
6127         params->twt_responder =
6128                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6129
6130         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6131                 err = nl80211_parse_he_obss_pd(
6132                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
6133                                         &params->he_obss_pd);
6134                 if (err)
6135                         goto out_unlock;
6136         }
6137
6138         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6139                 err = nl80211_parse_fils_discovery(rdev,
6140                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6141                                                    params);
6142                 if (err)
6143                         goto out_unlock;
6144         }
6145
6146         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6147                 err = nl80211_parse_unsol_bcast_probe_resp(
6148                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6149                         params);
6150                 if (err)
6151                         goto out_unlock;
6152         }
6153
6154         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6155                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6156                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6157                                                   &params->mbssid_config,
6158                                                   params->beacon.mbssid_ies ?
6159                                                         params->beacon.mbssid_ies->cnt :
6160                                                         0);
6161                 if (err)
6162                         goto out_unlock;
6163         }
6164
6165         if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6166                 err = -EINVAL;
6167                 goto out_unlock;
6168         }
6169
6170         err = nl80211_calculate_ap_params(params);
6171         if (err)
6172                 goto out_unlock;
6173
6174         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6175                 params->flags = nla_get_u32(
6176                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6177         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6178                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6179
6180         if (wdev->conn_owner_nlportid &&
6181             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6182             wdev->conn_owner_nlportid != info->snd_portid) {
6183                 err = -EINVAL;
6184                 goto out_unlock;
6185         }
6186
6187         /* FIXME: validate MLO/link-id against driver capabilities */
6188
6189         err = rdev_start_ap(rdev, dev, params);
6190         if (!err) {
6191                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6192                 wdev->links[link_id].ap.chandef = params->chandef;
6193                 wdev->u.ap.ssid_len = params->ssid_len;
6194                 memcpy(wdev->u.ap.ssid, params->ssid,
6195                        params->ssid_len);
6196
6197                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6198                         wdev->conn_owner_nlportid = info->snd_portid;
6199
6200                 nl80211_send_ap_started(wdev, link_id);
6201         }
6202 out_unlock:
6203         wdev_unlock(wdev);
6204 out:
6205         kfree(params->acl);
6206         kfree(params->beacon.mbssid_ies);
6207         if (params->mbssid_config.tx_wdev &&
6208             params->mbssid_config.tx_wdev->netdev &&
6209             params->mbssid_config.tx_wdev->netdev != dev)
6210                 dev_put(params->mbssid_config.tx_wdev->netdev);
6211         kfree(params->beacon.rnr_ies);
6212         kfree(params);
6213
6214         return err;
6215 }
6216
6217 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6218 {
6219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6220         unsigned int link_id = nl80211_link_id(info->attrs);
6221         struct net_device *dev = info->user_ptr[1];
6222         struct wireless_dev *wdev = dev->ieee80211_ptr;
6223         struct cfg80211_beacon_data params;
6224         int err;
6225
6226         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6227             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6228                 return -EOPNOTSUPP;
6229
6230         if (!rdev->ops->change_beacon)
6231                 return -EOPNOTSUPP;
6232
6233         if (!wdev->links[link_id].ap.beacon_interval)
6234                 return -EINVAL;
6235
6236         err = nl80211_parse_beacon(rdev, info->attrs, &params, info->extack);
6237         if (err)
6238                 goto out;
6239
6240         wdev_lock(wdev);
6241         err = rdev_change_beacon(rdev, dev, &params);
6242         wdev_unlock(wdev);
6243
6244 out:
6245         kfree(params.mbssid_ies);
6246         kfree(params.rnr_ies);
6247         return err;
6248 }
6249
6250 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6251 {
6252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6253         unsigned int link_id = nl80211_link_id(info->attrs);
6254         struct net_device *dev = info->user_ptr[1];
6255
6256         return cfg80211_stop_ap(rdev, dev, link_id, false);
6257 }
6258
6259 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6260         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6261         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6262         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6263         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6264         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6265         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6266 };
6267
6268 static int parse_station_flags(struct genl_info *info,
6269                                enum nl80211_iftype iftype,
6270                                struct station_parameters *params)
6271 {
6272         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6273         struct nlattr *nla;
6274         int flag;
6275
6276         /*
6277          * Try parsing the new attribute first so userspace
6278          * can specify both for older kernels.
6279          */
6280         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6281         if (nla) {
6282                 struct nl80211_sta_flag_update *sta_flags;
6283
6284                 sta_flags = nla_data(nla);
6285                 params->sta_flags_mask = sta_flags->mask;
6286                 params->sta_flags_set = sta_flags->set;
6287                 params->sta_flags_set &= params->sta_flags_mask;
6288                 if ((params->sta_flags_mask |
6289                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6290                         return -EINVAL;
6291                 return 0;
6292         }
6293
6294         /* if present, parse the old attribute */
6295
6296         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6297         if (!nla)
6298                 return 0;
6299
6300         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6301                 return -EINVAL;
6302
6303         /*
6304          * Only allow certain flags for interface types so that
6305          * other attributes are silently ignored. Remember that
6306          * this is backward compatibility code with old userspace
6307          * and shouldn't be hit in other cases anyway.
6308          */
6309         switch (iftype) {
6310         case NL80211_IFTYPE_AP:
6311         case NL80211_IFTYPE_AP_VLAN:
6312         case NL80211_IFTYPE_P2P_GO:
6313                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6314                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6315                                          BIT(NL80211_STA_FLAG_WME) |
6316                                          BIT(NL80211_STA_FLAG_MFP);
6317                 break;
6318         case NL80211_IFTYPE_P2P_CLIENT:
6319         case NL80211_IFTYPE_STATION:
6320                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6321                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6322                 break;
6323         case NL80211_IFTYPE_MESH_POINT:
6324                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6325                                          BIT(NL80211_STA_FLAG_MFP) |
6326                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6327                 break;
6328         default:
6329                 return -EINVAL;
6330         }
6331
6332         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6333                 if (flags[flag]) {
6334                         params->sta_flags_set |= (1<<flag);
6335
6336                         /* no longer support new API additions in old API */
6337                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6338                                 return -EINVAL;
6339                 }
6340         }
6341
6342         return 0;
6343 }
6344
6345 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6346 {
6347         struct nlattr *rate;
6348         u32 bitrate;
6349         u16 bitrate_compat;
6350         enum nl80211_rate_info rate_flg;
6351
6352         rate = nla_nest_start_noflag(msg, attr);
6353         if (!rate)
6354                 return false;
6355
6356         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6357         bitrate = cfg80211_calculate_bitrate(info);
6358         /* report 16-bit bitrate only if we can */
6359         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6360         if (bitrate > 0 &&
6361             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6362                 return false;
6363         if (bitrate_compat > 0 &&
6364             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6365                 return false;
6366
6367         switch (info->bw) {
6368         case RATE_INFO_BW_5:
6369                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6370                 break;
6371         case RATE_INFO_BW_10:
6372                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6373                 break;
6374         default:
6375                 WARN_ON(1);
6376                 fallthrough;
6377         case RATE_INFO_BW_20:
6378                 rate_flg = 0;
6379                 break;
6380         case RATE_INFO_BW_40:
6381                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6382                 break;
6383         case RATE_INFO_BW_80:
6384                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6385                 break;
6386         case RATE_INFO_BW_160:
6387                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6388                 break;
6389         case RATE_INFO_BW_HE_RU:
6390                 rate_flg = 0;
6391                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6392                 break;
6393         case RATE_INFO_BW_320:
6394                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6395                 break;
6396         case RATE_INFO_BW_EHT_RU:
6397                 rate_flg = 0;
6398                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6399                 break;
6400         }
6401
6402         if (rate_flg && nla_put_flag(msg, rate_flg))
6403                 return false;
6404
6405         if (info->flags & RATE_INFO_FLAGS_MCS) {
6406                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6407                         return false;
6408                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6409                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6410                         return false;
6411         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6412                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6413                         return false;
6414                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6415                         return false;
6416                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6417                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6418                         return false;
6419         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6420                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6421                         return false;
6422                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6423                         return false;
6424                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6425                         return false;
6426                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6427                         return false;
6428                 if (info->bw == RATE_INFO_BW_HE_RU &&
6429                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6430                                info->he_ru_alloc))
6431                         return false;
6432         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6433                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6434                         return false;
6435                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6436                         return false;
6437                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6438                         return false;
6439                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6440                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6441                                info->eht_ru_alloc))
6442                         return false;
6443         }
6444
6445         nla_nest_end(msg, rate);
6446         return true;
6447 }
6448
6449 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6450                                int id)
6451 {
6452         void *attr;
6453         int i = 0;
6454
6455         if (!mask)
6456                 return true;
6457
6458         attr = nla_nest_start_noflag(msg, id);
6459         if (!attr)
6460                 return false;
6461
6462         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6463                 if (!(mask & BIT(i)))
6464                         continue;
6465
6466                 if (nla_put_u8(msg, i, signal[i]))
6467                         return false;
6468         }
6469
6470         nla_nest_end(msg, attr);
6471
6472         return true;
6473 }
6474
6475 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6476                                 u32 seq, int flags,
6477                                 struct cfg80211_registered_device *rdev,
6478                                 struct net_device *dev,
6479                                 const u8 *mac_addr, struct station_info *sinfo)
6480 {
6481         void *hdr;
6482         struct nlattr *sinfoattr, *bss_param;
6483
6484         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6485         if (!hdr) {
6486                 cfg80211_sinfo_release_content(sinfo);
6487                 return -1;
6488         }
6489
6490         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6491             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6492             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6493                 goto nla_put_failure;
6494
6495         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6496         if (!sinfoattr)
6497                 goto nla_put_failure;
6498
6499 #define PUT_SINFO(attr, memb, type) do {                                \
6500         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6501         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6502             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6503                              sinfo->memb))                              \
6504                 goto nla_put_failure;                                   \
6505         } while (0)
6506 #define PUT_SINFO_U64(attr, memb) do {                                  \
6507         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6508             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6509                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6510                 goto nla_put_failure;                                   \
6511         } while (0)
6512
6513         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6514         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6515         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6516
6517         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6518                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6519             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6520                         (u32)sinfo->rx_bytes))
6521                 goto nla_put_failure;
6522
6523         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6524                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6525             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6526                         (u32)sinfo->tx_bytes))
6527                 goto nla_put_failure;
6528
6529         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6530         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6531         PUT_SINFO(LLID, llid, u16);
6532         PUT_SINFO(PLID, plid, u16);
6533         PUT_SINFO(PLINK_STATE, plink_state, u8);
6534         PUT_SINFO_U64(RX_DURATION, rx_duration);
6535         PUT_SINFO_U64(TX_DURATION, tx_duration);
6536
6537         if (wiphy_ext_feature_isset(&rdev->wiphy,
6538                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6539                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6540
6541         switch (rdev->wiphy.signal_type) {
6542         case CFG80211_SIGNAL_TYPE_MBM:
6543                 PUT_SINFO(SIGNAL, signal, u8);
6544                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6545                 break;
6546         default:
6547                 break;
6548         }
6549         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6550                 if (!nl80211_put_signal(msg, sinfo->chains,
6551                                         sinfo->chain_signal,
6552                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6553                         goto nla_put_failure;
6554         }
6555         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6556                 if (!nl80211_put_signal(msg, sinfo->chains,
6557                                         sinfo->chain_signal_avg,
6558                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6559                         goto nla_put_failure;
6560         }
6561         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6562                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6563                                           NL80211_STA_INFO_TX_BITRATE))
6564                         goto nla_put_failure;
6565         }
6566         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6567                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6568                                           NL80211_STA_INFO_RX_BITRATE))
6569                         goto nla_put_failure;
6570         }
6571
6572         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6573         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6574         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6575         PUT_SINFO(TX_FAILED, tx_failed, u32);
6576         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6577         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6578         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6579         PUT_SINFO(LOCAL_PM, local_pm, u32);
6580         PUT_SINFO(PEER_PM, peer_pm, u32);
6581         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6582         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6583         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6584
6585         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6586                 bss_param = nla_nest_start_noflag(msg,
6587                                                   NL80211_STA_INFO_BSS_PARAM);
6588                 if (!bss_param)
6589                         goto nla_put_failure;
6590
6591                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6592                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6593                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6594                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6595                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6596                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6597                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6598                                sinfo->bss_param.dtim_period) ||
6599                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6600                                 sinfo->bss_param.beacon_interval))
6601                         goto nla_put_failure;
6602
6603                 nla_nest_end(msg, bss_param);
6604         }
6605         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6606             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6607                     sizeof(struct nl80211_sta_flag_update),
6608                     &sinfo->sta_flags))
6609                 goto nla_put_failure;
6610
6611         PUT_SINFO_U64(T_OFFSET, t_offset);
6612         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6613         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6614         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6615         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6616         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6617         if (wiphy_ext_feature_isset(&rdev->wiphy,
6618                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6619                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6620                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6621         }
6622
6623 #undef PUT_SINFO
6624 #undef PUT_SINFO_U64
6625
6626         if (sinfo->pertid) {
6627                 struct nlattr *tidsattr;
6628                 int tid;
6629
6630                 tidsattr = nla_nest_start_noflag(msg,
6631                                                  NL80211_STA_INFO_TID_STATS);
6632                 if (!tidsattr)
6633                         goto nla_put_failure;
6634
6635                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6636                         struct cfg80211_tid_stats *tidstats;
6637                         struct nlattr *tidattr;
6638
6639                         tidstats = &sinfo->pertid[tid];
6640
6641                         if (!tidstats->filled)
6642                                 continue;
6643
6644                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6645                         if (!tidattr)
6646                                 goto nla_put_failure;
6647
6648 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6649         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6650             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6651                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6652                 goto nla_put_failure;                                   \
6653         } while (0)
6654
6655                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6656                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6657                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6658                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6659
6660 #undef PUT_TIDVAL_U64
6661                         if ((tidstats->filled &
6662                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6663                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6664                                                    NL80211_TID_STATS_TXQ_STATS))
6665                                 goto nla_put_failure;
6666
6667                         nla_nest_end(msg, tidattr);
6668                 }
6669
6670                 nla_nest_end(msg, tidsattr);
6671         }
6672
6673         nla_nest_end(msg, sinfoattr);
6674
6675         if (sinfo->assoc_req_ies_len &&
6676             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6677                     sinfo->assoc_req_ies))
6678                 goto nla_put_failure;
6679
6680         if (sinfo->assoc_resp_ies_len &&
6681             nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6682                     sinfo->assoc_resp_ies))
6683                 goto nla_put_failure;
6684
6685         if (sinfo->mlo_params_valid) {
6686                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6687                                sinfo->assoc_link_id))
6688                         goto nla_put_failure;
6689
6690                 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6691                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6692                             sinfo->mld_addr))
6693                         goto nla_put_failure;
6694         }
6695
6696         cfg80211_sinfo_release_content(sinfo);
6697         genlmsg_end(msg, hdr);
6698         return 0;
6699
6700  nla_put_failure:
6701         cfg80211_sinfo_release_content(sinfo);
6702         genlmsg_cancel(msg, hdr);
6703         return -EMSGSIZE;
6704 }
6705
6706 static int nl80211_dump_station(struct sk_buff *skb,
6707                                 struct netlink_callback *cb)
6708 {
6709         struct station_info sinfo;
6710         struct cfg80211_registered_device *rdev;
6711         struct wireless_dev *wdev;
6712         u8 mac_addr[ETH_ALEN];
6713         int sta_idx = cb->args[2];
6714         int err;
6715
6716         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6717         if (err)
6718                 return err;
6719         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6720         __acquire(&rdev->wiphy.mtx);
6721
6722         if (!wdev->netdev) {
6723                 err = -EINVAL;
6724                 goto out_err;
6725         }
6726
6727         if (!rdev->ops->dump_station) {
6728                 err = -EOPNOTSUPP;
6729                 goto out_err;
6730         }
6731
6732         while (1) {
6733                 memset(&sinfo, 0, sizeof(sinfo));
6734                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6735                                         mac_addr, &sinfo);
6736                 if (err == -ENOENT)
6737                         break;
6738                 if (err)
6739                         goto out_err;
6740
6741                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6742                                 NETLINK_CB(cb->skb).portid,
6743                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6744                                 rdev, wdev->netdev, mac_addr,
6745                                 &sinfo) < 0)
6746                         goto out;
6747
6748                 sta_idx++;
6749         }
6750
6751  out:
6752         cb->args[2] = sta_idx;
6753         err = skb->len;
6754  out_err:
6755         wiphy_unlock(&rdev->wiphy);
6756
6757         return err;
6758 }
6759
6760 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6761 {
6762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6763         struct net_device *dev = info->user_ptr[1];
6764         struct station_info sinfo;
6765         struct sk_buff *msg;
6766         u8 *mac_addr = NULL;
6767         int err;
6768
6769         memset(&sinfo, 0, sizeof(sinfo));
6770
6771         if (!info->attrs[NL80211_ATTR_MAC])
6772                 return -EINVAL;
6773
6774         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6775
6776         if (!rdev->ops->get_station)
6777                 return -EOPNOTSUPP;
6778
6779         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6780         if (err)
6781                 return err;
6782
6783         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6784         if (!msg) {
6785                 cfg80211_sinfo_release_content(&sinfo);
6786                 return -ENOMEM;
6787         }
6788
6789         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6790                                  info->snd_portid, info->snd_seq, 0,
6791                                  rdev, dev, mac_addr, &sinfo) < 0) {
6792                 nlmsg_free(msg);
6793                 return -ENOBUFS;
6794         }
6795
6796         return genlmsg_reply(msg, info);
6797 }
6798
6799 int cfg80211_check_station_change(struct wiphy *wiphy,
6800                                   struct station_parameters *params,
6801                                   enum cfg80211_station_type statype)
6802 {
6803         if (params->listen_interval != -1 &&
6804             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6805                 return -EINVAL;
6806
6807         if (params->support_p2p_ps != -1 &&
6808             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6809                 return -EINVAL;
6810
6811         if (params->aid &&
6812             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6813             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6814                 return -EINVAL;
6815
6816         /* When you run into this, adjust the code below for the new flag */
6817         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6818
6819         switch (statype) {
6820         case CFG80211_STA_MESH_PEER_KERNEL:
6821         case CFG80211_STA_MESH_PEER_USER:
6822                 /*
6823                  * No ignoring the TDLS flag here -- the userspace mesh
6824                  * code doesn't have the bug of including TDLS in the
6825                  * mask everywhere.
6826                  */
6827                 if (params->sta_flags_mask &
6828                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6829                                   BIT(NL80211_STA_FLAG_MFP) |
6830                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6831                         return -EINVAL;
6832                 break;
6833         case CFG80211_STA_TDLS_PEER_SETUP:
6834         case CFG80211_STA_TDLS_PEER_ACTIVE:
6835                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6836                         return -EINVAL;
6837                 /* ignore since it can't change */
6838                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6839                 break;
6840         default:
6841                 /* disallow mesh-specific things */
6842                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6843                         return -EINVAL;
6844                 if (params->local_pm)
6845                         return -EINVAL;
6846                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6847                         return -EINVAL;
6848         }
6849
6850         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6851             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6852                 /* TDLS can't be set, ... */
6853                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6854                         return -EINVAL;
6855                 /*
6856                  * ... but don't bother the driver with it. This works around
6857                  * a hostapd/wpa_supplicant issue -- it always includes the
6858                  * TLDS_PEER flag in the mask even for AP mode.
6859                  */
6860                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6861         }
6862
6863         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6864             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6865                 /* reject other things that can't change */
6866                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6867                         return -EINVAL;
6868                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6869                         return -EINVAL;
6870                 if (params->link_sta_params.supported_rates)
6871                         return -EINVAL;
6872                 if (params->ext_capab || params->link_sta_params.ht_capa ||
6873                     params->link_sta_params.vht_capa ||
6874                     params->link_sta_params.he_capa ||
6875                     params->link_sta_params.eht_capa)
6876                         return -EINVAL;
6877         }
6878
6879         if (statype != CFG80211_STA_AP_CLIENT &&
6880             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6881                 if (params->vlan)
6882                         return -EINVAL;
6883         }
6884
6885         switch (statype) {
6886         case CFG80211_STA_AP_MLME_CLIENT:
6887                 /* Use this only for authorizing/unauthorizing a station */
6888                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6889                         return -EOPNOTSUPP;
6890                 break;
6891         case CFG80211_STA_AP_CLIENT:
6892         case CFG80211_STA_AP_CLIENT_UNASSOC:
6893                 /* accept only the listed bits */
6894                 if (params->sta_flags_mask &
6895                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6896                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6897                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6898                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6899                                   BIT(NL80211_STA_FLAG_WME) |
6900                                   BIT(NL80211_STA_FLAG_MFP)))
6901                         return -EINVAL;
6902
6903                 /* but authenticated/associated only if driver handles it */
6904                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6905                     params->sta_flags_mask &
6906                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6907                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6908                         return -EINVAL;
6909                 break;
6910         case CFG80211_STA_IBSS:
6911         case CFG80211_STA_AP_STA:
6912                 /* reject any changes other than AUTHORIZED */
6913                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6914                         return -EINVAL;
6915                 break;
6916         case CFG80211_STA_TDLS_PEER_SETUP:
6917                 /* reject any changes other than AUTHORIZED or WME */
6918                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6919                                                BIT(NL80211_STA_FLAG_WME)))
6920                         return -EINVAL;
6921                 /* force (at least) rates when authorizing */
6922                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6923                     !params->link_sta_params.supported_rates)
6924                         return -EINVAL;
6925                 break;
6926         case CFG80211_STA_TDLS_PEER_ACTIVE:
6927                 /* reject any changes */
6928                 return -EINVAL;
6929         case CFG80211_STA_MESH_PEER_KERNEL:
6930                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6931                         return -EINVAL;
6932                 break;
6933         case CFG80211_STA_MESH_PEER_USER:
6934                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6935                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6936                         return -EINVAL;
6937                 break;
6938         }
6939
6940         /*
6941          * Older kernel versions ignored this attribute entirely, so don't
6942          * reject attempts to update it but mark it as unused instead so the
6943          * driver won't look at the data.
6944          */
6945         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6946             statype != CFG80211_STA_TDLS_PEER_SETUP)
6947                 params->link_sta_params.opmode_notif_used = false;
6948
6949         return 0;
6950 }
6951 EXPORT_SYMBOL(cfg80211_check_station_change);
6952
6953 /*
6954  * Get vlan interface making sure it is running and on the right wiphy.
6955  */
6956 static struct net_device *get_vlan(struct genl_info *info,
6957                                    struct cfg80211_registered_device *rdev)
6958 {
6959         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6960         struct net_device *v;
6961         int ret;
6962
6963         if (!vlanattr)
6964                 return NULL;
6965
6966         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6967         if (!v)
6968                 return ERR_PTR(-ENODEV);
6969
6970         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6971                 ret = -EINVAL;
6972                 goto error;
6973         }
6974
6975         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6976             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6977             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6978                 ret = -EINVAL;
6979                 goto error;
6980         }
6981
6982         if (!netif_running(v)) {
6983                 ret = -ENETDOWN;
6984                 goto error;
6985         }
6986
6987         return v;
6988  error:
6989         dev_put(v);
6990         return ERR_PTR(ret);
6991 }
6992
6993 static int nl80211_parse_sta_wme(struct genl_info *info,
6994                                  struct station_parameters *params)
6995 {
6996         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6997         struct nlattr *nla;
6998         int err;
6999
7000         /* parse WME attributes if present */
7001         if (!info->attrs[NL80211_ATTR_STA_WME])
7002                 return 0;
7003
7004         nla = info->attrs[NL80211_ATTR_STA_WME];
7005         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7006                                           nl80211_sta_wme_policy,
7007                                           info->extack);
7008         if (err)
7009                 return err;
7010
7011         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7012                 params->uapsd_queues = nla_get_u8(
7013                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
7014         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7015                 return -EINVAL;
7016
7017         if (tb[NL80211_STA_WME_MAX_SP])
7018                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7019
7020         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7021                 return -EINVAL;
7022
7023         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7024
7025         return 0;
7026 }
7027
7028 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7029                                       struct station_parameters *params)
7030 {
7031         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7032                 params->supported_channels =
7033                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7034                 params->supported_channels_len =
7035                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7036                 /*
7037                  * Need to include at least one (first channel, number of
7038                  * channels) tuple for each subband (checked in policy),
7039                  * and must have proper tuples for the rest of the data as well.
7040                  */
7041                 if (params->supported_channels_len % 2)
7042                         return -EINVAL;
7043         }
7044
7045         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7046                 params->supported_oper_classes =
7047                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7048                 params->supported_oper_classes_len =
7049                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7050         }
7051         return 0;
7052 }
7053
7054 static int nl80211_set_station_tdls(struct genl_info *info,
7055                                     struct station_parameters *params)
7056 {
7057         int err;
7058         /* Dummy STA entry gets updated once the peer capabilities are known */
7059         if (info->attrs[NL80211_ATTR_PEER_AID])
7060                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7061         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7062                 params->link_sta_params.ht_capa =
7063                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7064         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7065                 params->link_sta_params.vht_capa =
7066                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7067         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7068                 params->link_sta_params.he_capa =
7069                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7070                 params->link_sta_params.he_capa_len =
7071                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7072
7073                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7074                         params->link_sta_params.eht_capa =
7075                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7076                         params->link_sta_params.eht_capa_len =
7077                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7078
7079                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7080                                                         (const u8 *)params->link_sta_params.eht_capa,
7081                                                         params->link_sta_params.eht_capa_len,
7082                                                         false))
7083                                 return -EINVAL;
7084                 }
7085         }
7086
7087         err = nl80211_parse_sta_channel_info(info, params);
7088         if (err)
7089                 return err;
7090
7091         return nl80211_parse_sta_wme(info, params);
7092 }
7093
7094 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7095                                              struct sta_txpwr *txpwr,
7096                                              bool *txpwr_set)
7097 {
7098         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7099         int idx;
7100
7101         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7102                 if (!rdev->ops->set_tx_power ||
7103                     !wiphy_ext_feature_isset(&rdev->wiphy,
7104                                          NL80211_EXT_FEATURE_STA_TX_PWR))
7105                         return -EOPNOTSUPP;
7106
7107                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7108                 txpwr->type = nla_get_u8(info->attrs[idx]);
7109
7110                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7111                         idx = NL80211_ATTR_STA_TX_POWER;
7112
7113                         if (info->attrs[idx])
7114                                 txpwr->power = nla_get_s16(info->attrs[idx]);
7115                         else
7116                                 return -EINVAL;
7117                 }
7118
7119                 *txpwr_set = true;
7120         } else {
7121                 *txpwr_set = false;
7122         }
7123
7124         return 0;
7125 }
7126
7127 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7128 {
7129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7130         struct net_device *dev = info->user_ptr[1];
7131         struct station_parameters params;
7132         u8 *mac_addr;
7133         int err;
7134
7135         memset(&params, 0, sizeof(params));
7136
7137         if (!rdev->ops->change_station)
7138                 return -EOPNOTSUPP;
7139
7140         /*
7141          * AID and listen_interval properties can be set only for unassociated
7142          * station. Include these parameters here and will check them in
7143          * cfg80211_check_station_change().
7144          */
7145         if (info->attrs[NL80211_ATTR_STA_AID])
7146                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7147
7148         if (info->attrs[NL80211_ATTR_VLAN_ID])
7149                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7150
7151         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7152                 params.listen_interval =
7153                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7154         else
7155                 params.listen_interval = -1;
7156
7157         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7158                 params.support_p2p_ps =
7159                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7160         else
7161                 params.support_p2p_ps = -1;
7162
7163         if (!info->attrs[NL80211_ATTR_MAC])
7164                 return -EINVAL;
7165
7166         params.link_sta_params.link_id =
7167                 nl80211_link_id_or_invalid(info->attrs);
7168
7169         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7170                 /* If MLD_ADDR attribute is set then this is an MLD station
7171                  * and the MLD_ADDR attribute holds the MLD address and the
7172                  * MAC attribute holds for the LINK address.
7173                  * In that case, the link_id is also expected to be valid.
7174                  */
7175                 if (params.link_sta_params.link_id < 0)
7176                         return -EINVAL;
7177
7178                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7179                 params.link_sta_params.mld_mac = mac_addr;
7180                 params.link_sta_params.link_mac =
7181                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7182                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7183                         return -EINVAL;
7184         } else {
7185                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7186         }
7187
7188
7189         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7190                 params.link_sta_params.supported_rates =
7191                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7192                 params.link_sta_params.supported_rates_len =
7193                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7194         }
7195
7196         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7197                 params.capability =
7198                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7199                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7200         }
7201
7202         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7203                 params.ext_capab =
7204                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7205                 params.ext_capab_len =
7206                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7207         }
7208
7209         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7210                 return -EINVAL;
7211
7212         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7213                 params.plink_action =
7214                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7215
7216         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7217                 params.plink_state =
7218                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7219                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7220                         params.peer_aid = nla_get_u16(
7221                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7222                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7223         }
7224
7225         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7226                 params.local_pm = nla_get_u32(
7227                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7228
7229         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7230                 params.link_sta_params.opmode_notif_used = true;
7231                 params.link_sta_params.opmode_notif =
7232                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7233         }
7234
7235         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7236                 params.link_sta_params.he_6ghz_capa =
7237                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7238
7239         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7240                 params.airtime_weight =
7241                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7242
7243         if (params.airtime_weight &&
7244             !wiphy_ext_feature_isset(&rdev->wiphy,
7245                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7246                 return -EOPNOTSUPP;
7247
7248         err = nl80211_parse_sta_txpower_setting(info,
7249                                                 &params.link_sta_params.txpwr,
7250                                                 &params.link_sta_params.txpwr_set);
7251         if (err)
7252                 return err;
7253
7254         /* Include parameters for TDLS peer (will check later) */
7255         err = nl80211_set_station_tdls(info, &params);
7256         if (err)
7257                 return err;
7258
7259         params.vlan = get_vlan(info, rdev);
7260         if (IS_ERR(params.vlan))
7261                 return PTR_ERR(params.vlan);
7262
7263         switch (dev->ieee80211_ptr->iftype) {
7264         case NL80211_IFTYPE_AP:
7265         case NL80211_IFTYPE_AP_VLAN:
7266         case NL80211_IFTYPE_P2P_GO:
7267         case NL80211_IFTYPE_P2P_CLIENT:
7268         case NL80211_IFTYPE_STATION:
7269         case NL80211_IFTYPE_ADHOC:
7270         case NL80211_IFTYPE_MESH_POINT:
7271                 break;
7272         default:
7273                 err = -EOPNOTSUPP;
7274                 goto out_put_vlan;
7275         }
7276
7277         /* driver will call cfg80211_check_station_change() */
7278         wdev_lock(dev->ieee80211_ptr);
7279         err = rdev_change_station(rdev, dev, mac_addr, &params);
7280         wdev_unlock(dev->ieee80211_ptr);
7281
7282  out_put_vlan:
7283         dev_put(params.vlan);
7284
7285         return err;
7286 }
7287
7288 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7289 {
7290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7291         int err;
7292         struct net_device *dev = info->user_ptr[1];
7293         struct wireless_dev *wdev = dev->ieee80211_ptr;
7294         struct station_parameters params;
7295         u8 *mac_addr = NULL;
7296         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7297                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7298
7299         memset(&params, 0, sizeof(params));
7300
7301         if (!rdev->ops->add_station)
7302                 return -EOPNOTSUPP;
7303
7304         if (!info->attrs[NL80211_ATTR_MAC])
7305                 return -EINVAL;
7306
7307         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7308                 return -EINVAL;
7309
7310         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7311                 return -EINVAL;
7312
7313         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7314             !info->attrs[NL80211_ATTR_PEER_AID])
7315                 return -EINVAL;
7316
7317         params.link_sta_params.link_id =
7318                 nl80211_link_id_or_invalid(info->attrs);
7319
7320         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7321                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7322                 params.link_sta_params.mld_mac = mac_addr;
7323                 params.link_sta_params.link_mac =
7324                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7325                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7326                         return -EINVAL;
7327         } else {
7328                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7329         }
7330
7331         params.link_sta_params.supported_rates =
7332                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7333         params.link_sta_params.supported_rates_len =
7334                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7335         params.listen_interval =
7336                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7337
7338         if (info->attrs[NL80211_ATTR_VLAN_ID])
7339                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7340
7341         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7342                 params.support_p2p_ps =
7343                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7344         } else {
7345                 /*
7346                  * if not specified, assume it's supported for P2P GO interface,
7347                  * and is NOT supported for AP interface
7348                  */
7349                 params.support_p2p_ps =
7350                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7351         }
7352
7353         if (info->attrs[NL80211_ATTR_PEER_AID])
7354                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7355         else
7356                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7357
7358         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7359                 params.capability =
7360                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7361                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7362         }
7363
7364         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7365                 params.ext_capab =
7366                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7367                 params.ext_capab_len =
7368                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7369         }
7370
7371         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7372                 params.link_sta_params.ht_capa =
7373                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7374
7375         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7376                 params.link_sta_params.vht_capa =
7377                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7378
7379         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7380                 params.link_sta_params.he_capa =
7381                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7382                 params.link_sta_params.he_capa_len =
7383                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7384
7385                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7386                         params.link_sta_params.eht_capa =
7387                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7388                         params.link_sta_params.eht_capa_len =
7389                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7390
7391                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7392                                                         (const u8 *)params.link_sta_params.eht_capa,
7393                                                         params.link_sta_params.eht_capa_len,
7394                                                         false))
7395                                 return -EINVAL;
7396                 }
7397         }
7398
7399         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7400                 params.link_sta_params.he_6ghz_capa =
7401                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7402
7403         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7404                 params.link_sta_params.opmode_notif_used = true;
7405                 params.link_sta_params.opmode_notif =
7406                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7407         }
7408
7409         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7410                 params.plink_action =
7411                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7412
7413         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7414                 params.airtime_weight =
7415                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7416
7417         if (params.airtime_weight &&
7418             !wiphy_ext_feature_isset(&rdev->wiphy,
7419                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7420                 return -EOPNOTSUPP;
7421
7422         err = nl80211_parse_sta_txpower_setting(info,
7423                                                 &params.link_sta_params.txpwr,
7424                                                 &params.link_sta_params.txpwr_set);
7425         if (err)
7426                 return err;
7427
7428         err = nl80211_parse_sta_channel_info(info, &params);
7429         if (err)
7430                 return err;
7431
7432         err = nl80211_parse_sta_wme(info, &params);
7433         if (err)
7434                 return err;
7435
7436         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7437                 return -EINVAL;
7438
7439         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7440          * as userspace might just pass through the capabilities from the IEs
7441          * directly, rather than enforcing this restriction and returning an
7442          * error in this case.
7443          */
7444         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7445                 params.link_sta_params.ht_capa = NULL;
7446                 params.link_sta_params.vht_capa = NULL;
7447
7448                 /* HE and EHT require WME */
7449                 if (params.link_sta_params.he_capa_len ||
7450                     params.link_sta_params.he_6ghz_capa ||
7451                     params.link_sta_params.eht_capa_len)
7452                         return -EINVAL;
7453         }
7454
7455         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7456         if (params.link_sta_params.he_6ghz_capa &&
7457             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7458                 return -EINVAL;
7459
7460         /* When you run into this, adjust the code below for the new flag */
7461         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7462
7463         switch (dev->ieee80211_ptr->iftype) {
7464         case NL80211_IFTYPE_AP:
7465         case NL80211_IFTYPE_AP_VLAN:
7466         case NL80211_IFTYPE_P2P_GO:
7467                 /* ignore WME attributes if iface/sta is not capable */
7468                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7469                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7470                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7471
7472                 /* TDLS peers cannot be added */
7473                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7474                     info->attrs[NL80211_ATTR_PEER_AID])
7475                         return -EINVAL;
7476                 /* but don't bother the driver with it */
7477                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7478
7479                 /* allow authenticated/associated only if driver handles it */
7480                 if (!(rdev->wiphy.features &
7481                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7482                     params.sta_flags_mask & auth_assoc)
7483                         return -EINVAL;
7484
7485                 /* Older userspace, or userspace wanting to be compatible with
7486                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7487                  * and assoc flags in the mask, but assumes the station will be
7488                  * added as associated anyway since this was the required driver
7489                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7490                  * introduced.
7491                  * In order to not bother drivers with this quirk in the API
7492                  * set the flags in both the mask and set for new stations in
7493                  * this case.
7494                  */
7495                 if (!(params.sta_flags_mask & auth_assoc)) {
7496                         params.sta_flags_mask |= auth_assoc;
7497                         params.sta_flags_set |= auth_assoc;
7498                 }
7499
7500                 /* must be last in here for error handling */
7501                 params.vlan = get_vlan(info, rdev);
7502                 if (IS_ERR(params.vlan))
7503                         return PTR_ERR(params.vlan);
7504                 break;
7505         case NL80211_IFTYPE_MESH_POINT:
7506                 /* ignore uAPSD data */
7507                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7508
7509                 /* associated is disallowed */
7510                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7511                         return -EINVAL;
7512                 /* TDLS peers cannot be added */
7513                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7514                     info->attrs[NL80211_ATTR_PEER_AID])
7515                         return -EINVAL;
7516                 break;
7517         case NL80211_IFTYPE_STATION:
7518         case NL80211_IFTYPE_P2P_CLIENT:
7519                 /* ignore uAPSD data */
7520                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7521
7522                 /* these are disallowed */
7523                 if (params.sta_flags_mask &
7524                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7525                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7526                         return -EINVAL;
7527                 /* Only TDLS peers can be added */
7528                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7529                         return -EINVAL;
7530                 /* Can only add if TDLS ... */
7531                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7532                         return -EOPNOTSUPP;
7533                 /* ... with external setup is supported */
7534                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7535                         return -EOPNOTSUPP;
7536                 /*
7537                  * Older wpa_supplicant versions always mark the TDLS peer
7538                  * as authorized, but it shouldn't yet be.
7539                  */
7540                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7541                 break;
7542         default:
7543                 return -EOPNOTSUPP;
7544         }
7545
7546         /* be aware of params.vlan when changing code here */
7547
7548         wdev_lock(dev->ieee80211_ptr);
7549         if (wdev->valid_links) {
7550                 if (params.link_sta_params.link_id < 0) {
7551                         err = -EINVAL;
7552                         goto out;
7553                 }
7554                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7555                         err = -ENOLINK;
7556                         goto out;
7557                 }
7558         } else {
7559                 if (params.link_sta_params.link_id >= 0) {
7560                         err = -EINVAL;
7561                         goto out;
7562                 }
7563         }
7564         err = rdev_add_station(rdev, dev, mac_addr, &params);
7565 out:
7566         wdev_unlock(dev->ieee80211_ptr);
7567         dev_put(params.vlan);
7568         return err;
7569 }
7570
7571 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7572 {
7573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7574         struct net_device *dev = info->user_ptr[1];
7575         struct station_del_parameters params;
7576         int ret;
7577
7578         memset(&params, 0, sizeof(params));
7579
7580         if (info->attrs[NL80211_ATTR_MAC])
7581                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7582
7583         switch (dev->ieee80211_ptr->iftype) {
7584         case NL80211_IFTYPE_AP:
7585         case NL80211_IFTYPE_AP_VLAN:
7586         case NL80211_IFTYPE_MESH_POINT:
7587         case NL80211_IFTYPE_P2P_GO:
7588                 /* always accept these */
7589                 break;
7590         case NL80211_IFTYPE_ADHOC:
7591                 /* conditionally accept */
7592                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7593                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7594                         break;
7595                 return -EINVAL;
7596         default:
7597                 return -EINVAL;
7598         }
7599
7600         if (!rdev->ops->del_station)
7601                 return -EOPNOTSUPP;
7602
7603         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7604                 params.subtype =
7605                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7606                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7607                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7608                         return -EINVAL;
7609         } else {
7610                 /* Default to Deauthentication frame */
7611                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7612         }
7613
7614         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7615                 params.reason_code =
7616                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7617                 if (params.reason_code == 0)
7618                         return -EINVAL; /* 0 is reserved */
7619         } else {
7620                 /* Default to reason code 2 */
7621                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7622         }
7623
7624         wdev_lock(dev->ieee80211_ptr);
7625         ret = rdev_del_station(rdev, dev, &params);
7626         wdev_unlock(dev->ieee80211_ptr);
7627
7628         return ret;
7629 }
7630
7631 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7632                                 int flags, struct net_device *dev,
7633                                 u8 *dst, u8 *next_hop,
7634                                 struct mpath_info *pinfo)
7635 {
7636         void *hdr;
7637         struct nlattr *pinfoattr;
7638
7639         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7640         if (!hdr)
7641                 return -1;
7642
7643         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7644             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7645             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7646             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7647                 goto nla_put_failure;
7648
7649         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7650         if (!pinfoattr)
7651                 goto nla_put_failure;
7652         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7653             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7654                         pinfo->frame_qlen))
7655                 goto nla_put_failure;
7656         if (((pinfo->filled & MPATH_INFO_SN) &&
7657              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7658             ((pinfo->filled & MPATH_INFO_METRIC) &&
7659              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7660                          pinfo->metric)) ||
7661             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7662              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7663                          pinfo->exptime)) ||
7664             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7665              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7666                         pinfo->flags)) ||
7667             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7668              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7669                          pinfo->discovery_timeout)) ||
7670             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7671              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7672                         pinfo->discovery_retries)) ||
7673             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7674              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7675                         pinfo->hop_count)) ||
7676             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7677              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7678                          pinfo->path_change_count)))
7679                 goto nla_put_failure;
7680
7681         nla_nest_end(msg, pinfoattr);
7682
7683         genlmsg_end(msg, hdr);
7684         return 0;
7685
7686  nla_put_failure:
7687         genlmsg_cancel(msg, hdr);
7688         return -EMSGSIZE;
7689 }
7690
7691 static int nl80211_dump_mpath(struct sk_buff *skb,
7692                               struct netlink_callback *cb)
7693 {
7694         struct mpath_info pinfo;
7695         struct cfg80211_registered_device *rdev;
7696         struct wireless_dev *wdev;
7697         u8 dst[ETH_ALEN];
7698         u8 next_hop[ETH_ALEN];
7699         int path_idx = cb->args[2];
7700         int err;
7701
7702         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7703         if (err)
7704                 return err;
7705         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7706         __acquire(&rdev->wiphy.mtx);
7707
7708         if (!rdev->ops->dump_mpath) {
7709                 err = -EOPNOTSUPP;
7710                 goto out_err;
7711         }
7712
7713         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7714                 err = -EOPNOTSUPP;
7715                 goto out_err;
7716         }
7717
7718         while (1) {
7719                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7720                                       next_hop, &pinfo);
7721                 if (err == -ENOENT)
7722                         break;
7723                 if (err)
7724                         goto out_err;
7725
7726                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7727                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7728                                        wdev->netdev, dst, next_hop,
7729                                        &pinfo) < 0)
7730                         goto out;
7731
7732                 path_idx++;
7733         }
7734
7735  out:
7736         cb->args[2] = path_idx;
7737         err = skb->len;
7738  out_err:
7739         wiphy_unlock(&rdev->wiphy);
7740         return err;
7741 }
7742
7743 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7744 {
7745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7746         int err;
7747         struct net_device *dev = info->user_ptr[1];
7748         struct mpath_info pinfo;
7749         struct sk_buff *msg;
7750         u8 *dst = NULL;
7751         u8 next_hop[ETH_ALEN];
7752
7753         memset(&pinfo, 0, sizeof(pinfo));
7754
7755         if (!info->attrs[NL80211_ATTR_MAC])
7756                 return -EINVAL;
7757
7758         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7759
7760         if (!rdev->ops->get_mpath)
7761                 return -EOPNOTSUPP;
7762
7763         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7764                 return -EOPNOTSUPP;
7765
7766         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7767         if (err)
7768                 return err;
7769
7770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7771         if (!msg)
7772                 return -ENOMEM;
7773
7774         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7775                                  dev, dst, next_hop, &pinfo) < 0) {
7776                 nlmsg_free(msg);
7777                 return -ENOBUFS;
7778         }
7779
7780         return genlmsg_reply(msg, info);
7781 }
7782
7783 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7784 {
7785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7786         struct net_device *dev = info->user_ptr[1];
7787         u8 *dst = NULL;
7788         u8 *next_hop = NULL;
7789
7790         if (!info->attrs[NL80211_ATTR_MAC])
7791                 return -EINVAL;
7792
7793         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7794                 return -EINVAL;
7795
7796         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7797         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7798
7799         if (!rdev->ops->change_mpath)
7800                 return -EOPNOTSUPP;
7801
7802         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7803                 return -EOPNOTSUPP;
7804
7805         return rdev_change_mpath(rdev, dev, dst, next_hop);
7806 }
7807
7808 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7809 {
7810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7811         struct net_device *dev = info->user_ptr[1];
7812         u8 *dst = NULL;
7813         u8 *next_hop = NULL;
7814
7815         if (!info->attrs[NL80211_ATTR_MAC])
7816                 return -EINVAL;
7817
7818         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7819                 return -EINVAL;
7820
7821         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7822         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7823
7824         if (!rdev->ops->add_mpath)
7825                 return -EOPNOTSUPP;
7826
7827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7828                 return -EOPNOTSUPP;
7829
7830         return rdev_add_mpath(rdev, dev, dst, next_hop);
7831 }
7832
7833 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7834 {
7835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7836         struct net_device *dev = info->user_ptr[1];
7837         u8 *dst = NULL;
7838
7839         if (info->attrs[NL80211_ATTR_MAC])
7840                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7841
7842         if (!rdev->ops->del_mpath)
7843                 return -EOPNOTSUPP;
7844
7845         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7846                 return -EOPNOTSUPP;
7847
7848         return rdev_del_mpath(rdev, dev, dst);
7849 }
7850
7851 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7852 {
7853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7854         int err;
7855         struct net_device *dev = info->user_ptr[1];
7856         struct mpath_info pinfo;
7857         struct sk_buff *msg;
7858         u8 *dst = NULL;
7859         u8 mpp[ETH_ALEN];
7860
7861         memset(&pinfo, 0, sizeof(pinfo));
7862
7863         if (!info->attrs[NL80211_ATTR_MAC])
7864                 return -EINVAL;
7865
7866         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7867
7868         if (!rdev->ops->get_mpp)
7869                 return -EOPNOTSUPP;
7870
7871         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7872                 return -EOPNOTSUPP;
7873
7874         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7875         if (err)
7876                 return err;
7877
7878         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7879         if (!msg)
7880                 return -ENOMEM;
7881
7882         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7883                                dev, dst, mpp, &pinfo) < 0) {
7884                 nlmsg_free(msg);
7885                 return -ENOBUFS;
7886         }
7887
7888         return genlmsg_reply(msg, info);
7889 }
7890
7891 static int nl80211_dump_mpp(struct sk_buff *skb,
7892                             struct netlink_callback *cb)
7893 {
7894         struct mpath_info pinfo;
7895         struct cfg80211_registered_device *rdev;
7896         struct wireless_dev *wdev;
7897         u8 dst[ETH_ALEN];
7898         u8 mpp[ETH_ALEN];
7899         int path_idx = cb->args[2];
7900         int err;
7901
7902         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7903         if (err)
7904                 return err;
7905         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7906         __acquire(&rdev->wiphy.mtx);
7907
7908         if (!rdev->ops->dump_mpp) {
7909                 err = -EOPNOTSUPP;
7910                 goto out_err;
7911         }
7912
7913         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7914                 err = -EOPNOTSUPP;
7915                 goto out_err;
7916         }
7917
7918         while (1) {
7919                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7920                                     mpp, &pinfo);
7921                 if (err == -ENOENT)
7922                         break;
7923                 if (err)
7924                         goto out_err;
7925
7926                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7927                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7928                                        wdev->netdev, dst, mpp,
7929                                        &pinfo) < 0)
7930                         goto out;
7931
7932                 path_idx++;
7933         }
7934
7935  out:
7936         cb->args[2] = path_idx;
7937         err = skb->len;
7938  out_err:
7939         wiphy_unlock(&rdev->wiphy);
7940         return err;
7941 }
7942
7943 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7944 {
7945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7946         struct net_device *dev = info->user_ptr[1];
7947         struct wireless_dev *wdev = dev->ieee80211_ptr;
7948         struct bss_parameters params;
7949         int err;
7950
7951         memset(&params, 0, sizeof(params));
7952         params.link_id = nl80211_link_id_or_invalid(info->attrs);
7953         /* default to not changing parameters */
7954         params.use_cts_prot = -1;
7955         params.use_short_preamble = -1;
7956         params.use_short_slot_time = -1;
7957         params.ap_isolate = -1;
7958         params.ht_opmode = -1;
7959         params.p2p_ctwindow = -1;
7960         params.p2p_opp_ps = -1;
7961
7962         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7963                 params.use_cts_prot =
7964                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7965         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7966                 params.use_short_preamble =
7967                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7968         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7969                 params.use_short_slot_time =
7970                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7971         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7972                 params.basic_rates =
7973                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7974                 params.basic_rates_len =
7975                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7976         }
7977         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7978                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7979         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7980                 params.ht_opmode =
7981                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7982
7983         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7984                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7985                         return -EINVAL;
7986                 params.p2p_ctwindow =
7987                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7988                 if (params.p2p_ctwindow != 0 &&
7989                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7990                         return -EINVAL;
7991         }
7992
7993         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7994                 u8 tmp;
7995
7996                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7997                         return -EINVAL;
7998                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7999                 params.p2p_opp_ps = tmp;
8000                 if (params.p2p_opp_ps &&
8001                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8002                         return -EINVAL;
8003         }
8004
8005         if (!rdev->ops->change_bss)
8006                 return -EOPNOTSUPP;
8007
8008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8009             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8010                 return -EOPNOTSUPP;
8011
8012         wdev_lock(wdev);
8013         err = rdev_change_bss(rdev, dev, &params);
8014         wdev_unlock(wdev);
8015
8016         return err;
8017 }
8018
8019 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8020 {
8021         char *data = NULL;
8022         bool is_indoor;
8023         enum nl80211_user_reg_hint_type user_reg_hint_type;
8024         u32 owner_nlportid;
8025
8026         /*
8027          * You should only get this when cfg80211 hasn't yet initialized
8028          * completely when built-in to the kernel right between the time
8029          * window between nl80211_init() and regulatory_init(), if that is
8030          * even possible.
8031          */
8032         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8033                 return -EINPROGRESS;
8034
8035         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8036                 user_reg_hint_type =
8037                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8038         else
8039                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8040
8041         switch (user_reg_hint_type) {
8042         case NL80211_USER_REG_HINT_USER:
8043         case NL80211_USER_REG_HINT_CELL_BASE:
8044                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8045                         return -EINVAL;
8046
8047                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8048                 return regulatory_hint_user(data, user_reg_hint_type);
8049         case NL80211_USER_REG_HINT_INDOOR:
8050                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8051                         owner_nlportid = info->snd_portid;
8052                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8053                 } else {
8054                         owner_nlportid = 0;
8055                         is_indoor = true;
8056                 }
8057
8058                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
8059         default:
8060                 return -EINVAL;
8061         }
8062 }
8063
8064 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8065 {
8066         return reg_reload_regdb();
8067 }
8068
8069 static int nl80211_get_mesh_config(struct sk_buff *skb,
8070                                    struct genl_info *info)
8071 {
8072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8073         struct net_device *dev = info->user_ptr[1];
8074         struct wireless_dev *wdev = dev->ieee80211_ptr;
8075         struct mesh_config cur_params;
8076         int err = 0;
8077         void *hdr;
8078         struct nlattr *pinfoattr;
8079         struct sk_buff *msg;
8080
8081         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8082                 return -EOPNOTSUPP;
8083
8084         if (!rdev->ops->get_mesh_config)
8085                 return -EOPNOTSUPP;
8086
8087         wdev_lock(wdev);
8088         /* If not connected, get default parameters */
8089         if (!wdev->u.mesh.id_len)
8090                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8091         else
8092                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8093         wdev_unlock(wdev);
8094
8095         if (err)
8096                 return err;
8097
8098         /* Draw up a netlink message to send back */
8099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8100         if (!msg)
8101                 return -ENOMEM;
8102         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8103                              NL80211_CMD_GET_MESH_CONFIG);
8104         if (!hdr)
8105                 goto out;
8106         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8107         if (!pinfoattr)
8108                 goto nla_put_failure;
8109         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8110             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8111                         cur_params.dot11MeshRetryTimeout) ||
8112             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8113                         cur_params.dot11MeshConfirmTimeout) ||
8114             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8115                         cur_params.dot11MeshHoldingTimeout) ||
8116             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8117                         cur_params.dot11MeshMaxPeerLinks) ||
8118             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8119                        cur_params.dot11MeshMaxRetries) ||
8120             nla_put_u8(msg, NL80211_MESHCONF_TTL,
8121                        cur_params.dot11MeshTTL) ||
8122             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8123                        cur_params.element_ttl) ||
8124             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8125                        cur_params.auto_open_plinks) ||
8126             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8127                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8128             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8129                        cur_params.dot11MeshHWMPmaxPREQretries) ||
8130             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8131                         cur_params.path_refresh_time) ||
8132             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8133                         cur_params.min_discovery_timeout) ||
8134             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8135                         cur_params.dot11MeshHWMPactivePathTimeout) ||
8136             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8137                         cur_params.dot11MeshHWMPpreqMinInterval) ||
8138             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8139                         cur_params.dot11MeshHWMPperrMinInterval) ||
8140             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8141                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8142             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8143                        cur_params.dot11MeshHWMPRootMode) ||
8144             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8145                         cur_params.dot11MeshHWMPRannInterval) ||
8146             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8147                        cur_params.dot11MeshGateAnnouncementProtocol) ||
8148             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8149                        cur_params.dot11MeshForwarding) ||
8150             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8151                         cur_params.rssi_threshold) ||
8152             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8153                         cur_params.ht_opmode) ||
8154             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8155                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8156             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8157                         cur_params.dot11MeshHWMProotInterval) ||
8158             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8159                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8160             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8161                         cur_params.power_mode) ||
8162             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8163                         cur_params.dot11MeshAwakeWindowDuration) ||
8164             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8165                         cur_params.plink_timeout) ||
8166             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8167                        cur_params.dot11MeshConnectedToMeshGate) ||
8168             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8169                        cur_params.dot11MeshNolearn) ||
8170             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8171                        cur_params.dot11MeshConnectedToAuthServer))
8172                 goto nla_put_failure;
8173         nla_nest_end(msg, pinfoattr);
8174         genlmsg_end(msg, hdr);
8175         return genlmsg_reply(msg, info);
8176
8177  nla_put_failure:
8178  out:
8179         nlmsg_free(msg);
8180         return -ENOBUFS;
8181 }
8182
8183 static const struct nla_policy
8184 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8185         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8186                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8187         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8188                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8189         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8190                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8191         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8192                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8193         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8194         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8195         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8196         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8197         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8198                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8199         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8200         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8201         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8202         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8203         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8204                 NLA_POLICY_MIN(NLA_U16, 1),
8205         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8206                 NLA_POLICY_MIN(NLA_U16, 1),
8207         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8208                 NLA_POLICY_MIN(NLA_U16, 1),
8209         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8210         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8211                 NLA_POLICY_MIN(NLA_U16, 1),
8212         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8213         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8214         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8215                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8216         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8217         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8218         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8219                 NLA_POLICY_MIN(NLA_U16, 1),
8220         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8221                 NLA_POLICY_MIN(NLA_U16, 1),
8222         [NL80211_MESHCONF_POWER_MODE] =
8223                 NLA_POLICY_RANGE(NLA_U32,
8224                                  NL80211_MESH_POWER_ACTIVE,
8225                                  NL80211_MESH_POWER_MAX),
8226         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8227         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8228         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8229         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8230         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8231 };
8232
8233 static const struct nla_policy
8234         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8235         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8236         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8237         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8238         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8239         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8240         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8241         [NL80211_MESH_SETUP_IE] =
8242                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8243                                        IEEE80211_MAX_DATA_LEN),
8244         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8245 };
8246
8247 static int nl80211_parse_mesh_config(struct genl_info *info,
8248                                      struct mesh_config *cfg,
8249                                      u32 *mask_out)
8250 {
8251         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8252         u32 mask = 0;
8253         u16 ht_opmode;
8254
8255 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8256 do {                                                                    \
8257         if (tb[attr]) {                                                 \
8258                 cfg->param = fn(tb[attr]);                              \
8259                 mask |= BIT((attr) - 1);                                \
8260         }                                                               \
8261 } while (0)
8262
8263         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8264                 return -EINVAL;
8265         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8266                 return -EINVAL;
8267
8268         /* This makes sure that there aren't more than 32 mesh config
8269          * parameters (otherwise our bitfield scheme would not work.) */
8270         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8271
8272         /* Fill in the params struct */
8273         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8274                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8275         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8276                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8277                                   nla_get_u16);
8278         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8279                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8280                                   nla_get_u16);
8281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8282                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8283                                   nla_get_u16);
8284         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8285                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8286         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8287                                   NL80211_MESHCONF_TTL, nla_get_u8);
8288         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8289                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8291                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8292                                   nla_get_u8);
8293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8294                                   mask,
8295                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8296                                   nla_get_u32);
8297         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8298                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8299                                   nla_get_u8);
8300         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8301                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8302                                   nla_get_u32);
8303         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8304             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8305                 return -EINVAL;
8306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8307                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8308                                   nla_get_u16);
8309         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8310                                   mask,
8311                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8312                                   nla_get_u32);
8313         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8314             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8315              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8316                 return -EINVAL;
8317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8318                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8319                                   nla_get_u16);
8320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8321                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8322                                   nla_get_u16);
8323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8324                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8325                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8326                                   nla_get_u16);
8327         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8328                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8329         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8330                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8331                                   nla_get_u16);
8332         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8333                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8334                                   nla_get_u8);
8335         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8336                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8337         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8338                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8339                                   nla_get_s32);
8340         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8341                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8342                                   nla_get_u8);
8343         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8344                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8345                                   nla_get_u8);
8346         /*
8347          * Check HT operation mode based on
8348          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8349          */
8350         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8351                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8352
8353                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8354                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8355                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8356                         return -EINVAL;
8357
8358                 /* NON_HT_STA bit is reserved, but some programs set it */
8359                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8360
8361                 cfg->ht_opmode = ht_opmode;
8362                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8363         }
8364         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8365                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8366                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8367                                   nla_get_u32);
8368         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8369             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8370              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8371                 return -EINVAL;
8372         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8373                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8374                                   nla_get_u16);
8375         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8376                                   mask,
8377                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8378                                   nla_get_u16);
8379         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8380                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8381         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8382                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8383         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8384                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8385         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8386                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8387         if (mask_out)
8388                 *mask_out = mask;
8389
8390         return 0;
8391
8392 #undef FILL_IN_MESH_PARAM_IF_SET
8393 }
8394
8395 static int nl80211_parse_mesh_setup(struct genl_info *info,
8396                                      struct mesh_setup *setup)
8397 {
8398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8399         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8400
8401         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8402                 return -EINVAL;
8403         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8404                 return -EINVAL;
8405
8406         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8407                 setup->sync_method =
8408                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8409                  IEEE80211_SYNC_METHOD_VENDOR :
8410                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8411
8412         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8413                 setup->path_sel_proto =
8414                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8415                  IEEE80211_PATH_PROTOCOL_VENDOR :
8416                  IEEE80211_PATH_PROTOCOL_HWMP;
8417
8418         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8419                 setup->path_metric =
8420                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8421                  IEEE80211_PATH_METRIC_VENDOR :
8422                  IEEE80211_PATH_METRIC_AIRTIME;
8423
8424         if (tb[NL80211_MESH_SETUP_IE]) {
8425                 struct nlattr *ieattr =
8426                         tb[NL80211_MESH_SETUP_IE];
8427                 setup->ie = nla_data(ieattr);
8428                 setup->ie_len = nla_len(ieattr);
8429         }
8430         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8431             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8432                 return -EINVAL;
8433         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8434         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8435         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8436         if (setup->is_secure)
8437                 setup->user_mpm = true;
8438
8439         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8440                 if (!setup->user_mpm)
8441                         return -EINVAL;
8442                 setup->auth_id =
8443                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8444         }
8445
8446         return 0;
8447 }
8448
8449 static int nl80211_update_mesh_config(struct sk_buff *skb,
8450                                       struct genl_info *info)
8451 {
8452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8453         struct net_device *dev = info->user_ptr[1];
8454         struct wireless_dev *wdev = dev->ieee80211_ptr;
8455         struct mesh_config cfg;
8456         u32 mask;
8457         int err;
8458
8459         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8460                 return -EOPNOTSUPP;
8461
8462         if (!rdev->ops->update_mesh_config)
8463                 return -EOPNOTSUPP;
8464
8465         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8466         if (err)
8467                 return err;
8468
8469         wdev_lock(wdev);
8470         if (!wdev->u.mesh.id_len)
8471                 err = -ENOLINK;
8472
8473         if (!err)
8474                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8475
8476         wdev_unlock(wdev);
8477
8478         return err;
8479 }
8480
8481 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8482                               struct sk_buff *msg)
8483 {
8484         struct nlattr *nl_reg_rules;
8485         unsigned int i;
8486
8487         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8488             (regdom->dfs_region &&
8489              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8490                 goto nla_put_failure;
8491
8492         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8493         if (!nl_reg_rules)
8494                 goto nla_put_failure;
8495
8496         for (i = 0; i < regdom->n_reg_rules; i++) {
8497                 struct nlattr *nl_reg_rule;
8498                 const struct ieee80211_reg_rule *reg_rule;
8499                 const struct ieee80211_freq_range *freq_range;
8500                 const struct ieee80211_power_rule *power_rule;
8501                 unsigned int max_bandwidth_khz;
8502
8503                 reg_rule = &regdom->reg_rules[i];
8504                 freq_range = &reg_rule->freq_range;
8505                 power_rule = &reg_rule->power_rule;
8506
8507                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8508                 if (!nl_reg_rule)
8509                         goto nla_put_failure;
8510
8511                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8512                 if (!max_bandwidth_khz)
8513                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8514                                                                   reg_rule);
8515
8516                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8517                                 reg_rule->flags) ||
8518                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8519                                 freq_range->start_freq_khz) ||
8520                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8521                                 freq_range->end_freq_khz) ||
8522                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8523                                 max_bandwidth_khz) ||
8524                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8525                                 power_rule->max_antenna_gain) ||
8526                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8527                                 power_rule->max_eirp) ||
8528                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8529                                 reg_rule->dfs_cac_ms))
8530                         goto nla_put_failure;
8531
8532                 nla_nest_end(msg, nl_reg_rule);
8533         }
8534
8535         nla_nest_end(msg, nl_reg_rules);
8536         return 0;
8537
8538 nla_put_failure:
8539         return -EMSGSIZE;
8540 }
8541
8542 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8543 {
8544         const struct ieee80211_regdomain *regdom = NULL;
8545         struct cfg80211_registered_device *rdev;
8546         struct wiphy *wiphy = NULL;
8547         struct sk_buff *msg;
8548         int err = -EMSGSIZE;
8549         void *hdr;
8550
8551         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8552         if (!msg)
8553                 return -ENOBUFS;
8554
8555         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8556                              NL80211_CMD_GET_REG);
8557         if (!hdr)
8558                 goto put_failure;
8559
8560         rtnl_lock();
8561
8562         if (info->attrs[NL80211_ATTR_WIPHY]) {
8563                 bool self_managed;
8564
8565                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8566                 if (IS_ERR(rdev)) {
8567                         err = PTR_ERR(rdev);
8568                         goto nla_put_failure;
8569                 }
8570
8571                 wiphy = &rdev->wiphy;
8572                 self_managed = wiphy->regulatory_flags &
8573                                REGULATORY_WIPHY_SELF_MANAGED;
8574
8575                 rcu_read_lock();
8576
8577                 regdom = get_wiphy_regdom(wiphy);
8578
8579                 /* a self-managed-reg device must have a private regdom */
8580                 if (WARN_ON(!regdom && self_managed)) {
8581                         err = -EINVAL;
8582                         goto nla_put_failure_rcu;
8583                 }
8584
8585                 if (regdom &&
8586                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8587                         goto nla_put_failure_rcu;
8588         } else {
8589                 rcu_read_lock();
8590         }
8591
8592         if (!wiphy && reg_last_request_cell_base() &&
8593             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8594                         NL80211_USER_REG_HINT_CELL_BASE))
8595                 goto nla_put_failure_rcu;
8596
8597         if (!regdom)
8598                 regdom = rcu_dereference(cfg80211_regdomain);
8599
8600         if (nl80211_put_regdom(regdom, msg))
8601                 goto nla_put_failure_rcu;
8602
8603         rcu_read_unlock();
8604
8605         genlmsg_end(msg, hdr);
8606         rtnl_unlock();
8607         return genlmsg_reply(msg, info);
8608
8609 nla_put_failure_rcu:
8610         rcu_read_unlock();
8611 nla_put_failure:
8612         rtnl_unlock();
8613 put_failure:
8614         nlmsg_free(msg);
8615         return err;
8616 }
8617
8618 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8619                                u32 seq, int flags, struct wiphy *wiphy,
8620                                const struct ieee80211_regdomain *regdom)
8621 {
8622         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8623                                    NL80211_CMD_GET_REG);
8624
8625         if (!hdr)
8626                 return -1;
8627
8628         genl_dump_check_consistent(cb, hdr);
8629
8630         if (nl80211_put_regdom(regdom, msg))
8631                 goto nla_put_failure;
8632
8633         if (!wiphy && reg_last_request_cell_base() &&
8634             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8635                         NL80211_USER_REG_HINT_CELL_BASE))
8636                 goto nla_put_failure;
8637
8638         if (wiphy &&
8639             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8640                 goto nla_put_failure;
8641
8642         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8643             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8644                 goto nla_put_failure;
8645
8646         genlmsg_end(msg, hdr);
8647         return 0;
8648
8649 nla_put_failure:
8650         genlmsg_cancel(msg, hdr);
8651         return -EMSGSIZE;
8652 }
8653
8654 static int nl80211_get_reg_dump(struct sk_buff *skb,
8655                                 struct netlink_callback *cb)
8656 {
8657         const struct ieee80211_regdomain *regdom = NULL;
8658         struct cfg80211_registered_device *rdev;
8659         int err, reg_idx, start = cb->args[2];
8660
8661         rcu_read_lock();
8662
8663         if (cfg80211_regdomain && start == 0) {
8664                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8665                                           NLM_F_MULTI, NULL,
8666                                           rcu_dereference(cfg80211_regdomain));
8667                 if (err < 0)
8668                         goto out_err;
8669         }
8670
8671         /* the global regdom is idx 0 */
8672         reg_idx = 1;
8673         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8674                 regdom = get_wiphy_regdom(&rdev->wiphy);
8675                 if (!regdom)
8676                         continue;
8677
8678                 if (++reg_idx <= start)
8679                         continue;
8680
8681                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8682                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8683                 if (err < 0) {
8684                         reg_idx--;
8685                         break;
8686                 }
8687         }
8688
8689         cb->args[2] = reg_idx;
8690         err = skb->len;
8691 out_err:
8692         rcu_read_unlock();
8693         return err;
8694 }
8695
8696 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8697 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8698         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8699         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8700         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8701         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8702         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8703         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8704         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8705 };
8706
8707 static int parse_reg_rule(struct nlattr *tb[],
8708         struct ieee80211_reg_rule *reg_rule)
8709 {
8710         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8711         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8712
8713         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8714                 return -EINVAL;
8715         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8716                 return -EINVAL;
8717         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8718                 return -EINVAL;
8719         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8720                 return -EINVAL;
8721         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8722                 return -EINVAL;
8723
8724         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8725
8726         freq_range->start_freq_khz =
8727                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8728         freq_range->end_freq_khz =
8729                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8730         freq_range->max_bandwidth_khz =
8731                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8732
8733         power_rule->max_eirp =
8734                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8735
8736         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8737                 power_rule->max_antenna_gain =
8738                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8739
8740         if (tb[NL80211_ATTR_DFS_CAC_TIME])
8741                 reg_rule->dfs_cac_ms =
8742                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8743
8744         return 0;
8745 }
8746
8747 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8748 {
8749         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8750         struct nlattr *nl_reg_rule;
8751         char *alpha2;
8752         int rem_reg_rules, r;
8753         u32 num_rules = 0, rule_idx = 0;
8754         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8755         struct ieee80211_regdomain *rd;
8756
8757         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8758                 return -EINVAL;
8759
8760         if (!info->attrs[NL80211_ATTR_REG_RULES])
8761                 return -EINVAL;
8762
8763         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8764
8765         if (info->attrs[NL80211_ATTR_DFS_REGION])
8766                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8767
8768         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8769                             rem_reg_rules) {
8770                 num_rules++;
8771                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8772                         return -EINVAL;
8773         }
8774
8775         rtnl_lock();
8776         if (!reg_is_valid_request(alpha2)) {
8777                 r = -EINVAL;
8778                 goto out;
8779         }
8780
8781         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8782         if (!rd) {
8783                 r = -ENOMEM;
8784                 goto out;
8785         }
8786
8787         rd->n_reg_rules = num_rules;
8788         rd->alpha2[0] = alpha2[0];
8789         rd->alpha2[1] = alpha2[1];
8790
8791         /*
8792          * Disable DFS master mode if the DFS region was
8793          * not supported or known on this kernel.
8794          */
8795         if (reg_supported_dfs_region(dfs_region))
8796                 rd->dfs_region = dfs_region;
8797
8798         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8799                             rem_reg_rules) {
8800                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8801                                                 nl_reg_rule, reg_rule_policy,
8802                                                 info->extack);
8803                 if (r)
8804                         goto bad_reg;
8805                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8806                 if (r)
8807                         goto bad_reg;
8808
8809                 rule_idx++;
8810
8811                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8812                         r = -EINVAL;
8813                         goto bad_reg;
8814                 }
8815         }
8816
8817         r = set_regdom(rd, REGD_SOURCE_CRDA);
8818         /* set_regdom takes ownership of rd */
8819         rd = NULL;
8820  bad_reg:
8821         kfree(rd);
8822  out:
8823         rtnl_unlock();
8824         return r;
8825 }
8826 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8827
8828 static int validate_scan_freqs(struct nlattr *freqs)
8829 {
8830         struct nlattr *attr1, *attr2;
8831         int n_channels = 0, tmp1, tmp2;
8832
8833         nla_for_each_nested(attr1, freqs, tmp1)
8834                 if (nla_len(attr1) != sizeof(u32))
8835                         return 0;
8836
8837         nla_for_each_nested(attr1, freqs, tmp1) {
8838                 n_channels++;
8839                 /*
8840                  * Some hardware has a limited channel list for
8841                  * scanning, and it is pretty much nonsensical
8842                  * to scan for a channel twice, so disallow that
8843                  * and don't require drivers to check that the
8844                  * channel list they get isn't longer than what
8845                  * they can scan, as long as they can scan all
8846                  * the channels they registered at once.
8847                  */
8848                 nla_for_each_nested(attr2, freqs, tmp2)
8849                         if (attr1 != attr2 &&
8850                             nla_get_u32(attr1) == nla_get_u32(attr2))
8851                                 return 0;
8852         }
8853
8854         return n_channels;
8855 }
8856
8857 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8858 {
8859         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8860 }
8861
8862 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8863                             struct cfg80211_bss_selection *bss_select)
8864 {
8865         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8866         struct nlattr *nest;
8867         int err;
8868         bool found = false;
8869         int i;
8870
8871         /* only process one nested attribute */
8872         nest = nla_data(nla);
8873         if (!nla_ok(nest, nla_len(nest)))
8874                 return -EINVAL;
8875
8876         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8877                                           nest, nl80211_bss_select_policy,
8878                                           NULL);
8879         if (err)
8880                 return err;
8881
8882         /* only one attribute may be given */
8883         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8884                 if (attr[i]) {
8885                         if (found)
8886                                 return -EINVAL;
8887                         found = true;
8888                 }
8889         }
8890
8891         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8892
8893         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8894                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8895
8896         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8897                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8898                 bss_select->param.band_pref =
8899                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8900                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8901                         return -EINVAL;
8902         }
8903
8904         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8905                 struct nl80211_bss_select_rssi_adjust *adj_param;
8906
8907                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8908                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8909                 bss_select->param.adjust.band = adj_param->band;
8910                 bss_select->param.adjust.delta = adj_param->delta;
8911                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8912                         return -EINVAL;
8913         }
8914
8915         /* user-space did not provide behaviour attribute */
8916         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8917                 return -EINVAL;
8918
8919         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8920                 return -EINVAL;
8921
8922         return 0;
8923 }
8924
8925 int nl80211_parse_random_mac(struct nlattr **attrs,
8926                              u8 *mac_addr, u8 *mac_addr_mask)
8927 {
8928         int i;
8929
8930         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8931                 eth_zero_addr(mac_addr);
8932                 eth_zero_addr(mac_addr_mask);
8933                 mac_addr[0] = 0x2;
8934                 mac_addr_mask[0] = 0x3;
8935
8936                 return 0;
8937         }
8938
8939         /* need both or none */
8940         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8941                 return -EINVAL;
8942
8943         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8944         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8945
8946         /* don't allow or configure an mcast address */
8947         if (!is_multicast_ether_addr(mac_addr_mask) ||
8948             is_multicast_ether_addr(mac_addr))
8949                 return -EINVAL;
8950
8951         /*
8952          * allow users to pass a MAC address that has bits set outside
8953          * of the mask, but don't bother drivers with having to deal
8954          * with such bits
8955          */
8956         for (i = 0; i < ETH_ALEN; i++)
8957                 mac_addr[i] &= mac_addr_mask[i];
8958
8959         return 0;
8960 }
8961
8962 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8963                                               struct ieee80211_channel *chan)
8964 {
8965         unsigned int link_id;
8966         bool all_ok = true;
8967
8968         ASSERT_WDEV_LOCK(wdev);
8969
8970         if (!cfg80211_beaconing_iface_active(wdev))
8971                 return true;
8972
8973         /*
8974          * FIXME: check if we have a free HW resource/link for chan
8975          *
8976          * This, as well as the FIXME below, requires knowing the link
8977          * capabilities of the hardware.
8978          */
8979
8980         /* we cannot leave radar channels */
8981         for_each_valid_link(wdev, link_id) {
8982                 struct cfg80211_chan_def *chandef;
8983
8984                 chandef = wdev_chandef(wdev, link_id);
8985                 if (!chandef || !chandef->chan)
8986                         continue;
8987
8988                 /*
8989                  * FIXME: don't require all_ok, but rather check only the
8990                  *        correct HW resource/link onto which 'chan' falls,
8991                  *        as only that link leaves the channel for doing
8992                  *        the off-channel operation.
8993                  */
8994
8995                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
8996                         all_ok = false;
8997         }
8998
8999         if (all_ok)
9000                 return true;
9001
9002         return regulatory_pre_cac_allowed(wdev->wiphy);
9003 }
9004
9005 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9006                                     enum nl80211_ext_feature_index feat)
9007 {
9008         if (!(flags & flag))
9009                 return true;
9010         if (wiphy_ext_feature_isset(wiphy, feat))
9011                 return true;
9012         return false;
9013 }
9014
9015 static int
9016 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9017                          void *request, struct nlattr **attrs,
9018                          bool is_sched_scan)
9019 {
9020         u8 *mac_addr, *mac_addr_mask;
9021         u32 *flags;
9022         enum nl80211_feature_flags randomness_flag;
9023
9024         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9025                 return 0;
9026
9027         if (is_sched_scan) {
9028                 struct cfg80211_sched_scan_request *req = request;
9029
9030                 randomness_flag = wdev ?
9031                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9032                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9033                 flags = &req->flags;
9034                 mac_addr = req->mac_addr;
9035                 mac_addr_mask = req->mac_addr_mask;
9036         } else {
9037                 struct cfg80211_scan_request *req = request;
9038
9039                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9040                 flags = &req->flags;
9041                 mac_addr = req->mac_addr;
9042                 mac_addr_mask = req->mac_addr_mask;
9043         }
9044
9045         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9046
9047         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9048              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9049             !nl80211_check_scan_feat(wiphy, *flags,
9050                                      NL80211_SCAN_FLAG_LOW_SPAN,
9051                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9052             !nl80211_check_scan_feat(wiphy, *flags,
9053                                      NL80211_SCAN_FLAG_LOW_POWER,
9054                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9055             !nl80211_check_scan_feat(wiphy, *flags,
9056                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
9057                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9058             !nl80211_check_scan_feat(wiphy, *flags,
9059                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9060                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9061             !nl80211_check_scan_feat(wiphy, *flags,
9062                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9063                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9064             !nl80211_check_scan_feat(wiphy, *flags,
9065                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9066                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9067             !nl80211_check_scan_feat(wiphy, *flags,
9068                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9069                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9070             !nl80211_check_scan_feat(wiphy, *flags,
9071                                      NL80211_SCAN_FLAG_RANDOM_SN,
9072                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9073             !nl80211_check_scan_feat(wiphy, *flags,
9074                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9075                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9076                 return -EOPNOTSUPP;
9077
9078         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9079                 int err;
9080
9081                 if (!(wiphy->features & randomness_flag) ||
9082                     (wdev && wdev->connected))
9083                         return -EOPNOTSUPP;
9084
9085                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9086                 if (err)
9087                         return err;
9088         }
9089
9090         return 0;
9091 }
9092
9093 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9094 {
9095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9096         struct wireless_dev *wdev = info->user_ptr[1];
9097         struct cfg80211_scan_request *request;
9098         struct nlattr *scan_freqs = NULL;
9099         bool scan_freqs_khz = false;
9100         struct nlattr *attr;
9101         struct wiphy *wiphy;
9102         int err, tmp, n_ssids = 0, n_channels, i;
9103         size_t ie_len, size;
9104
9105         wiphy = &rdev->wiphy;
9106
9107         if (wdev->iftype == NL80211_IFTYPE_NAN)
9108                 return -EOPNOTSUPP;
9109
9110         if (!rdev->ops->scan)
9111                 return -EOPNOTSUPP;
9112
9113         if (rdev->scan_req || rdev->scan_msg)
9114                 return -EBUSY;
9115
9116         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9117                 if (!wiphy_ext_feature_isset(wiphy,
9118                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9119                         return -EOPNOTSUPP;
9120                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9121                 scan_freqs_khz = true;
9122         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9123                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9124
9125         if (scan_freqs) {
9126                 n_channels = validate_scan_freqs(scan_freqs);
9127                 if (!n_channels)
9128                         return -EINVAL;
9129         } else {
9130                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9131         }
9132
9133         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9134                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9135                         n_ssids++;
9136
9137         if (n_ssids > wiphy->max_scan_ssids)
9138                 return -EINVAL;
9139
9140         if (info->attrs[NL80211_ATTR_IE])
9141                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9142         else
9143                 ie_len = 0;
9144
9145         if (ie_len > wiphy->max_scan_ie_len)
9146                 return -EINVAL;
9147
9148         size = struct_size(request, channels, n_channels);
9149         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9150         size = size_add(size, ie_len);
9151         request = kzalloc(size, GFP_KERNEL);
9152         if (!request)
9153                 return -ENOMEM;
9154
9155         if (n_ssids)
9156                 request->ssids = (void *)&request->channels[n_channels];
9157         request->n_ssids = n_ssids;
9158         if (ie_len) {
9159                 if (n_ssids)
9160                         request->ie = (void *)(request->ssids + n_ssids);
9161                 else
9162                         request->ie = (void *)(request->channels + n_channels);
9163         }
9164
9165         i = 0;
9166         if (scan_freqs) {
9167                 /* user specified, bail out if channel not found */
9168                 nla_for_each_nested(attr, scan_freqs, tmp) {
9169                         struct ieee80211_channel *chan;
9170                         int freq = nla_get_u32(attr);
9171
9172                         if (!scan_freqs_khz)
9173                                 freq = MHZ_TO_KHZ(freq);
9174
9175                         chan = ieee80211_get_channel_khz(wiphy, freq);
9176                         if (!chan) {
9177                                 err = -EINVAL;
9178                                 goto out_free;
9179                         }
9180
9181                         /* ignore disabled channels */
9182                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9183                                 continue;
9184
9185                         request->channels[i] = chan;
9186                         i++;
9187                 }
9188         } else {
9189                 enum nl80211_band band;
9190
9191                 /* all channels */
9192                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9193                         int j;
9194
9195                         if (!wiphy->bands[band])
9196                                 continue;
9197                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9198                                 struct ieee80211_channel *chan;
9199
9200                                 chan = &wiphy->bands[band]->channels[j];
9201
9202                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9203                                         continue;
9204
9205                                 request->channels[i] = chan;
9206                                 i++;
9207                         }
9208                 }
9209         }
9210
9211         if (!i) {
9212                 err = -EINVAL;
9213                 goto out_free;
9214         }
9215
9216         request->n_channels = i;
9217
9218         wdev_lock(wdev);
9219         for (i = 0; i < request->n_channels; i++) {
9220                 struct ieee80211_channel *chan = request->channels[i];
9221
9222                 /* if we can go off-channel to the target channel we're good */
9223                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9224                         continue;
9225
9226                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9227                         wdev_unlock(wdev);
9228                         err = -EBUSY;
9229                         goto out_free;
9230                 }
9231         }
9232         wdev_unlock(wdev);
9233
9234         i = 0;
9235         if (n_ssids) {
9236                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9237                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9238                                 err = -EINVAL;
9239                                 goto out_free;
9240                         }
9241                         request->ssids[i].ssid_len = nla_len(attr);
9242                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9243                         i++;
9244                 }
9245         }
9246
9247         if (info->attrs[NL80211_ATTR_IE]) {
9248                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9249                 memcpy((void *)request->ie,
9250                        nla_data(info->attrs[NL80211_ATTR_IE]),
9251                        request->ie_len);
9252         }
9253
9254         for (i = 0; i < NUM_NL80211_BANDS; i++)
9255                 if (wiphy->bands[i])
9256                         request->rates[i] =
9257                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9258
9259         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9260                 nla_for_each_nested(attr,
9261                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9262                                     tmp) {
9263                         enum nl80211_band band = nla_type(attr);
9264
9265                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9266                                 err = -EINVAL;
9267                                 goto out_free;
9268                         }
9269
9270                         if (!wiphy->bands[band])
9271                                 continue;
9272
9273                         err = ieee80211_get_ratemask(wiphy->bands[band],
9274                                                      nla_data(attr),
9275                                                      nla_len(attr),
9276                                                      &request->rates[band]);
9277                         if (err)
9278                                 goto out_free;
9279                 }
9280         }
9281
9282         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9283                 request->duration =
9284                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9285                 request->duration_mandatory =
9286                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9287         }
9288
9289         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9290                                        false);
9291         if (err)
9292                 goto out_free;
9293
9294         request->no_cck =
9295                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9296
9297         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9298          * BSSID to scan for. This was problematic because that same attribute
9299          * was already used for another purpose (local random MAC address). The
9300          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9301          * compatibility with older userspace components, also use the
9302          * NL80211_ATTR_MAC value here if it can be determined to be used for
9303          * the specific BSSID use case instead of the random MAC address
9304          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9305          */
9306         if (info->attrs[NL80211_ATTR_BSSID])
9307                 memcpy(request->bssid,
9308                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9309         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9310                  info->attrs[NL80211_ATTR_MAC])
9311                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9312                        ETH_ALEN);
9313         else
9314                 eth_broadcast_addr(request->bssid);
9315
9316         request->wdev = wdev;
9317         request->wiphy = &rdev->wiphy;
9318         request->scan_start = jiffies;
9319
9320         rdev->scan_req = request;
9321         err = cfg80211_scan(rdev);
9322
9323         if (err)
9324                 goto out_free;
9325
9326         nl80211_send_scan_start(rdev, wdev);
9327         dev_hold(wdev->netdev);
9328
9329         return 0;
9330
9331  out_free:
9332         rdev->scan_req = NULL;
9333         kfree(request);
9334
9335         return err;
9336 }
9337
9338 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9339 {
9340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9341         struct wireless_dev *wdev = info->user_ptr[1];
9342
9343         if (!rdev->ops->abort_scan)
9344                 return -EOPNOTSUPP;
9345
9346         if (rdev->scan_msg)
9347                 return 0;
9348
9349         if (!rdev->scan_req)
9350                 return -ENOENT;
9351
9352         rdev_abort_scan(rdev, wdev);
9353         return 0;
9354 }
9355
9356 static int
9357 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9358                                struct cfg80211_sched_scan_request *request,
9359                                struct nlattr **attrs)
9360 {
9361         int tmp, err, i = 0;
9362         struct nlattr *attr;
9363
9364         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9365                 u32 interval;
9366
9367                 /*
9368                  * If scan plans are not specified,
9369                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9370                  * case one scan plan will be set with the specified scan
9371                  * interval and infinite number of iterations.
9372                  */
9373                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9374                 if (!interval)
9375                         return -EINVAL;
9376
9377                 request->scan_plans[0].interval =
9378                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9379                 if (!request->scan_plans[0].interval)
9380                         return -EINVAL;
9381
9382                 if (request->scan_plans[0].interval >
9383                     wiphy->max_sched_scan_plan_interval)
9384                         request->scan_plans[0].interval =
9385                                 wiphy->max_sched_scan_plan_interval;
9386
9387                 return 0;
9388         }
9389
9390         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9391                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9392
9393                 if (WARN_ON(i >= n_plans))
9394                         return -EINVAL;
9395
9396                 err = nla_parse_nested_deprecated(plan,
9397                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9398                                                   attr, nl80211_plan_policy,
9399                                                   NULL);
9400                 if (err)
9401                         return err;
9402
9403                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9404                         return -EINVAL;
9405
9406                 request->scan_plans[i].interval =
9407                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9408                 if (!request->scan_plans[i].interval ||
9409                     request->scan_plans[i].interval >
9410                     wiphy->max_sched_scan_plan_interval)
9411                         return -EINVAL;
9412
9413                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9414                         request->scan_plans[i].iterations =
9415                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9416                         if (!request->scan_plans[i].iterations ||
9417                             (request->scan_plans[i].iterations >
9418                              wiphy->max_sched_scan_plan_iterations))
9419                                 return -EINVAL;
9420                 } else if (i < n_plans - 1) {
9421                         /*
9422                          * All scan plans but the last one must specify
9423                          * a finite number of iterations
9424                          */
9425                         return -EINVAL;
9426                 }
9427
9428                 i++;
9429         }
9430
9431         /*
9432          * The last scan plan must not specify the number of
9433          * iterations, it is supposed to run infinitely
9434          */
9435         if (request->scan_plans[n_plans - 1].iterations)
9436                 return  -EINVAL;
9437
9438         return 0;
9439 }
9440
9441 static int
9442 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9443                                        struct cfg80211_match_set *match_sets,
9444                                        struct nlattr *tb_band_rssi,
9445                                        s32 rssi_thold)
9446 {
9447         struct nlattr *attr;
9448         int i, tmp, ret = 0;
9449
9450         if (!wiphy_ext_feature_isset(wiphy,
9451                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9452                 if (tb_band_rssi)
9453                         ret = -EOPNOTSUPP;
9454                 else
9455                         for (i = 0; i < NUM_NL80211_BANDS; i++)
9456                                 match_sets->per_band_rssi_thold[i] =
9457                                         NL80211_SCAN_RSSI_THOLD_OFF;
9458                 return ret;
9459         }
9460
9461         for (i = 0; i < NUM_NL80211_BANDS; i++)
9462                 match_sets->per_band_rssi_thold[i] = rssi_thold;
9463
9464         nla_for_each_nested(attr, tb_band_rssi, tmp) {
9465                 enum nl80211_band band = nla_type(attr);
9466
9467                 if (band < 0 || band >= NUM_NL80211_BANDS)
9468                         return -EINVAL;
9469
9470                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9471         }
9472
9473         return 0;
9474 }
9475
9476 static struct cfg80211_sched_scan_request *
9477 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9478                          struct nlattr **attrs, int max_match_sets)
9479 {
9480         struct cfg80211_sched_scan_request *request;
9481         struct nlattr *attr;
9482         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9483         enum nl80211_band band;
9484         size_t ie_len, size;
9485         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9486         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9487
9488         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9489                 n_channels = validate_scan_freqs(
9490                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9491                 if (!n_channels)
9492                         return ERR_PTR(-EINVAL);
9493         } else {
9494                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9495         }
9496
9497         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9498                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9499                                     tmp)
9500                         n_ssids++;
9501
9502         if (n_ssids > wiphy->max_sched_scan_ssids)
9503                 return ERR_PTR(-EINVAL);
9504
9505         /*
9506          * First, count the number of 'real' matchsets. Due to an issue with
9507          * the old implementation, matchsets containing only the RSSI attribute
9508          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9509          * RSSI for all matchsets, rather than their own matchset for reporting
9510          * all APs with a strong RSSI. This is needed to be compatible with
9511          * older userspace that treated a matchset with only the RSSI as the
9512          * global RSSI for all other matchsets - if there are other matchsets.
9513          */
9514         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9515                 nla_for_each_nested(attr,
9516                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9517                                     tmp) {
9518                         struct nlattr *rssi;
9519
9520                         err = nla_parse_nested_deprecated(tb,
9521                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9522                                                           attr,
9523                                                           nl80211_match_policy,
9524                                                           NULL);
9525                         if (err)
9526                                 return ERR_PTR(err);
9527
9528                         /* SSID and BSSID are mutually exclusive */
9529                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9530                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9531                                 return ERR_PTR(-EINVAL);
9532
9533                         /* add other standalone attributes here */
9534                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9535                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9536                                 n_match_sets++;
9537                                 continue;
9538                         }
9539                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9540                         if (rssi)
9541                                 default_match_rssi = nla_get_s32(rssi);
9542                 }
9543         }
9544
9545         /* However, if there's no other matchset, add the RSSI one */
9546         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9547                 n_match_sets = 1;
9548
9549         if (n_match_sets > max_match_sets)
9550                 return ERR_PTR(-EINVAL);
9551
9552         if (attrs[NL80211_ATTR_IE])
9553                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9554         else
9555                 ie_len = 0;
9556
9557         if (ie_len > wiphy->max_sched_scan_ie_len)
9558                 return ERR_PTR(-EINVAL);
9559
9560         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9561                 /*
9562                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9563                  * each scan plan already specifies its own interval
9564                  */
9565                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9566                         return ERR_PTR(-EINVAL);
9567
9568                 nla_for_each_nested(attr,
9569                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9570                         n_plans++;
9571         } else {
9572                 /*
9573                  * The scan interval attribute is kept for backward
9574                  * compatibility. If no scan plans are specified and sched scan
9575                  * interval is specified, one scan plan will be set with this
9576                  * scan interval and infinite number of iterations.
9577                  */
9578                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9579                         return ERR_PTR(-EINVAL);
9580
9581                 n_plans = 1;
9582         }
9583
9584         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9585                 return ERR_PTR(-EINVAL);
9586
9587         if (!wiphy_ext_feature_isset(
9588                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9589             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9590              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9591                 return ERR_PTR(-EINVAL);
9592
9593         size = struct_size(request, channels, n_channels);
9594         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9595         size = size_add(size, array_size(sizeof(*request->match_sets),
9596                                          n_match_sets));
9597         size = size_add(size, array_size(sizeof(*request->scan_plans),
9598                                          n_plans));
9599         size = size_add(size, ie_len);
9600         request = kzalloc(size, GFP_KERNEL);
9601         if (!request)
9602                 return ERR_PTR(-ENOMEM);
9603
9604         if (n_ssids)
9605                 request->ssids = (void *)&request->channels[n_channels];
9606         request->n_ssids = n_ssids;
9607         if (ie_len) {
9608                 if (n_ssids)
9609                         request->ie = (void *)(request->ssids + n_ssids);
9610                 else
9611                         request->ie = (void *)(request->channels + n_channels);
9612         }
9613
9614         if (n_match_sets) {
9615                 if (request->ie)
9616                         request->match_sets = (void *)(request->ie + ie_len);
9617                 else if (n_ssids)
9618                         request->match_sets =
9619                                 (void *)(request->ssids + n_ssids);
9620                 else
9621                         request->match_sets =
9622                                 (void *)(request->channels + n_channels);
9623         }
9624         request->n_match_sets = n_match_sets;
9625
9626         if (n_match_sets)
9627                 request->scan_plans = (void *)(request->match_sets +
9628                                                n_match_sets);
9629         else if (request->ie)
9630                 request->scan_plans = (void *)(request->ie + ie_len);
9631         else if (n_ssids)
9632                 request->scan_plans = (void *)(request->ssids + n_ssids);
9633         else
9634                 request->scan_plans = (void *)(request->channels + n_channels);
9635
9636         request->n_scan_plans = n_plans;
9637
9638         i = 0;
9639         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9640                 /* user specified, bail out if channel not found */
9641                 nla_for_each_nested(attr,
9642                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9643                                     tmp) {
9644                         struct ieee80211_channel *chan;
9645
9646                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9647
9648                         if (!chan) {
9649                                 err = -EINVAL;
9650                                 goto out_free;
9651                         }
9652
9653                         /* ignore disabled channels */
9654                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9655                                 continue;
9656
9657                         request->channels[i] = chan;
9658                         i++;
9659                 }
9660         } else {
9661                 /* all channels */
9662                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9663                         int j;
9664
9665                         if (!wiphy->bands[band])
9666                                 continue;
9667                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9668                                 struct ieee80211_channel *chan;
9669
9670                                 chan = &wiphy->bands[band]->channels[j];
9671
9672                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9673                                         continue;
9674
9675                                 request->channels[i] = chan;
9676                                 i++;
9677                         }
9678                 }
9679         }
9680
9681         if (!i) {
9682                 err = -EINVAL;
9683                 goto out_free;
9684         }
9685
9686         request->n_channels = i;
9687
9688         i = 0;
9689         if (n_ssids) {
9690                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9691                                     tmp) {
9692                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9693                                 err = -EINVAL;
9694                                 goto out_free;
9695                         }
9696                         request->ssids[i].ssid_len = nla_len(attr);
9697                         memcpy(request->ssids[i].ssid, nla_data(attr),
9698                                nla_len(attr));
9699                         i++;
9700                 }
9701         }
9702
9703         i = 0;
9704         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9705                 nla_for_each_nested(attr,
9706                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9707                                     tmp) {
9708                         struct nlattr *ssid, *bssid, *rssi;
9709
9710                         err = nla_parse_nested_deprecated(tb,
9711                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9712                                                           attr,
9713                                                           nl80211_match_policy,
9714                                                           NULL);
9715                         if (err)
9716                                 goto out_free;
9717                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9718                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9719
9720                         if (!ssid && !bssid) {
9721                                 i++;
9722                                 continue;
9723                         }
9724
9725                         if (WARN_ON(i >= n_match_sets)) {
9726                                 /* this indicates a programming error,
9727                                  * the loop above should have verified
9728                                  * things properly
9729                                  */
9730                                 err = -EINVAL;
9731                                 goto out_free;
9732                         }
9733
9734                         if (ssid) {
9735                                 memcpy(request->match_sets[i].ssid.ssid,
9736                                        nla_data(ssid), nla_len(ssid));
9737                                 request->match_sets[i].ssid.ssid_len =
9738                                         nla_len(ssid);
9739                         }
9740                         if (bssid)
9741                                 memcpy(request->match_sets[i].bssid,
9742                                        nla_data(bssid), ETH_ALEN);
9743
9744                         /* special attribute - old implementation w/a */
9745                         request->match_sets[i].rssi_thold = default_match_rssi;
9746                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9747                         if (rssi)
9748                                 request->match_sets[i].rssi_thold =
9749                                         nla_get_s32(rssi);
9750
9751                         /* Parse per band RSSI attribute */
9752                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9753                                 &request->match_sets[i],
9754                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9755                                 request->match_sets[i].rssi_thold);
9756                         if (err)
9757                                 goto out_free;
9758
9759                         i++;
9760                 }
9761
9762                 /* there was no other matchset, so the RSSI one is alone */
9763                 if (i == 0 && n_match_sets)
9764                         request->match_sets[0].rssi_thold = default_match_rssi;
9765
9766                 request->min_rssi_thold = INT_MAX;
9767                 for (i = 0; i < n_match_sets; i++)
9768                         request->min_rssi_thold =
9769                                 min(request->match_sets[i].rssi_thold,
9770                                     request->min_rssi_thold);
9771         } else {
9772                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9773         }
9774
9775         if (ie_len) {
9776                 request->ie_len = ie_len;
9777                 memcpy((void *)request->ie,
9778                        nla_data(attrs[NL80211_ATTR_IE]),
9779                        request->ie_len);
9780         }
9781
9782         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9783         if (err)
9784                 goto out_free;
9785
9786         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9787                 request->delay =
9788                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9789
9790         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9791                 request->relative_rssi = nla_get_s8(
9792                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9793                 request->relative_rssi_set = true;
9794         }
9795
9796         if (request->relative_rssi_set &&
9797             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9798                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9799
9800                 rssi_adjust = nla_data(
9801                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9802                 request->rssi_adjust.band = rssi_adjust->band;
9803                 request->rssi_adjust.delta = rssi_adjust->delta;
9804                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9805                         err = -EINVAL;
9806                         goto out_free;
9807                 }
9808         }
9809
9810         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9811         if (err)
9812                 goto out_free;
9813
9814         request->scan_start = jiffies;
9815
9816         return request;
9817
9818 out_free:
9819         kfree(request);
9820         return ERR_PTR(err);
9821 }
9822
9823 static int nl80211_start_sched_scan(struct sk_buff *skb,
9824                                     struct genl_info *info)
9825 {
9826         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9827         struct net_device *dev = info->user_ptr[1];
9828         struct wireless_dev *wdev = dev->ieee80211_ptr;
9829         struct cfg80211_sched_scan_request *sched_scan_req;
9830         bool want_multi;
9831         int err;
9832
9833         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9834                 return -EOPNOTSUPP;
9835
9836         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9837         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9838         if (err)
9839                 return err;
9840
9841         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9842                                                   info->attrs,
9843                                                   rdev->wiphy.max_match_sets);
9844
9845         err = PTR_ERR_OR_ZERO(sched_scan_req);
9846         if (err)
9847                 goto out_err;
9848
9849         /* leave request id zero for legacy request
9850          * or if driver does not support multi-scheduled scan
9851          */
9852         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9853                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9854
9855         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9856         if (err)
9857                 goto out_free;
9858
9859         sched_scan_req->dev = dev;
9860         sched_scan_req->wiphy = &rdev->wiphy;
9861
9862         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9863                 sched_scan_req->owner_nlportid = info->snd_portid;
9864
9865         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9866
9867         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9868         return 0;
9869
9870 out_free:
9871         kfree(sched_scan_req);
9872 out_err:
9873         return err;
9874 }
9875
9876 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9877                                    struct genl_info *info)
9878 {
9879         struct cfg80211_sched_scan_request *req;
9880         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9881         u64 cookie;
9882
9883         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9884                 return -EOPNOTSUPP;
9885
9886         if (info->attrs[NL80211_ATTR_COOKIE]) {
9887                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9888                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9889         }
9890
9891         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9892                                      struct cfg80211_sched_scan_request,
9893                                      list);
9894         if (!req || req->reqid ||
9895             (req->owner_nlportid &&
9896              req->owner_nlportid != info->snd_portid))
9897                 return -ENOENT;
9898
9899         return cfg80211_stop_sched_scan_req(rdev, req, false);
9900 }
9901
9902 static int nl80211_start_radar_detection(struct sk_buff *skb,
9903                                          struct genl_info *info)
9904 {
9905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9906         struct net_device *dev = info->user_ptr[1];
9907         struct wireless_dev *wdev = dev->ieee80211_ptr;
9908         struct wiphy *wiphy = wdev->wiphy;
9909         struct cfg80211_chan_def chandef;
9910         enum nl80211_dfs_regions dfs_region;
9911         unsigned int cac_time_ms;
9912         int err = -EINVAL;
9913
9914         flush_delayed_work(&rdev->dfs_update_channels_wk);
9915
9916         wiphy_lock(wiphy);
9917
9918         dfs_region = reg_get_dfs_region(wiphy);
9919         if (dfs_region == NL80211_DFS_UNSET)
9920                 goto unlock;
9921
9922         err = nl80211_parse_chandef(rdev, info, &chandef);
9923         if (err)
9924                 goto unlock;
9925
9926         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9927         if (err < 0)
9928                 goto unlock;
9929
9930         if (err == 0) {
9931                 err = -EINVAL;
9932                 goto unlock;
9933         }
9934
9935         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9936                 err = -EINVAL;
9937                 goto unlock;
9938         }
9939
9940         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9941                 err = cfg80211_start_background_radar_detection(rdev, wdev,
9942                                                                 &chandef);
9943                 goto unlock;
9944         }
9945
9946         if (netif_carrier_ok(dev)) {
9947                 err = -EBUSY;
9948                 goto unlock;
9949         }
9950
9951         if (wdev->cac_started) {
9952                 err = -EBUSY;
9953                 goto unlock;
9954         }
9955
9956         /* CAC start is offloaded to HW and can't be started manually */
9957         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9958                 err = -EOPNOTSUPP;
9959                 goto unlock;
9960         }
9961
9962         if (!rdev->ops->start_radar_detection) {
9963                 err = -EOPNOTSUPP;
9964                 goto unlock;
9965         }
9966
9967         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9968         if (WARN_ON(!cac_time_ms))
9969                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9970
9971         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9972         if (!err) {
9973                 wdev->links[0].ap.chandef = chandef;
9974                 wdev->cac_started = true;
9975                 wdev->cac_start_time = jiffies;
9976                 wdev->cac_time_ms = cac_time_ms;
9977         }
9978 unlock:
9979         wiphy_unlock(wiphy);
9980
9981         return err;
9982 }
9983
9984 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9985                                           struct genl_info *info)
9986 {
9987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9988         struct net_device *dev = info->user_ptr[1];
9989         struct wireless_dev *wdev = dev->ieee80211_ptr;
9990         struct wiphy *wiphy = wdev->wiphy;
9991         struct cfg80211_chan_def chandef;
9992         enum nl80211_dfs_regions dfs_region;
9993         int err;
9994
9995         dfs_region = reg_get_dfs_region(wiphy);
9996         if (dfs_region == NL80211_DFS_UNSET) {
9997                 GENL_SET_ERR_MSG(info,
9998                                  "DFS Region is not set. Unexpected Radar indication");
9999                 return -EINVAL;
10000         }
10001
10002         err = nl80211_parse_chandef(rdev, info, &chandef);
10003         if (err) {
10004                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10005                 return err;
10006         }
10007
10008         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10009         if (err < 0) {
10010                 GENL_SET_ERR_MSG(info, "chandef is invalid");
10011                 return err;
10012         }
10013
10014         if (err == 0) {
10015                 GENL_SET_ERR_MSG(info,
10016                                  "Unexpected Radar indication for chandef/iftype");
10017                 return -EINVAL;
10018         }
10019
10020         /* Do not process this notification if radar is already detected
10021          * by kernel on this channel, and return success.
10022          */
10023         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10024                 return 0;
10025
10026         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10027
10028         cfg80211_sched_dfs_chan_update(rdev);
10029
10030         rdev->radar_chandef = chandef;
10031
10032         /* Propagate this notification to other radios as well */
10033         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10034
10035         return 0;
10036 }
10037
10038 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10039 {
10040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10041         unsigned int link_id = nl80211_link_id(info->attrs);
10042         struct net_device *dev = info->user_ptr[1];
10043         struct wireless_dev *wdev = dev->ieee80211_ptr;
10044         struct cfg80211_csa_settings params;
10045         struct nlattr **csa_attrs = NULL;
10046         int err;
10047         bool need_new_beacon = false;
10048         bool need_handle_dfs_flag = true;
10049         int len, i;
10050         u32 cs_count;
10051
10052         if (!rdev->ops->channel_switch ||
10053             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10054                 return -EOPNOTSUPP;
10055
10056         switch (dev->ieee80211_ptr->iftype) {
10057         case NL80211_IFTYPE_AP:
10058         case NL80211_IFTYPE_P2P_GO:
10059                 need_new_beacon = true;
10060                 /* For all modes except AP the handle_dfs flag needs to be
10061                  * supplied to tell the kernel that userspace will handle radar
10062                  * events when they happen. Otherwise a switch to a channel
10063                  * requiring DFS will be rejected.
10064                  */
10065                 need_handle_dfs_flag = false;
10066
10067                 /* useless if AP is not running */
10068                 if (!wdev->links[link_id].ap.beacon_interval)
10069                         return -ENOTCONN;
10070                 break;
10071         case NL80211_IFTYPE_ADHOC:
10072                 if (!wdev->u.ibss.ssid_len)
10073                         return -ENOTCONN;
10074                 break;
10075         case NL80211_IFTYPE_MESH_POINT:
10076                 if (!wdev->u.mesh.id_len)
10077                         return -ENOTCONN;
10078                 break;
10079         default:
10080                 return -EOPNOTSUPP;
10081         }
10082
10083         memset(&params, 0, sizeof(params));
10084         params.beacon_csa.ftm_responder = -1;
10085
10086         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10087             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10088                 return -EINVAL;
10089
10090         /* only important for AP, IBSS and mesh create IEs internally */
10091         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10092                 return -EINVAL;
10093
10094         /* Even though the attribute is u32, the specification says
10095          * u8, so let's make sure we don't overflow.
10096          */
10097         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10098         if (cs_count > 255)
10099                 return -EINVAL;
10100
10101         params.count = cs_count;
10102
10103         if (!need_new_beacon)
10104                 goto skip_beacons;
10105
10106         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10107                                    info->extack);
10108         if (err)
10109                 goto free;
10110
10111         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10112                             GFP_KERNEL);
10113         if (!csa_attrs) {
10114                 err = -ENOMEM;
10115                 goto free;
10116         }
10117
10118         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10119                                           info->attrs[NL80211_ATTR_CSA_IES],
10120                                           nl80211_policy, info->extack);
10121         if (err)
10122                 goto free;
10123
10124         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10125                                    info->extack);
10126         if (err)
10127                 goto free;
10128
10129         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10130                 err = -EINVAL;
10131                 goto free;
10132         }
10133
10134         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10135         if (!len || (len % sizeof(u16))) {
10136                 err = -EINVAL;
10137                 goto free;
10138         }
10139
10140         params.n_counter_offsets_beacon = len / sizeof(u16);
10141         if (rdev->wiphy.max_num_csa_counters &&
10142             (params.n_counter_offsets_beacon >
10143              rdev->wiphy.max_num_csa_counters)) {
10144                 err = -EINVAL;
10145                 goto free;
10146         }
10147
10148         params.counter_offsets_beacon =
10149                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10150
10151         /* sanity checks - counters should fit and be the same */
10152         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10153                 u16 offset = params.counter_offsets_beacon[i];
10154
10155                 if (offset >= params.beacon_csa.tail_len) {
10156                         err = -EINVAL;
10157                         goto free;
10158                 }
10159
10160                 if (params.beacon_csa.tail[offset] != params.count) {
10161                         err = -EINVAL;
10162                         goto free;
10163                 }
10164         }
10165
10166         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10167                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10168                 if (!len || (len % sizeof(u16))) {
10169                         err = -EINVAL;
10170                         goto free;
10171                 }
10172
10173                 params.n_counter_offsets_presp = len / sizeof(u16);
10174                 if (rdev->wiphy.max_num_csa_counters &&
10175                     (params.n_counter_offsets_presp >
10176                      rdev->wiphy.max_num_csa_counters)) {
10177                         err = -EINVAL;
10178                         goto free;
10179                 }
10180
10181                 params.counter_offsets_presp =
10182                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10183
10184                 /* sanity checks - counters should fit and be the same */
10185                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10186                         u16 offset = params.counter_offsets_presp[i];
10187
10188                         if (offset >= params.beacon_csa.probe_resp_len) {
10189                                 err = -EINVAL;
10190                                 goto free;
10191                         }
10192
10193                         if (params.beacon_csa.probe_resp[offset] !=
10194                             params.count) {
10195                                 err = -EINVAL;
10196                                 goto free;
10197                         }
10198                 }
10199         }
10200
10201 skip_beacons:
10202         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10203         if (err)
10204                 goto free;
10205
10206         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10207                                            wdev->iftype)) {
10208                 err = -EINVAL;
10209                 goto free;
10210         }
10211
10212         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10213                                             &params.chandef,
10214                                             wdev->iftype);
10215         if (err < 0)
10216                 goto free;
10217
10218         if (err > 0) {
10219                 params.radar_required = true;
10220                 if (need_handle_dfs_flag &&
10221                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10222                         err = -EINVAL;
10223                         goto free;
10224                 }
10225         }
10226
10227         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10228                 params.block_tx = true;
10229
10230         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10231                 err = nl80211_parse_punct_bitmap(rdev, info,
10232                                                  &params.chandef,
10233                                                  &params.punct_bitmap);
10234                 if (err)
10235                         goto free;
10236         }
10237
10238         wdev_lock(wdev);
10239         err = rdev_channel_switch(rdev, dev, &params);
10240         wdev_unlock(wdev);
10241
10242 free:
10243         kfree(params.beacon_after.mbssid_ies);
10244         kfree(params.beacon_csa.mbssid_ies);
10245         kfree(params.beacon_after.rnr_ies);
10246         kfree(params.beacon_csa.rnr_ies);
10247         kfree(csa_attrs);
10248         return err;
10249 }
10250
10251 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10252                             u32 seq, int flags,
10253                             struct cfg80211_registered_device *rdev,
10254                             struct wireless_dev *wdev,
10255                             struct cfg80211_internal_bss *intbss)
10256 {
10257         struct cfg80211_bss *res = &intbss->pub;
10258         const struct cfg80211_bss_ies *ies;
10259         unsigned int link_id;
10260         void *hdr;
10261         struct nlattr *bss;
10262
10263         ASSERT_WDEV_LOCK(wdev);
10264
10265         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10266                              NL80211_CMD_NEW_SCAN_RESULTS);
10267         if (!hdr)
10268                 return -1;
10269
10270         genl_dump_check_consistent(cb, hdr);
10271
10272         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10273                 goto nla_put_failure;
10274         if (wdev->netdev &&
10275             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10276                 goto nla_put_failure;
10277         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10278                               NL80211_ATTR_PAD))
10279                 goto nla_put_failure;
10280
10281         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10282         if (!bss)
10283                 goto nla_put_failure;
10284         if ((!is_zero_ether_addr(res->bssid) &&
10285              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10286                 goto nla_put_failure;
10287
10288         rcu_read_lock();
10289         /* indicate whether we have probe response data or not */
10290         if (rcu_access_pointer(res->proberesp_ies) &&
10291             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10292                 goto fail_unlock_rcu;
10293
10294         /* this pointer prefers to be pointed to probe response data
10295          * but is always valid
10296          */
10297         ies = rcu_dereference(res->ies);
10298         if (ies) {
10299                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10300                                       NL80211_BSS_PAD))
10301                         goto fail_unlock_rcu;
10302                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10303                                         ies->len, ies->data))
10304                         goto fail_unlock_rcu;
10305         }
10306
10307         /* and this pointer is always (unless driver didn't know) beacon data */
10308         ies = rcu_dereference(res->beacon_ies);
10309         if (ies && ies->from_beacon) {
10310                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10311                                       NL80211_BSS_PAD))
10312                         goto fail_unlock_rcu;
10313                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10314                                         ies->len, ies->data))
10315                         goto fail_unlock_rcu;
10316         }
10317         rcu_read_unlock();
10318
10319         if (res->beacon_interval &&
10320             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10321                 goto nla_put_failure;
10322         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10323             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10324             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10325                         res->channel->freq_offset) ||
10326             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10327             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10328                         jiffies_to_msecs(jiffies - intbss->ts)))
10329                 goto nla_put_failure;
10330
10331         if (intbss->parent_tsf &&
10332             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10333                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10334              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10335                      intbss->parent_bssid)))
10336                 goto nla_put_failure;
10337
10338         if (intbss->ts_boottime &&
10339             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10340                               intbss->ts_boottime, NL80211_BSS_PAD))
10341                 goto nla_put_failure;
10342
10343         if (!nl80211_put_signal(msg, intbss->pub.chains,
10344                                 intbss->pub.chain_signal,
10345                                 NL80211_BSS_CHAIN_SIGNAL))
10346                 goto nla_put_failure;
10347
10348         switch (rdev->wiphy.signal_type) {
10349         case CFG80211_SIGNAL_TYPE_MBM:
10350                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10351                         goto nla_put_failure;
10352                 break;
10353         case CFG80211_SIGNAL_TYPE_UNSPEC:
10354                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10355                         goto nla_put_failure;
10356                 break;
10357         default:
10358                 break;
10359         }
10360
10361         switch (wdev->iftype) {
10362         case NL80211_IFTYPE_P2P_CLIENT:
10363         case NL80211_IFTYPE_STATION:
10364                 for_each_valid_link(wdev, link_id) {
10365                         if (intbss == wdev->links[link_id].client.current_bss &&
10366                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10367                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10368                              (wdev->valid_links &&
10369                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10370                                           link_id) ||
10371                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10372                                        wdev->u.client.connected_addr)))))
10373                                 goto nla_put_failure;
10374                 }
10375                 break;
10376         case NL80211_IFTYPE_ADHOC:
10377                 if (intbss == wdev->u.ibss.current_bss &&
10378                     nla_put_u32(msg, NL80211_BSS_STATUS,
10379                                 NL80211_BSS_STATUS_IBSS_JOINED))
10380                         goto nla_put_failure;
10381                 break;
10382         default:
10383                 break;
10384         }
10385
10386         nla_nest_end(msg, bss);
10387
10388         genlmsg_end(msg, hdr);
10389         return 0;
10390
10391  fail_unlock_rcu:
10392         rcu_read_unlock();
10393  nla_put_failure:
10394         genlmsg_cancel(msg, hdr);
10395         return -EMSGSIZE;
10396 }
10397
10398 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10399 {
10400         struct cfg80211_registered_device *rdev;
10401         struct cfg80211_internal_bss *scan;
10402         struct wireless_dev *wdev;
10403         int start = cb->args[2], idx = 0;
10404         int err;
10405
10406         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10407         if (err)
10408                 return err;
10409         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10410         __acquire(&rdev->wiphy.mtx);
10411
10412         wdev_lock(wdev);
10413         spin_lock_bh(&rdev->bss_lock);
10414
10415         /*
10416          * dump_scan will be called multiple times to break up the scan results
10417          * into multiple messages.  It is unlikely that any more bss-es will be
10418          * expired after the first call, so only call only call this on the
10419          * first dump_scan invocation.
10420          */
10421         if (start == 0)
10422                 cfg80211_bss_expire(rdev);
10423
10424         cb->seq = rdev->bss_generation;
10425
10426         list_for_each_entry(scan, &rdev->bss_list, list) {
10427                 if (++idx <= start)
10428                         continue;
10429                 if (nl80211_send_bss(skb, cb,
10430                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10431                                 rdev, wdev, scan) < 0) {
10432                         idx--;
10433                         break;
10434                 }
10435         }
10436
10437         spin_unlock_bh(&rdev->bss_lock);
10438         wdev_unlock(wdev);
10439
10440         cb->args[2] = idx;
10441         wiphy_unlock(&rdev->wiphy);
10442
10443         return skb->len;
10444 }
10445
10446 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10447                                int flags, struct net_device *dev,
10448                                bool allow_radio_stats,
10449                                struct survey_info *survey)
10450 {
10451         void *hdr;
10452         struct nlattr *infoattr;
10453
10454         /* skip radio stats if userspace didn't request them */
10455         if (!survey->channel && !allow_radio_stats)
10456                 return 0;
10457
10458         hdr = nl80211hdr_put(msg, portid, seq, flags,
10459                              NL80211_CMD_NEW_SURVEY_RESULTS);
10460         if (!hdr)
10461                 return -ENOMEM;
10462
10463         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10464                 goto nla_put_failure;
10465
10466         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10467         if (!infoattr)
10468                 goto nla_put_failure;
10469
10470         if (survey->channel &&
10471             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10472                         survey->channel->center_freq))
10473                 goto nla_put_failure;
10474
10475         if (survey->channel && survey->channel->freq_offset &&
10476             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10477                         survey->channel->freq_offset))
10478                 goto nla_put_failure;
10479
10480         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10481             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10482                 goto nla_put_failure;
10483         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10484             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10485                 goto nla_put_failure;
10486         if ((survey->filled & SURVEY_INFO_TIME) &&
10487             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10488                         survey->time, NL80211_SURVEY_INFO_PAD))
10489                 goto nla_put_failure;
10490         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10491             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10492                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10493                 goto nla_put_failure;
10494         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10495             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10496                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10497                 goto nla_put_failure;
10498         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10499             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10500                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10501                 goto nla_put_failure;
10502         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10503             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10504                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10505                 goto nla_put_failure;
10506         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10507             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10508                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10509                 goto nla_put_failure;
10510         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10511             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10512                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10513                 goto nla_put_failure;
10514
10515         nla_nest_end(msg, infoattr);
10516
10517         genlmsg_end(msg, hdr);
10518         return 0;
10519
10520  nla_put_failure:
10521         genlmsg_cancel(msg, hdr);
10522         return -EMSGSIZE;
10523 }
10524
10525 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10526 {
10527         struct nlattr **attrbuf;
10528         struct survey_info survey;
10529         struct cfg80211_registered_device *rdev;
10530         struct wireless_dev *wdev;
10531         int survey_idx = cb->args[2];
10532         int res;
10533         bool radio_stats;
10534
10535         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10536         if (!attrbuf)
10537                 return -ENOMEM;
10538
10539         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10540         if (res) {
10541                 kfree(attrbuf);
10542                 return res;
10543         }
10544         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10545         __acquire(&rdev->wiphy.mtx);
10546
10547         /* prepare_wdev_dump parsed the attributes */
10548         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10549
10550         if (!wdev->netdev) {
10551                 res = -EINVAL;
10552                 goto out_err;
10553         }
10554
10555         if (!rdev->ops->dump_survey) {
10556                 res = -EOPNOTSUPP;
10557                 goto out_err;
10558         }
10559
10560         while (1) {
10561                 wdev_lock(wdev);
10562                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10563                 wdev_unlock(wdev);
10564                 if (res == -ENOENT)
10565                         break;
10566                 if (res)
10567                         goto out_err;
10568
10569                 /* don't send disabled channels, but do send non-channel data */
10570                 if (survey.channel &&
10571                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10572                         survey_idx++;
10573                         continue;
10574                 }
10575
10576                 if (nl80211_send_survey(skb,
10577                                 NETLINK_CB(cb->skb).portid,
10578                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10579                                 wdev->netdev, radio_stats, &survey) < 0)
10580                         goto out;
10581                 survey_idx++;
10582         }
10583
10584  out:
10585         cb->args[2] = survey_idx;
10586         res = skb->len;
10587  out_err:
10588         kfree(attrbuf);
10589         wiphy_unlock(&rdev->wiphy);
10590         return res;
10591 }
10592
10593 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10594 {
10595         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10596                                   NL80211_WPA_VERSION_2 |
10597                                   NL80211_WPA_VERSION_3));
10598 }
10599
10600 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10601 {
10602         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10603         struct net_device *dev = info->user_ptr[1];
10604         struct ieee80211_channel *chan;
10605         const u8 *bssid, *ssid;
10606         int err, ssid_len;
10607         enum nl80211_auth_type auth_type;
10608         struct key_parse key;
10609         bool local_state_change;
10610         struct cfg80211_auth_request req = {};
10611         u32 freq;
10612
10613         if (!info->attrs[NL80211_ATTR_MAC])
10614                 return -EINVAL;
10615
10616         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10617                 return -EINVAL;
10618
10619         if (!info->attrs[NL80211_ATTR_SSID])
10620                 return -EINVAL;
10621
10622         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10623                 return -EINVAL;
10624
10625         err = nl80211_parse_key(info, &key);
10626         if (err)
10627                 return err;
10628
10629         if (key.idx >= 0) {
10630                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10631                         return -EINVAL;
10632                 if (!key.p.key || !key.p.key_len)
10633                         return -EINVAL;
10634                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10635                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10636                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10637                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10638                         return -EINVAL;
10639                 if (key.idx > 3)
10640                         return -EINVAL;
10641         } else {
10642                 key.p.key_len = 0;
10643                 key.p.key = NULL;
10644         }
10645
10646         if (key.idx >= 0) {
10647                 int i;
10648                 bool ok = false;
10649
10650                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10651                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10652                                 ok = true;
10653                                 break;
10654                         }
10655                 }
10656                 if (!ok)
10657                         return -EINVAL;
10658         }
10659
10660         if (!rdev->ops->auth)
10661                 return -EOPNOTSUPP;
10662
10663         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10664             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10665                 return -EOPNOTSUPP;
10666
10667         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10668         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10669         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10670                 freq +=
10671                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10672
10673         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10674         if (!chan)
10675                 return -EINVAL;
10676
10677         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10678         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10679
10680         if (info->attrs[NL80211_ATTR_IE]) {
10681                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10682                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10683         }
10684
10685         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10686         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10687                 return -EINVAL;
10688
10689         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10690              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10691              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10692              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10693             !info->attrs[NL80211_ATTR_AUTH_DATA])
10694                 return -EINVAL;
10695
10696         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10697                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10698                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10699                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10700                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10701                         return -EINVAL;
10702                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10703                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10704         }
10705
10706         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10707
10708         /*
10709          * Since we no longer track auth state, ignore
10710          * requests to only change local state.
10711          */
10712         if (local_state_change)
10713                 return 0;
10714
10715         req.auth_type = auth_type;
10716         req.key = key.p.key;
10717         req.key_len = key.p.key_len;
10718         req.key_idx = key.idx;
10719         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10720         if (req.link_id >= 0) {
10721                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10722                         return -EINVAL;
10723                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10724                         return -EINVAL;
10725                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10726         }
10727
10728         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10729                                    IEEE80211_BSS_TYPE_ESS,
10730                                    IEEE80211_PRIVACY_ANY);
10731         if (!req.bss)
10732                 return -ENOENT;
10733
10734         wdev_lock(dev->ieee80211_ptr);
10735         err = cfg80211_mlme_auth(rdev, dev, &req);
10736         wdev_unlock(dev->ieee80211_ptr);
10737
10738         cfg80211_put_bss(&rdev->wiphy, req.bss);
10739
10740         return err;
10741 }
10742
10743 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10744                                      struct genl_info *info)
10745 {
10746         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10747                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10748                 return -EINVAL;
10749         }
10750
10751         if (!rdev->ops->tx_control_port ||
10752             !wiphy_ext_feature_isset(&rdev->wiphy,
10753                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10754                 return -EOPNOTSUPP;
10755
10756         return 0;
10757 }
10758
10759 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10760                                    struct genl_info *info,
10761                                    struct cfg80211_crypto_settings *settings,
10762                                    int cipher_limit)
10763 {
10764         memset(settings, 0, sizeof(*settings));
10765
10766         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10767
10768         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10769                 u16 proto;
10770
10771                 proto = nla_get_u16(
10772                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10773                 settings->control_port_ethertype = cpu_to_be16(proto);
10774                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10775                     proto != ETH_P_PAE)
10776                         return -EINVAL;
10777                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10778                         settings->control_port_no_encrypt = true;
10779         } else
10780                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10781
10782         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10783                 int r = validate_pae_over_nl80211(rdev, info);
10784
10785                 if (r < 0)
10786                         return r;
10787
10788                 settings->control_port_over_nl80211 = true;
10789
10790                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10791                         settings->control_port_no_preauth = true;
10792         }
10793
10794         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10795                 void *data;
10796                 int len, i;
10797
10798                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10799                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10800                 settings->n_ciphers_pairwise = len / sizeof(u32);
10801
10802                 if (len % sizeof(u32))
10803                         return -EINVAL;
10804
10805                 if (settings->n_ciphers_pairwise > cipher_limit)
10806                         return -EINVAL;
10807
10808                 memcpy(settings->ciphers_pairwise, data, len);
10809
10810                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10811                         if (!cfg80211_supported_cipher_suite(
10812                                         &rdev->wiphy,
10813                                         settings->ciphers_pairwise[i]))
10814                                 return -EINVAL;
10815         }
10816
10817         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10818                 settings->cipher_group =
10819                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10820                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10821                                                      settings->cipher_group))
10822                         return -EINVAL;
10823         }
10824
10825         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10826                 settings->wpa_versions =
10827                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10828                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10829                         return -EINVAL;
10830         }
10831
10832         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10833                 void *data;
10834                 int len;
10835
10836                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10837                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10838                 settings->n_akm_suites = len / sizeof(u32);
10839
10840                 if (len % sizeof(u32))
10841                         return -EINVAL;
10842
10843                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10844                         return -EINVAL;
10845
10846                 memcpy(settings->akm_suites, data, len);
10847         }
10848
10849         if (info->attrs[NL80211_ATTR_PMK]) {
10850                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10851                         return -EINVAL;
10852                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10853                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10854                     !wiphy_ext_feature_isset(&rdev->wiphy,
10855                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10856                         return -EINVAL;
10857                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10858         }
10859
10860         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10861                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10862                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10863                     !wiphy_ext_feature_isset(&rdev->wiphy,
10864                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10865                         return -EINVAL;
10866                 settings->sae_pwd =
10867                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10868                 settings->sae_pwd_len =
10869                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10870         }
10871
10872         if (info->attrs[NL80211_ATTR_SAE_PWE])
10873                 settings->sae_pwe =
10874                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10875         else
10876                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10877
10878         return 0;
10879 }
10880
10881 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10882                                               const u8 *ssid, int ssid_len,
10883                                               struct nlattr **attrs)
10884 {
10885         struct ieee80211_channel *chan;
10886         struct cfg80211_bss *bss;
10887         const u8 *bssid;
10888         u32 freq;
10889
10890         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10891                 return ERR_PTR(-EINVAL);
10892
10893         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10894
10895         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10896         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10897                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10898
10899         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10900         if (!chan)
10901                 return ERR_PTR(-EINVAL);
10902
10903         bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10904                                ssid, ssid_len,
10905                                IEEE80211_BSS_TYPE_ESS,
10906                                IEEE80211_PRIVACY_ANY);
10907         if (!bss)
10908                 return ERR_PTR(-ENOENT);
10909
10910         return bss;
10911 }
10912
10913 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10914 {
10915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10916         struct net_device *dev = info->user_ptr[1];
10917         struct cfg80211_assoc_request req = {};
10918         struct nlattr **attrs = NULL;
10919         const u8 *ap_addr, *ssid;
10920         unsigned int link_id;
10921         int err, ssid_len;
10922
10923         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10924             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10925                 return -EPERM;
10926
10927         if (!info->attrs[NL80211_ATTR_SSID])
10928                 return -EINVAL;
10929
10930         if (!rdev->ops->assoc)
10931                 return -EOPNOTSUPP;
10932
10933         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10934             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10935                 return -EOPNOTSUPP;
10936
10937         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10938         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10939
10940         if (info->attrs[NL80211_ATTR_IE]) {
10941                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10942                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10943
10944                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10945                                            req.ie, req.ie_len)) {
10946                         GENL_SET_ERR_MSG(info,
10947                                          "non-inheritance makes no sense");
10948                         return -EINVAL;
10949                 }
10950         }
10951
10952         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10953                 enum nl80211_mfp mfp =
10954                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10955                 if (mfp == NL80211_MFP_REQUIRED)
10956                         req.use_mfp = true;
10957                 else if (mfp != NL80211_MFP_NO)
10958                         return -EINVAL;
10959         }
10960
10961         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10962                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10963
10964         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10965                 req.flags |= ASSOC_REQ_DISABLE_HT;
10966
10967         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10968                 memcpy(&req.ht_capa_mask,
10969                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10970                        sizeof(req.ht_capa_mask));
10971
10972         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10973                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10974                         return -EINVAL;
10975                 memcpy(&req.ht_capa,
10976                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10977                        sizeof(req.ht_capa));
10978         }
10979
10980         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10981                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10982
10983         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10984                 req.flags |= ASSOC_REQ_DISABLE_HE;
10985
10986         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
10987                 req.flags |= ASSOC_REQ_DISABLE_EHT;
10988
10989         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10990                 memcpy(&req.vht_capa_mask,
10991                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10992                        sizeof(req.vht_capa_mask));
10993
10994         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10995                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10996                         return -EINVAL;
10997                 memcpy(&req.vht_capa,
10998                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10999                        sizeof(req.vht_capa));
11000         }
11001
11002         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11003                 if (!((rdev->wiphy.features &
11004                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11005                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11006                     !wiphy_ext_feature_isset(&rdev->wiphy,
11007                                              NL80211_EXT_FEATURE_RRM))
11008                         return -EINVAL;
11009                 req.flags |= ASSOC_REQ_USE_RRM;
11010         }
11011
11012         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11013                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11014                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11015                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11016                         return -EINVAL;
11017                 req.fils_nonces =
11018                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11019         }
11020
11021         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11022                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11023                         return -EINVAL;
11024                 memcpy(&req.s1g_capa_mask,
11025                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11026                        sizeof(req.s1g_capa_mask));
11027         }
11028
11029         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11030                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11031                         return -EINVAL;
11032                 memcpy(&req.s1g_capa,
11033                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11034                        sizeof(req.s1g_capa));
11035         }
11036
11037         req.link_id = nl80211_link_id_or_invalid(info->attrs);
11038
11039         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11040                 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11041                 struct nlattr *link;
11042                 int rem = 0;
11043
11044                 if (req.link_id < 0)
11045                         return -EINVAL;
11046
11047                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11048                         return -EINVAL;
11049
11050                 if (info->attrs[NL80211_ATTR_MAC] ||
11051                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11052                     !info->attrs[NL80211_ATTR_MLD_ADDR])
11053                         return -EINVAL;
11054
11055                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11056                 ap_addr = req.ap_mld_addr;
11057
11058                 attrs = kzalloc(attrsize, GFP_KERNEL);
11059                 if (!attrs)
11060                         return -ENOMEM;
11061
11062                 nla_for_each_nested(link,
11063                                     info->attrs[NL80211_ATTR_MLO_LINKS],
11064                                     rem) {
11065                         memset(attrs, 0, attrsize);
11066
11067                         nla_parse_nested(attrs, NL80211_ATTR_MAX,
11068                                          link, NULL, NULL);
11069
11070                         if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11071                                 err = -EINVAL;
11072                                 goto free;
11073                         }
11074
11075                         link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11076                         /* cannot use the same link ID again */
11077                         if (req.links[link_id].bss) {
11078                                 err = -EINVAL;
11079                                 goto free;
11080                         }
11081                         req.links[link_id].bss =
11082                                 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11083                         if (IS_ERR(req.links[link_id].bss)) {
11084                                 err = PTR_ERR(req.links[link_id].bss);
11085                                 req.links[link_id].bss = NULL;
11086                                 goto free;
11087                         }
11088
11089                         if (attrs[NL80211_ATTR_IE]) {
11090                                 req.links[link_id].elems =
11091                                         nla_data(attrs[NL80211_ATTR_IE]);
11092                                 req.links[link_id].elems_len =
11093                                         nla_len(attrs[NL80211_ATTR_IE]);
11094
11095                                 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11096                                                        req.links[link_id].elems,
11097                                                        req.links[link_id].elems_len)) {
11098                                         GENL_SET_ERR_MSG(info,
11099                                                          "cannot deal with fragmentation");
11100                                         err = -EINVAL;
11101                                         goto free;
11102                                 }
11103
11104                                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11105                                                            req.links[link_id].elems,
11106                                                            req.links[link_id].elems_len)) {
11107                                         GENL_SET_ERR_MSG(info,
11108                                                          "cannot deal with non-inheritance");
11109                                         err = -EINVAL;
11110                                         goto free;
11111                                 }
11112                         }
11113                 }
11114
11115                 if (!req.links[req.link_id].bss) {
11116                         err = -EINVAL;
11117                         goto free;
11118                 }
11119
11120                 if (req.links[req.link_id].elems_len) {
11121                         GENL_SET_ERR_MSG(info,
11122                                          "cannot have per-link elems on assoc link");
11123                         err = -EINVAL;
11124                         goto free;
11125                 }
11126
11127                 kfree(attrs);
11128                 attrs = NULL;
11129         } else {
11130                 if (req.link_id >= 0)
11131                         return -EINVAL;
11132
11133                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11134                 if (IS_ERR(req.bss))
11135                         return PTR_ERR(req.bss);
11136                 ap_addr = req.bss->bssid;
11137         }
11138
11139         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11140         if (!err) {
11141                 wdev_lock(dev->ieee80211_ptr);
11142
11143                 err = cfg80211_mlme_assoc(rdev, dev, &req);
11144
11145                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11146                         dev->ieee80211_ptr->conn_owner_nlportid =
11147                                 info->snd_portid;
11148                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11149                                ap_addr, ETH_ALEN);
11150                 }
11151
11152                 wdev_unlock(dev->ieee80211_ptr);
11153         }
11154
11155 free:
11156         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11157                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11158         cfg80211_put_bss(&rdev->wiphy, req.bss);
11159         kfree(attrs);
11160
11161         return err;
11162 }
11163
11164 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11165 {
11166         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11167         struct net_device *dev = info->user_ptr[1];
11168         const u8 *ie = NULL, *bssid;
11169         int ie_len = 0, err;
11170         u16 reason_code;
11171         bool local_state_change;
11172
11173         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11174             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11175                 return -EPERM;
11176
11177         if (!info->attrs[NL80211_ATTR_MAC])
11178                 return -EINVAL;
11179
11180         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11181                 return -EINVAL;
11182
11183         if (!rdev->ops->deauth)
11184                 return -EOPNOTSUPP;
11185
11186         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11187             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11188                 return -EOPNOTSUPP;
11189
11190         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11191
11192         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11193         if (reason_code == 0) {
11194                 /* Reason Code 0 is reserved */
11195                 return -EINVAL;
11196         }
11197
11198         if (info->attrs[NL80211_ATTR_IE]) {
11199                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11200                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11201         }
11202
11203         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11204
11205         wdev_lock(dev->ieee80211_ptr);
11206         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11207                                    local_state_change);
11208         wdev_unlock(dev->ieee80211_ptr);
11209         return err;
11210 }
11211
11212 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11213 {
11214         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11215         struct net_device *dev = info->user_ptr[1];
11216         const u8 *ie = NULL, *bssid;
11217         int ie_len = 0, err;
11218         u16 reason_code;
11219         bool local_state_change;
11220
11221         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11222             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11223                 return -EPERM;
11224
11225         if (!info->attrs[NL80211_ATTR_MAC])
11226                 return -EINVAL;
11227
11228         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11229                 return -EINVAL;
11230
11231         if (!rdev->ops->disassoc)
11232                 return -EOPNOTSUPP;
11233
11234         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11235             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11236                 return -EOPNOTSUPP;
11237
11238         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11239
11240         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11241         if (reason_code == 0) {
11242                 /* Reason Code 0 is reserved */
11243                 return -EINVAL;
11244         }
11245
11246         if (info->attrs[NL80211_ATTR_IE]) {
11247                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11248                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11249         }
11250
11251         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11252
11253         wdev_lock(dev->ieee80211_ptr);
11254         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11255                                      local_state_change);
11256         wdev_unlock(dev->ieee80211_ptr);
11257         return err;
11258 }
11259
11260 static bool
11261 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11262                          int mcast_rate[NUM_NL80211_BANDS],
11263                          int rateval)
11264 {
11265         struct wiphy *wiphy = &rdev->wiphy;
11266         bool found = false;
11267         int band, i;
11268
11269         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11270                 struct ieee80211_supported_band *sband;
11271
11272                 sband = wiphy->bands[band];
11273                 if (!sband)
11274                         continue;
11275
11276                 for (i = 0; i < sband->n_bitrates; i++) {
11277                         if (sband->bitrates[i].bitrate == rateval) {
11278                                 mcast_rate[band] = i + 1;
11279                                 found = true;
11280                                 break;
11281                         }
11282                 }
11283         }
11284
11285         return found;
11286 }
11287
11288 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11289 {
11290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11291         struct net_device *dev = info->user_ptr[1];
11292         struct cfg80211_ibss_params ibss;
11293         struct wiphy *wiphy;
11294         struct cfg80211_cached_keys *connkeys = NULL;
11295         int err;
11296
11297         memset(&ibss, 0, sizeof(ibss));
11298
11299         if (!info->attrs[NL80211_ATTR_SSID] ||
11300             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11301                 return -EINVAL;
11302
11303         ibss.beacon_interval = 100;
11304
11305         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11306                 ibss.beacon_interval =
11307                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11308
11309         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11310                                            ibss.beacon_interval);
11311         if (err)
11312                 return err;
11313
11314         if (!rdev->ops->join_ibss)
11315                 return -EOPNOTSUPP;
11316
11317         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11318                 return -EOPNOTSUPP;
11319
11320         wiphy = &rdev->wiphy;
11321
11322         if (info->attrs[NL80211_ATTR_MAC]) {
11323                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11324
11325                 if (!is_valid_ether_addr(ibss.bssid))
11326                         return -EINVAL;
11327         }
11328         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11329         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11330
11331         if (info->attrs[NL80211_ATTR_IE]) {
11332                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11333                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11334         }
11335
11336         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11337         if (err)
11338                 return err;
11339
11340         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11341                                      NL80211_IFTYPE_ADHOC))
11342                 return -EINVAL;
11343
11344         switch (ibss.chandef.width) {
11345         case NL80211_CHAN_WIDTH_5:
11346         case NL80211_CHAN_WIDTH_10:
11347         case NL80211_CHAN_WIDTH_20_NOHT:
11348                 break;
11349         case NL80211_CHAN_WIDTH_20:
11350         case NL80211_CHAN_WIDTH_40:
11351                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11352                         return -EINVAL;
11353                 break;
11354         case NL80211_CHAN_WIDTH_80:
11355         case NL80211_CHAN_WIDTH_80P80:
11356         case NL80211_CHAN_WIDTH_160:
11357                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11358                         return -EINVAL;
11359                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11360                                              NL80211_EXT_FEATURE_VHT_IBSS))
11361                         return -EINVAL;
11362                 break;
11363         case NL80211_CHAN_WIDTH_320:
11364                 return -EINVAL;
11365         default:
11366                 return -EINVAL;
11367         }
11368
11369         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11370         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11371
11372         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11373                 u8 *rates =
11374                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11375                 int n_rates =
11376                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11377                 struct ieee80211_supported_band *sband =
11378                         wiphy->bands[ibss.chandef.chan->band];
11379
11380                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11381                                              &ibss.basic_rates);
11382                 if (err)
11383                         return err;
11384         }
11385
11386         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11387                 memcpy(&ibss.ht_capa_mask,
11388                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11389                        sizeof(ibss.ht_capa_mask));
11390
11391         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11392                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11393                         return -EINVAL;
11394                 memcpy(&ibss.ht_capa,
11395                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11396                        sizeof(ibss.ht_capa));
11397         }
11398
11399         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11400             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11401                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11402                 return -EINVAL;
11403
11404         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11405                 bool no_ht = false;
11406
11407                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11408                 if (IS_ERR(connkeys))
11409                         return PTR_ERR(connkeys);
11410
11411                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11412                     no_ht) {
11413                         kfree_sensitive(connkeys);
11414                         return -EINVAL;
11415                 }
11416         }
11417
11418         ibss.control_port =
11419                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11420
11421         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11422                 int r = validate_pae_over_nl80211(rdev, info);
11423
11424                 if (r < 0) {
11425                         kfree_sensitive(connkeys);
11426                         return r;
11427                 }
11428
11429                 ibss.control_port_over_nl80211 = true;
11430         }
11431
11432         ibss.userspace_handles_dfs =
11433                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11434
11435         wdev_lock(dev->ieee80211_ptr);
11436         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11437         if (err)
11438                 kfree_sensitive(connkeys);
11439         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11440                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11441         wdev_unlock(dev->ieee80211_ptr);
11442
11443         return err;
11444 }
11445
11446 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11447 {
11448         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11449         struct net_device *dev = info->user_ptr[1];
11450
11451         if (!rdev->ops->leave_ibss)
11452                 return -EOPNOTSUPP;
11453
11454         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11455                 return -EOPNOTSUPP;
11456
11457         return cfg80211_leave_ibss(rdev, dev, false);
11458 }
11459
11460 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11461 {
11462         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11463         struct net_device *dev = info->user_ptr[1];
11464         int mcast_rate[NUM_NL80211_BANDS];
11465         u32 nla_rate;
11466
11467         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11468             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11469             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11470                 return -EOPNOTSUPP;
11471
11472         if (!rdev->ops->set_mcast_rate)
11473                 return -EOPNOTSUPP;
11474
11475         memset(mcast_rate, 0, sizeof(mcast_rate));
11476
11477         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11478                 return -EINVAL;
11479
11480         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11481         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11482                 return -EINVAL;
11483
11484         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11485 }
11486
11487 static struct sk_buff *
11488 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11489                             struct wireless_dev *wdev, int approxlen,
11490                             u32 portid, u32 seq, enum nl80211_commands cmd,
11491                             enum nl80211_attrs attr,
11492                             const struct nl80211_vendor_cmd_info *info,
11493                             gfp_t gfp)
11494 {
11495         struct sk_buff *skb;
11496         void *hdr;
11497         struct nlattr *data;
11498
11499         skb = nlmsg_new(approxlen + 100, gfp);
11500         if (!skb)
11501                 return NULL;
11502
11503         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11504         if (!hdr) {
11505                 kfree_skb(skb);
11506                 return NULL;
11507         }
11508
11509         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11510                 goto nla_put_failure;
11511
11512         if (info) {
11513                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11514                                 info->vendor_id))
11515                         goto nla_put_failure;
11516                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11517                                 info->subcmd))
11518                         goto nla_put_failure;
11519         }
11520
11521         if (wdev) {
11522                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11523                                       wdev_id(wdev), NL80211_ATTR_PAD))
11524                         goto nla_put_failure;
11525                 if (wdev->netdev &&
11526                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11527                                 wdev->netdev->ifindex))
11528                         goto nla_put_failure;
11529         }
11530
11531         data = nla_nest_start_noflag(skb, attr);
11532         if (!data)
11533                 goto nla_put_failure;
11534
11535         ((void **)skb->cb)[0] = rdev;
11536         ((void **)skb->cb)[1] = hdr;
11537         ((void **)skb->cb)[2] = data;
11538
11539         return skb;
11540
11541  nla_put_failure:
11542         kfree_skb(skb);
11543         return NULL;
11544 }
11545
11546 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11547                                            struct wireless_dev *wdev,
11548                                            enum nl80211_commands cmd,
11549                                            enum nl80211_attrs attr,
11550                                            unsigned int portid,
11551                                            int vendor_event_idx,
11552                                            int approxlen, gfp_t gfp)
11553 {
11554         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11555         const struct nl80211_vendor_cmd_info *info;
11556
11557         switch (cmd) {
11558         case NL80211_CMD_TESTMODE:
11559                 if (WARN_ON(vendor_event_idx != -1))
11560                         return NULL;
11561                 info = NULL;
11562                 break;
11563         case NL80211_CMD_VENDOR:
11564                 if (WARN_ON(vendor_event_idx < 0 ||
11565                             vendor_event_idx >= wiphy->n_vendor_events))
11566                         return NULL;
11567                 info = &wiphy->vendor_events[vendor_event_idx];
11568                 break;
11569         default:
11570                 WARN_ON(1);
11571                 return NULL;
11572         }
11573
11574         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11575                                            cmd, attr, info, gfp);
11576 }
11577 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11578
11579 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11580 {
11581         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11582         void *hdr = ((void **)skb->cb)[1];
11583         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11584         struct nlattr *data = ((void **)skb->cb)[2];
11585         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11586
11587         /* clear CB data for netlink core to own from now on */
11588         memset(skb->cb, 0, sizeof(skb->cb));
11589
11590         nla_nest_end(skb, data);
11591         genlmsg_end(skb, hdr);
11592
11593         if (nlhdr->nlmsg_pid) {
11594                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11595                                 nlhdr->nlmsg_pid);
11596         } else {
11597                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11598                         mcgrp = NL80211_MCGRP_VENDOR;
11599
11600                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11601                                         skb, 0, mcgrp, gfp);
11602         }
11603 }
11604 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11605
11606 #ifdef CONFIG_NL80211_TESTMODE
11607 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11608 {
11609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11610         struct wireless_dev *wdev;
11611         int err;
11612
11613         lockdep_assert_held(&rdev->wiphy.mtx);
11614
11615         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11616                                           info->attrs);
11617
11618         if (!rdev->ops->testmode_cmd)
11619                 return -EOPNOTSUPP;
11620
11621         if (IS_ERR(wdev)) {
11622                 err = PTR_ERR(wdev);
11623                 if (err != -EINVAL)
11624                         return err;
11625                 wdev = NULL;
11626         } else if (wdev->wiphy != &rdev->wiphy) {
11627                 return -EINVAL;
11628         }
11629
11630         if (!info->attrs[NL80211_ATTR_TESTDATA])
11631                 return -EINVAL;
11632
11633         rdev->cur_cmd_info = info;
11634         err = rdev_testmode_cmd(rdev, wdev,
11635                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11636                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11637         rdev->cur_cmd_info = NULL;
11638
11639         return err;
11640 }
11641
11642 static int nl80211_testmode_dump(struct sk_buff *skb,
11643                                  struct netlink_callback *cb)
11644 {
11645         struct cfg80211_registered_device *rdev;
11646         struct nlattr **attrbuf = NULL;
11647         int err;
11648         long phy_idx;
11649         void *data = NULL;
11650         int data_len = 0;
11651
11652         rtnl_lock();
11653
11654         if (cb->args[0]) {
11655                 /*
11656                  * 0 is a valid index, but not valid for args[0],
11657                  * so we need to offset by 1.
11658                  */
11659                 phy_idx = cb->args[0] - 1;
11660
11661                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11662                 if (!rdev) {
11663                         err = -ENOENT;
11664                         goto out_err;
11665                 }
11666         } else {
11667                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11668                                   GFP_KERNEL);
11669                 if (!attrbuf) {
11670                         err = -ENOMEM;
11671                         goto out_err;
11672                 }
11673
11674                 err = nlmsg_parse_deprecated(cb->nlh,
11675                                              GENL_HDRLEN + nl80211_fam.hdrsize,
11676                                              attrbuf, nl80211_fam.maxattr,
11677                                              nl80211_policy, NULL);
11678                 if (err)
11679                         goto out_err;
11680
11681                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11682                 if (IS_ERR(rdev)) {
11683                         err = PTR_ERR(rdev);
11684                         goto out_err;
11685                 }
11686                 phy_idx = rdev->wiphy_idx;
11687
11688                 if (attrbuf[NL80211_ATTR_TESTDATA])
11689                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11690         }
11691
11692         if (cb->args[1]) {
11693                 data = nla_data((void *)cb->args[1]);
11694                 data_len = nla_len((void *)cb->args[1]);
11695         }
11696
11697         if (!rdev->ops->testmode_dump) {
11698                 err = -EOPNOTSUPP;
11699                 goto out_err;
11700         }
11701
11702         while (1) {
11703                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11704                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11705                                            NL80211_CMD_TESTMODE);
11706                 struct nlattr *tmdata;
11707
11708                 if (!hdr)
11709                         break;
11710
11711                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11712                         genlmsg_cancel(skb, hdr);
11713                         break;
11714                 }
11715
11716                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11717                 if (!tmdata) {
11718                         genlmsg_cancel(skb, hdr);
11719                         break;
11720                 }
11721                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11722                 nla_nest_end(skb, tmdata);
11723
11724                 if (err == -ENOBUFS || err == -ENOENT) {
11725                         genlmsg_cancel(skb, hdr);
11726                         break;
11727                 } else if (err) {
11728                         genlmsg_cancel(skb, hdr);
11729                         goto out_err;
11730                 }
11731
11732                 genlmsg_end(skb, hdr);
11733         }
11734
11735         err = skb->len;
11736         /* see above */
11737         cb->args[0] = phy_idx + 1;
11738  out_err:
11739         kfree(attrbuf);
11740         rtnl_unlock();
11741         return err;
11742 }
11743 #endif
11744
11745 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11746 {
11747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11748         struct net_device *dev = info->user_ptr[1];
11749         struct cfg80211_connect_params connect;
11750         struct wiphy *wiphy;
11751         struct cfg80211_cached_keys *connkeys = NULL;
11752         u32 freq = 0;
11753         int err;
11754
11755         memset(&connect, 0, sizeof(connect));
11756
11757         if (!info->attrs[NL80211_ATTR_SSID] ||
11758             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11759                 return -EINVAL;
11760
11761         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11762                 connect.auth_type =
11763                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11764                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11765                                              NL80211_CMD_CONNECT))
11766                         return -EINVAL;
11767         } else
11768                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11769
11770         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11771
11772         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11773             !wiphy_ext_feature_isset(&rdev->wiphy,
11774                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11775                 return -EINVAL;
11776         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11777
11778         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11779                                       NL80211_MAX_NR_CIPHER_SUITES);
11780         if (err)
11781                 return err;
11782
11783         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11784             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11785                 return -EOPNOTSUPP;
11786
11787         wiphy = &rdev->wiphy;
11788
11789         connect.bg_scan_period = -1;
11790         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11791                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11792                 connect.bg_scan_period =
11793                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11794         }
11795
11796         if (info->attrs[NL80211_ATTR_MAC])
11797                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11798         else if (info->attrs[NL80211_ATTR_MAC_HINT])
11799                 connect.bssid_hint =
11800                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11801         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11802         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11803
11804         if (info->attrs[NL80211_ATTR_IE]) {
11805                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11806                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11807         }
11808
11809         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11810                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11811                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11812                     !wiphy_ext_feature_isset(&rdev->wiphy,
11813                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
11814                         return -EOPNOTSUPP;
11815         } else {
11816                 connect.mfp = NL80211_MFP_NO;
11817         }
11818
11819         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11820                 connect.prev_bssid =
11821                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11822
11823         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11824                 freq = MHZ_TO_KHZ(nla_get_u32(
11825                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11826         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11827                 freq +=
11828                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11829
11830         if (freq) {
11831                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11832                 if (!connect.channel)
11833                         return -EINVAL;
11834         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11835                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11836                 freq = MHZ_TO_KHZ(freq);
11837                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11838                 if (!connect.channel_hint)
11839                         return -EINVAL;
11840         }
11841
11842         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11843                 connect.edmg.channels =
11844                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11845
11846                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11847                         connect.edmg.bw_config =
11848                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11849         }
11850
11851         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11852                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11853                 if (IS_ERR(connkeys))
11854                         return PTR_ERR(connkeys);
11855         }
11856
11857         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11858                 connect.flags |= ASSOC_REQ_DISABLE_HT;
11859
11860         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11861                 memcpy(&connect.ht_capa_mask,
11862                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11863                        sizeof(connect.ht_capa_mask));
11864
11865         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11866                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11867                         kfree_sensitive(connkeys);
11868                         return -EINVAL;
11869                 }
11870                 memcpy(&connect.ht_capa,
11871                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11872                        sizeof(connect.ht_capa));
11873         }
11874
11875         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11876                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11877
11878         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11879                 connect.flags |= ASSOC_REQ_DISABLE_HE;
11880
11881         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11882                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11883
11884         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11885                 memcpy(&connect.vht_capa_mask,
11886                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11887                        sizeof(connect.vht_capa_mask));
11888
11889         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11890                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11891                         kfree_sensitive(connkeys);
11892                         return -EINVAL;
11893                 }
11894                 memcpy(&connect.vht_capa,
11895                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11896                        sizeof(connect.vht_capa));
11897         }
11898
11899         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11900                 if (!((rdev->wiphy.features &
11901                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11902                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11903                     !wiphy_ext_feature_isset(&rdev->wiphy,
11904                                              NL80211_EXT_FEATURE_RRM)) {
11905                         kfree_sensitive(connkeys);
11906                         return -EINVAL;
11907                 }
11908                 connect.flags |= ASSOC_REQ_USE_RRM;
11909         }
11910
11911         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11912         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11913                 kfree_sensitive(connkeys);
11914                 return -EOPNOTSUPP;
11915         }
11916
11917         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11918                 /* bss selection makes no sense if bssid is set */
11919                 if (connect.bssid) {
11920                         kfree_sensitive(connkeys);
11921                         return -EINVAL;
11922                 }
11923
11924                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11925                                        wiphy, &connect.bss_select);
11926                 if (err) {
11927                         kfree_sensitive(connkeys);
11928                         return err;
11929                 }
11930         }
11931
11932         if (wiphy_ext_feature_isset(&rdev->wiphy,
11933                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11934             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11935             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11936             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11937             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11938                 connect.fils_erp_username =
11939                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11940                 connect.fils_erp_username_len =
11941                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11942                 connect.fils_erp_realm =
11943                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11944                 connect.fils_erp_realm_len =
11945                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11946                 connect.fils_erp_next_seq_num =
11947                         nla_get_u16(
11948                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11949                 connect.fils_erp_rrk =
11950                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11951                 connect.fils_erp_rrk_len =
11952                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11953         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11954                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11955                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11956                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11957                 kfree_sensitive(connkeys);
11958                 return -EINVAL;
11959         }
11960
11961         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
11962                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11963                         kfree_sensitive(connkeys);
11964                         GENL_SET_ERR_MSG(info,
11965                                          "external auth requires connection ownership");
11966                         return -EINVAL;
11967                 }
11968                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
11969         }
11970
11971         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
11972                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
11973
11974         wdev_lock(dev->ieee80211_ptr);
11975
11976         err = cfg80211_connect(rdev, dev, &connect, connkeys,
11977                                connect.prev_bssid);
11978         if (err)
11979                 kfree_sensitive(connkeys);
11980
11981         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11982                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11983                 if (connect.bssid)
11984                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11985                                connect.bssid, ETH_ALEN);
11986                 else
11987                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
11988         }
11989
11990         wdev_unlock(dev->ieee80211_ptr);
11991
11992         return err;
11993 }
11994
11995 static int nl80211_update_connect_params(struct sk_buff *skb,
11996                                          struct genl_info *info)
11997 {
11998         struct cfg80211_connect_params connect = {};
11999         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12000         struct net_device *dev = info->user_ptr[1];
12001         struct wireless_dev *wdev = dev->ieee80211_ptr;
12002         bool fils_sk_offload;
12003         u32 auth_type;
12004         u32 changed = 0;
12005         int ret;
12006
12007         if (!rdev->ops->update_connect_params)
12008                 return -EOPNOTSUPP;
12009
12010         if (info->attrs[NL80211_ATTR_IE]) {
12011                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12012                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12013                 changed |= UPDATE_ASSOC_IES;
12014         }
12015
12016         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12017                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12018
12019         /*
12020          * when driver supports fils-sk offload all attributes must be
12021          * provided. So the else covers "fils-sk-not-all" and
12022          * "no-fils-sk-any".
12023          */
12024         if (fils_sk_offload &&
12025             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12026             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12027             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12028             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12029                 connect.fils_erp_username =
12030                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12031                 connect.fils_erp_username_len =
12032                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12033                 connect.fils_erp_realm =
12034                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12035                 connect.fils_erp_realm_len =
12036                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12037                 connect.fils_erp_next_seq_num =
12038                         nla_get_u16(
12039                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12040                 connect.fils_erp_rrk =
12041                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12042                 connect.fils_erp_rrk_len =
12043                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12044                 changed |= UPDATE_FILS_ERP_INFO;
12045         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12046                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12047                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12048                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12049                 return -EINVAL;
12050         }
12051
12052         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12053                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12054                 if (!nl80211_valid_auth_type(rdev, auth_type,
12055                                              NL80211_CMD_CONNECT))
12056                         return -EINVAL;
12057
12058                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12059                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12060                         return -EINVAL;
12061
12062                 connect.auth_type = auth_type;
12063                 changed |= UPDATE_AUTH_TYPE;
12064         }
12065
12066         wdev_lock(dev->ieee80211_ptr);
12067         if (!wdev->connected)
12068                 ret = -ENOLINK;
12069         else
12070                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
12071         wdev_unlock(dev->ieee80211_ptr);
12072
12073         return ret;
12074 }
12075
12076 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12077 {
12078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12079         struct net_device *dev = info->user_ptr[1];
12080         u16 reason;
12081         int ret;
12082
12083         if (dev->ieee80211_ptr->conn_owner_nlportid &&
12084             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12085                 return -EPERM;
12086
12087         if (!info->attrs[NL80211_ATTR_REASON_CODE])
12088                 reason = WLAN_REASON_DEAUTH_LEAVING;
12089         else
12090                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12091
12092         if (reason == 0)
12093                 return -EINVAL;
12094
12095         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12096             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12097                 return -EOPNOTSUPP;
12098
12099         wdev_lock(dev->ieee80211_ptr);
12100         ret = cfg80211_disconnect(rdev, dev, reason, true);
12101         wdev_unlock(dev->ieee80211_ptr);
12102         return ret;
12103 }
12104
12105 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12106 {
12107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12108         struct net *net;
12109         int err;
12110
12111         if (info->attrs[NL80211_ATTR_PID]) {
12112                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12113
12114                 net = get_net_ns_by_pid(pid);
12115         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12116                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12117
12118                 net = get_net_ns_by_fd(fd);
12119         } else {
12120                 return -EINVAL;
12121         }
12122
12123         if (IS_ERR(net))
12124                 return PTR_ERR(net);
12125
12126         err = 0;
12127
12128         /* check if anything to do */
12129         if (!net_eq(wiphy_net(&rdev->wiphy), net))
12130                 err = cfg80211_switch_netns(rdev, net);
12131
12132         put_net(net);
12133         return err;
12134 }
12135
12136 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12137 {
12138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12139         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12140                         struct cfg80211_pmksa *pmksa) = NULL;
12141         struct net_device *dev = info->user_ptr[1];
12142         struct cfg80211_pmksa pmksa;
12143
12144         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12145
12146         if (!info->attrs[NL80211_ATTR_PMKID])
12147                 return -EINVAL;
12148
12149         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12150
12151         if (info->attrs[NL80211_ATTR_MAC]) {
12152                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12153         } else if (info->attrs[NL80211_ATTR_SSID] &&
12154                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12155                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12156                     info->attrs[NL80211_ATTR_PMK])) {
12157                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12158                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12159                 pmksa.cache_id =
12160                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12161         } else {
12162                 return -EINVAL;
12163         }
12164         if (info->attrs[NL80211_ATTR_PMK]) {
12165                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12166                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12167         }
12168
12169         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12170                 pmksa.pmk_lifetime =
12171                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12172
12173         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12174                 pmksa.pmk_reauth_threshold =
12175                         nla_get_u8(
12176                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12177
12178         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12179             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12180             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12181               wiphy_ext_feature_isset(&rdev->wiphy,
12182                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12183                 return -EOPNOTSUPP;
12184
12185         switch (info->genlhdr->cmd) {
12186         case NL80211_CMD_SET_PMKSA:
12187                 rdev_ops = rdev->ops->set_pmksa;
12188                 break;
12189         case NL80211_CMD_DEL_PMKSA:
12190                 rdev_ops = rdev->ops->del_pmksa;
12191                 break;
12192         default:
12193                 WARN_ON(1);
12194                 break;
12195         }
12196
12197         if (!rdev_ops)
12198                 return -EOPNOTSUPP;
12199
12200         return rdev_ops(&rdev->wiphy, dev, &pmksa);
12201 }
12202
12203 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12204 {
12205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12206         struct net_device *dev = info->user_ptr[1];
12207
12208         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12209             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12210                 return -EOPNOTSUPP;
12211
12212         if (!rdev->ops->flush_pmksa)
12213                 return -EOPNOTSUPP;
12214
12215         return rdev_flush_pmksa(rdev, dev);
12216 }
12217
12218 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12219 {
12220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12221         struct net_device *dev = info->user_ptr[1];
12222         u8 action_code, dialog_token;
12223         u32 peer_capability = 0;
12224         u16 status_code;
12225         u8 *peer;
12226         bool initiator;
12227
12228         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12229             !rdev->ops->tdls_mgmt)
12230                 return -EOPNOTSUPP;
12231
12232         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12233             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12234             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12235             !info->attrs[NL80211_ATTR_IE] ||
12236             !info->attrs[NL80211_ATTR_MAC])
12237                 return -EINVAL;
12238
12239         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12240         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12241         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12242         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12243         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12244         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12245                 peer_capability =
12246                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12247
12248         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
12249                               dialog_token, status_code, peer_capability,
12250                               initiator,
12251                               nla_data(info->attrs[NL80211_ATTR_IE]),
12252                               nla_len(info->attrs[NL80211_ATTR_IE]));
12253 }
12254
12255 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12256 {
12257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12258         struct net_device *dev = info->user_ptr[1];
12259         enum nl80211_tdls_operation operation;
12260         u8 *peer;
12261
12262         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12263             !rdev->ops->tdls_oper)
12264                 return -EOPNOTSUPP;
12265
12266         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12267             !info->attrs[NL80211_ATTR_MAC])
12268                 return -EINVAL;
12269
12270         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12271         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12272
12273         return rdev_tdls_oper(rdev, dev, peer, operation);
12274 }
12275
12276 static int nl80211_remain_on_channel(struct sk_buff *skb,
12277                                      struct genl_info *info)
12278 {
12279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12280         unsigned int link_id = nl80211_link_id(info->attrs);
12281         struct wireless_dev *wdev = info->user_ptr[1];
12282         struct cfg80211_chan_def chandef;
12283         struct sk_buff *msg;
12284         void *hdr;
12285         u64 cookie;
12286         u32 duration;
12287         int err;
12288
12289         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12290             !info->attrs[NL80211_ATTR_DURATION])
12291                 return -EINVAL;
12292
12293         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12294
12295         if (!rdev->ops->remain_on_channel ||
12296             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12297                 return -EOPNOTSUPP;
12298
12299         /*
12300          * We should be on that channel for at least a minimum amount of
12301          * time (10ms) but no longer than the driver supports.
12302          */
12303         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12304             duration > rdev->wiphy.max_remain_on_channel_duration)
12305                 return -EINVAL;
12306
12307         err = nl80211_parse_chandef(rdev, info, &chandef);
12308         if (err)
12309                 return err;
12310
12311         wdev_lock(wdev);
12312         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12313                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12314
12315                 oper_chandef = wdev_chandef(wdev, link_id);
12316
12317                 if (WARN_ON(!oper_chandef)) {
12318                         /* cannot happen since we must beacon to get here */
12319                         WARN_ON(1);
12320                         wdev_unlock(wdev);
12321                         return -EBUSY;
12322                 }
12323
12324                 /* note: returns first one if identical chandefs */
12325                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12326                                                              oper_chandef);
12327
12328                 if (compat_chandef != &chandef) {
12329                         wdev_unlock(wdev);
12330                         return -EBUSY;
12331                 }
12332         }
12333         wdev_unlock(wdev);
12334
12335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12336         if (!msg)
12337                 return -ENOMEM;
12338
12339         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12340                              NL80211_CMD_REMAIN_ON_CHANNEL);
12341         if (!hdr) {
12342                 err = -ENOBUFS;
12343                 goto free_msg;
12344         }
12345
12346         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12347                                      duration, &cookie);
12348
12349         if (err)
12350                 goto free_msg;
12351
12352         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12353                               NL80211_ATTR_PAD))
12354                 goto nla_put_failure;
12355
12356         genlmsg_end(msg, hdr);
12357
12358         return genlmsg_reply(msg, info);
12359
12360  nla_put_failure:
12361         err = -ENOBUFS;
12362  free_msg:
12363         nlmsg_free(msg);
12364         return err;
12365 }
12366
12367 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12368                                             struct genl_info *info)
12369 {
12370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12371         struct wireless_dev *wdev = info->user_ptr[1];
12372         u64 cookie;
12373
12374         if (!info->attrs[NL80211_ATTR_COOKIE])
12375                 return -EINVAL;
12376
12377         if (!rdev->ops->cancel_remain_on_channel)
12378                 return -EOPNOTSUPP;
12379
12380         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12381
12382         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12383 }
12384
12385 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12386                                        struct genl_info *info)
12387 {
12388         struct cfg80211_bitrate_mask mask;
12389         unsigned int link_id = nl80211_link_id(info->attrs);
12390         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12391         struct net_device *dev = info->user_ptr[1];
12392         struct wireless_dev *wdev = dev->ieee80211_ptr;
12393         int err;
12394
12395         if (!rdev->ops->set_bitrate_mask)
12396                 return -EOPNOTSUPP;
12397
12398         wdev_lock(wdev);
12399         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12400                                             NL80211_ATTR_TX_RATES, &mask,
12401                                             dev, true, link_id);
12402         if (err)
12403                 goto out;
12404
12405         err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12406 out:
12407         wdev_unlock(wdev);
12408         return err;
12409 }
12410
12411 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12412 {
12413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12414         struct wireless_dev *wdev = info->user_ptr[1];
12415         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12416
12417         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12418                 return -EINVAL;
12419
12420         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12421                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12422
12423         switch (wdev->iftype) {
12424         case NL80211_IFTYPE_STATION:
12425         case NL80211_IFTYPE_ADHOC:
12426         case NL80211_IFTYPE_P2P_CLIENT:
12427         case NL80211_IFTYPE_AP:
12428         case NL80211_IFTYPE_AP_VLAN:
12429         case NL80211_IFTYPE_MESH_POINT:
12430         case NL80211_IFTYPE_P2P_GO:
12431         case NL80211_IFTYPE_P2P_DEVICE:
12432                 break;
12433         case NL80211_IFTYPE_NAN:
12434                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12435                                              NL80211_EXT_FEATURE_SECURE_NAN))
12436                         return -EOPNOTSUPP;
12437                 break;
12438         default:
12439                 return -EOPNOTSUPP;
12440         }
12441
12442         /* not much point in registering if we can't reply */
12443         if (!rdev->ops->mgmt_tx)
12444                 return -EOPNOTSUPP;
12445
12446         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12447             !wiphy_ext_feature_isset(&rdev->wiphy,
12448                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12449                 GENL_SET_ERR_MSG(info,
12450                                  "multicast RX registrations are not supported");
12451                 return -EOPNOTSUPP;
12452         }
12453
12454         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12455                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12456                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12457                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12458                                            info->extack);
12459 }
12460
12461 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12462 {
12463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12464         struct wireless_dev *wdev = info->user_ptr[1];
12465         struct cfg80211_chan_def chandef;
12466         int err;
12467         void *hdr = NULL;
12468         u64 cookie;
12469         struct sk_buff *msg = NULL;
12470         struct cfg80211_mgmt_tx_params params = {
12471                 .dont_wait_for_ack =
12472                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12473         };
12474
12475         if (!info->attrs[NL80211_ATTR_FRAME])
12476                 return -EINVAL;
12477
12478         if (!rdev->ops->mgmt_tx)
12479                 return -EOPNOTSUPP;
12480
12481         switch (wdev->iftype) {
12482         case NL80211_IFTYPE_P2P_DEVICE:
12483                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12484                         return -EINVAL;
12485                 break;
12486         case NL80211_IFTYPE_STATION:
12487         case NL80211_IFTYPE_ADHOC:
12488         case NL80211_IFTYPE_P2P_CLIENT:
12489         case NL80211_IFTYPE_AP:
12490         case NL80211_IFTYPE_AP_VLAN:
12491         case NL80211_IFTYPE_MESH_POINT:
12492         case NL80211_IFTYPE_P2P_GO:
12493                 break;
12494         case NL80211_IFTYPE_NAN:
12495                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12496                                              NL80211_EXT_FEATURE_SECURE_NAN))
12497                         return -EOPNOTSUPP;
12498                 break;
12499         default:
12500                 return -EOPNOTSUPP;
12501         }
12502
12503         if (info->attrs[NL80211_ATTR_DURATION]) {
12504                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12505                         return -EINVAL;
12506                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12507
12508                 /*
12509                  * We should wait on the channel for at least a minimum amount
12510                  * of time (10ms) but no longer than the driver supports.
12511                  */
12512                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12513                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12514                         return -EINVAL;
12515         }
12516
12517         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12518
12519         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12520                 return -EINVAL;
12521
12522         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12523
12524         /* get the channel if any has been specified, otherwise pass NULL to
12525          * the driver. The latter will use the current one
12526          */
12527         chandef.chan = NULL;
12528         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12529                 err = nl80211_parse_chandef(rdev, info, &chandef);
12530                 if (err)
12531                         return err;
12532         }
12533
12534         if (!chandef.chan && params.offchan)
12535                 return -EINVAL;
12536
12537         wdev_lock(wdev);
12538         if (params.offchan &&
12539             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12540                 wdev_unlock(wdev);
12541                 return -EBUSY;
12542         }
12543
12544         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12545         /*
12546          * This now races due to the unlock, but we cannot check
12547          * the valid links for the _station_ anyway, so that's up
12548          * to the driver.
12549          */
12550         if (params.link_id >= 0 &&
12551             !(wdev->valid_links & BIT(params.link_id))) {
12552                 wdev_unlock(wdev);
12553                 return -EINVAL;
12554         }
12555         wdev_unlock(wdev);
12556
12557         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12558         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12559
12560         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12561                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12562                 int i;
12563
12564                 if (len % sizeof(u16))
12565                         return -EINVAL;
12566
12567                 params.n_csa_offsets = len / sizeof(u16);
12568                 params.csa_offsets =
12569                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12570
12571                 /* check that all the offsets fit the frame */
12572                 for (i = 0; i < params.n_csa_offsets; i++) {
12573                         if (params.csa_offsets[i] >= params.len)
12574                                 return -EINVAL;
12575                 }
12576         }
12577
12578         if (!params.dont_wait_for_ack) {
12579                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12580                 if (!msg)
12581                         return -ENOMEM;
12582
12583                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12584                                      NL80211_CMD_FRAME);
12585                 if (!hdr) {
12586                         err = -ENOBUFS;
12587                         goto free_msg;
12588                 }
12589         }
12590
12591         params.chan = chandef.chan;
12592         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12593         if (err)
12594                 goto free_msg;
12595
12596         if (msg) {
12597                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12598                                       NL80211_ATTR_PAD))
12599                         goto nla_put_failure;
12600
12601                 genlmsg_end(msg, hdr);
12602                 return genlmsg_reply(msg, info);
12603         }
12604
12605         return 0;
12606
12607  nla_put_failure:
12608         err = -ENOBUFS;
12609  free_msg:
12610         nlmsg_free(msg);
12611         return err;
12612 }
12613
12614 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12615 {
12616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12617         struct wireless_dev *wdev = info->user_ptr[1];
12618         u64 cookie;
12619
12620         if (!info->attrs[NL80211_ATTR_COOKIE])
12621                 return -EINVAL;
12622
12623         if (!rdev->ops->mgmt_tx_cancel_wait)
12624                 return -EOPNOTSUPP;
12625
12626         switch (wdev->iftype) {
12627         case NL80211_IFTYPE_STATION:
12628         case NL80211_IFTYPE_ADHOC:
12629         case NL80211_IFTYPE_P2P_CLIENT:
12630         case NL80211_IFTYPE_AP:
12631         case NL80211_IFTYPE_AP_VLAN:
12632         case NL80211_IFTYPE_P2P_GO:
12633         case NL80211_IFTYPE_P2P_DEVICE:
12634                 break;
12635         case NL80211_IFTYPE_NAN:
12636                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12637                                              NL80211_EXT_FEATURE_SECURE_NAN))
12638                         return -EOPNOTSUPP;
12639                 break;
12640         default:
12641                 return -EOPNOTSUPP;
12642         }
12643
12644         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12645
12646         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12647 }
12648
12649 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12650 {
12651         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12652         struct wireless_dev *wdev;
12653         struct net_device *dev = info->user_ptr[1];
12654         u8 ps_state;
12655         bool state;
12656         int err;
12657
12658         if (!info->attrs[NL80211_ATTR_PS_STATE])
12659                 return -EINVAL;
12660
12661         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12662
12663         wdev = dev->ieee80211_ptr;
12664
12665         if (!rdev->ops->set_power_mgmt)
12666                 return -EOPNOTSUPP;
12667
12668         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12669
12670         if (state == wdev->ps)
12671                 return 0;
12672
12673         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12674         if (!err)
12675                 wdev->ps = state;
12676         return err;
12677 }
12678
12679 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12680 {
12681         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12682         enum nl80211_ps_state ps_state;
12683         struct wireless_dev *wdev;
12684         struct net_device *dev = info->user_ptr[1];
12685         struct sk_buff *msg;
12686         void *hdr;
12687         int err;
12688
12689         wdev = dev->ieee80211_ptr;
12690
12691         if (!rdev->ops->set_power_mgmt)
12692                 return -EOPNOTSUPP;
12693
12694         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12695         if (!msg)
12696                 return -ENOMEM;
12697
12698         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12699                              NL80211_CMD_GET_POWER_SAVE);
12700         if (!hdr) {
12701                 err = -ENOBUFS;
12702                 goto free_msg;
12703         }
12704
12705         if (wdev->ps)
12706                 ps_state = NL80211_PS_ENABLED;
12707         else
12708                 ps_state = NL80211_PS_DISABLED;
12709
12710         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12711                 goto nla_put_failure;
12712
12713         genlmsg_end(msg, hdr);
12714         return genlmsg_reply(msg, info);
12715
12716  nla_put_failure:
12717         err = -ENOBUFS;
12718  free_msg:
12719         nlmsg_free(msg);
12720         return err;
12721 }
12722
12723 static const struct nla_policy
12724 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12725         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12726         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12727         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12728         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12729         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12730         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12731         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12732 };
12733
12734 static int nl80211_set_cqm_txe(struct genl_info *info,
12735                                u32 rate, u32 pkts, u32 intvl)
12736 {
12737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12738         struct net_device *dev = info->user_ptr[1];
12739         struct wireless_dev *wdev = dev->ieee80211_ptr;
12740
12741         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12742                 return -EINVAL;
12743
12744         if (!rdev->ops->set_cqm_txe_config)
12745                 return -EOPNOTSUPP;
12746
12747         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12748             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12749                 return -EOPNOTSUPP;
12750
12751         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12752 }
12753
12754 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12755                                     struct net_device *dev)
12756 {
12757         struct wireless_dev *wdev = dev->ieee80211_ptr;
12758         s32 last, low, high;
12759         u32 hyst;
12760         int i, n, low_index;
12761         int err;
12762
12763         /* RSSI reporting disabled? */
12764         if (!wdev->cqm_config)
12765                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12766
12767         /*
12768          * Obtain current RSSI value if possible, if not and no RSSI threshold
12769          * event has been received yet, we should receive an event after a
12770          * connection is established and enough beacons received to calculate
12771          * the average.
12772          */
12773         if (!wdev->cqm_config->last_rssi_event_value &&
12774             wdev->links[0].client.current_bss &&
12775             rdev->ops->get_station) {
12776                 struct station_info sinfo = {};
12777                 u8 *mac_addr;
12778
12779                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12780
12781                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12782                 if (err)
12783                         return err;
12784
12785                 cfg80211_sinfo_release_content(&sinfo);
12786                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12787                         wdev->cqm_config->last_rssi_event_value =
12788                                 (s8) sinfo.rx_beacon_signal_avg;
12789         }
12790
12791         last = wdev->cqm_config->last_rssi_event_value;
12792         hyst = wdev->cqm_config->rssi_hyst;
12793         n = wdev->cqm_config->n_rssi_thresholds;
12794
12795         for (i = 0; i < n; i++) {
12796                 i = array_index_nospec(i, n);
12797                 if (last < wdev->cqm_config->rssi_thresholds[i])
12798                         break;
12799         }
12800
12801         low_index = i - 1;
12802         if (low_index >= 0) {
12803                 low_index = array_index_nospec(low_index, n);
12804                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
12805         } else {
12806                 low = S32_MIN;
12807         }
12808         if (i < n) {
12809                 i = array_index_nospec(i, n);
12810                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
12811         } else {
12812                 high = S32_MAX;
12813         }
12814
12815         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12816 }
12817
12818 static int nl80211_set_cqm_rssi(struct genl_info *info,
12819                                 const s32 *thresholds, int n_thresholds,
12820                                 u32 hysteresis)
12821 {
12822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12823         struct net_device *dev = info->user_ptr[1];
12824         struct wireless_dev *wdev = dev->ieee80211_ptr;
12825         int i, err;
12826         s32 prev = S32_MIN;
12827
12828         /* Check all values negative and sorted */
12829         for (i = 0; i < n_thresholds; i++) {
12830                 if (thresholds[i] > 0 || thresholds[i] <= prev)
12831                         return -EINVAL;
12832
12833                 prev = thresholds[i];
12834         }
12835
12836         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12837             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12838                 return -EOPNOTSUPP;
12839
12840         wdev_lock(wdev);
12841         cfg80211_cqm_config_free(wdev);
12842         wdev_unlock(wdev);
12843
12844         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12845                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12846                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12847
12848                 return rdev_set_cqm_rssi_config(rdev, dev,
12849                                                 thresholds[0], hysteresis);
12850         }
12851
12852         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12853                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12854                 return -EOPNOTSUPP;
12855
12856         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12857                 n_thresholds = 0;
12858
12859         wdev_lock(wdev);
12860         if (n_thresholds) {
12861                 struct cfg80211_cqm_config *cqm_config;
12862
12863                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12864                                                  n_thresholds),
12865                                      GFP_KERNEL);
12866                 if (!cqm_config) {
12867                         err = -ENOMEM;
12868                         goto unlock;
12869                 }
12870
12871                 cqm_config->rssi_hyst = hysteresis;
12872                 cqm_config->n_rssi_thresholds = n_thresholds;
12873                 memcpy(cqm_config->rssi_thresholds, thresholds,
12874                        flex_array_size(cqm_config, rssi_thresholds,
12875                                        n_thresholds));
12876
12877                 wdev->cqm_config = cqm_config;
12878         }
12879
12880         err = cfg80211_cqm_rssi_update(rdev, dev);
12881
12882 unlock:
12883         wdev_unlock(wdev);
12884
12885         return err;
12886 }
12887
12888 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12889 {
12890         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12891         struct nlattr *cqm;
12892         int err;
12893
12894         cqm = info->attrs[NL80211_ATTR_CQM];
12895         if (!cqm)
12896                 return -EINVAL;
12897
12898         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12899                                           nl80211_attr_cqm_policy,
12900                                           info->extack);
12901         if (err)
12902                 return err;
12903
12904         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12905             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12906                 const s32 *thresholds =
12907                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12908                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12909                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12910
12911                 if (len % 4)
12912                         return -EINVAL;
12913
12914                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12915                                             hysteresis);
12916         }
12917
12918         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12919             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12920             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12921                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12922                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12923                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12924
12925                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12926         }
12927
12928         return -EINVAL;
12929 }
12930
12931 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12932 {
12933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12934         struct net_device *dev = info->user_ptr[1];
12935         struct ocb_setup setup = {};
12936         int err;
12937
12938         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12939         if (err)
12940                 return err;
12941
12942         return cfg80211_join_ocb(rdev, dev, &setup);
12943 }
12944
12945 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12946 {
12947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12948         struct net_device *dev = info->user_ptr[1];
12949
12950         return cfg80211_leave_ocb(rdev, dev);
12951 }
12952
12953 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12954 {
12955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12956         struct net_device *dev = info->user_ptr[1];
12957         struct mesh_config cfg;
12958         struct mesh_setup setup;
12959         int err;
12960
12961         /* start with default */
12962         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
12963         memcpy(&setup, &default_mesh_setup, sizeof(setup));
12964
12965         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
12966                 /* and parse parameters if given */
12967                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
12968                 if (err)
12969                         return err;
12970         }
12971
12972         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
12973             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
12974                 return -EINVAL;
12975
12976         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
12977         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
12978
12979         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12980             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
12981                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12982                         return -EINVAL;
12983
12984         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
12985                 setup.beacon_interval =
12986                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12987
12988                 err = cfg80211_validate_beacon_int(rdev,
12989                                                    NL80211_IFTYPE_MESH_POINT,
12990                                                    setup.beacon_interval);
12991                 if (err)
12992                         return err;
12993         }
12994
12995         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
12996                 setup.dtim_period =
12997                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
12998                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
12999                         return -EINVAL;
13000         }
13001
13002         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13003                 /* parse additional setup parameters if given */
13004                 err = nl80211_parse_mesh_setup(info, &setup);
13005                 if (err)
13006                         return err;
13007         }
13008
13009         if (setup.user_mpm)
13010                 cfg.auto_open_plinks = false;
13011
13012         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13013                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13014                 if (err)
13015                         return err;
13016         } else {
13017                 /* __cfg80211_join_mesh() will sort it out */
13018                 setup.chandef.chan = NULL;
13019         }
13020
13021         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13022                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13023                 int n_rates =
13024                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13025                 struct ieee80211_supported_band *sband;
13026
13027                 if (!setup.chandef.chan)
13028                         return -EINVAL;
13029
13030                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13031
13032                 err = ieee80211_get_ratemask(sband, rates, n_rates,
13033                                              &setup.basic_rates);
13034                 if (err)
13035                         return err;
13036         }
13037
13038         if (info->attrs[NL80211_ATTR_TX_RATES]) {
13039                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13040                                                     NL80211_ATTR_TX_RATES,
13041                                                     &setup.beacon_rate,
13042                                                     dev, false, 0);
13043                 if (err)
13044                         return err;
13045
13046                 if (!setup.chandef.chan)
13047                         return -EINVAL;
13048
13049                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13050                                               &setup.beacon_rate);
13051                 if (err)
13052                         return err;
13053         }
13054
13055         setup.userspace_handles_dfs =
13056                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13057
13058         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13059                 int r = validate_pae_over_nl80211(rdev, info);
13060
13061                 if (r < 0)
13062                         return r;
13063
13064                 setup.control_port_over_nl80211 = true;
13065         }
13066
13067         wdev_lock(dev->ieee80211_ptr);
13068         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13069         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13070                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13071         wdev_unlock(dev->ieee80211_ptr);
13072
13073         return err;
13074 }
13075
13076 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13077 {
13078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13079         struct net_device *dev = info->user_ptr[1];
13080
13081         return cfg80211_leave_mesh(rdev, dev);
13082 }
13083
13084 #ifdef CONFIG_PM
13085 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13086                                         struct cfg80211_registered_device *rdev)
13087 {
13088         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13089         struct nlattr *nl_pats, *nl_pat;
13090         int i, pat_len;
13091
13092         if (!wowlan->n_patterns)
13093                 return 0;
13094
13095         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13096         if (!nl_pats)
13097                 return -ENOBUFS;
13098
13099         for (i = 0; i < wowlan->n_patterns; i++) {
13100                 nl_pat = nla_nest_start_noflag(msg, i + 1);
13101                 if (!nl_pat)
13102                         return -ENOBUFS;
13103                 pat_len = wowlan->patterns[i].pattern_len;
13104                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13105                             wowlan->patterns[i].mask) ||
13106                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13107                             wowlan->patterns[i].pattern) ||
13108                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13109                                 wowlan->patterns[i].pkt_offset))
13110                         return -ENOBUFS;
13111                 nla_nest_end(msg, nl_pat);
13112         }
13113         nla_nest_end(msg, nl_pats);
13114
13115         return 0;
13116 }
13117
13118 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13119                                    struct cfg80211_wowlan_tcp *tcp)
13120 {
13121         struct nlattr *nl_tcp;
13122
13123         if (!tcp)
13124                 return 0;
13125
13126         nl_tcp = nla_nest_start_noflag(msg,
13127                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13128         if (!nl_tcp)
13129                 return -ENOBUFS;
13130
13131         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13132             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13133             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13134             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13135             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13136             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13137                     tcp->payload_len, tcp->payload) ||
13138             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13139                         tcp->data_interval) ||
13140             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13141                     tcp->wake_len, tcp->wake_data) ||
13142             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13143                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13144                 return -ENOBUFS;
13145
13146         if (tcp->payload_seq.len &&
13147             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13148                     sizeof(tcp->payload_seq), &tcp->payload_seq))
13149                 return -ENOBUFS;
13150
13151         if (tcp->payload_tok.len &&
13152             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13153                     sizeof(tcp->payload_tok) + tcp->tokens_size,
13154                     &tcp->payload_tok))
13155                 return -ENOBUFS;
13156
13157         nla_nest_end(msg, nl_tcp);
13158
13159         return 0;
13160 }
13161
13162 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13163                                   struct cfg80211_sched_scan_request *req)
13164 {
13165         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13166         int i;
13167
13168         if (!req)
13169                 return 0;
13170
13171         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13172         if (!nd)
13173                 return -ENOBUFS;
13174
13175         if (req->n_scan_plans == 1 &&
13176             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13177                         req->scan_plans[0].interval * 1000))
13178                 return -ENOBUFS;
13179
13180         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13181                 return -ENOBUFS;
13182
13183         if (req->relative_rssi_set) {
13184                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13185
13186                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13187                                req->relative_rssi))
13188                         return -ENOBUFS;
13189
13190                 rssi_adjust.band = req->rssi_adjust.band;
13191                 rssi_adjust.delta = req->rssi_adjust.delta;
13192                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13193                             sizeof(rssi_adjust), &rssi_adjust))
13194                         return -ENOBUFS;
13195         }
13196
13197         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13198         if (!freqs)
13199                 return -ENOBUFS;
13200
13201         for (i = 0; i < req->n_channels; i++) {
13202                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13203                         return -ENOBUFS;
13204         }
13205
13206         nla_nest_end(msg, freqs);
13207
13208         if (req->n_match_sets) {
13209                 matches = nla_nest_start_noflag(msg,
13210                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13211                 if (!matches)
13212                         return -ENOBUFS;
13213
13214                 for (i = 0; i < req->n_match_sets; i++) {
13215                         match = nla_nest_start_noflag(msg, i);
13216                         if (!match)
13217                                 return -ENOBUFS;
13218
13219                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13220                                     req->match_sets[i].ssid.ssid_len,
13221                                     req->match_sets[i].ssid.ssid))
13222                                 return -ENOBUFS;
13223                         nla_nest_end(msg, match);
13224                 }
13225                 nla_nest_end(msg, matches);
13226         }
13227
13228         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13229         if (!scan_plans)
13230                 return -ENOBUFS;
13231
13232         for (i = 0; i < req->n_scan_plans; i++) {
13233                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13234                 if (!scan_plan)
13235                         return -ENOBUFS;
13236
13237                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13238                                 req->scan_plans[i].interval) ||
13239                     (req->scan_plans[i].iterations &&
13240                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13241                                  req->scan_plans[i].iterations)))
13242                         return -ENOBUFS;
13243                 nla_nest_end(msg, scan_plan);
13244         }
13245         nla_nest_end(msg, scan_plans);
13246
13247         nla_nest_end(msg, nd);
13248
13249         return 0;
13250 }
13251
13252 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13253 {
13254         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13255         struct sk_buff *msg;
13256         void *hdr;
13257         u32 size = NLMSG_DEFAULT_SIZE;
13258
13259         if (!rdev->wiphy.wowlan)
13260                 return -EOPNOTSUPP;
13261
13262         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13263                 /* adjust size to have room for all the data */
13264                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13265                         rdev->wiphy.wowlan_config->tcp->payload_len +
13266                         rdev->wiphy.wowlan_config->tcp->wake_len +
13267                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13268         }
13269
13270         msg = nlmsg_new(size, GFP_KERNEL);
13271         if (!msg)
13272                 return -ENOMEM;
13273
13274         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13275                              NL80211_CMD_GET_WOWLAN);
13276         if (!hdr)
13277                 goto nla_put_failure;
13278
13279         if (rdev->wiphy.wowlan_config) {
13280                 struct nlattr *nl_wowlan;
13281
13282                 nl_wowlan = nla_nest_start_noflag(msg,
13283                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13284                 if (!nl_wowlan)
13285                         goto nla_put_failure;
13286
13287                 if ((rdev->wiphy.wowlan_config->any &&
13288                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13289                     (rdev->wiphy.wowlan_config->disconnect &&
13290                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13291                     (rdev->wiphy.wowlan_config->magic_pkt &&
13292                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13293                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13294                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13295                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13296                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13297                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13298                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13299                     (rdev->wiphy.wowlan_config->rfkill_release &&
13300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13301                         goto nla_put_failure;
13302
13303                 if (nl80211_send_wowlan_patterns(msg, rdev))
13304                         goto nla_put_failure;
13305
13306                 if (nl80211_send_wowlan_tcp(msg,
13307                                             rdev->wiphy.wowlan_config->tcp))
13308                         goto nla_put_failure;
13309
13310                 if (nl80211_send_wowlan_nd(
13311                             msg,
13312                             rdev->wiphy.wowlan_config->nd_config))
13313                         goto nla_put_failure;
13314
13315                 nla_nest_end(msg, nl_wowlan);
13316         }
13317
13318         genlmsg_end(msg, hdr);
13319         return genlmsg_reply(msg, info);
13320
13321 nla_put_failure:
13322         nlmsg_free(msg);
13323         return -ENOBUFS;
13324 }
13325
13326 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13327                                     struct nlattr *attr,
13328                                     struct cfg80211_wowlan *trig)
13329 {
13330         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13331         struct cfg80211_wowlan_tcp *cfg;
13332         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13333         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13334         u32 size;
13335         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13336         int err, port;
13337
13338         if (!rdev->wiphy.wowlan->tcp)
13339                 return -EINVAL;
13340
13341         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13342                                           nl80211_wowlan_tcp_policy, NULL);
13343         if (err)
13344                 return err;
13345
13346         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13347             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13348             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13349             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13350             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13351             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13352             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13353             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13354                 return -EINVAL;
13355
13356         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13357         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13358                 return -EINVAL;
13359
13360         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13361                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13362             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13363                 return -EINVAL;
13364
13365         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13366         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13367                 return -EINVAL;
13368
13369         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13370         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13371                 return -EINVAL;
13372
13373         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13374                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13375
13376                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13377                 tokens_size = tokln - sizeof(*tok);
13378
13379                 if (!tok->len || tokens_size % tok->len)
13380                         return -EINVAL;
13381                 if (!rdev->wiphy.wowlan->tcp->tok)
13382                         return -EINVAL;
13383                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13384                         return -EINVAL;
13385                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13386                         return -EINVAL;
13387                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13388                         return -EINVAL;
13389                 if (tok->offset + tok->len > data_size)
13390                         return -EINVAL;
13391         }
13392
13393         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13394                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13395                 if (!rdev->wiphy.wowlan->tcp->seq)
13396                         return -EINVAL;
13397                 if (seq->len == 0 || seq->len > 4)
13398                         return -EINVAL;
13399                 if (seq->len + seq->offset > data_size)
13400                         return -EINVAL;
13401         }
13402
13403         size = sizeof(*cfg);
13404         size += data_size;
13405         size += wake_size + wake_mask_size;
13406         size += tokens_size;
13407
13408         cfg = kzalloc(size, GFP_KERNEL);
13409         if (!cfg)
13410                 return -ENOMEM;
13411         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13412         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13413         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13414                ETH_ALEN);
13415         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13416                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13417         else
13418                 port = 0;
13419 #ifdef CONFIG_INET
13420         /* allocate a socket and port for it and use it */
13421         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13422                             IPPROTO_TCP, &cfg->sock, 1);
13423         if (err) {
13424                 kfree(cfg);
13425                 return err;
13426         }
13427         if (inet_csk_get_port(cfg->sock->sk, port)) {
13428                 sock_release(cfg->sock);
13429                 kfree(cfg);
13430                 return -EADDRINUSE;
13431         }
13432         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13433 #else
13434         if (!port) {
13435                 kfree(cfg);
13436                 return -EINVAL;
13437         }
13438         cfg->src_port = port;
13439 #endif
13440
13441         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13442         cfg->payload_len = data_size;
13443         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13444         memcpy((void *)cfg->payload,
13445                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13446                data_size);
13447         if (seq)
13448                 cfg->payload_seq = *seq;
13449         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13450         cfg->wake_len = wake_size;
13451         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13452         memcpy((void *)cfg->wake_data,
13453                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13454                wake_size);
13455         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13456                          data_size + wake_size;
13457         memcpy((void *)cfg->wake_mask,
13458                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13459                wake_mask_size);
13460         if (tok) {
13461                 cfg->tokens_size = tokens_size;
13462                 cfg->payload_tok = *tok;
13463                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13464                        tokens_size);
13465         }
13466
13467         trig->tcp = cfg;
13468
13469         return 0;
13470 }
13471
13472 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13473                                    const struct wiphy_wowlan_support *wowlan,
13474                                    struct nlattr *attr,
13475                                    struct cfg80211_wowlan *trig)
13476 {
13477         struct nlattr **tb;
13478         int err;
13479
13480         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13481         if (!tb)
13482                 return -ENOMEM;
13483
13484         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13485                 err = -EOPNOTSUPP;
13486                 goto out;
13487         }
13488
13489         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13490                                           nl80211_policy, NULL);
13491         if (err)
13492                 goto out;
13493
13494         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13495                                                    wowlan->max_nd_match_sets);
13496         err = PTR_ERR_OR_ZERO(trig->nd_config);
13497         if (err)
13498                 trig->nd_config = NULL;
13499
13500 out:
13501         kfree(tb);
13502         return err;
13503 }
13504
13505 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13506 {
13507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13508         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13509         struct cfg80211_wowlan new_triggers = {};
13510         struct cfg80211_wowlan *ntrig;
13511         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13512         int err, i;
13513         bool prev_enabled = rdev->wiphy.wowlan_config;
13514         bool regular = false;
13515
13516         if (!wowlan)
13517                 return -EOPNOTSUPP;
13518
13519         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13520                 cfg80211_rdev_free_wowlan(rdev);
13521                 rdev->wiphy.wowlan_config = NULL;
13522                 goto set_wakeup;
13523         }
13524
13525         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13526                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13527                                           nl80211_wowlan_policy, info->extack);
13528         if (err)
13529                 return err;
13530
13531         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13532                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13533                         return -EINVAL;
13534                 new_triggers.any = true;
13535         }
13536
13537         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13538                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13539                         return -EINVAL;
13540                 new_triggers.disconnect = true;
13541                 regular = true;
13542         }
13543
13544         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13545                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13546                         return -EINVAL;
13547                 new_triggers.magic_pkt = true;
13548                 regular = true;
13549         }
13550
13551         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13552                 return -EINVAL;
13553
13554         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13555                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13556                         return -EINVAL;
13557                 new_triggers.gtk_rekey_failure = true;
13558                 regular = true;
13559         }
13560
13561         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13562                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13563                         return -EINVAL;
13564                 new_triggers.eap_identity_req = true;
13565                 regular = true;
13566         }
13567
13568         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13569                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13570                         return -EINVAL;
13571                 new_triggers.four_way_handshake = true;
13572                 regular = true;
13573         }
13574
13575         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13576                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13577                         return -EINVAL;
13578                 new_triggers.rfkill_release = true;
13579                 regular = true;
13580         }
13581
13582         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13583                 struct nlattr *pat;
13584                 int n_patterns = 0;
13585                 int rem, pat_len, mask_len, pkt_offset;
13586                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13587
13588                 regular = true;
13589
13590                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13591                                     rem)
13592                         n_patterns++;
13593                 if (n_patterns > wowlan->n_patterns)
13594                         return -EINVAL;
13595
13596                 new_triggers.patterns = kcalloc(n_patterns,
13597                                                 sizeof(new_triggers.patterns[0]),
13598                                                 GFP_KERNEL);
13599                 if (!new_triggers.patterns)
13600                         return -ENOMEM;
13601
13602                 new_triggers.n_patterns = n_patterns;
13603                 i = 0;
13604
13605                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13606                                     rem) {
13607                         u8 *mask_pat;
13608
13609                         err = nla_parse_nested_deprecated(pat_tb,
13610                                                           MAX_NL80211_PKTPAT,
13611                                                           pat,
13612                                                           nl80211_packet_pattern_policy,
13613                                                           info->extack);
13614                         if (err)
13615                                 goto error;
13616
13617                         err = -EINVAL;
13618                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13619                             !pat_tb[NL80211_PKTPAT_PATTERN])
13620                                 goto error;
13621                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13622                         mask_len = DIV_ROUND_UP(pat_len, 8);
13623                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13624                                 goto error;
13625                         if (pat_len > wowlan->pattern_max_len ||
13626                             pat_len < wowlan->pattern_min_len)
13627                                 goto error;
13628
13629                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
13630                                 pkt_offset = 0;
13631                         else
13632                                 pkt_offset = nla_get_u32(
13633                                         pat_tb[NL80211_PKTPAT_OFFSET]);
13634                         if (pkt_offset > wowlan->max_pkt_offset)
13635                                 goto error;
13636                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13637
13638                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13639                         if (!mask_pat) {
13640                                 err = -ENOMEM;
13641                                 goto error;
13642                         }
13643                         new_triggers.patterns[i].mask = mask_pat;
13644                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13645                                mask_len);
13646                         mask_pat += mask_len;
13647                         new_triggers.patterns[i].pattern = mask_pat;
13648                         new_triggers.patterns[i].pattern_len = pat_len;
13649                         memcpy(mask_pat,
13650                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13651                                pat_len);
13652                         i++;
13653                 }
13654         }
13655
13656         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13657                 regular = true;
13658                 err = nl80211_parse_wowlan_tcp(
13659                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13660                         &new_triggers);
13661                 if (err)
13662                         goto error;
13663         }
13664
13665         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13666                 regular = true;
13667                 err = nl80211_parse_wowlan_nd(
13668                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13669                         &new_triggers);
13670                 if (err)
13671                         goto error;
13672         }
13673
13674         /* The 'any' trigger means the device continues operating more or less
13675          * as in its normal operation mode and wakes up the host on most of the
13676          * normal interrupts (like packet RX, ...)
13677          * It therefore makes little sense to combine with the more constrained
13678          * wakeup trigger modes.
13679          */
13680         if (new_triggers.any && regular) {
13681                 err = -EINVAL;
13682                 goto error;
13683         }
13684
13685         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13686         if (!ntrig) {
13687                 err = -ENOMEM;
13688                 goto error;
13689         }
13690         cfg80211_rdev_free_wowlan(rdev);
13691         rdev->wiphy.wowlan_config = ntrig;
13692
13693  set_wakeup:
13694         if (rdev->ops->set_wakeup &&
13695             prev_enabled != !!rdev->wiphy.wowlan_config)
13696                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13697
13698         return 0;
13699  error:
13700         for (i = 0; i < new_triggers.n_patterns; i++)
13701                 kfree(new_triggers.patterns[i].mask);
13702         kfree(new_triggers.patterns);
13703         if (new_triggers.tcp && new_triggers.tcp->sock)
13704                 sock_release(new_triggers.tcp->sock);
13705         kfree(new_triggers.tcp);
13706         kfree(new_triggers.nd_config);
13707         return err;
13708 }
13709 #endif
13710
13711 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13712                                        struct cfg80211_registered_device *rdev)
13713 {
13714         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13715         int i, j, pat_len;
13716         struct cfg80211_coalesce_rules *rule;
13717
13718         if (!rdev->coalesce->n_rules)
13719                 return 0;
13720
13721         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13722         if (!nl_rules)
13723                 return -ENOBUFS;
13724
13725         for (i = 0; i < rdev->coalesce->n_rules; i++) {
13726                 nl_rule = nla_nest_start_noflag(msg, i + 1);
13727                 if (!nl_rule)
13728                         return -ENOBUFS;
13729
13730                 rule = &rdev->coalesce->rules[i];
13731                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13732                                 rule->delay))
13733                         return -ENOBUFS;
13734
13735                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13736                                 rule->condition))
13737                         return -ENOBUFS;
13738
13739                 nl_pats = nla_nest_start_noflag(msg,
13740                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13741                 if (!nl_pats)
13742                         return -ENOBUFS;
13743
13744                 for (j = 0; j < rule->n_patterns; j++) {
13745                         nl_pat = nla_nest_start_noflag(msg, j + 1);
13746                         if (!nl_pat)
13747                                 return -ENOBUFS;
13748                         pat_len = rule->patterns[j].pattern_len;
13749                         if (nla_put(msg, NL80211_PKTPAT_MASK,
13750                                     DIV_ROUND_UP(pat_len, 8),
13751                                     rule->patterns[j].mask) ||
13752                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13753                                     rule->patterns[j].pattern) ||
13754                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13755                                         rule->patterns[j].pkt_offset))
13756                                 return -ENOBUFS;
13757                         nla_nest_end(msg, nl_pat);
13758                 }
13759                 nla_nest_end(msg, nl_pats);
13760                 nla_nest_end(msg, nl_rule);
13761         }
13762         nla_nest_end(msg, nl_rules);
13763
13764         return 0;
13765 }
13766
13767 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13768 {
13769         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13770         struct sk_buff *msg;
13771         void *hdr;
13772
13773         if (!rdev->wiphy.coalesce)
13774                 return -EOPNOTSUPP;
13775
13776         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13777         if (!msg)
13778                 return -ENOMEM;
13779
13780         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13781                              NL80211_CMD_GET_COALESCE);
13782         if (!hdr)
13783                 goto nla_put_failure;
13784
13785         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13786                 goto nla_put_failure;
13787
13788         genlmsg_end(msg, hdr);
13789         return genlmsg_reply(msg, info);
13790
13791 nla_put_failure:
13792         nlmsg_free(msg);
13793         return -ENOBUFS;
13794 }
13795
13796 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13797 {
13798         struct cfg80211_coalesce *coalesce = rdev->coalesce;
13799         int i, j;
13800         struct cfg80211_coalesce_rules *rule;
13801
13802         if (!coalesce)
13803                 return;
13804
13805         for (i = 0; i < coalesce->n_rules; i++) {
13806                 rule = &coalesce->rules[i];
13807                 for (j = 0; j < rule->n_patterns; j++)
13808                         kfree(rule->patterns[j].mask);
13809                 kfree(rule->patterns);
13810         }
13811         kfree(coalesce->rules);
13812         kfree(coalesce);
13813         rdev->coalesce = NULL;
13814 }
13815
13816 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13817                                        struct nlattr *rule,
13818                                        struct cfg80211_coalesce_rules *new_rule)
13819 {
13820         int err, i;
13821         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13822         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13823         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13824         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13825
13826         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13827                                           rule, nl80211_coalesce_policy, NULL);
13828         if (err)
13829                 return err;
13830
13831         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13832                 new_rule->delay =
13833                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13834         if (new_rule->delay > coalesce->max_delay)
13835                 return -EINVAL;
13836
13837         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13838                 new_rule->condition =
13839                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13840
13841         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13842                 return -EINVAL;
13843
13844         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13845                             rem)
13846                 n_patterns++;
13847         if (n_patterns > coalesce->n_patterns)
13848                 return -EINVAL;
13849
13850         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13851                                      GFP_KERNEL);
13852         if (!new_rule->patterns)
13853                 return -ENOMEM;
13854
13855         new_rule->n_patterns = n_patterns;
13856         i = 0;
13857
13858         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13859                             rem) {
13860                 u8 *mask_pat;
13861
13862                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13863                                                   pat,
13864                                                   nl80211_packet_pattern_policy,
13865                                                   NULL);
13866                 if (err)
13867                         return err;
13868
13869                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13870                     !pat_tb[NL80211_PKTPAT_PATTERN])
13871                         return -EINVAL;
13872                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13873                 mask_len = DIV_ROUND_UP(pat_len, 8);
13874                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13875                         return -EINVAL;
13876                 if (pat_len > coalesce->pattern_max_len ||
13877                     pat_len < coalesce->pattern_min_len)
13878                         return -EINVAL;
13879
13880                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13881                         pkt_offset = 0;
13882                 else
13883                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13884                 if (pkt_offset > coalesce->max_pkt_offset)
13885                         return -EINVAL;
13886                 new_rule->patterns[i].pkt_offset = pkt_offset;
13887
13888                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13889                 if (!mask_pat)
13890                         return -ENOMEM;
13891
13892                 new_rule->patterns[i].mask = mask_pat;
13893                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13894                        mask_len);
13895
13896                 mask_pat += mask_len;
13897                 new_rule->patterns[i].pattern = mask_pat;
13898                 new_rule->patterns[i].pattern_len = pat_len;
13899                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13900                        pat_len);
13901                 i++;
13902         }
13903
13904         return 0;
13905 }
13906
13907 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13908 {
13909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13910         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13911         struct cfg80211_coalesce new_coalesce = {};
13912         struct cfg80211_coalesce *n_coalesce;
13913         int err, rem_rule, n_rules = 0, i, j;
13914         struct nlattr *rule;
13915         struct cfg80211_coalesce_rules *tmp_rule;
13916
13917         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13918                 return -EOPNOTSUPP;
13919
13920         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13921                 cfg80211_rdev_free_coalesce(rdev);
13922                 rdev_set_coalesce(rdev, NULL);
13923                 return 0;
13924         }
13925
13926         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13927                             rem_rule)
13928                 n_rules++;
13929         if (n_rules > coalesce->n_rules)
13930                 return -EINVAL;
13931
13932         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13933                                      GFP_KERNEL);
13934         if (!new_coalesce.rules)
13935                 return -ENOMEM;
13936
13937         new_coalesce.n_rules = n_rules;
13938         i = 0;
13939
13940         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13941                             rem_rule) {
13942                 err = nl80211_parse_coalesce_rule(rdev, rule,
13943                                                   &new_coalesce.rules[i]);
13944                 if (err)
13945                         goto error;
13946
13947                 i++;
13948         }
13949
13950         err = rdev_set_coalesce(rdev, &new_coalesce);
13951         if (err)
13952                 goto error;
13953
13954         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13955         if (!n_coalesce) {
13956                 err = -ENOMEM;
13957                 goto error;
13958         }
13959         cfg80211_rdev_free_coalesce(rdev);
13960         rdev->coalesce = n_coalesce;
13961
13962         return 0;
13963 error:
13964         for (i = 0; i < new_coalesce.n_rules; i++) {
13965                 tmp_rule = &new_coalesce.rules[i];
13966                 for (j = 0; j < tmp_rule->n_patterns; j++)
13967                         kfree(tmp_rule->patterns[j].mask);
13968                 kfree(tmp_rule->patterns);
13969         }
13970         kfree(new_coalesce.rules);
13971
13972         return err;
13973 }
13974
13975 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
13976 {
13977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13978         struct net_device *dev = info->user_ptr[1];
13979         struct wireless_dev *wdev = dev->ieee80211_ptr;
13980         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
13981         struct cfg80211_gtk_rekey_data rekey_data = {};
13982         int err;
13983
13984         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
13985                 return -EINVAL;
13986
13987         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
13988                                           info->attrs[NL80211_ATTR_REKEY_DATA],
13989                                           nl80211_rekey_policy, info->extack);
13990         if (err)
13991                 return err;
13992
13993         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
13994             !tb[NL80211_REKEY_DATA_KCK])
13995                 return -EINVAL;
13996         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
13997             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13998               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
13999                 return -ERANGE;
14000         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14001             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14002               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14003              !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14004                nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14005                 return -ERANGE;
14006
14007         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14008         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14009         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14010         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14011         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14012         if (tb[NL80211_REKEY_DATA_AKM])
14013                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14014
14015         wdev_lock(wdev);
14016         if (!wdev->connected) {
14017                 err = -ENOTCONN;
14018                 goto out;
14019         }
14020
14021         if (!rdev->ops->set_rekey_data) {
14022                 err = -EOPNOTSUPP;
14023                 goto out;
14024         }
14025
14026         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
14027  out:
14028         wdev_unlock(wdev);
14029         return err;
14030 }
14031
14032 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14033                                              struct genl_info *info)
14034 {
14035         struct net_device *dev = info->user_ptr[1];
14036         struct wireless_dev *wdev = dev->ieee80211_ptr;
14037
14038         if (wdev->iftype != NL80211_IFTYPE_AP &&
14039             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14040                 return -EINVAL;
14041
14042         if (wdev->ap_unexpected_nlportid)
14043                 return -EBUSY;
14044
14045         wdev->ap_unexpected_nlportid = info->snd_portid;
14046         return 0;
14047 }
14048
14049 static int nl80211_probe_client(struct sk_buff *skb,
14050                                 struct genl_info *info)
14051 {
14052         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14053         struct net_device *dev = info->user_ptr[1];
14054         struct wireless_dev *wdev = dev->ieee80211_ptr;
14055         struct sk_buff *msg;
14056         void *hdr;
14057         const u8 *addr;
14058         u64 cookie;
14059         int err;
14060
14061         if (wdev->iftype != NL80211_IFTYPE_AP &&
14062             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14063                 return -EOPNOTSUPP;
14064
14065         if (!info->attrs[NL80211_ATTR_MAC])
14066                 return -EINVAL;
14067
14068         if (!rdev->ops->probe_client)
14069                 return -EOPNOTSUPP;
14070
14071         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14072         if (!msg)
14073                 return -ENOMEM;
14074
14075         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14076                              NL80211_CMD_PROBE_CLIENT);
14077         if (!hdr) {
14078                 err = -ENOBUFS;
14079                 goto free_msg;
14080         }
14081
14082         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14083
14084         err = rdev_probe_client(rdev, dev, addr, &cookie);
14085         if (err)
14086                 goto free_msg;
14087
14088         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14089                               NL80211_ATTR_PAD))
14090                 goto nla_put_failure;
14091
14092         genlmsg_end(msg, hdr);
14093
14094         return genlmsg_reply(msg, info);
14095
14096  nla_put_failure:
14097         err = -ENOBUFS;
14098  free_msg:
14099         nlmsg_free(msg);
14100         return err;
14101 }
14102
14103 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14104 {
14105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14106         struct cfg80211_beacon_registration *reg, *nreg;
14107         int rv;
14108
14109         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14110                 return -EOPNOTSUPP;
14111
14112         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14113         if (!nreg)
14114                 return -ENOMEM;
14115
14116         /* First, check if already registered. */
14117         spin_lock_bh(&rdev->beacon_registrations_lock);
14118         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14119                 if (reg->nlportid == info->snd_portid) {
14120                         rv = -EALREADY;
14121                         goto out_err;
14122                 }
14123         }
14124         /* Add it to the list */
14125         nreg->nlportid = info->snd_portid;
14126         list_add(&nreg->list, &rdev->beacon_registrations);
14127
14128         spin_unlock_bh(&rdev->beacon_registrations_lock);
14129
14130         return 0;
14131 out_err:
14132         spin_unlock_bh(&rdev->beacon_registrations_lock);
14133         kfree(nreg);
14134         return rv;
14135 }
14136
14137 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14138 {
14139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14140         struct wireless_dev *wdev = info->user_ptr[1];
14141         int err;
14142
14143         if (!rdev->ops->start_p2p_device)
14144                 return -EOPNOTSUPP;
14145
14146         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14147                 return -EOPNOTSUPP;
14148
14149         if (wdev_running(wdev))
14150                 return 0;
14151
14152         if (rfkill_blocked(rdev->wiphy.rfkill))
14153                 return -ERFKILL;
14154
14155         err = rdev_start_p2p_device(rdev, wdev);
14156         if (err)
14157                 return err;
14158
14159         wdev->is_running = true;
14160         rdev->opencount++;
14161
14162         return 0;
14163 }
14164
14165 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14166 {
14167         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14168         struct wireless_dev *wdev = info->user_ptr[1];
14169
14170         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14171                 return -EOPNOTSUPP;
14172
14173         if (!rdev->ops->stop_p2p_device)
14174                 return -EOPNOTSUPP;
14175
14176         cfg80211_stop_p2p_device(rdev, wdev);
14177
14178         return 0;
14179 }
14180
14181 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14182 {
14183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14184         struct wireless_dev *wdev = info->user_ptr[1];
14185         struct cfg80211_nan_conf conf = {};
14186         int err;
14187
14188         if (wdev->iftype != NL80211_IFTYPE_NAN)
14189                 return -EOPNOTSUPP;
14190
14191         if (wdev_running(wdev))
14192                 return -EEXIST;
14193
14194         if (rfkill_blocked(rdev->wiphy.rfkill))
14195                 return -ERFKILL;
14196
14197         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14198                 return -EINVAL;
14199
14200         conf.master_pref =
14201                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14202
14203         if (info->attrs[NL80211_ATTR_BANDS]) {
14204                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14205
14206                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14207                         return -EOPNOTSUPP;
14208
14209                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14210                         return -EINVAL;
14211
14212                 conf.bands = bands;
14213         }
14214
14215         err = rdev_start_nan(rdev, wdev, &conf);
14216         if (err)
14217                 return err;
14218
14219         wdev->is_running = true;
14220         rdev->opencount++;
14221
14222         return 0;
14223 }
14224
14225 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14226 {
14227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14228         struct wireless_dev *wdev = info->user_ptr[1];
14229
14230         if (wdev->iftype != NL80211_IFTYPE_NAN)
14231                 return -EOPNOTSUPP;
14232
14233         cfg80211_stop_nan(rdev, wdev);
14234
14235         return 0;
14236 }
14237
14238 static int validate_nan_filter(struct nlattr *filter_attr)
14239 {
14240         struct nlattr *attr;
14241         int len = 0, n_entries = 0, rem;
14242
14243         nla_for_each_nested(attr, filter_attr, rem) {
14244                 len += nla_len(attr);
14245                 n_entries++;
14246         }
14247
14248         if (len >= U8_MAX)
14249                 return -EINVAL;
14250
14251         return n_entries;
14252 }
14253
14254 static int handle_nan_filter(struct nlattr *attr_filter,
14255                              struct cfg80211_nan_func *func,
14256                              bool tx)
14257 {
14258         struct nlattr *attr;
14259         int n_entries, rem, i;
14260         struct cfg80211_nan_func_filter *filter;
14261
14262         n_entries = validate_nan_filter(attr_filter);
14263         if (n_entries < 0)
14264                 return n_entries;
14265
14266         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14267
14268         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14269         if (!filter)
14270                 return -ENOMEM;
14271
14272         i = 0;
14273         nla_for_each_nested(attr, attr_filter, rem) {
14274                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14275                 if (!filter[i].filter)
14276                         goto err;
14277
14278                 filter[i].len = nla_len(attr);
14279                 i++;
14280         }
14281         if (tx) {
14282                 func->num_tx_filters = n_entries;
14283                 func->tx_filters = filter;
14284         } else {
14285                 func->num_rx_filters = n_entries;
14286                 func->rx_filters = filter;
14287         }
14288
14289         return 0;
14290
14291 err:
14292         i = 0;
14293         nla_for_each_nested(attr, attr_filter, rem) {
14294                 kfree(filter[i].filter);
14295                 i++;
14296         }
14297         kfree(filter);
14298         return -ENOMEM;
14299 }
14300
14301 static int nl80211_nan_add_func(struct sk_buff *skb,
14302                                 struct genl_info *info)
14303 {
14304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14305         struct wireless_dev *wdev = info->user_ptr[1];
14306         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14307         struct cfg80211_nan_func *func;
14308         struct sk_buff *msg = NULL;
14309         void *hdr = NULL;
14310         int err = 0;
14311
14312         if (wdev->iftype != NL80211_IFTYPE_NAN)
14313                 return -EOPNOTSUPP;
14314
14315         if (!wdev_running(wdev))
14316                 return -ENOTCONN;
14317
14318         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14319                 return -EINVAL;
14320
14321         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14322                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14323                                           nl80211_nan_func_policy,
14324                                           info->extack);
14325         if (err)
14326                 return err;
14327
14328         func = kzalloc(sizeof(*func), GFP_KERNEL);
14329         if (!func)
14330                 return -ENOMEM;
14331
14332         func->cookie = cfg80211_assign_cookie(rdev);
14333
14334         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14335                 err = -EINVAL;
14336                 goto out;
14337         }
14338
14339
14340         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14341
14342         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14343                 err = -EINVAL;
14344                 goto out;
14345         }
14346
14347         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14348                sizeof(func->service_id));
14349
14350         func->close_range =
14351                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14352
14353         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14354                 func->serv_spec_info_len =
14355                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14356                 func->serv_spec_info =
14357                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14358                                 func->serv_spec_info_len,
14359                                 GFP_KERNEL);
14360                 if (!func->serv_spec_info) {
14361                         err = -ENOMEM;
14362                         goto out;
14363                 }
14364         }
14365
14366         if (tb[NL80211_NAN_FUNC_TTL])
14367                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14368
14369         switch (func->type) {
14370         case NL80211_NAN_FUNC_PUBLISH:
14371                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14372                         err = -EINVAL;
14373                         goto out;
14374                 }
14375
14376                 func->publish_type =
14377                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14378                 func->publish_bcast =
14379                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14380
14381                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14382                         func->publish_bcast) {
14383                         err = -EINVAL;
14384                         goto out;
14385                 }
14386                 break;
14387         case NL80211_NAN_FUNC_SUBSCRIBE:
14388                 func->subscribe_active =
14389                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14390                 break;
14391         case NL80211_NAN_FUNC_FOLLOW_UP:
14392                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14393                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14394                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14395                         err = -EINVAL;
14396                         goto out;
14397                 }
14398
14399                 func->followup_id =
14400                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14401                 func->followup_reqid =
14402                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14403                 memcpy(func->followup_dest.addr,
14404                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14405                        sizeof(func->followup_dest.addr));
14406                 if (func->ttl) {
14407                         err = -EINVAL;
14408                         goto out;
14409                 }
14410                 break;
14411         default:
14412                 err = -EINVAL;
14413                 goto out;
14414         }
14415
14416         if (tb[NL80211_NAN_FUNC_SRF]) {
14417                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14418
14419                 err = nla_parse_nested_deprecated(srf_tb,
14420                                                   NL80211_NAN_SRF_ATTR_MAX,
14421                                                   tb[NL80211_NAN_FUNC_SRF],
14422                                                   nl80211_nan_srf_policy,
14423                                                   info->extack);
14424                 if (err)
14425                         goto out;
14426
14427                 func->srf_include =
14428                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14429
14430                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14431                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14432                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14433                                 err = -EINVAL;
14434                                 goto out;
14435                         }
14436
14437                         func->srf_bf_len =
14438                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14439                         func->srf_bf =
14440                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14441                                         func->srf_bf_len, GFP_KERNEL);
14442                         if (!func->srf_bf) {
14443                                 err = -ENOMEM;
14444                                 goto out;
14445                         }
14446
14447                         func->srf_bf_idx =
14448                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14449                 } else {
14450                         struct nlattr *attr, *mac_attr =
14451                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14452                         int n_entries, rem, i = 0;
14453
14454                         if (!mac_attr) {
14455                                 err = -EINVAL;
14456                                 goto out;
14457                         }
14458
14459                         n_entries = validate_acl_mac_addrs(mac_attr);
14460                         if (n_entries <= 0) {
14461                                 err = -EINVAL;
14462                                 goto out;
14463                         }
14464
14465                         func->srf_num_macs = n_entries;
14466                         func->srf_macs =
14467                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14468                                         GFP_KERNEL);
14469                         if (!func->srf_macs) {
14470                                 err = -ENOMEM;
14471                                 goto out;
14472                         }
14473
14474                         nla_for_each_nested(attr, mac_attr, rem)
14475                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14476                                        sizeof(*func->srf_macs));
14477                 }
14478         }
14479
14480         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14481                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14482                                         func, true);
14483                 if (err)
14484                         goto out;
14485         }
14486
14487         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14488                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14489                                         func, false);
14490                 if (err)
14491                         goto out;
14492         }
14493
14494         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14495         if (!msg) {
14496                 err = -ENOMEM;
14497                 goto out;
14498         }
14499
14500         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14501                              NL80211_CMD_ADD_NAN_FUNCTION);
14502         /* This can't really happen - we just allocated 4KB */
14503         if (WARN_ON(!hdr)) {
14504                 err = -ENOMEM;
14505                 goto out;
14506         }
14507
14508         err = rdev_add_nan_func(rdev, wdev, func);
14509 out:
14510         if (err < 0) {
14511                 cfg80211_free_nan_func(func);
14512                 nlmsg_free(msg);
14513                 return err;
14514         }
14515
14516         /* propagate the instance id and cookie to userspace  */
14517         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14518                               NL80211_ATTR_PAD))
14519                 goto nla_put_failure;
14520
14521         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14522         if (!func_attr)
14523                 goto nla_put_failure;
14524
14525         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14526                        func->instance_id))
14527                 goto nla_put_failure;
14528
14529         nla_nest_end(msg, func_attr);
14530
14531         genlmsg_end(msg, hdr);
14532         return genlmsg_reply(msg, info);
14533
14534 nla_put_failure:
14535         nlmsg_free(msg);
14536         return -ENOBUFS;
14537 }
14538
14539 static int nl80211_nan_del_func(struct sk_buff *skb,
14540                                struct genl_info *info)
14541 {
14542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14543         struct wireless_dev *wdev = info->user_ptr[1];
14544         u64 cookie;
14545
14546         if (wdev->iftype != NL80211_IFTYPE_NAN)
14547                 return -EOPNOTSUPP;
14548
14549         if (!wdev_running(wdev))
14550                 return -ENOTCONN;
14551
14552         if (!info->attrs[NL80211_ATTR_COOKIE])
14553                 return -EINVAL;
14554
14555         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14556
14557         rdev_del_nan_func(rdev, wdev, cookie);
14558
14559         return 0;
14560 }
14561
14562 static int nl80211_nan_change_config(struct sk_buff *skb,
14563                                      struct genl_info *info)
14564 {
14565         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14566         struct wireless_dev *wdev = info->user_ptr[1];
14567         struct cfg80211_nan_conf conf = {};
14568         u32 changed = 0;
14569
14570         if (wdev->iftype != NL80211_IFTYPE_NAN)
14571                 return -EOPNOTSUPP;
14572
14573         if (!wdev_running(wdev))
14574                 return -ENOTCONN;
14575
14576         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14577                 conf.master_pref =
14578                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14579                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14580                         return -EINVAL;
14581
14582                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14583         }
14584
14585         if (info->attrs[NL80211_ATTR_BANDS]) {
14586                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14587
14588                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14589                         return -EOPNOTSUPP;
14590
14591                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14592                         return -EINVAL;
14593
14594                 conf.bands = bands;
14595                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14596         }
14597
14598         if (!changed)
14599                 return -EINVAL;
14600
14601         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14602 }
14603
14604 void cfg80211_nan_match(struct wireless_dev *wdev,
14605                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14606 {
14607         struct wiphy *wiphy = wdev->wiphy;
14608         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14609         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14610         struct sk_buff *msg;
14611         void *hdr;
14612
14613         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14614                 return;
14615
14616         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14617         if (!msg)
14618                 return;
14619
14620         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14621         if (!hdr) {
14622                 nlmsg_free(msg);
14623                 return;
14624         }
14625
14626         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14627             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14628                                          wdev->netdev->ifindex)) ||
14629             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14630                               NL80211_ATTR_PAD))
14631                 goto nla_put_failure;
14632
14633         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14634                               NL80211_ATTR_PAD) ||
14635             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14636                 goto nla_put_failure;
14637
14638         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14639         if (!match_attr)
14640                 goto nla_put_failure;
14641
14642         local_func_attr = nla_nest_start_noflag(msg,
14643                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14644         if (!local_func_attr)
14645                 goto nla_put_failure;
14646
14647         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14648                 goto nla_put_failure;
14649
14650         nla_nest_end(msg, local_func_attr);
14651
14652         peer_func_attr = nla_nest_start_noflag(msg,
14653                                                NL80211_NAN_MATCH_FUNC_PEER);
14654         if (!peer_func_attr)
14655                 goto nla_put_failure;
14656
14657         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14658             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14659                 goto nla_put_failure;
14660
14661         if (match->info && match->info_len &&
14662             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14663                     match->info))
14664                 goto nla_put_failure;
14665
14666         nla_nest_end(msg, peer_func_attr);
14667         nla_nest_end(msg, match_attr);
14668         genlmsg_end(msg, hdr);
14669
14670         if (!wdev->owner_nlportid)
14671                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14672                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14673         else
14674                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14675                                 wdev->owner_nlportid);
14676
14677         return;
14678
14679 nla_put_failure:
14680         nlmsg_free(msg);
14681 }
14682 EXPORT_SYMBOL(cfg80211_nan_match);
14683
14684 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14685                                   u8 inst_id,
14686                                   enum nl80211_nan_func_term_reason reason,
14687                                   u64 cookie, gfp_t gfp)
14688 {
14689         struct wiphy *wiphy = wdev->wiphy;
14690         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14691         struct sk_buff *msg;
14692         struct nlattr *func_attr;
14693         void *hdr;
14694
14695         if (WARN_ON(!inst_id))
14696                 return;
14697
14698         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14699         if (!msg)
14700                 return;
14701
14702         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14703         if (!hdr) {
14704                 nlmsg_free(msg);
14705                 return;
14706         }
14707
14708         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14709             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14710                                          wdev->netdev->ifindex)) ||
14711             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14712                               NL80211_ATTR_PAD))
14713                 goto nla_put_failure;
14714
14715         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14716                               NL80211_ATTR_PAD))
14717                 goto nla_put_failure;
14718
14719         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14720         if (!func_attr)
14721                 goto nla_put_failure;
14722
14723         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14724             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14725                 goto nla_put_failure;
14726
14727         nla_nest_end(msg, func_attr);
14728         genlmsg_end(msg, hdr);
14729
14730         if (!wdev->owner_nlportid)
14731                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14732                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14733         else
14734                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14735                                 wdev->owner_nlportid);
14736
14737         return;
14738
14739 nla_put_failure:
14740         nlmsg_free(msg);
14741 }
14742 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14743
14744 static int nl80211_get_protocol_features(struct sk_buff *skb,
14745                                          struct genl_info *info)
14746 {
14747         void *hdr;
14748         struct sk_buff *msg;
14749
14750         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14751         if (!msg)
14752                 return -ENOMEM;
14753
14754         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14755                              NL80211_CMD_GET_PROTOCOL_FEATURES);
14756         if (!hdr)
14757                 goto nla_put_failure;
14758
14759         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14760                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14761                 goto nla_put_failure;
14762
14763         genlmsg_end(msg, hdr);
14764         return genlmsg_reply(msg, info);
14765
14766  nla_put_failure:
14767         kfree_skb(msg);
14768         return -ENOBUFS;
14769 }
14770
14771 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14772 {
14773         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14774         struct cfg80211_update_ft_ies_params ft_params;
14775         struct net_device *dev = info->user_ptr[1];
14776
14777         if (!rdev->ops->update_ft_ies)
14778                 return -EOPNOTSUPP;
14779
14780         if (!info->attrs[NL80211_ATTR_MDID] ||
14781             !info->attrs[NL80211_ATTR_IE])
14782                 return -EINVAL;
14783
14784         memset(&ft_params, 0, sizeof(ft_params));
14785         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14786         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14787         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14788
14789         return rdev_update_ft_ies(rdev, dev, &ft_params);
14790 }
14791
14792 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14793                                        struct genl_info *info)
14794 {
14795         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14796         struct wireless_dev *wdev = info->user_ptr[1];
14797         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14798         u16 duration;
14799         int ret;
14800
14801         if (!rdev->ops->crit_proto_start)
14802                 return -EOPNOTSUPP;
14803
14804         if (WARN_ON(!rdev->ops->crit_proto_stop))
14805                 return -EINVAL;
14806
14807         if (rdev->crit_proto_nlportid)
14808                 return -EBUSY;
14809
14810         /* determine protocol if provided */
14811         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14812                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14813
14814         if (proto >= NUM_NL80211_CRIT_PROTO)
14815                 return -EINVAL;
14816
14817         /* timeout must be provided */
14818         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14819                 return -EINVAL;
14820
14821         duration =
14822                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14823
14824         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14825         if (!ret)
14826                 rdev->crit_proto_nlportid = info->snd_portid;
14827
14828         return ret;
14829 }
14830
14831 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14832                                       struct genl_info *info)
14833 {
14834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14835         struct wireless_dev *wdev = info->user_ptr[1];
14836
14837         if (!rdev->ops->crit_proto_stop)
14838                 return -EOPNOTSUPP;
14839
14840         if (rdev->crit_proto_nlportid) {
14841                 rdev->crit_proto_nlportid = 0;
14842                 rdev_crit_proto_stop(rdev, wdev);
14843         }
14844         return 0;
14845 }
14846
14847 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14848                                        struct nlattr *attr,
14849                                        struct netlink_ext_ack *extack)
14850 {
14851         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14852                 if (attr->nla_type & NLA_F_NESTED) {
14853                         NL_SET_ERR_MSG_ATTR(extack, attr,
14854                                             "unexpected nested data");
14855                         return -EINVAL;
14856                 }
14857
14858                 return 0;
14859         }
14860
14861         if (!(attr->nla_type & NLA_F_NESTED)) {
14862                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14863                 return -EINVAL;
14864         }
14865
14866         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14867 }
14868
14869 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14870 {
14871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14872         struct wireless_dev *wdev =
14873                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14874                                            info->attrs);
14875         int i, err;
14876         u32 vid, subcmd;
14877
14878         if (!rdev->wiphy.vendor_commands)
14879                 return -EOPNOTSUPP;
14880
14881         if (IS_ERR(wdev)) {
14882                 err = PTR_ERR(wdev);
14883                 if (err != -EINVAL)
14884                         return err;
14885                 wdev = NULL;
14886         } else if (wdev->wiphy != &rdev->wiphy) {
14887                 return -EINVAL;
14888         }
14889
14890         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14891             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14892                 return -EINVAL;
14893
14894         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14895         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14896         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14897                 const struct wiphy_vendor_command *vcmd;
14898                 void *data = NULL;
14899                 int len = 0;
14900
14901                 vcmd = &rdev->wiphy.vendor_commands[i];
14902
14903                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14904                         continue;
14905
14906                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14907                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14908                         if (!wdev)
14909                                 return -EINVAL;
14910                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14911                             !wdev->netdev)
14912                                 return -EINVAL;
14913
14914                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14915                                 if (!wdev_running(wdev))
14916                                         return -ENETDOWN;
14917                         }
14918                 } else {
14919                         wdev = NULL;
14920                 }
14921
14922                 if (!vcmd->doit)
14923                         return -EOPNOTSUPP;
14924
14925                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14926                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14927                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14928
14929                         err = nl80211_vendor_check_policy(vcmd,
14930                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
14931                                         info->extack);
14932                         if (err)
14933                                 return err;
14934                 }
14935
14936                 rdev->cur_cmd_info = info;
14937                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14938                 rdev->cur_cmd_info = NULL;
14939                 return err;
14940         }
14941
14942         return -EOPNOTSUPP;
14943 }
14944
14945 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14946                                        struct netlink_callback *cb,
14947                                        struct cfg80211_registered_device **rdev,
14948                                        struct wireless_dev **wdev)
14949 {
14950         struct nlattr **attrbuf;
14951         u32 vid, subcmd;
14952         unsigned int i;
14953         int vcmd_idx = -1;
14954         int err;
14955         void *data = NULL;
14956         unsigned int data_len = 0;
14957
14958         if (cb->args[0]) {
14959                 /* subtract the 1 again here */
14960                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14961                 struct wireless_dev *tmp;
14962
14963                 if (!wiphy)
14964                         return -ENODEV;
14965                 *rdev = wiphy_to_rdev(wiphy);
14966                 *wdev = NULL;
14967
14968                 if (cb->args[1]) {
14969                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
14970                                 if (tmp->identifier == cb->args[1] - 1) {
14971                                         *wdev = tmp;
14972                                         break;
14973                                 }
14974                         }
14975                 }
14976
14977                 /* keep rtnl locked in successful case */
14978                 return 0;
14979         }
14980
14981         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
14982         if (!attrbuf)
14983                 return -ENOMEM;
14984
14985         err = nlmsg_parse_deprecated(cb->nlh,
14986                                      GENL_HDRLEN + nl80211_fam.hdrsize,
14987                                      attrbuf, nl80211_fam.maxattr,
14988                                      nl80211_policy, NULL);
14989         if (err)
14990                 goto out;
14991
14992         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
14993             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
14994                 err = -EINVAL;
14995                 goto out;
14996         }
14997
14998         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
14999         if (IS_ERR(*wdev))
15000                 *wdev = NULL;
15001
15002         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15003         if (IS_ERR(*rdev)) {
15004                 err = PTR_ERR(*rdev);
15005                 goto out;
15006         }
15007
15008         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15009         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15010
15011         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15012                 const struct wiphy_vendor_command *vcmd;
15013
15014                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15015
15016                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15017                         continue;
15018
15019                 if (!vcmd->dumpit) {
15020                         err = -EOPNOTSUPP;
15021                         goto out;
15022                 }
15023
15024                 vcmd_idx = i;
15025                 break;
15026         }
15027
15028         if (vcmd_idx < 0) {
15029                 err = -EOPNOTSUPP;
15030                 goto out;
15031         }
15032
15033         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15034                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15035                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15036
15037                 err = nl80211_vendor_check_policy(
15038                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15039                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
15040                                 cb->extack);
15041                 if (err)
15042                         goto out;
15043         }
15044
15045         /* 0 is the first index - add 1 to parse only once */
15046         cb->args[0] = (*rdev)->wiphy_idx + 1;
15047         /* add 1 to know if it was NULL */
15048         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15049         cb->args[2] = vcmd_idx;
15050         cb->args[3] = (unsigned long)data;
15051         cb->args[4] = data_len;
15052
15053         /* keep rtnl locked in successful case */
15054         err = 0;
15055 out:
15056         kfree(attrbuf);
15057         return err;
15058 }
15059
15060 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15061                                    struct netlink_callback *cb)
15062 {
15063         struct cfg80211_registered_device *rdev;
15064         struct wireless_dev *wdev;
15065         unsigned int vcmd_idx;
15066         const struct wiphy_vendor_command *vcmd;
15067         void *data;
15068         int data_len;
15069         int err;
15070         struct nlattr *vendor_data;
15071
15072         rtnl_lock();
15073         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15074         if (err)
15075                 goto out;
15076
15077         vcmd_idx = cb->args[2];
15078         data = (void *)cb->args[3];
15079         data_len = cb->args[4];
15080         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15081
15082         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15083                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15084                 if (!wdev) {
15085                         err = -EINVAL;
15086                         goto out;
15087                 }
15088                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15089                     !wdev->netdev) {
15090                         err = -EINVAL;
15091                         goto out;
15092                 }
15093
15094                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15095                         if (!wdev_running(wdev)) {
15096                                 err = -ENETDOWN;
15097                                 goto out;
15098                         }
15099                 }
15100         }
15101
15102         while (1) {
15103                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15104                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
15105                                            NL80211_CMD_VENDOR);
15106                 if (!hdr)
15107                         break;
15108
15109                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15110                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15111                                                wdev_id(wdev),
15112                                                NL80211_ATTR_PAD))) {
15113                         genlmsg_cancel(skb, hdr);
15114                         break;
15115                 }
15116
15117                 vendor_data = nla_nest_start_noflag(skb,
15118                                                     NL80211_ATTR_VENDOR_DATA);
15119                 if (!vendor_data) {
15120                         genlmsg_cancel(skb, hdr);
15121                         break;
15122                 }
15123
15124                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15125                                    (unsigned long *)&cb->args[5]);
15126                 nla_nest_end(skb, vendor_data);
15127
15128                 if (err == -ENOBUFS || err == -ENOENT) {
15129                         genlmsg_cancel(skb, hdr);
15130                         break;
15131                 } else if (err <= 0) {
15132                         genlmsg_cancel(skb, hdr);
15133                         goto out;
15134                 }
15135
15136                 genlmsg_end(skb, hdr);
15137         }
15138
15139         err = skb->len;
15140  out:
15141         rtnl_unlock();
15142         return err;
15143 }
15144
15145 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15146                                            enum nl80211_commands cmd,
15147                                            enum nl80211_attrs attr,
15148                                            int approxlen)
15149 {
15150         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15151
15152         if (WARN_ON(!rdev->cur_cmd_info))
15153                 return NULL;
15154
15155         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15156                                            rdev->cur_cmd_info->snd_portid,
15157                                            rdev->cur_cmd_info->snd_seq,
15158                                            cmd, attr, NULL, GFP_KERNEL);
15159 }
15160 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15161
15162 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15163 {
15164         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15165         void *hdr = ((void **)skb->cb)[1];
15166         struct nlattr *data = ((void **)skb->cb)[2];
15167
15168         /* clear CB data for netlink core to own from now on */
15169         memset(skb->cb, 0, sizeof(skb->cb));
15170
15171         if (WARN_ON(!rdev->cur_cmd_info)) {
15172                 kfree_skb(skb);
15173                 return -EINVAL;
15174         }
15175
15176         nla_nest_end(skb, data);
15177         genlmsg_end(skb, hdr);
15178         return genlmsg_reply(skb, rdev->cur_cmd_info);
15179 }
15180 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15181
15182 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15183 {
15184         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15185
15186         if (WARN_ON(!rdev->cur_cmd_info))
15187                 return 0;
15188
15189         return rdev->cur_cmd_info->snd_portid;
15190 }
15191 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15192
15193 static int nl80211_set_qos_map(struct sk_buff *skb,
15194                                struct genl_info *info)
15195 {
15196         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15197         struct cfg80211_qos_map *qos_map = NULL;
15198         struct net_device *dev = info->user_ptr[1];
15199         u8 *pos, len, num_des, des_len, des;
15200         int ret;
15201
15202         if (!rdev->ops->set_qos_map)
15203                 return -EOPNOTSUPP;
15204
15205         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15206                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15207                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15208
15209                 if (len % 2)
15210                         return -EINVAL;
15211
15212                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15213                 if (!qos_map)
15214                         return -ENOMEM;
15215
15216                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15217                 if (num_des) {
15218                         des_len = num_des *
15219                                 sizeof(struct cfg80211_dscp_exception);
15220                         memcpy(qos_map->dscp_exception, pos, des_len);
15221                         qos_map->num_des = num_des;
15222                         for (des = 0; des < num_des; des++) {
15223                                 if (qos_map->dscp_exception[des].up > 7) {
15224                                         kfree(qos_map);
15225                                         return -EINVAL;
15226                                 }
15227                         }
15228                         pos += des_len;
15229                 }
15230                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15231         }
15232
15233         wdev_lock(dev->ieee80211_ptr);
15234         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15235         if (!ret)
15236                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15237         wdev_unlock(dev->ieee80211_ptr);
15238
15239         kfree(qos_map);
15240         return ret;
15241 }
15242
15243 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15244 {
15245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15246         struct net_device *dev = info->user_ptr[1];
15247         struct wireless_dev *wdev = dev->ieee80211_ptr;
15248         const u8 *peer;
15249         u8 tsid, up;
15250         u16 admitted_time = 0;
15251         int err;
15252
15253         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15254                 return -EOPNOTSUPP;
15255
15256         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15257             !info->attrs[NL80211_ATTR_USER_PRIO])
15258                 return -EINVAL;
15259
15260         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15261         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15262
15263         /* WMM uses TIDs 0-7 even for TSPEC */
15264         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15265                 /* TODO: handle 802.11 TSPEC/admission control
15266                  * need more attributes for that (e.g. BA session requirement);
15267                  * change the WMM adminssion test above to allow both then
15268                  */
15269                 return -EINVAL;
15270         }
15271
15272         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15273
15274         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15275                 admitted_time =
15276                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15277                 if (!admitted_time)
15278                         return -EINVAL;
15279         }
15280
15281         wdev_lock(wdev);
15282         switch (wdev->iftype) {
15283         case NL80211_IFTYPE_STATION:
15284         case NL80211_IFTYPE_P2P_CLIENT:
15285                 if (wdev->connected)
15286                         break;
15287                 err = -ENOTCONN;
15288                 goto out;
15289         default:
15290                 err = -EOPNOTSUPP;
15291                 goto out;
15292         }
15293
15294         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15295
15296  out:
15297         wdev_unlock(wdev);
15298         return err;
15299 }
15300
15301 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15302 {
15303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15304         struct net_device *dev = info->user_ptr[1];
15305         struct wireless_dev *wdev = dev->ieee80211_ptr;
15306         const u8 *peer;
15307         u8 tsid;
15308         int err;
15309
15310         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15311                 return -EINVAL;
15312
15313         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15314         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15315
15316         wdev_lock(wdev);
15317         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15318         wdev_unlock(wdev);
15319
15320         return err;
15321 }
15322
15323 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15324                                        struct genl_info *info)
15325 {
15326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15327         struct net_device *dev = info->user_ptr[1];
15328         struct wireless_dev *wdev = dev->ieee80211_ptr;
15329         struct cfg80211_chan_def chandef = {};
15330         const u8 *addr;
15331         u8 oper_class;
15332         int err;
15333
15334         if (!rdev->ops->tdls_channel_switch ||
15335             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15336                 return -EOPNOTSUPP;
15337
15338         switch (dev->ieee80211_ptr->iftype) {
15339         case NL80211_IFTYPE_STATION:
15340         case NL80211_IFTYPE_P2P_CLIENT:
15341                 break;
15342         default:
15343                 return -EOPNOTSUPP;
15344         }
15345
15346         if (!info->attrs[NL80211_ATTR_MAC] ||
15347             !info->attrs[NL80211_ATTR_OPER_CLASS])
15348                 return -EINVAL;
15349
15350         err = nl80211_parse_chandef(rdev, info, &chandef);
15351         if (err)
15352                 return err;
15353
15354         /*
15355          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15356          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15357          * specification is not defined for them.
15358          */
15359         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15360             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15361             chandef.width != NL80211_CHAN_WIDTH_20)
15362                 return -EINVAL;
15363
15364         /* we will be active on the TDLS link */
15365         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15366                                            wdev->iftype))
15367                 return -EINVAL;
15368
15369         /* don't allow switching to DFS channels */
15370         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15371                 return -EINVAL;
15372
15373         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15374         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15375
15376         wdev_lock(wdev);
15377         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15378         wdev_unlock(wdev);
15379
15380         return err;
15381 }
15382
15383 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15384                                               struct genl_info *info)
15385 {
15386         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15387         struct net_device *dev = info->user_ptr[1];
15388         struct wireless_dev *wdev = dev->ieee80211_ptr;
15389         const u8 *addr;
15390
15391         if (!rdev->ops->tdls_channel_switch ||
15392             !rdev->ops->tdls_cancel_channel_switch ||
15393             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15394                 return -EOPNOTSUPP;
15395
15396         switch (dev->ieee80211_ptr->iftype) {
15397         case NL80211_IFTYPE_STATION:
15398         case NL80211_IFTYPE_P2P_CLIENT:
15399                 break;
15400         default:
15401                 return -EOPNOTSUPP;
15402         }
15403
15404         if (!info->attrs[NL80211_ATTR_MAC])
15405                 return -EINVAL;
15406
15407         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15408
15409         wdev_lock(wdev);
15410         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15411         wdev_unlock(wdev);
15412
15413         return 0;
15414 }
15415
15416 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15417                                             struct genl_info *info)
15418 {
15419         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15420         struct net_device *dev = info->user_ptr[1];
15421         struct wireless_dev *wdev = dev->ieee80211_ptr;
15422         const struct nlattr *nla;
15423         bool enabled;
15424
15425         if (!rdev->ops->set_multicast_to_unicast)
15426                 return -EOPNOTSUPP;
15427
15428         if (wdev->iftype != NL80211_IFTYPE_AP &&
15429             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15430                 return -EOPNOTSUPP;
15431
15432         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15433         enabled = nla_get_flag(nla);
15434
15435         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15436 }
15437
15438 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15439 {
15440         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15441         struct net_device *dev = info->user_ptr[1];
15442         struct wireless_dev *wdev = dev->ieee80211_ptr;
15443         struct cfg80211_pmk_conf pmk_conf = {};
15444         int ret;
15445
15446         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15447             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15448                 return -EOPNOTSUPP;
15449
15450         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15451                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15452                 return -EOPNOTSUPP;
15453
15454         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15455                 return -EINVAL;
15456
15457         wdev_lock(wdev);
15458         if (!wdev->connected) {
15459                 ret = -ENOTCONN;
15460                 goto out;
15461         }
15462
15463         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15464         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15465                 ret = -EINVAL;
15466                 goto out;
15467         }
15468
15469         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15470         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15471         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15472             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15473                 ret = -EINVAL;
15474                 goto out;
15475         }
15476
15477         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15478                 pmk_conf.pmk_r0_name =
15479                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15480
15481         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15482 out:
15483         wdev_unlock(wdev);
15484         return ret;
15485 }
15486
15487 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15488 {
15489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15490         struct net_device *dev = info->user_ptr[1];
15491         struct wireless_dev *wdev = dev->ieee80211_ptr;
15492         const u8 *aa;
15493         int ret;
15494
15495         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15496             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15497                 return -EOPNOTSUPP;
15498
15499         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15500                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15501                 return -EOPNOTSUPP;
15502
15503         if (!info->attrs[NL80211_ATTR_MAC])
15504                 return -EINVAL;
15505
15506         wdev_lock(wdev);
15507         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15508         ret = rdev_del_pmk(rdev, dev, aa);
15509         wdev_unlock(wdev);
15510
15511         return ret;
15512 }
15513
15514 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15515 {
15516         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15517         struct net_device *dev = info->user_ptr[1];
15518         struct cfg80211_external_auth_params params;
15519
15520         if (!rdev->ops->external_auth)
15521                 return -EOPNOTSUPP;
15522
15523         if (!info->attrs[NL80211_ATTR_SSID] &&
15524             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15525             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15526                 return -EINVAL;
15527
15528         if (!info->attrs[NL80211_ATTR_BSSID])
15529                 return -EINVAL;
15530
15531         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15532                 return -EINVAL;
15533
15534         memset(&params, 0, sizeof(params));
15535
15536         if (info->attrs[NL80211_ATTR_SSID]) {
15537                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15538                 if (params.ssid.ssid_len == 0)
15539                         return -EINVAL;
15540                 memcpy(params.ssid.ssid,
15541                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15542                        params.ssid.ssid_len);
15543         }
15544
15545         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15546                ETH_ALEN);
15547
15548         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15549
15550         if (info->attrs[NL80211_ATTR_PMKID])
15551                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15552
15553         return rdev_external_auth(rdev, dev, &params);
15554 }
15555
15556 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15557 {
15558         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15560         struct net_device *dev = info->user_ptr[1];
15561         struct wireless_dev *wdev = dev->ieee80211_ptr;
15562         const u8 *buf;
15563         size_t len;
15564         u8 *dest;
15565         u16 proto;
15566         bool noencrypt;
15567         u64 cookie = 0;
15568         int link_id;
15569         int err;
15570
15571         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15572                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15573                 return -EOPNOTSUPP;
15574
15575         if (!rdev->ops->tx_control_port)
15576                 return -EOPNOTSUPP;
15577
15578         if (!info->attrs[NL80211_ATTR_FRAME] ||
15579             !info->attrs[NL80211_ATTR_MAC] ||
15580             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15581                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15582                 return -EINVAL;
15583         }
15584
15585         wdev_lock(wdev);
15586
15587         switch (wdev->iftype) {
15588         case NL80211_IFTYPE_AP:
15589         case NL80211_IFTYPE_P2P_GO:
15590         case NL80211_IFTYPE_MESH_POINT:
15591                 break;
15592         case NL80211_IFTYPE_ADHOC:
15593                 if (wdev->u.ibss.current_bss)
15594                         break;
15595                 err = -ENOTCONN;
15596                 goto out;
15597         case NL80211_IFTYPE_STATION:
15598         case NL80211_IFTYPE_P2P_CLIENT:
15599                 if (wdev->connected)
15600                         break;
15601                 err = -ENOTCONN;
15602                 goto out;
15603         default:
15604                 err = -EOPNOTSUPP;
15605                 goto out;
15606         }
15607
15608         wdev_unlock(wdev);
15609
15610         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15611         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15612         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15613         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15614         noencrypt =
15615                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15616
15617         link_id = nl80211_link_id_or_invalid(info->attrs);
15618
15619         err = rdev_tx_control_port(rdev, dev, buf, len,
15620                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15621                                    dont_wait_for_ack ? NULL : &cookie);
15622         if (!err && !dont_wait_for_ack)
15623                 nl_set_extack_cookie_u64(info->extack, cookie);
15624         return err;
15625  out:
15626         wdev_unlock(wdev);
15627         return err;
15628 }
15629
15630 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15631                                            struct genl_info *info)
15632 {
15633         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15634         struct net_device *dev = info->user_ptr[1];
15635         struct wireless_dev *wdev = dev->ieee80211_ptr;
15636         struct cfg80211_ftm_responder_stats ftm_stats = {};
15637         unsigned int link_id = nl80211_link_id(info->attrs);
15638         struct sk_buff *msg;
15639         void *hdr;
15640         struct nlattr *ftm_stats_attr;
15641         int err;
15642
15643         if (wdev->iftype != NL80211_IFTYPE_AP ||
15644             !wdev->links[link_id].ap.beacon_interval)
15645                 return -EOPNOTSUPP;
15646
15647         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15648         if (err)
15649                 return err;
15650
15651         if (!ftm_stats.filled)
15652                 return -ENODATA;
15653
15654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15655         if (!msg)
15656                 return -ENOMEM;
15657
15658         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15659                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15660         if (!hdr)
15661                 goto nla_put_failure;
15662
15663         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15664                 goto nla_put_failure;
15665
15666         ftm_stats_attr = nla_nest_start_noflag(msg,
15667                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15668         if (!ftm_stats_attr)
15669                 goto nla_put_failure;
15670
15671 #define SET_FTM(field, name, type)                                       \
15672         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15673             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15674                              ftm_stats.field))                           \
15675                 goto nla_put_failure; } while (0)
15676 #define SET_FTM_U64(field, name)                                         \
15677         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15678             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15679                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15680                 goto nla_put_failure; } while (0)
15681
15682         SET_FTM(success_num, SUCCESS_NUM, u32);
15683         SET_FTM(partial_num, PARTIAL_NUM, u32);
15684         SET_FTM(failed_num, FAILED_NUM, u32);
15685         SET_FTM(asap_num, ASAP_NUM, u32);
15686         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15687         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15688         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15689         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15690         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15691 #undef SET_FTM
15692
15693         nla_nest_end(msg, ftm_stats_attr);
15694
15695         genlmsg_end(msg, hdr);
15696         return genlmsg_reply(msg, info);
15697
15698 nla_put_failure:
15699         nlmsg_free(msg);
15700         return -ENOBUFS;
15701 }
15702
15703 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15704 {
15705         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15706         struct cfg80211_update_owe_info owe_info;
15707         struct net_device *dev = info->user_ptr[1];
15708
15709         if (!rdev->ops->update_owe_info)
15710                 return -EOPNOTSUPP;
15711
15712         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15713             !info->attrs[NL80211_ATTR_MAC])
15714                 return -EINVAL;
15715
15716         memset(&owe_info, 0, sizeof(owe_info));
15717         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15718         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15719
15720         if (info->attrs[NL80211_ATTR_IE]) {
15721                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15722                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15723         }
15724
15725         return rdev_update_owe_info(rdev, dev, &owe_info);
15726 }
15727
15728 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15729 {
15730         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15731         struct net_device *dev = info->user_ptr[1];
15732         struct wireless_dev *wdev = dev->ieee80211_ptr;
15733         struct station_info sinfo = {};
15734         const u8 *buf;
15735         size_t len;
15736         u8 *dest;
15737         int err;
15738
15739         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15740                 return -EOPNOTSUPP;
15741
15742         if (!info->attrs[NL80211_ATTR_MAC] ||
15743             !info->attrs[NL80211_ATTR_FRAME]) {
15744                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15745                 return -EINVAL;
15746         }
15747
15748         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15749                 return -EOPNOTSUPP;
15750
15751         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15752         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15753         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15754
15755         if (len < sizeof(struct ethhdr))
15756                 return -EINVAL;
15757
15758         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15759             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15760                 return -EINVAL;
15761
15762         err = rdev_get_station(rdev, dev, dest, &sinfo);
15763         if (err)
15764                 return err;
15765
15766         cfg80211_sinfo_release_content(&sinfo);
15767
15768         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15769 }
15770
15771 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15772                           struct nlattr *attrs[], struct net_device *dev,
15773                           struct cfg80211_tid_cfg *tid_conf,
15774                           struct genl_info *info, const u8 *peer,
15775                           unsigned int link_id)
15776 {
15777         struct netlink_ext_ack *extack = info->extack;
15778         u64 mask;
15779         int err;
15780
15781         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15782                 return -EINVAL;
15783
15784         tid_conf->config_override =
15785                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15786         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15787
15788         if (tid_conf->config_override) {
15789                 if (rdev->ops->reset_tid_config) {
15790                         err = rdev_reset_tid_config(rdev, dev, peer,
15791                                                     tid_conf->tids);
15792                         if (err)
15793                                 return err;
15794                 } else {
15795                         return -EINVAL;
15796                 }
15797         }
15798
15799         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15800                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15801                 tid_conf->noack =
15802                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15803         }
15804
15805         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15806                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15807                 tid_conf->retry_short =
15808                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15809
15810                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15811                         return -EINVAL;
15812         }
15813
15814         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15815                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15816                 tid_conf->retry_long =
15817                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15818
15819                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15820                         return -EINVAL;
15821         }
15822
15823         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15824                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15825                 tid_conf->ampdu =
15826                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15827         }
15828
15829         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15830                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15831                 tid_conf->rtscts =
15832                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15833         }
15834
15835         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15836                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15837                 tid_conf->amsdu =
15838                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15839         }
15840
15841         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15842                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15843
15844                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15845
15846                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15847                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15848                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15849                                                     &tid_conf->txrate_mask, dev,
15850                                                     true, link_id);
15851                         if (err)
15852                                 return err;
15853
15854                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15855                 }
15856                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15857         }
15858
15859         if (peer)
15860                 mask = rdev->wiphy.tid_config_support.peer;
15861         else
15862                 mask = rdev->wiphy.tid_config_support.vif;
15863
15864         if (tid_conf->mask & ~mask) {
15865                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15866                 return -ENOTSUPP;
15867         }
15868
15869         return 0;
15870 }
15871
15872 static int nl80211_set_tid_config(struct sk_buff *skb,
15873                                   struct genl_info *info)
15874 {
15875         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15876         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15877         unsigned int link_id = nl80211_link_id(info->attrs);
15878         struct net_device *dev = info->user_ptr[1];
15879         struct cfg80211_tid_config *tid_config;
15880         struct nlattr *tid;
15881         int conf_idx = 0, rem_conf;
15882         int ret = -EINVAL;
15883         u32 num_conf = 0;
15884
15885         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15886                 return -EINVAL;
15887
15888         if (!rdev->ops->set_tid_config)
15889                 return -EOPNOTSUPP;
15890
15891         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15892                             rem_conf)
15893                 num_conf++;
15894
15895         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15896                              GFP_KERNEL);
15897         if (!tid_config)
15898                 return -ENOMEM;
15899
15900         tid_config->n_tid_conf = num_conf;
15901
15902         if (info->attrs[NL80211_ATTR_MAC])
15903                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15904
15905         wdev_lock(dev->ieee80211_ptr);
15906
15907         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15908                             rem_conf) {
15909                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15910                                        tid, NULL, NULL);
15911
15912                 if (ret)
15913                         goto bad_tid_conf;
15914
15915                 ret = parse_tid_conf(rdev, attrs, dev,
15916                                      &tid_config->tid_conf[conf_idx],
15917                                      info, tid_config->peer, link_id);
15918                 if (ret)
15919                         goto bad_tid_conf;
15920
15921                 conf_idx++;
15922         }
15923
15924         ret = rdev_set_tid_config(rdev, dev, tid_config);
15925
15926 bad_tid_conf:
15927         kfree(tid_config);
15928         wdev_unlock(dev->ieee80211_ptr);
15929         return ret;
15930 }
15931
15932 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15933 {
15934         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15935         struct cfg80211_color_change_settings params = {};
15936         struct net_device *dev = info->user_ptr[1];
15937         struct wireless_dev *wdev = dev->ieee80211_ptr;
15938         struct nlattr **tb;
15939         u16 offset;
15940         int err;
15941
15942         if (!rdev->ops->color_change)
15943                 return -EOPNOTSUPP;
15944
15945         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15946                                      NL80211_EXT_FEATURE_BSS_COLOR))
15947                 return -EOPNOTSUPP;
15948
15949         if (wdev->iftype != NL80211_IFTYPE_AP)
15950                 return -EOPNOTSUPP;
15951
15952         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15953             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15954             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15955                 return -EINVAL;
15956
15957         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15958         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15959
15960         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
15961                                    info->extack);
15962         if (err)
15963                 return err;
15964
15965         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15966         if (!tb)
15967                 return -ENOMEM;
15968
15969         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15970                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15971                                nl80211_policy, info->extack);
15972         if (err)
15973                 goto out;
15974
15975         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
15976                                    info->extack);
15977         if (err)
15978                 goto out;
15979
15980         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15981                 err = -EINVAL;
15982                 goto out;
15983         }
15984
15985         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15986                 err = -EINVAL;
15987                 goto out;
15988         }
15989
15990         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15991         if (offset >= params.beacon_color_change.tail_len) {
15992                 err = -EINVAL;
15993                 goto out;
15994         }
15995
15996         if (params.beacon_color_change.tail[offset] != params.count) {
15997                 err = -EINVAL;
15998                 goto out;
15999         }
16000
16001         params.counter_offset_beacon = offset;
16002
16003         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16004                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16005                     sizeof(u16)) {
16006                         err = -EINVAL;
16007                         goto out;
16008                 }
16009
16010                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16011                 if (offset >= params.beacon_color_change.probe_resp_len) {
16012                         err = -EINVAL;
16013                         goto out;
16014                 }
16015
16016                 if (params.beacon_color_change.probe_resp[offset] !=
16017                     params.count) {
16018                         err = -EINVAL;
16019                         goto out;
16020                 }
16021
16022                 params.counter_offset_presp = offset;
16023         }
16024
16025         wdev_lock(wdev);
16026         err = rdev_color_change(rdev, dev, &params);
16027         wdev_unlock(wdev);
16028
16029 out:
16030         kfree(params.beacon_next.mbssid_ies);
16031         kfree(params.beacon_color_change.mbssid_ies);
16032         kfree(params.beacon_next.rnr_ies);
16033         kfree(params.beacon_color_change.rnr_ies);
16034         kfree(tb);
16035         return err;
16036 }
16037
16038 static int nl80211_set_fils_aad(struct sk_buff *skb,
16039                                 struct genl_info *info)
16040 {
16041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16042         struct net_device *dev = info->user_ptr[1];
16043         struct cfg80211_fils_aad fils_aad = {};
16044         u8 *nonces;
16045
16046         if (!info->attrs[NL80211_ATTR_MAC] ||
16047             !info->attrs[NL80211_ATTR_FILS_KEK] ||
16048             !info->attrs[NL80211_ATTR_FILS_NONCES])
16049                 return -EINVAL;
16050
16051         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16052         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16053         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16054         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16055         fils_aad.snonce = nonces;
16056         fils_aad.anonce = nonces + FILS_NONCE_LEN;
16057
16058         return rdev_set_fils_aad(rdev, dev, &fils_aad);
16059 }
16060
16061 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16062 {
16063         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16064         unsigned int link_id = nl80211_link_id(info->attrs);
16065         struct net_device *dev = info->user_ptr[1];
16066         struct wireless_dev *wdev = dev->ieee80211_ptr;
16067         int ret;
16068
16069         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16070                 return -EINVAL;
16071
16072         switch (wdev->iftype) {
16073         case NL80211_IFTYPE_AP:
16074                 break;
16075         default:
16076                 return -EINVAL;
16077         }
16078
16079         if (!info->attrs[NL80211_ATTR_MAC] ||
16080             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16081                 return -EINVAL;
16082
16083         wdev_lock(wdev);
16084         wdev->valid_links |= BIT(link_id);
16085         ether_addr_copy(wdev->links[link_id].addr,
16086                         nla_data(info->attrs[NL80211_ATTR_MAC]));
16087
16088         ret = rdev_add_intf_link(rdev, wdev, link_id);
16089         if (ret) {
16090                 wdev->valid_links &= ~BIT(link_id);
16091                 eth_zero_addr(wdev->links[link_id].addr);
16092         }
16093         wdev_unlock(wdev);
16094
16095         return ret;
16096 }
16097
16098 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16099 {
16100         unsigned int link_id = nl80211_link_id(info->attrs);
16101         struct net_device *dev = info->user_ptr[1];
16102         struct wireless_dev *wdev = dev->ieee80211_ptr;
16103
16104         /* cannot remove if there's no link */
16105         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16106                 return -EINVAL;
16107
16108         switch (wdev->iftype) {
16109         case NL80211_IFTYPE_AP:
16110                 break;
16111         default:
16112                 return -EINVAL;
16113         }
16114
16115         wdev_lock(wdev);
16116         cfg80211_remove_link(wdev, link_id);
16117         wdev_unlock(wdev);
16118
16119         return 0;
16120 }
16121
16122 static int
16123 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16124                              bool add)
16125 {
16126         struct link_station_parameters params = {};
16127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16128         struct net_device *dev = info->user_ptr[1];
16129         int err;
16130
16131         if ((add && !rdev->ops->add_link_station) ||
16132             (!add && !rdev->ops->mod_link_station))
16133                 return -EOPNOTSUPP;
16134
16135         if (add && !info->attrs[NL80211_ATTR_MAC])
16136                 return -EINVAL;
16137
16138         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16139                 return -EINVAL;
16140
16141         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16142                 return -EINVAL;
16143
16144         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16145
16146         if (info->attrs[NL80211_ATTR_MAC]) {
16147                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16148                 if (!is_valid_ether_addr(params.link_mac))
16149                         return -EINVAL;
16150         }
16151
16152         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16153                 return -EINVAL;
16154
16155         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16156
16157         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16158                 params.supported_rates =
16159                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16160                 params.supported_rates_len =
16161                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16162         }
16163
16164         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16165                 params.ht_capa =
16166                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16167
16168         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16169                 params.vht_capa =
16170                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16171
16172         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16173                 params.he_capa =
16174                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16175                 params.he_capa_len =
16176                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16177
16178                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16179                         params.eht_capa =
16180                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16181                         params.eht_capa_len =
16182                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16183
16184                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16185                                                         (const u8 *)params.eht_capa,
16186                                                         params.eht_capa_len,
16187                                                         false))
16188                                 return -EINVAL;
16189                 }
16190         }
16191
16192         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16193                 params.he_6ghz_capa =
16194                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16195
16196         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16197                 params.opmode_notif_used = true;
16198                 params.opmode_notif =
16199                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16200         }
16201
16202         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16203                                                 &params.txpwr_set);
16204         if (err)
16205                 return err;
16206
16207         wdev_lock(dev->ieee80211_ptr);
16208         if (add)
16209                 err = rdev_add_link_station(rdev, dev, &params);
16210         else
16211                 err = rdev_mod_link_station(rdev, dev, &params);
16212         wdev_unlock(dev->ieee80211_ptr);
16213
16214         return err;
16215 }
16216
16217 static int
16218 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16219 {
16220         return nl80211_add_mod_link_station(skb, info, true);
16221 }
16222
16223 static int
16224 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16225 {
16226         return nl80211_add_mod_link_station(skb, info, false);
16227 }
16228
16229 static int
16230 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16231 {
16232         struct link_station_del_parameters params = {};
16233         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16234         struct net_device *dev = info->user_ptr[1];
16235         int ret;
16236
16237         if (!rdev->ops->del_link_station)
16238                 return -EOPNOTSUPP;
16239
16240         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16241             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16242                 return -EINVAL;
16243
16244         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16245         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16246
16247         wdev_lock(dev->ieee80211_ptr);
16248         ret = rdev_del_link_station(rdev, dev, &params);
16249         wdev_unlock(dev->ieee80211_ptr);
16250
16251         return ret;
16252 }
16253
16254 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16255                                     struct genl_info *info)
16256 {
16257         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16258         struct net_device *dev = info->user_ptr[1];
16259         struct cfg80211_set_hw_timestamp hwts = {};
16260
16261         if (!rdev->wiphy.hw_timestamp_max_peers)
16262                 return -EOPNOTSUPP;
16263
16264         if (!info->attrs[NL80211_ATTR_MAC] &&
16265             rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16266                 return -EOPNOTSUPP;
16267
16268         if (info->attrs[NL80211_ATTR_MAC])
16269                 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16270
16271         hwts.enable =
16272                 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16273
16274         return rdev_set_hw_timestamp(rdev, dev, &hwts);
16275 }
16276
16277 #define NL80211_FLAG_NEED_WIPHY         0x01
16278 #define NL80211_FLAG_NEED_NETDEV        0x02
16279 #define NL80211_FLAG_NEED_RTNL          0x04
16280 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16281 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16282                                          NL80211_FLAG_CHECK_NETDEV_UP)
16283 #define NL80211_FLAG_NEED_WDEV          0x10
16284 /* If a netdev is associated, it must be UP, P2P must be started */
16285 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16286                                          NL80211_FLAG_CHECK_NETDEV_UP)
16287 #define NL80211_FLAG_CLEAR_SKB          0x20
16288 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16289 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16290 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16291
16292 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16293         SELECTOR(__sel, NONE, 0) /* must be first */    \
16294         SELECTOR(__sel, WIPHY,                          \
16295                  NL80211_FLAG_NEED_WIPHY)               \
16296         SELECTOR(__sel, WDEV,                           \
16297                  NL80211_FLAG_NEED_WDEV)                \
16298         SELECTOR(__sel, NETDEV,                         \
16299                  NL80211_FLAG_NEED_NETDEV)              \
16300         SELECTOR(__sel, NETDEV_LINK,                    \
16301                  NL80211_FLAG_NEED_NETDEV |             \
16302                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16303         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16304                  NL80211_FLAG_NEED_NETDEV |             \
16305                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16306         SELECTOR(__sel, WIPHY_RTNL,                     \
16307                  NL80211_FLAG_NEED_WIPHY |              \
16308                  NL80211_FLAG_NEED_RTNL)                \
16309         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16310                  NL80211_FLAG_NEED_WIPHY |              \
16311                  NL80211_FLAG_NEED_RTNL |               \
16312                  NL80211_FLAG_NO_WIPHY_MTX)             \
16313         SELECTOR(__sel, WDEV_RTNL,                      \
16314                  NL80211_FLAG_NEED_WDEV |               \
16315                  NL80211_FLAG_NEED_RTNL)                \
16316         SELECTOR(__sel, NETDEV_RTNL,                    \
16317                  NL80211_FLAG_NEED_NETDEV |             \
16318                  NL80211_FLAG_NEED_RTNL)                \
16319         SELECTOR(__sel, NETDEV_UP,                      \
16320                  NL80211_FLAG_NEED_NETDEV_UP)           \
16321         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16322                  NL80211_FLAG_NEED_NETDEV_UP |          \
16323                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16324         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16325                  NL80211_FLAG_NEED_NETDEV_UP |          \
16326                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16327         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16328                  NL80211_FLAG_NEED_NETDEV_UP |          \
16329                  NL80211_FLAG_CLEAR_SKB |               \
16330                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16331         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16332                  NL80211_FLAG_NEED_NETDEV_UP |          \
16333                  NL80211_FLAG_NO_WIPHY_MTX)             \
16334         SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,          \
16335                  NL80211_FLAG_NEED_NETDEV_UP |          \
16336                  NL80211_FLAG_NO_WIPHY_MTX |            \
16337                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16338         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16339                  NL80211_FLAG_NEED_NETDEV_UP |          \
16340                  NL80211_FLAG_CLEAR_SKB)                \
16341         SELECTOR(__sel, WDEV_UP,                        \
16342                  NL80211_FLAG_NEED_WDEV_UP)             \
16343         SELECTOR(__sel, WDEV_UP_LINK,                   \
16344                  NL80211_FLAG_NEED_WDEV_UP |            \
16345                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16346         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16347                  NL80211_FLAG_NEED_WDEV_UP |            \
16348                  NL80211_FLAG_NEED_RTNL)                \
16349         SELECTOR(__sel, WIPHY_CLEAR,                    \
16350                  NL80211_FLAG_NEED_WIPHY |              \
16351                  NL80211_FLAG_CLEAR_SKB)
16352
16353 enum nl80211_internal_flags_selector {
16354 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16355         INTERNAL_FLAG_SELECTORS(_)
16356 #undef SELECTOR
16357 };
16358
16359 static u32 nl80211_internal_flags[] = {
16360 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16361         INTERNAL_FLAG_SELECTORS(_)
16362 #undef SELECTOR
16363 };
16364
16365 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16366                             struct sk_buff *skb,
16367                             struct genl_info *info)
16368 {
16369         struct cfg80211_registered_device *rdev = NULL;
16370         struct wireless_dev *wdev = NULL;
16371         struct net_device *dev = NULL;
16372         u32 internal_flags;
16373         int err;
16374
16375         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16376                 return -EINVAL;
16377
16378         internal_flags = nl80211_internal_flags[ops->internal_flags];
16379
16380         rtnl_lock();
16381         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16382                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16383                 if (IS_ERR(rdev)) {
16384                         err = PTR_ERR(rdev);
16385                         goto out_unlock;
16386                 }
16387                 info->user_ptr[0] = rdev;
16388         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16389                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16390                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16391                                                   info->attrs);
16392                 if (IS_ERR(wdev)) {
16393                         err = PTR_ERR(wdev);
16394                         goto out_unlock;
16395                 }
16396
16397                 dev = wdev->netdev;
16398                 dev_hold(dev);
16399                 rdev = wiphy_to_rdev(wdev->wiphy);
16400
16401                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16402                         if (!dev) {
16403                                 err = -EINVAL;
16404                                 goto out_unlock;
16405                         }
16406
16407                         info->user_ptr[1] = dev;
16408                 } else {
16409                         info->user_ptr[1] = wdev;
16410                 }
16411
16412                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16413                     !wdev_running(wdev)) {
16414                         err = -ENETDOWN;
16415                         goto out_unlock;
16416                 }
16417
16418                 info->user_ptr[0] = rdev;
16419         }
16420
16421         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16422                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16423
16424                 if (!wdev) {
16425                         err = -EINVAL;
16426                         goto out_unlock;
16427                 }
16428
16429                 /* MLO -> require valid link ID */
16430                 if (wdev->valid_links &&
16431                     (!link_id ||
16432                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16433                         err = -EINVAL;
16434                         goto out_unlock;
16435                 }
16436
16437                 /* non-MLO -> no link ID attribute accepted */
16438                 if (!wdev->valid_links && link_id) {
16439                         err = -EINVAL;
16440                         goto out_unlock;
16441                 }
16442         }
16443
16444         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16445                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16446                     (wdev && wdev->valid_links)) {
16447                         err = -EINVAL;
16448                         goto out_unlock;
16449                 }
16450         }
16451
16452         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16453                 wiphy_lock(&rdev->wiphy);
16454                 /* we keep the mutex locked until post_doit */
16455                 __release(&rdev->wiphy.mtx);
16456         }
16457         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16458                 rtnl_unlock();
16459
16460         return 0;
16461 out_unlock:
16462         rtnl_unlock();
16463         dev_put(dev);
16464         return err;
16465 }
16466
16467 static void nl80211_post_doit(const struct genl_split_ops *ops,
16468                               struct sk_buff *skb,
16469                               struct genl_info *info)
16470 {
16471         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16472
16473         if (info->user_ptr[1]) {
16474                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16475                         struct wireless_dev *wdev = info->user_ptr[1];
16476
16477                         dev_put(wdev->netdev);
16478                 } else {
16479                         dev_put(info->user_ptr[1]);
16480                 }
16481         }
16482
16483         if (info->user_ptr[0] &&
16484             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16485                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16486
16487                 /* we kept the mutex locked since pre_doit */
16488                 __acquire(&rdev->wiphy.mtx);
16489                 wiphy_unlock(&rdev->wiphy);
16490         }
16491
16492         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16493                 rtnl_unlock();
16494
16495         /* If needed, clear the netlink message payload from the SKB
16496          * as it might contain key data that shouldn't stick around on
16497          * the heap after the SKB is freed. The netlink message header
16498          * is still needed for further processing, so leave it intact.
16499          */
16500         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16501                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16502
16503                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16504         }
16505 }
16506
16507 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16508                                      struct cfg80211_sar_specs *sar_specs,
16509                                      struct nlattr *spec[], int index)
16510 {
16511         u32 range_index, i;
16512
16513         if (!sar_specs || !spec)
16514                 return -EINVAL;
16515
16516         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16517             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16518                 return -EINVAL;
16519
16520         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16521
16522         /* check if range_index exceeds num_freq_ranges */
16523         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16524                 return -EINVAL;
16525
16526         /* check if range_index duplicates */
16527         for (i = 0; i < index; i++) {
16528                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16529                         return -EINVAL;
16530         }
16531
16532         sar_specs->sub_specs[index].power =
16533                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16534
16535         sar_specs->sub_specs[index].freq_range_index = range_index;
16536
16537         return 0;
16538 }
16539
16540 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16541 {
16542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16543         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16544         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16545         struct cfg80211_sar_specs *sar_spec;
16546         enum nl80211_sar_type type;
16547         struct nlattr *spec_list;
16548         u32 specs;
16549         int rem, err;
16550
16551         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16552                 return -EOPNOTSUPP;
16553
16554         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16555                 return -EINVAL;
16556
16557         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16558                          info->attrs[NL80211_ATTR_SAR_SPEC],
16559                          NULL, NULL);
16560
16561         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16562                 return -EINVAL;
16563
16564         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16565         if (type != rdev->wiphy.sar_capa->type)
16566                 return -EINVAL;
16567
16568         specs = 0;
16569         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16570                 specs++;
16571
16572         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16573                 return -EINVAL;
16574
16575         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16576         if (!sar_spec)
16577                 return -ENOMEM;
16578
16579         sar_spec->type = type;
16580         specs = 0;
16581         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16582                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16583                                  spec_list, NULL, NULL);
16584
16585                 switch (type) {
16586                 case NL80211_SAR_TYPE_POWER:
16587                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16588                                                       spec, specs)) {
16589                                 err = -EINVAL;
16590                                 goto error;
16591                         }
16592                         break;
16593                 default:
16594                         err = -EINVAL;
16595                         goto error;
16596                 }
16597                 specs++;
16598         }
16599
16600         sar_spec->num_sub_specs = specs;
16601
16602         rdev->cur_cmd_info = info;
16603         err = rdev_set_sar_specs(rdev, sar_spec);
16604         rdev->cur_cmd_info = NULL;
16605 error:
16606         kfree(sar_spec);
16607         return err;
16608 }
16609
16610 #define SELECTOR(__sel, name, value) \
16611         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16612 int __missing_selector(void);
16613 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16614
16615 static const struct genl_ops nl80211_ops[] = {
16616         {
16617                 .cmd = NL80211_CMD_GET_WIPHY,
16618                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16619                 .doit = nl80211_get_wiphy,
16620                 .dumpit = nl80211_dump_wiphy,
16621                 .done = nl80211_dump_wiphy_done,
16622                 /* can be retrieved by unprivileged users */
16623                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16624         },
16625 };
16626
16627 static const struct genl_small_ops nl80211_small_ops[] = {
16628         {
16629                 .cmd = NL80211_CMD_SET_WIPHY,
16630                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16631                 .doit = nl80211_set_wiphy,
16632                 .flags = GENL_UNS_ADMIN_PERM,
16633         },
16634         {
16635                 .cmd = NL80211_CMD_GET_INTERFACE,
16636                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16637                 .doit = nl80211_get_interface,
16638                 .dumpit = nl80211_dump_interface,
16639                 /* can be retrieved by unprivileged users */
16640                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16641         },
16642         {
16643                 .cmd = NL80211_CMD_SET_INTERFACE,
16644                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16645                 .doit = nl80211_set_interface,
16646                 .flags = GENL_UNS_ADMIN_PERM,
16647                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16648                                          NL80211_FLAG_NEED_RTNL),
16649         },
16650         {
16651                 .cmd = NL80211_CMD_NEW_INTERFACE,
16652                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16653                 .doit = nl80211_new_interface,
16654                 .flags = GENL_UNS_ADMIN_PERM,
16655                 .internal_flags =
16656                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
16657                                NL80211_FLAG_NEED_RTNL |
16658                                /* we take the wiphy mutex later ourselves */
16659                                NL80211_FLAG_NO_WIPHY_MTX),
16660         },
16661         {
16662                 .cmd = NL80211_CMD_DEL_INTERFACE,
16663                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16664                 .doit = nl80211_del_interface,
16665                 .flags = GENL_UNS_ADMIN_PERM,
16666                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16667                                          NL80211_FLAG_NEED_RTNL),
16668         },
16669         {
16670                 .cmd = NL80211_CMD_GET_KEY,
16671                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16672                 .doit = nl80211_get_key,
16673                 .flags = GENL_UNS_ADMIN_PERM,
16674                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16675         },
16676         {
16677                 .cmd = NL80211_CMD_SET_KEY,
16678                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16679                 .doit = nl80211_set_key,
16680                 .flags = GENL_UNS_ADMIN_PERM,
16681                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16682                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16683                                          NL80211_FLAG_CLEAR_SKB),
16684         },
16685         {
16686                 .cmd = NL80211_CMD_NEW_KEY,
16687                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16688                 .doit = nl80211_new_key,
16689                 .flags = GENL_UNS_ADMIN_PERM,
16690                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16691                                          NL80211_FLAG_CLEAR_SKB),
16692         },
16693         {
16694                 .cmd = NL80211_CMD_DEL_KEY,
16695                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16696                 .doit = nl80211_del_key,
16697                 .flags = GENL_UNS_ADMIN_PERM,
16698                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16699         },
16700         {
16701                 .cmd = NL80211_CMD_SET_BEACON,
16702                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16703                 .flags = GENL_UNS_ADMIN_PERM,
16704                 .doit = nl80211_set_beacon,
16705                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16706                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16707         },
16708         {
16709                 .cmd = NL80211_CMD_START_AP,
16710                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16711                 .flags = GENL_UNS_ADMIN_PERM,
16712                 .doit = nl80211_start_ap,
16713                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16714                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16715         },
16716         {
16717                 .cmd = NL80211_CMD_STOP_AP,
16718                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16719                 .flags = GENL_UNS_ADMIN_PERM,
16720                 .doit = nl80211_stop_ap,
16721                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16722                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16723         },
16724         {
16725                 .cmd = NL80211_CMD_GET_STATION,
16726                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16727                 .doit = nl80211_get_station,
16728                 .dumpit = nl80211_dump_station,
16729                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16730         },
16731         {
16732                 .cmd = NL80211_CMD_SET_STATION,
16733                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16734                 .doit = nl80211_set_station,
16735                 .flags = GENL_UNS_ADMIN_PERM,
16736                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16737         },
16738         {
16739                 .cmd = NL80211_CMD_NEW_STATION,
16740                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16741                 .doit = nl80211_new_station,
16742                 .flags = GENL_UNS_ADMIN_PERM,
16743                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16744         },
16745         {
16746                 .cmd = NL80211_CMD_DEL_STATION,
16747                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16748                 .doit = nl80211_del_station,
16749                 .flags = GENL_UNS_ADMIN_PERM,
16750                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16751         },
16752         {
16753                 .cmd = NL80211_CMD_GET_MPATH,
16754                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16755                 .doit = nl80211_get_mpath,
16756                 .dumpit = nl80211_dump_mpath,
16757                 .flags = GENL_UNS_ADMIN_PERM,
16758                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16759         },
16760         {
16761                 .cmd = NL80211_CMD_GET_MPP,
16762                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16763                 .doit = nl80211_get_mpp,
16764                 .dumpit = nl80211_dump_mpp,
16765                 .flags = GENL_UNS_ADMIN_PERM,
16766                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16767         },
16768         {
16769                 .cmd = NL80211_CMD_SET_MPATH,
16770                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16771                 .doit = nl80211_set_mpath,
16772                 .flags = GENL_UNS_ADMIN_PERM,
16773                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16774         },
16775         {
16776                 .cmd = NL80211_CMD_NEW_MPATH,
16777                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16778                 .doit = nl80211_new_mpath,
16779                 .flags = GENL_UNS_ADMIN_PERM,
16780                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16781         },
16782         {
16783                 .cmd = NL80211_CMD_DEL_MPATH,
16784                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16785                 .doit = nl80211_del_mpath,
16786                 .flags = GENL_UNS_ADMIN_PERM,
16787                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16788         },
16789         {
16790                 .cmd = NL80211_CMD_SET_BSS,
16791                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16792                 .doit = nl80211_set_bss,
16793                 .flags = GENL_UNS_ADMIN_PERM,
16794                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16795                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16796         },
16797         {
16798                 .cmd = NL80211_CMD_GET_REG,
16799                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16800                 .doit = nl80211_get_reg_do,
16801                 .dumpit = nl80211_get_reg_dump,
16802                 /* can be retrieved by unprivileged users */
16803         },
16804 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16805         {
16806                 .cmd = NL80211_CMD_SET_REG,
16807                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16808                 .doit = nl80211_set_reg,
16809                 .flags = GENL_ADMIN_PERM,
16810         },
16811 #endif
16812         {
16813                 .cmd = NL80211_CMD_REQ_SET_REG,
16814                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16815                 .doit = nl80211_req_set_reg,
16816                 .flags = GENL_ADMIN_PERM,
16817         },
16818         {
16819                 .cmd = NL80211_CMD_RELOAD_REGDB,
16820                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16821                 .doit = nl80211_reload_regdb,
16822                 .flags = GENL_ADMIN_PERM,
16823         },
16824         {
16825                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16826                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16827                 .doit = nl80211_get_mesh_config,
16828                 /* can be retrieved by unprivileged users */
16829                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16830         },
16831         {
16832                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16833                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16834                 .doit = nl80211_update_mesh_config,
16835                 .flags = GENL_UNS_ADMIN_PERM,
16836                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16837         },
16838         {
16839                 .cmd = NL80211_CMD_TRIGGER_SCAN,
16840                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16841                 .doit = nl80211_trigger_scan,
16842                 .flags = GENL_UNS_ADMIN_PERM,
16843                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16844         },
16845         {
16846                 .cmd = NL80211_CMD_ABORT_SCAN,
16847                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16848                 .doit = nl80211_abort_scan,
16849                 .flags = GENL_UNS_ADMIN_PERM,
16850                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16851         },
16852         {
16853                 .cmd = NL80211_CMD_GET_SCAN,
16854                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16855                 .dumpit = nl80211_dump_scan,
16856         },
16857         {
16858                 .cmd = NL80211_CMD_START_SCHED_SCAN,
16859                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16860                 .doit = nl80211_start_sched_scan,
16861                 .flags = GENL_UNS_ADMIN_PERM,
16862                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16863         },
16864         {
16865                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16866                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16867                 .doit = nl80211_stop_sched_scan,
16868                 .flags = GENL_UNS_ADMIN_PERM,
16869                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16870         },
16871         {
16872                 .cmd = NL80211_CMD_AUTHENTICATE,
16873                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16874                 .doit = nl80211_authenticate,
16875                 .flags = GENL_UNS_ADMIN_PERM,
16876                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16877                                          NL80211_FLAG_CLEAR_SKB),
16878         },
16879         {
16880                 .cmd = NL80211_CMD_ASSOCIATE,
16881                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16882                 .doit = nl80211_associate,
16883                 .flags = GENL_UNS_ADMIN_PERM,
16884                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16885                                          NL80211_FLAG_CLEAR_SKB),
16886         },
16887         {
16888                 .cmd = NL80211_CMD_DEAUTHENTICATE,
16889                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16890                 .doit = nl80211_deauthenticate,
16891                 .flags = GENL_UNS_ADMIN_PERM,
16892                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16893         },
16894         {
16895                 .cmd = NL80211_CMD_DISASSOCIATE,
16896                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16897                 .doit = nl80211_disassociate,
16898                 .flags = GENL_UNS_ADMIN_PERM,
16899                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16900         },
16901         {
16902                 .cmd = NL80211_CMD_JOIN_IBSS,
16903                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16904                 .doit = nl80211_join_ibss,
16905                 .flags = GENL_UNS_ADMIN_PERM,
16906                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16907         },
16908         {
16909                 .cmd = NL80211_CMD_LEAVE_IBSS,
16910                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16911                 .doit = nl80211_leave_ibss,
16912                 .flags = GENL_UNS_ADMIN_PERM,
16913                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16914         },
16915 #ifdef CONFIG_NL80211_TESTMODE
16916         {
16917                 .cmd = NL80211_CMD_TESTMODE,
16918                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16919                 .doit = nl80211_testmode_do,
16920                 .dumpit = nl80211_testmode_dump,
16921                 .flags = GENL_UNS_ADMIN_PERM,
16922                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16923         },
16924 #endif
16925         {
16926                 .cmd = NL80211_CMD_CONNECT,
16927                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16928                 .doit = nl80211_connect,
16929                 .flags = GENL_UNS_ADMIN_PERM,
16930                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16931                                          NL80211_FLAG_CLEAR_SKB),
16932         },
16933         {
16934                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16935                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16936                 .doit = nl80211_update_connect_params,
16937                 .flags = GENL_ADMIN_PERM,
16938                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16939                                          NL80211_FLAG_CLEAR_SKB),
16940         },
16941         {
16942                 .cmd = NL80211_CMD_DISCONNECT,
16943                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16944                 .doit = nl80211_disconnect,
16945                 .flags = GENL_UNS_ADMIN_PERM,
16946                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16947         },
16948         {
16949                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16950                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16951                 .doit = nl80211_wiphy_netns,
16952                 .flags = GENL_UNS_ADMIN_PERM,
16953                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16954                                          NL80211_FLAG_NEED_RTNL |
16955                                          NL80211_FLAG_NO_WIPHY_MTX),
16956         },
16957         {
16958                 .cmd = NL80211_CMD_GET_SURVEY,
16959                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16960                 .dumpit = nl80211_dump_survey,
16961         },
16962         {
16963                 .cmd = NL80211_CMD_SET_PMKSA,
16964                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16965                 .doit = nl80211_setdel_pmksa,
16966                 .flags = GENL_UNS_ADMIN_PERM,
16967                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16968                                          NL80211_FLAG_CLEAR_SKB),
16969         },
16970         {
16971                 .cmd = NL80211_CMD_DEL_PMKSA,
16972                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16973                 .doit = nl80211_setdel_pmksa,
16974                 .flags = GENL_UNS_ADMIN_PERM,
16975                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16976         },
16977         {
16978                 .cmd = NL80211_CMD_FLUSH_PMKSA,
16979                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16980                 .doit = nl80211_flush_pmksa,
16981                 .flags = GENL_UNS_ADMIN_PERM,
16982                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16983         },
16984         {
16985                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16986                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16987                 .doit = nl80211_remain_on_channel,
16988                 .flags = GENL_UNS_ADMIN_PERM,
16989                 /* FIXME: requiring a link ID here is probably not good */
16990                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16991                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16992         },
16993         {
16994                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16995                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16996                 .doit = nl80211_cancel_remain_on_channel,
16997                 .flags = GENL_UNS_ADMIN_PERM,
16998                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16999         },
17000         {
17001                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17002                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17003                 .doit = nl80211_set_tx_bitrate_mask,
17004                 .flags = GENL_UNS_ADMIN_PERM,
17005                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17006                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17007         },
17008         {
17009                 .cmd = NL80211_CMD_REGISTER_FRAME,
17010                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17011                 .doit = nl80211_register_mgmt,
17012                 .flags = GENL_UNS_ADMIN_PERM,
17013                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17014         },
17015         {
17016                 .cmd = NL80211_CMD_FRAME,
17017                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17018                 .doit = nl80211_tx_mgmt,
17019                 .flags = GENL_UNS_ADMIN_PERM,
17020                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17021         },
17022         {
17023                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17024                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17025                 .doit = nl80211_tx_mgmt_cancel_wait,
17026                 .flags = GENL_UNS_ADMIN_PERM,
17027                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17028         },
17029         {
17030                 .cmd = NL80211_CMD_SET_POWER_SAVE,
17031                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17032                 .doit = nl80211_set_power_save,
17033                 .flags = GENL_UNS_ADMIN_PERM,
17034                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17035         },
17036         {
17037                 .cmd = NL80211_CMD_GET_POWER_SAVE,
17038                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17039                 .doit = nl80211_get_power_save,
17040                 /* can be retrieved by unprivileged users */
17041                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17042         },
17043         {
17044                 .cmd = NL80211_CMD_SET_CQM,
17045                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17046                 .doit = nl80211_set_cqm,
17047                 .flags = GENL_UNS_ADMIN_PERM,
17048                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17049         },
17050         {
17051                 .cmd = NL80211_CMD_SET_CHANNEL,
17052                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17053                 .doit = nl80211_set_channel,
17054                 .flags = GENL_UNS_ADMIN_PERM,
17055                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17056                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17057         },
17058         {
17059                 .cmd = NL80211_CMD_JOIN_MESH,
17060                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17061                 .doit = nl80211_join_mesh,
17062                 .flags = GENL_UNS_ADMIN_PERM,
17063                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17064         },
17065         {
17066                 .cmd = NL80211_CMD_LEAVE_MESH,
17067                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17068                 .doit = nl80211_leave_mesh,
17069                 .flags = GENL_UNS_ADMIN_PERM,
17070                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17071         },
17072         {
17073                 .cmd = NL80211_CMD_JOIN_OCB,
17074                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17075                 .doit = nl80211_join_ocb,
17076                 .flags = GENL_UNS_ADMIN_PERM,
17077                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17078         },
17079         {
17080                 .cmd = NL80211_CMD_LEAVE_OCB,
17081                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17082                 .doit = nl80211_leave_ocb,
17083                 .flags = GENL_UNS_ADMIN_PERM,
17084                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17085         },
17086 #ifdef CONFIG_PM
17087         {
17088                 .cmd = NL80211_CMD_GET_WOWLAN,
17089                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17090                 .doit = nl80211_get_wowlan,
17091                 /* can be retrieved by unprivileged users */
17092                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17093         },
17094         {
17095                 .cmd = NL80211_CMD_SET_WOWLAN,
17096                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17097                 .doit = nl80211_set_wowlan,
17098                 .flags = GENL_UNS_ADMIN_PERM,
17099                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17100         },
17101 #endif
17102         {
17103                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17104                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17105                 .doit = nl80211_set_rekey_data,
17106                 .flags = GENL_UNS_ADMIN_PERM,
17107                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17108                                          NL80211_FLAG_CLEAR_SKB),
17109         },
17110         {
17111                 .cmd = NL80211_CMD_TDLS_MGMT,
17112                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17113                 .doit = nl80211_tdls_mgmt,
17114                 .flags = GENL_UNS_ADMIN_PERM,
17115                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17116         },
17117         {
17118                 .cmd = NL80211_CMD_TDLS_OPER,
17119                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17120                 .doit = nl80211_tdls_oper,
17121                 .flags = GENL_UNS_ADMIN_PERM,
17122                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17123         },
17124         {
17125                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17126                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17127                 .doit = nl80211_register_unexpected_frame,
17128                 .flags = GENL_UNS_ADMIN_PERM,
17129                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17130         },
17131         {
17132                 .cmd = NL80211_CMD_PROBE_CLIENT,
17133                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17134                 .doit = nl80211_probe_client,
17135                 .flags = GENL_UNS_ADMIN_PERM,
17136                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17137         },
17138         {
17139                 .cmd = NL80211_CMD_REGISTER_BEACONS,
17140                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17141                 .doit = nl80211_register_beacons,
17142                 .flags = GENL_UNS_ADMIN_PERM,
17143                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17144         },
17145         {
17146                 .cmd = NL80211_CMD_SET_NOACK_MAP,
17147                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17148                 .doit = nl80211_set_noack_map,
17149                 .flags = GENL_UNS_ADMIN_PERM,
17150                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17151         },
17152         {
17153                 .cmd = NL80211_CMD_START_P2P_DEVICE,
17154                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17155                 .doit = nl80211_start_p2p_device,
17156                 .flags = GENL_UNS_ADMIN_PERM,
17157                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17158                                          NL80211_FLAG_NEED_RTNL),
17159         },
17160         {
17161                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17162                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17163                 .doit = nl80211_stop_p2p_device,
17164                 .flags = GENL_UNS_ADMIN_PERM,
17165                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17166                                          NL80211_FLAG_NEED_RTNL),
17167         },
17168         {
17169                 .cmd = NL80211_CMD_START_NAN,
17170                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17171                 .doit = nl80211_start_nan,
17172                 .flags = GENL_ADMIN_PERM,
17173                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17174                                          NL80211_FLAG_NEED_RTNL),
17175         },
17176         {
17177                 .cmd = NL80211_CMD_STOP_NAN,
17178                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17179                 .doit = nl80211_stop_nan,
17180                 .flags = GENL_ADMIN_PERM,
17181                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17182                                          NL80211_FLAG_NEED_RTNL),
17183         },
17184         {
17185                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17186                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17187                 .doit = nl80211_nan_add_func,
17188                 .flags = GENL_ADMIN_PERM,
17189                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17190         },
17191         {
17192                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17193                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17194                 .doit = nl80211_nan_del_func,
17195                 .flags = GENL_ADMIN_PERM,
17196                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17197         },
17198         {
17199                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17200                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17201                 .doit = nl80211_nan_change_config,
17202                 .flags = GENL_ADMIN_PERM,
17203                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17204         },
17205         {
17206                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17207                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17208                 .doit = nl80211_set_mcast_rate,
17209                 .flags = GENL_UNS_ADMIN_PERM,
17210                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17211         },
17212         {
17213                 .cmd = NL80211_CMD_SET_MAC_ACL,
17214                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17215                 .doit = nl80211_set_mac_acl,
17216                 .flags = GENL_UNS_ADMIN_PERM,
17217                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17218                                          NL80211_FLAG_MLO_UNSUPPORTED),
17219         },
17220         {
17221                 .cmd = NL80211_CMD_RADAR_DETECT,
17222                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17223                 .doit = nl80211_start_radar_detection,
17224                 .flags = GENL_UNS_ADMIN_PERM,
17225                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17226                                          NL80211_FLAG_NO_WIPHY_MTX |
17227                                          NL80211_FLAG_MLO_UNSUPPORTED),
17228         },
17229         {
17230                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17231                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17232                 .doit = nl80211_get_protocol_features,
17233         },
17234         {
17235                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17236                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17237                 .doit = nl80211_update_ft_ies,
17238                 .flags = GENL_UNS_ADMIN_PERM,
17239                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17240         },
17241         {
17242                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17243                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17244                 .doit = nl80211_crit_protocol_start,
17245                 .flags = GENL_UNS_ADMIN_PERM,
17246                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17247         },
17248         {
17249                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17250                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17251                 .doit = nl80211_crit_protocol_stop,
17252                 .flags = GENL_UNS_ADMIN_PERM,
17253                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17254         },
17255         {
17256                 .cmd = NL80211_CMD_GET_COALESCE,
17257                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17258                 .doit = nl80211_get_coalesce,
17259                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17260         },
17261         {
17262                 .cmd = NL80211_CMD_SET_COALESCE,
17263                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17264                 .doit = nl80211_set_coalesce,
17265                 .flags = GENL_UNS_ADMIN_PERM,
17266                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17267         },
17268         {
17269                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17270                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17271                 .doit = nl80211_channel_switch,
17272                 .flags = GENL_UNS_ADMIN_PERM,
17273                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17274                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17275         },
17276         {
17277                 .cmd = NL80211_CMD_VENDOR,
17278                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17279                 .doit = nl80211_vendor_cmd,
17280                 .dumpit = nl80211_vendor_cmd_dump,
17281                 .flags = GENL_UNS_ADMIN_PERM,
17282                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17283                                          NL80211_FLAG_CLEAR_SKB),
17284         },
17285         {
17286                 .cmd = NL80211_CMD_SET_QOS_MAP,
17287                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17288                 .doit = nl80211_set_qos_map,
17289                 .flags = GENL_UNS_ADMIN_PERM,
17290                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17291         },
17292         {
17293                 .cmd = NL80211_CMD_ADD_TX_TS,
17294                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17295                 .doit = nl80211_add_tx_ts,
17296                 .flags = GENL_UNS_ADMIN_PERM,
17297                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17298                                          NL80211_FLAG_MLO_UNSUPPORTED),
17299         },
17300         {
17301                 .cmd = NL80211_CMD_DEL_TX_TS,
17302                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17303                 .doit = nl80211_del_tx_ts,
17304                 .flags = GENL_UNS_ADMIN_PERM,
17305                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17306         },
17307         {
17308                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17309                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17310                 .doit = nl80211_tdls_channel_switch,
17311                 .flags = GENL_UNS_ADMIN_PERM,
17312                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17313         },
17314         {
17315                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17316                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17317                 .doit = nl80211_tdls_cancel_channel_switch,
17318                 .flags = GENL_UNS_ADMIN_PERM,
17319                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17320         },
17321         {
17322                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17323                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17324                 .doit = nl80211_set_multicast_to_unicast,
17325                 .flags = GENL_UNS_ADMIN_PERM,
17326                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17327         },
17328         {
17329                 .cmd = NL80211_CMD_SET_PMK,
17330                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17331                 .doit = nl80211_set_pmk,
17332                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17333                                          NL80211_FLAG_CLEAR_SKB),
17334         },
17335         {
17336                 .cmd = NL80211_CMD_DEL_PMK,
17337                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17338                 .doit = nl80211_del_pmk,
17339                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17340         },
17341         {
17342                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17343                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17344                 .doit = nl80211_external_auth,
17345                 .flags = GENL_ADMIN_PERM,
17346                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17347         },
17348         {
17349                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17350                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17351                 .doit = nl80211_tx_control_port,
17352                 .flags = GENL_UNS_ADMIN_PERM,
17353                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17354         },
17355         {
17356                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17357                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17358                 .doit = nl80211_get_ftm_responder_stats,
17359                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17360                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17361         },
17362         {
17363                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17364                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17365                 .doit = nl80211_pmsr_start,
17366                 .flags = GENL_UNS_ADMIN_PERM,
17367                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17368         },
17369         {
17370                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17371                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17372                 .doit = nl80211_notify_radar_detection,
17373                 .flags = GENL_UNS_ADMIN_PERM,
17374                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17375         },
17376         {
17377                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17378                 .doit = nl80211_update_owe_info,
17379                 .flags = GENL_ADMIN_PERM,
17380                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17381         },
17382         {
17383                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17384                 .doit = nl80211_probe_mesh_link,
17385                 .flags = GENL_UNS_ADMIN_PERM,
17386                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17387         },
17388         {
17389                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17390                 .doit = nl80211_set_tid_config,
17391                 .flags = GENL_UNS_ADMIN_PERM,
17392                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17393                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17394         },
17395         {
17396                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17397                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17398                 .doit = nl80211_set_sar_specs,
17399                 .flags = GENL_UNS_ADMIN_PERM,
17400                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17401                                          NL80211_FLAG_NEED_RTNL),
17402         },
17403         {
17404                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17405                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17406                 .doit = nl80211_color_change,
17407                 .flags = GENL_UNS_ADMIN_PERM,
17408                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17409         },
17410         {
17411                 .cmd = NL80211_CMD_SET_FILS_AAD,
17412                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17413                 .doit = nl80211_set_fils_aad,
17414                 .flags = GENL_UNS_ADMIN_PERM,
17415                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17416         },
17417         {
17418                 .cmd = NL80211_CMD_ADD_LINK,
17419                 .doit = nl80211_add_link,
17420                 .flags = GENL_UNS_ADMIN_PERM,
17421                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17422         },
17423         {
17424                 .cmd = NL80211_CMD_REMOVE_LINK,
17425                 .doit = nl80211_remove_link,
17426                 .flags = GENL_UNS_ADMIN_PERM,
17427                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17428                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17429         },
17430         {
17431                 .cmd = NL80211_CMD_ADD_LINK_STA,
17432                 .doit = nl80211_add_link_station,
17433                 .flags = GENL_UNS_ADMIN_PERM,
17434                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17435                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17436         },
17437         {
17438                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17439                 .doit = nl80211_modify_link_station,
17440                 .flags = GENL_UNS_ADMIN_PERM,
17441                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17442                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17443         },
17444         {
17445                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17446                 .doit = nl80211_remove_link_station,
17447                 .flags = GENL_UNS_ADMIN_PERM,
17448                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17449                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17450         },
17451         {
17452                 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17453                 .doit = nl80211_set_hw_timestamp,
17454                 .flags = GENL_UNS_ADMIN_PERM,
17455                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17456         },
17457 };
17458
17459 static struct genl_family nl80211_fam __ro_after_init = {
17460         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17461         .hdrsize = 0,                   /* no private header */
17462         .version = 1,                   /* no particular meaning now */
17463         .maxattr = NL80211_ATTR_MAX,
17464         .policy = nl80211_policy,
17465         .netnsok = true,
17466         .pre_doit = nl80211_pre_doit,
17467         .post_doit = nl80211_post_doit,
17468         .module = THIS_MODULE,
17469         .ops = nl80211_ops,
17470         .n_ops = ARRAY_SIZE(nl80211_ops),
17471         .small_ops = nl80211_small_ops,
17472         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17473         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17474         .mcgrps = nl80211_mcgrps,
17475         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17476         .parallel_ops = true,
17477 };
17478
17479 /* notification functions */
17480
17481 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17482                           enum nl80211_commands cmd)
17483 {
17484         struct sk_buff *msg;
17485         struct nl80211_dump_wiphy_state state = {};
17486
17487         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17488                 cmd != NL80211_CMD_DEL_WIPHY);
17489
17490         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17491         if (!msg)
17492                 return;
17493
17494         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17495                 nlmsg_free(msg);
17496                 return;
17497         }
17498
17499         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17500                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17501 }
17502
17503 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17504                                 struct wireless_dev *wdev,
17505                                 enum nl80211_commands cmd)
17506 {
17507         struct sk_buff *msg;
17508
17509         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17510         if (!msg)
17511                 return;
17512
17513         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17514                 nlmsg_free(msg);
17515                 return;
17516         }
17517
17518         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17519                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17520 }
17521
17522 static int nl80211_add_scan_req(struct sk_buff *msg,
17523                                 struct cfg80211_registered_device *rdev)
17524 {
17525         struct cfg80211_scan_request *req = rdev->scan_req;
17526         struct nlattr *nest;
17527         int i;
17528         struct cfg80211_scan_info *info;
17529
17530         if (WARN_ON(!req))
17531                 return 0;
17532
17533         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17534         if (!nest)
17535                 goto nla_put_failure;
17536         for (i = 0; i < req->n_ssids; i++) {
17537                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17538                         goto nla_put_failure;
17539         }
17540         nla_nest_end(msg, nest);
17541
17542         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17543                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17544                 if (!nest)
17545                         goto nla_put_failure;
17546                 for (i = 0; i < req->n_channels; i++) {
17547                         if (nla_put_u32(msg, i,
17548                                    ieee80211_channel_to_khz(req->channels[i])))
17549                                 goto nla_put_failure;
17550                 }
17551                 nla_nest_end(msg, nest);
17552         } else {
17553                 nest = nla_nest_start_noflag(msg,
17554                                              NL80211_ATTR_SCAN_FREQUENCIES);
17555                 if (!nest)
17556                         goto nla_put_failure;
17557                 for (i = 0; i < req->n_channels; i++) {
17558                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17559                                 goto nla_put_failure;
17560                 }
17561                 nla_nest_end(msg, nest);
17562         }
17563
17564         if (req->ie &&
17565             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17566                 goto nla_put_failure;
17567
17568         if (req->flags &&
17569             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17570                 goto nla_put_failure;
17571
17572         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17573                 &rdev->scan_req->info;
17574         if (info->scan_start_tsf &&
17575             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17576                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17577              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17578                      info->tsf_bssid)))
17579                 goto nla_put_failure;
17580
17581         return 0;
17582  nla_put_failure:
17583         return -ENOBUFS;
17584 }
17585
17586 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17587                                  struct cfg80211_registered_device *rdev,
17588                                  struct wireless_dev *wdev,
17589                                  u32 portid, u32 seq, int flags,
17590                                  u32 cmd)
17591 {
17592         void *hdr;
17593
17594         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17595         if (!hdr)
17596                 return -1;
17597
17598         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17599             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17600                                          wdev->netdev->ifindex)) ||
17601             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17602                               NL80211_ATTR_PAD))
17603                 goto nla_put_failure;
17604
17605         /* ignore errors and send incomplete event anyway */
17606         nl80211_add_scan_req(msg, rdev);
17607
17608         genlmsg_end(msg, hdr);
17609         return 0;
17610
17611  nla_put_failure:
17612         genlmsg_cancel(msg, hdr);
17613         return -EMSGSIZE;
17614 }
17615
17616 static int
17617 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17618                             struct cfg80211_sched_scan_request *req, u32 cmd)
17619 {
17620         void *hdr;
17621
17622         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17623         if (!hdr)
17624                 return -1;
17625
17626         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17627                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17628             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17629             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17630                               NL80211_ATTR_PAD))
17631                 goto nla_put_failure;
17632
17633         genlmsg_end(msg, hdr);
17634         return 0;
17635
17636  nla_put_failure:
17637         genlmsg_cancel(msg, hdr);
17638         return -EMSGSIZE;
17639 }
17640
17641 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17642                              struct wireless_dev *wdev)
17643 {
17644         struct sk_buff *msg;
17645
17646         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17647         if (!msg)
17648                 return;
17649
17650         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17651                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
17652                 nlmsg_free(msg);
17653                 return;
17654         }
17655
17656         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17657                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17658 }
17659
17660 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17661                                        struct wireless_dev *wdev, bool aborted)
17662 {
17663         struct sk_buff *msg;
17664
17665         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17666         if (!msg)
17667                 return NULL;
17668
17669         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17670                                   aborted ? NL80211_CMD_SCAN_ABORTED :
17671                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17672                 nlmsg_free(msg);
17673                 return NULL;
17674         }
17675
17676         return msg;
17677 }
17678
17679 /* send message created by nl80211_build_scan_msg() */
17680 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17681                            struct sk_buff *msg)
17682 {
17683         if (!msg)
17684                 return;
17685
17686         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17687                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17688 }
17689
17690 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17691 {
17692         struct sk_buff *msg;
17693
17694         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17695         if (!msg)
17696                 return;
17697
17698         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17699                 nlmsg_free(msg);
17700                 return;
17701         }
17702
17703         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17704                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17705 }
17706
17707 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17708                                           struct regulatory_request *request)
17709 {
17710         /* Userspace can always count this one always being set */
17711         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17712                 goto nla_put_failure;
17713
17714         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17715                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17716                                NL80211_REGDOM_TYPE_WORLD))
17717                         goto nla_put_failure;
17718         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17719                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17720                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17721                         goto nla_put_failure;
17722         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17723                    request->intersect) {
17724                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17725                                NL80211_REGDOM_TYPE_INTERSECTION))
17726                         goto nla_put_failure;
17727         } else {
17728                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17729                                NL80211_REGDOM_TYPE_COUNTRY) ||
17730                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17731                                    request->alpha2))
17732                         goto nla_put_failure;
17733         }
17734
17735         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17736                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17737
17738                 if (wiphy &&
17739                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17740                         goto nla_put_failure;
17741
17742                 if (wiphy &&
17743                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17744                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17745                         goto nla_put_failure;
17746         }
17747
17748         return true;
17749
17750 nla_put_failure:
17751         return false;
17752 }
17753
17754 /*
17755  * This can happen on global regulatory changes or device specific settings
17756  * based on custom regulatory domains.
17757  */
17758 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17759                                      struct regulatory_request *request)
17760 {
17761         struct sk_buff *msg;
17762         void *hdr;
17763
17764         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17765         if (!msg)
17766                 return;
17767
17768         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17769         if (!hdr)
17770                 goto nla_put_failure;
17771
17772         if (!nl80211_reg_change_event_fill(msg, request))
17773                 goto nla_put_failure;
17774
17775         genlmsg_end(msg, hdr);
17776
17777         rcu_read_lock();
17778         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17779                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17780         rcu_read_unlock();
17781
17782         return;
17783
17784 nla_put_failure:
17785         nlmsg_free(msg);
17786 }
17787
17788 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17789                                     struct net_device *netdev,
17790                                     const u8 *buf, size_t len,
17791                                     enum nl80211_commands cmd, gfp_t gfp,
17792                                     int uapsd_queues, const u8 *req_ies,
17793                                     size_t req_ies_len, bool reconnect)
17794 {
17795         struct sk_buff *msg;
17796         void *hdr;
17797
17798         msg = nlmsg_new(100 + len + req_ies_len, gfp);
17799         if (!msg)
17800                 return;
17801
17802         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17803         if (!hdr) {
17804                 nlmsg_free(msg);
17805                 return;
17806         }
17807
17808         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17809             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17810             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17811             (req_ies &&
17812              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17813                 goto nla_put_failure;
17814
17815         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17816                 goto nla_put_failure;
17817
17818         if (uapsd_queues >= 0) {
17819                 struct nlattr *nla_wmm =
17820                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17821                 if (!nla_wmm)
17822                         goto nla_put_failure;
17823
17824                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17825                                uapsd_queues))
17826                         goto nla_put_failure;
17827
17828                 nla_nest_end(msg, nla_wmm);
17829         }
17830
17831         genlmsg_end(msg, hdr);
17832
17833         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17834                                 NL80211_MCGRP_MLME, gfp);
17835         return;
17836
17837  nla_put_failure:
17838         nlmsg_free(msg);
17839 }
17840
17841 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17842                           struct net_device *netdev, const u8 *buf,
17843                           size_t len, gfp_t gfp)
17844 {
17845         nl80211_send_mlme_event(rdev, netdev, buf, len,
17846                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17847                                 false);
17848 }
17849
17850 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17851                            struct net_device *netdev,
17852                            struct cfg80211_rx_assoc_resp *data)
17853 {
17854         nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17855                                 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17856                                 data->uapsd_queues,
17857                                 data->req_ies, data->req_ies_len, false);
17858 }
17859
17860 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17861                          struct net_device *netdev, const u8 *buf,
17862                          size_t len, bool reconnect, gfp_t gfp)
17863 {
17864         nl80211_send_mlme_event(rdev, netdev, buf, len,
17865                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17866                                 reconnect);
17867 }
17868
17869 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17870                            struct net_device *netdev, const u8 *buf,
17871                            size_t len, bool reconnect, gfp_t gfp)
17872 {
17873         nl80211_send_mlme_event(rdev, netdev, buf, len,
17874                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17875                                 reconnect);
17876 }
17877
17878 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17879                                   size_t len)
17880 {
17881         struct wireless_dev *wdev = dev->ieee80211_ptr;
17882         struct wiphy *wiphy = wdev->wiphy;
17883         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17884         const struct ieee80211_mgmt *mgmt = (void *)buf;
17885         u32 cmd;
17886
17887         if (WARN_ON(len < 2))
17888                 return;
17889
17890         if (ieee80211_is_deauth(mgmt->frame_control)) {
17891                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17892         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17893                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17894         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17895                 if (wdev->unprot_beacon_reported &&
17896                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17897                         return;
17898                 cmd = NL80211_CMD_UNPROT_BEACON;
17899                 wdev->unprot_beacon_reported = jiffies;
17900         } else {
17901                 return;
17902         }
17903
17904         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17905         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17906                                 NULL, 0, false);
17907 }
17908 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17909
17910 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17911                                       struct net_device *netdev, int cmd,
17912                                       const u8 *addr, gfp_t gfp)
17913 {
17914         struct sk_buff *msg;
17915         void *hdr;
17916
17917         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17918         if (!msg)
17919                 return;
17920
17921         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17922         if (!hdr) {
17923                 nlmsg_free(msg);
17924                 return;
17925         }
17926
17927         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17928             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17929             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17930             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17931                 goto nla_put_failure;
17932
17933         genlmsg_end(msg, hdr);
17934
17935         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17936                                 NL80211_MCGRP_MLME, gfp);
17937         return;
17938
17939  nla_put_failure:
17940         nlmsg_free(msg);
17941 }
17942
17943 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17944                                struct net_device *netdev, const u8 *addr,
17945                                gfp_t gfp)
17946 {
17947         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17948                                   addr, gfp);
17949 }
17950
17951 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17952                                 struct net_device *netdev, const u8 *addr,
17953                                 gfp_t gfp)
17954 {
17955         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17956                                   addr, gfp);
17957 }
17958
17959 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17960                                  struct net_device *netdev,
17961                                  struct cfg80211_connect_resp_params *cr,
17962                                  gfp_t gfp)
17963 {
17964         struct sk_buff *msg;
17965         void *hdr;
17966         unsigned int link;
17967         size_t link_info_size = 0;
17968         const u8 *connected_addr = cr->valid_links ?
17969                                    cr->ap_mld_addr : cr->links[0].bssid;
17970
17971         if (cr->valid_links) {
17972                 for_each_valid_link(cr, link) {
17973                         /* Nested attribute header */
17974                         link_info_size += NLA_HDRLEN;
17975                         /* Link ID */
17976                         link_info_size += nla_total_size(sizeof(u8));
17977                         link_info_size += cr->links[link].addr ?
17978                                           nla_total_size(ETH_ALEN) : 0;
17979                         link_info_size += (cr->links[link].bssid ||
17980                                            cr->links[link].bss) ?
17981                                           nla_total_size(ETH_ALEN) : 0;
17982                         link_info_size += nla_total_size(sizeof(u16));
17983                 }
17984         }
17985
17986         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17987                         cr->fils.kek_len + cr->fils.pmk_len +
17988                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
17989                         gfp);
17990         if (!msg)
17991                 return;
17992
17993         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17994         if (!hdr) {
17995                 nlmsg_free(msg);
17996                 return;
17997         }
17998
17999         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18000             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18001             (connected_addr &&
18002              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18003             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18004                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18005                         cr->status) ||
18006             (cr->status < 0 &&
18007              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18008               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18009                           cr->timeout_reason))) ||
18010             (cr->req_ie &&
18011              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18012             (cr->resp_ie &&
18013              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18014                      cr->resp_ie)) ||
18015             (cr->fils.update_erp_next_seq_num &&
18016              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18017                          cr->fils.erp_next_seq_num)) ||
18018             (cr->status == WLAN_STATUS_SUCCESS &&
18019              ((cr->fils.kek &&
18020                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18021                        cr->fils.kek)) ||
18022               (cr->fils.pmk &&
18023                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18024               (cr->fils.pmkid &&
18025                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18026                 goto nla_put_failure;
18027
18028         if (cr->valid_links) {
18029                 int i = 1;
18030                 struct nlattr *nested;
18031
18032                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18033                 if (!nested)
18034                         goto nla_put_failure;
18035
18036                 for_each_valid_link(cr, link) {
18037                         struct nlattr *nested_mlo_links;
18038                         const u8 *bssid = cr->links[link].bss ?
18039                                           cr->links[link].bss->bssid :
18040                                           cr->links[link].bssid;
18041
18042                         nested_mlo_links = nla_nest_start(msg, i);
18043                         if (!nested_mlo_links)
18044                                 goto nla_put_failure;
18045
18046                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18047                             (bssid &&
18048                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18049                             (cr->links[link].addr &&
18050                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18051                                      cr->links[link].addr)) ||
18052                             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18053                                         cr->links[link].status))
18054                                 goto nla_put_failure;
18055
18056                         nla_nest_end(msg, nested_mlo_links);
18057                         i++;
18058                 }
18059                 nla_nest_end(msg, nested);
18060         }
18061
18062         genlmsg_end(msg, hdr);
18063
18064         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18065                                 NL80211_MCGRP_MLME, gfp);
18066         return;
18067
18068  nla_put_failure:
18069         nlmsg_free(msg);
18070 }
18071
18072 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18073                          struct net_device *netdev,
18074                          struct cfg80211_roam_info *info, gfp_t gfp)
18075 {
18076         struct sk_buff *msg;
18077         void *hdr;
18078         size_t link_info_size = 0;
18079         unsigned int link;
18080         const u8 *connected_addr = info->ap_mld_addr ?
18081                                    info->ap_mld_addr :
18082                                    (info->links[0].bss ?
18083                                     info->links[0].bss->bssid :
18084                                     info->links[0].bssid);
18085
18086         if (info->valid_links) {
18087                 for_each_valid_link(info, link) {
18088                         /* Nested attribute header */
18089                         link_info_size += NLA_HDRLEN;
18090                         /* Link ID */
18091                         link_info_size += nla_total_size(sizeof(u8));
18092                         link_info_size += info->links[link].addr ?
18093                                           nla_total_size(ETH_ALEN) : 0;
18094                         link_info_size += (info->links[link].bssid ||
18095                                            info->links[link].bss) ?
18096                                           nla_total_size(ETH_ALEN) : 0;
18097                 }
18098         }
18099
18100         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18101                         info->fils.kek_len + info->fils.pmk_len +
18102                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18103                         link_info_size, gfp);
18104         if (!msg)
18105                 return;
18106
18107         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18108         if (!hdr) {
18109                 nlmsg_free(msg);
18110                 return;
18111         }
18112
18113         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18114             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18115             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18116             (info->req_ie &&
18117              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18118                      info->req_ie)) ||
18119             (info->resp_ie &&
18120              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18121                      info->resp_ie)) ||
18122             (info->fils.update_erp_next_seq_num &&
18123              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18124                          info->fils.erp_next_seq_num)) ||
18125             (info->fils.kek &&
18126              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18127                      info->fils.kek)) ||
18128             (info->fils.pmk &&
18129              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18130             (info->fils.pmkid &&
18131              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18132                 goto nla_put_failure;
18133
18134         if (info->valid_links) {
18135                 int i = 1;
18136                 struct nlattr *nested;
18137
18138                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18139                 if (!nested)
18140                         goto nla_put_failure;
18141
18142                 for_each_valid_link(info, link) {
18143                         struct nlattr *nested_mlo_links;
18144                         const u8 *bssid = info->links[link].bss ?
18145                                           info->links[link].bss->bssid :
18146                                           info->links[link].bssid;
18147
18148                         nested_mlo_links = nla_nest_start(msg, i);
18149                         if (!nested_mlo_links)
18150                                 goto nla_put_failure;
18151
18152                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18153                             (bssid &&
18154                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18155                             (info->links[link].addr &&
18156                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18157                                      info->links[link].addr)))
18158                                 goto nla_put_failure;
18159
18160                         nla_nest_end(msg, nested_mlo_links);
18161                         i++;
18162                 }
18163                 nla_nest_end(msg, nested);
18164         }
18165
18166         genlmsg_end(msg, hdr);
18167
18168         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18169                                 NL80211_MCGRP_MLME, gfp);
18170         return;
18171
18172  nla_put_failure:
18173         nlmsg_free(msg);
18174 }
18175
18176 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18177                                   struct net_device *netdev, const u8 *bssid,
18178                                   const u8 *td_bitmap, u8 td_bitmap_len)
18179 {
18180         struct sk_buff *msg;
18181         void *hdr;
18182
18183         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18184         if (!msg)
18185                 return;
18186
18187         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18188         if (!hdr) {
18189                 nlmsg_free(msg);
18190                 return;
18191         }
18192
18193         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18194             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18195             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18196                 goto nla_put_failure;
18197
18198         if ((td_bitmap_len > 0) && td_bitmap)
18199                 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18200                             td_bitmap_len, td_bitmap))
18201                         goto nla_put_failure;
18202
18203         genlmsg_end(msg, hdr);
18204
18205         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18206                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18207         return;
18208
18209  nla_put_failure:
18210         nlmsg_free(msg);
18211 }
18212
18213 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18214                                struct net_device *netdev, u16 reason,
18215                                const u8 *ie, size_t ie_len, bool from_ap)
18216 {
18217         struct sk_buff *msg;
18218         void *hdr;
18219
18220         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18221         if (!msg)
18222                 return;
18223
18224         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18225         if (!hdr) {
18226                 nlmsg_free(msg);
18227                 return;
18228         }
18229
18230         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18231             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18232             (reason &&
18233              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18234             (from_ap &&
18235              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18236             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18237                 goto nla_put_failure;
18238
18239         genlmsg_end(msg, hdr);
18240
18241         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18242                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18243         return;
18244
18245  nla_put_failure:
18246         nlmsg_free(msg);
18247 }
18248
18249 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18250                              struct net_device *netdev, const u8 *bssid,
18251                              gfp_t gfp)
18252 {
18253         struct sk_buff *msg;
18254         void *hdr;
18255
18256         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18257         if (!msg)
18258                 return;
18259
18260         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18261         if (!hdr) {
18262                 nlmsg_free(msg);
18263                 return;
18264         }
18265
18266         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18267             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18268             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18269                 goto nla_put_failure;
18270
18271         genlmsg_end(msg, hdr);
18272
18273         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18274                                 NL80211_MCGRP_MLME, gfp);
18275         return;
18276
18277  nla_put_failure:
18278         nlmsg_free(msg);
18279 }
18280
18281 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18282                                         const u8 *ie, u8 ie_len,
18283                                         int sig_dbm, gfp_t gfp)
18284 {
18285         struct wireless_dev *wdev = dev->ieee80211_ptr;
18286         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18287         struct sk_buff *msg;
18288         void *hdr;
18289
18290         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18291                 return;
18292
18293         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18294
18295         msg = nlmsg_new(100 + ie_len, gfp);
18296         if (!msg)
18297                 return;
18298
18299         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18300         if (!hdr) {
18301                 nlmsg_free(msg);
18302                 return;
18303         }
18304
18305         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18306             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18307             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18308             (ie_len && ie &&
18309              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18310             (sig_dbm &&
18311              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18312                 goto nla_put_failure;
18313
18314         genlmsg_end(msg, hdr);
18315
18316         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18317                                 NL80211_MCGRP_MLME, gfp);
18318         return;
18319
18320  nla_put_failure:
18321         nlmsg_free(msg);
18322 }
18323 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18324
18325 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18326                                  struct net_device *netdev, const u8 *addr,
18327                                  enum nl80211_key_type key_type, int key_id,
18328                                  const u8 *tsc, gfp_t gfp)
18329 {
18330         struct sk_buff *msg;
18331         void *hdr;
18332
18333         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18334         if (!msg)
18335                 return;
18336
18337         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18338         if (!hdr) {
18339                 nlmsg_free(msg);
18340                 return;
18341         }
18342
18343         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18344             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18345             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18346             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18347             (key_id != -1 &&
18348              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18349             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18350                 goto nla_put_failure;
18351
18352         genlmsg_end(msg, hdr);
18353
18354         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18355                                 NL80211_MCGRP_MLME, gfp);
18356         return;
18357
18358  nla_put_failure:
18359         nlmsg_free(msg);
18360 }
18361
18362 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18363                                     struct ieee80211_channel *channel_before,
18364                                     struct ieee80211_channel *channel_after)
18365 {
18366         struct sk_buff *msg;
18367         void *hdr;
18368         struct nlattr *nl_freq;
18369
18370         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18371         if (!msg)
18372                 return;
18373
18374         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18375         if (!hdr) {
18376                 nlmsg_free(msg);
18377                 return;
18378         }
18379
18380         /*
18381          * Since we are applying the beacon hint to a wiphy we know its
18382          * wiphy_idx is valid
18383          */
18384         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18385                 goto nla_put_failure;
18386
18387         /* Before */
18388         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18389         if (!nl_freq)
18390                 goto nla_put_failure;
18391
18392         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18393                 goto nla_put_failure;
18394         nla_nest_end(msg, nl_freq);
18395
18396         /* After */
18397         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18398         if (!nl_freq)
18399                 goto nla_put_failure;
18400
18401         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18402                 goto nla_put_failure;
18403         nla_nest_end(msg, nl_freq);
18404
18405         genlmsg_end(msg, hdr);
18406
18407         rcu_read_lock();
18408         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18409                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18410         rcu_read_unlock();
18411
18412         return;
18413
18414 nla_put_failure:
18415         nlmsg_free(msg);
18416 }
18417
18418 static void nl80211_send_remain_on_chan_event(
18419         int cmd, struct cfg80211_registered_device *rdev,
18420         struct wireless_dev *wdev, u64 cookie,
18421         struct ieee80211_channel *chan,
18422         unsigned int duration, gfp_t gfp)
18423 {
18424         struct sk_buff *msg;
18425         void *hdr;
18426
18427         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18428         if (!msg)
18429                 return;
18430
18431         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18432         if (!hdr) {
18433                 nlmsg_free(msg);
18434                 return;
18435         }
18436
18437         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18438             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18439                                          wdev->netdev->ifindex)) ||
18440             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18441                               NL80211_ATTR_PAD) ||
18442             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18443             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18444                         NL80211_CHAN_NO_HT) ||
18445             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18446                               NL80211_ATTR_PAD))
18447                 goto nla_put_failure;
18448
18449         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18450             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18451                 goto nla_put_failure;
18452
18453         genlmsg_end(msg, hdr);
18454
18455         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18456                                 NL80211_MCGRP_MLME, gfp);
18457         return;
18458
18459  nla_put_failure:
18460         nlmsg_free(msg);
18461 }
18462
18463 void cfg80211_assoc_comeback(struct net_device *netdev,
18464                              const u8 *ap_addr, u32 timeout)
18465 {
18466         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18467         struct wiphy *wiphy = wdev->wiphy;
18468         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18469         struct sk_buff *msg;
18470         void *hdr;
18471
18472         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18473
18474         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18475         if (!msg)
18476                 return;
18477
18478         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18479         if (!hdr) {
18480                 nlmsg_free(msg);
18481                 return;
18482         }
18483
18484         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18485             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18486             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18487             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18488                 goto nla_put_failure;
18489
18490         genlmsg_end(msg, hdr);
18491
18492         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18493                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18494         return;
18495
18496  nla_put_failure:
18497         nlmsg_free(msg);
18498 }
18499 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18500
18501 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18502                                struct ieee80211_channel *chan,
18503                                unsigned int duration, gfp_t gfp)
18504 {
18505         struct wiphy *wiphy = wdev->wiphy;
18506         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18507
18508         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18509         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18510                                           rdev, wdev, cookie, chan,
18511                                           duration, gfp);
18512 }
18513 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18514
18515 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18516                                         struct ieee80211_channel *chan,
18517                                         gfp_t gfp)
18518 {
18519         struct wiphy *wiphy = wdev->wiphy;
18520         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18521
18522         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18523         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18524                                           rdev, wdev, cookie, chan, 0, gfp);
18525 }
18526 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18527
18528 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18529                                         struct ieee80211_channel *chan,
18530                                         gfp_t gfp)
18531 {
18532         struct wiphy *wiphy = wdev->wiphy;
18533         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18534
18535         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18536         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18537                                           rdev, wdev, cookie, chan, 0, gfp);
18538 }
18539 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18540
18541 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18542                       struct station_info *sinfo, gfp_t gfp)
18543 {
18544         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18545         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18546         struct sk_buff *msg;
18547
18548         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18549
18550         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18551         if (!msg)
18552                 return;
18553
18554         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18555                                  rdev, dev, mac_addr, sinfo) < 0) {
18556                 nlmsg_free(msg);
18557                 return;
18558         }
18559
18560         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18561                                 NL80211_MCGRP_MLME, gfp);
18562 }
18563 EXPORT_SYMBOL(cfg80211_new_sta);
18564
18565 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18566                             struct station_info *sinfo, gfp_t gfp)
18567 {
18568         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18569         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18570         struct sk_buff *msg;
18571         struct station_info empty_sinfo = {};
18572
18573         if (!sinfo)
18574                 sinfo = &empty_sinfo;
18575
18576         trace_cfg80211_del_sta(dev, mac_addr);
18577
18578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18579         if (!msg) {
18580                 cfg80211_sinfo_release_content(sinfo);
18581                 return;
18582         }
18583
18584         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18585                                  rdev, dev, mac_addr, sinfo) < 0) {
18586                 nlmsg_free(msg);
18587                 return;
18588         }
18589
18590         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18591                                 NL80211_MCGRP_MLME, gfp);
18592 }
18593 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18594
18595 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18596                           enum nl80211_connect_failed_reason reason,
18597                           gfp_t gfp)
18598 {
18599         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18600         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18601         struct sk_buff *msg;
18602         void *hdr;
18603
18604         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18605         if (!msg)
18606                 return;
18607
18608         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18609         if (!hdr) {
18610                 nlmsg_free(msg);
18611                 return;
18612         }
18613
18614         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18615             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18616             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18617                 goto nla_put_failure;
18618
18619         genlmsg_end(msg, hdr);
18620
18621         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18622                                 NL80211_MCGRP_MLME, gfp);
18623         return;
18624
18625  nla_put_failure:
18626         nlmsg_free(msg);
18627 }
18628 EXPORT_SYMBOL(cfg80211_conn_failed);
18629
18630 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18631                                        const u8 *addr, gfp_t gfp)
18632 {
18633         struct wireless_dev *wdev = dev->ieee80211_ptr;
18634         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18635         struct sk_buff *msg;
18636         void *hdr;
18637         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18638
18639         if (!nlportid)
18640                 return false;
18641
18642         msg = nlmsg_new(100, gfp);
18643         if (!msg)
18644                 return true;
18645
18646         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18647         if (!hdr) {
18648                 nlmsg_free(msg);
18649                 return true;
18650         }
18651
18652         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18653             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18654             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18655                 goto nla_put_failure;
18656
18657         genlmsg_end(msg, hdr);
18658         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18659         return true;
18660
18661  nla_put_failure:
18662         nlmsg_free(msg);
18663         return true;
18664 }
18665
18666 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18667                                 const u8 *addr, gfp_t gfp)
18668 {
18669         struct wireless_dev *wdev = dev->ieee80211_ptr;
18670         bool ret;
18671
18672         trace_cfg80211_rx_spurious_frame(dev, addr);
18673
18674         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18675                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18676                 trace_cfg80211_return_bool(false);
18677                 return false;
18678         }
18679         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18680                                          addr, gfp);
18681         trace_cfg80211_return_bool(ret);
18682         return ret;
18683 }
18684 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18685
18686 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18687                                         const u8 *addr, gfp_t gfp)
18688 {
18689         struct wireless_dev *wdev = dev->ieee80211_ptr;
18690         bool ret;
18691
18692         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18693
18694         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18695                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18696                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18697                 trace_cfg80211_return_bool(false);
18698                 return false;
18699         }
18700         ret = __nl80211_unexpected_frame(dev,
18701                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18702                                          addr, gfp);
18703         trace_cfg80211_return_bool(ret);
18704         return ret;
18705 }
18706 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18707
18708 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18709                       struct wireless_dev *wdev, u32 nlportid,
18710                       struct cfg80211_rx_info *info, gfp_t gfp)
18711 {
18712         struct net_device *netdev = wdev->netdev;
18713         struct sk_buff *msg;
18714         void *hdr;
18715
18716         msg = nlmsg_new(100 + info->len, gfp);
18717         if (!msg)
18718                 return -ENOMEM;
18719
18720         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18721         if (!hdr) {
18722                 nlmsg_free(msg);
18723                 return -ENOMEM;
18724         }
18725
18726         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18727             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18728                                         netdev->ifindex)) ||
18729             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18730                               NL80211_ATTR_PAD) ||
18731             (info->have_link_id &&
18732              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18733             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18734             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18735             (info->sig_dbm &&
18736              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18737             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18738             (info->flags &&
18739              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18740             (info->rx_tstamp && nla_put_u64_64bit(msg,
18741                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
18742                                                   info->rx_tstamp,
18743                                                   NL80211_ATTR_PAD)) ||
18744             (info->ack_tstamp && nla_put_u64_64bit(msg,
18745                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
18746                                                    info->ack_tstamp,
18747                                                    NL80211_ATTR_PAD)))
18748                 goto nla_put_failure;
18749
18750         genlmsg_end(msg, hdr);
18751
18752         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18753
18754  nla_put_failure:
18755         nlmsg_free(msg);
18756         return -ENOBUFS;
18757 }
18758
18759 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18760                                     struct cfg80211_tx_status *status,
18761                                     gfp_t gfp, enum nl80211_commands command)
18762 {
18763         struct wiphy *wiphy = wdev->wiphy;
18764         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18765         struct net_device *netdev = wdev->netdev;
18766         struct sk_buff *msg;
18767         void *hdr;
18768
18769         if (command == NL80211_CMD_FRAME_TX_STATUS)
18770                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18771                                               status->ack);
18772         else
18773                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18774                                                       status->ack);
18775
18776         msg = nlmsg_new(100 + status->len, gfp);
18777         if (!msg)
18778                 return;
18779
18780         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18781         if (!hdr) {
18782                 nlmsg_free(msg);
18783                 return;
18784         }
18785
18786         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18787             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18788                                    netdev->ifindex)) ||
18789             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18790                               NL80211_ATTR_PAD) ||
18791             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18792             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18793                               NL80211_ATTR_PAD) ||
18794             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18795             (status->tx_tstamp &&
18796              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18797                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
18798             (status->ack_tstamp &&
18799              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18800                                status->ack_tstamp, NL80211_ATTR_PAD)))
18801                 goto nla_put_failure;
18802
18803         genlmsg_end(msg, hdr);
18804
18805         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18806                                 NL80211_MCGRP_MLME, gfp);
18807         return;
18808
18809 nla_put_failure:
18810         nlmsg_free(msg);
18811 }
18812
18813 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18814                                      const u8 *buf, size_t len, bool ack,
18815                                      gfp_t gfp)
18816 {
18817         struct cfg80211_tx_status status = {
18818                 .cookie = cookie,
18819                 .buf = buf,
18820                 .len = len,
18821                 .ack = ack
18822         };
18823
18824         nl80211_frame_tx_status(wdev, &status, gfp,
18825                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18826 }
18827 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18828
18829 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18830                                  struct cfg80211_tx_status *status, gfp_t gfp)
18831 {
18832         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18833 }
18834 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18835
18836 static int __nl80211_rx_control_port(struct net_device *dev,
18837                                      struct sk_buff *skb,
18838                                      bool unencrypted,
18839                                      int link_id,
18840                                      gfp_t gfp)
18841 {
18842         struct wireless_dev *wdev = dev->ieee80211_ptr;
18843         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18844         struct ethhdr *ehdr = eth_hdr(skb);
18845         const u8 *addr = ehdr->h_source;
18846         u16 proto = be16_to_cpu(skb->protocol);
18847         struct sk_buff *msg;
18848         void *hdr;
18849         struct nlattr *frame;
18850
18851         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18852
18853         if (!nlportid)
18854                 return -ENOENT;
18855
18856         msg = nlmsg_new(100 + skb->len, gfp);
18857         if (!msg)
18858                 return -ENOMEM;
18859
18860         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18861         if (!hdr) {
18862                 nlmsg_free(msg);
18863                 return -ENOBUFS;
18864         }
18865
18866         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18867             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18868             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18869                               NL80211_ATTR_PAD) ||
18870             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18871             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18872             (link_id >= 0 &&
18873              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
18874             (unencrypted && nla_put_flag(msg,
18875                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18876                 goto nla_put_failure;
18877
18878         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18879         if (!frame)
18880                 goto nla_put_failure;
18881
18882         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18883         genlmsg_end(msg, hdr);
18884
18885         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18886
18887  nla_put_failure:
18888         nlmsg_free(msg);
18889         return -ENOBUFS;
18890 }
18891
18892 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
18893                               bool unencrypted, int link_id)
18894 {
18895         int ret;
18896
18897         trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
18898         ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
18899                                         GFP_ATOMIC);
18900         trace_cfg80211_return_bool(ret == 0);
18901         return ret == 0;
18902 }
18903 EXPORT_SYMBOL(cfg80211_rx_control_port);
18904
18905 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
18906                                             const char *mac, gfp_t gfp)
18907 {
18908         struct wireless_dev *wdev = dev->ieee80211_ptr;
18909         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18910         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18911         void **cb;
18912
18913         if (!msg)
18914                 return NULL;
18915
18916         cb = (void **)msg->cb;
18917
18918         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
18919         if (!cb[0]) {
18920                 nlmsg_free(msg);
18921                 return NULL;
18922         }
18923
18924         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18925             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18926                 goto nla_put_failure;
18927
18928         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18929                 goto nla_put_failure;
18930
18931         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
18932         if (!cb[1])
18933                 goto nla_put_failure;
18934
18935         cb[2] = rdev;
18936
18937         return msg;
18938  nla_put_failure:
18939         nlmsg_free(msg);
18940         return NULL;
18941 }
18942
18943 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
18944 {
18945         void **cb = (void **)msg->cb;
18946         struct cfg80211_registered_device *rdev = cb[2];
18947
18948         nla_nest_end(msg, cb[1]);
18949         genlmsg_end(msg, cb[0]);
18950
18951         memset(msg->cb, 0, sizeof(msg->cb));
18952
18953         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18954                                 NL80211_MCGRP_MLME, gfp);
18955 }
18956
18957 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18958                               enum nl80211_cqm_rssi_threshold_event rssi_event,
18959                               s32 rssi_level, gfp_t gfp)
18960 {
18961         struct sk_buff *msg;
18962         struct wireless_dev *wdev = dev->ieee80211_ptr;
18963         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18964
18965         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
18966
18967         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
18968                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
18969                 return;
18970
18971         if (wdev->cqm_config) {
18972                 wdev->cqm_config->last_rssi_event_value = rssi_level;
18973
18974                 cfg80211_cqm_rssi_update(rdev, dev);
18975
18976                 if (rssi_level == 0)
18977                         rssi_level = wdev->cqm_config->last_rssi_event_value;
18978         }
18979
18980         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18981         if (!msg)
18982                 return;
18983
18984         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
18985                         rssi_event))
18986                 goto nla_put_failure;
18987
18988         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
18989                                       rssi_level))
18990                 goto nla_put_failure;
18991
18992         cfg80211_send_cqm(msg, gfp);
18993
18994         return;
18995
18996  nla_put_failure:
18997         nlmsg_free(msg);
18998 }
18999 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19000
19001 void cfg80211_cqm_txe_notify(struct net_device *dev,
19002                              const u8 *peer, u32 num_packets,
19003                              u32 rate, u32 intvl, gfp_t gfp)
19004 {
19005         struct sk_buff *msg;
19006
19007         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19008         if (!msg)
19009                 return;
19010
19011         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19012                 goto nla_put_failure;
19013
19014         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19015                 goto nla_put_failure;
19016
19017         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19018                 goto nla_put_failure;
19019
19020         cfg80211_send_cqm(msg, gfp);
19021         return;
19022
19023  nla_put_failure:
19024         nlmsg_free(msg);
19025 }
19026 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19027
19028 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19029                                  const u8 *peer, u32 num_packets, gfp_t gfp)
19030 {
19031         struct sk_buff *msg;
19032
19033         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19034
19035         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19036         if (!msg)
19037                 return;
19038
19039         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19040                 goto nla_put_failure;
19041
19042         cfg80211_send_cqm(msg, gfp);
19043         return;
19044
19045  nla_put_failure:
19046         nlmsg_free(msg);
19047 }
19048 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19049
19050 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19051 {
19052         struct sk_buff *msg;
19053
19054         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19055         if (!msg)
19056                 return;
19057
19058         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19059                 goto nla_put_failure;
19060
19061         cfg80211_send_cqm(msg, gfp);
19062         return;
19063
19064  nla_put_failure:
19065         nlmsg_free(msg);
19066 }
19067 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19068
19069 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19070                                      struct net_device *netdev, const u8 *bssid,
19071                                      const u8 *replay_ctr, gfp_t gfp)
19072 {
19073         struct sk_buff *msg;
19074         struct nlattr *rekey_attr;
19075         void *hdr;
19076
19077         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19078         if (!msg)
19079                 return;
19080
19081         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19082         if (!hdr) {
19083                 nlmsg_free(msg);
19084                 return;
19085         }
19086
19087         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19088             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19089             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19090                 goto nla_put_failure;
19091
19092         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19093         if (!rekey_attr)
19094                 goto nla_put_failure;
19095
19096         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19097                     NL80211_REPLAY_CTR_LEN, replay_ctr))
19098                 goto nla_put_failure;
19099
19100         nla_nest_end(msg, rekey_attr);
19101
19102         genlmsg_end(msg, hdr);
19103
19104         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19105                                 NL80211_MCGRP_MLME, gfp);
19106         return;
19107
19108  nla_put_failure:
19109         nlmsg_free(msg);
19110 }
19111
19112 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19113                                const u8 *replay_ctr, gfp_t gfp)
19114 {
19115         struct wireless_dev *wdev = dev->ieee80211_ptr;
19116         struct wiphy *wiphy = wdev->wiphy;
19117         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19118
19119         trace_cfg80211_gtk_rekey_notify(dev, bssid);
19120         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19121 }
19122 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19123
19124 static void
19125 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19126                                struct net_device *netdev, int index,
19127                                const u8 *bssid, bool preauth, gfp_t gfp)
19128 {
19129         struct sk_buff *msg;
19130         struct nlattr *attr;
19131         void *hdr;
19132
19133         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19134         if (!msg)
19135                 return;
19136
19137         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19138         if (!hdr) {
19139                 nlmsg_free(msg);
19140                 return;
19141         }
19142
19143         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19144             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19145                 goto nla_put_failure;
19146
19147         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19148         if (!attr)
19149                 goto nla_put_failure;
19150
19151         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19152             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19153             (preauth &&
19154              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19155                 goto nla_put_failure;
19156
19157         nla_nest_end(msg, attr);
19158
19159         genlmsg_end(msg, hdr);
19160
19161         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19162                                 NL80211_MCGRP_MLME, gfp);
19163         return;
19164
19165  nla_put_failure:
19166         nlmsg_free(msg);
19167 }
19168
19169 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19170                                      const u8 *bssid, bool preauth, gfp_t gfp)
19171 {
19172         struct wireless_dev *wdev = dev->ieee80211_ptr;
19173         struct wiphy *wiphy = wdev->wiphy;
19174         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19175
19176         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19177         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19178 }
19179 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19180
19181 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19182                                      struct net_device *netdev,
19183                                      unsigned int link_id,
19184                                      struct cfg80211_chan_def *chandef,
19185                                      gfp_t gfp,
19186                                      enum nl80211_commands notif,
19187                                      u8 count, bool quiet, u16 punct_bitmap)
19188 {
19189         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19190         struct sk_buff *msg;
19191         void *hdr;
19192
19193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19194         if (!msg)
19195                 return;
19196
19197         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19198         if (!hdr) {
19199                 nlmsg_free(msg);
19200                 return;
19201         }
19202
19203         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19204                 goto nla_put_failure;
19205
19206         if (wdev->valid_links &&
19207             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19208                 goto nla_put_failure;
19209
19210         if (nl80211_send_chandef(msg, chandef))
19211                 goto nla_put_failure;
19212
19213         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19214                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19215                         goto nla_put_failure;
19216                 if (quiet &&
19217                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19218                         goto nla_put_failure;
19219         }
19220
19221         if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19222                 goto nla_put_failure;
19223
19224         genlmsg_end(msg, hdr);
19225
19226         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19227                                 NL80211_MCGRP_MLME, gfp);
19228         return;
19229
19230  nla_put_failure:
19231         nlmsg_free(msg);
19232 }
19233
19234 void cfg80211_ch_switch_notify(struct net_device *dev,
19235                                struct cfg80211_chan_def *chandef,
19236                                unsigned int link_id, u16 punct_bitmap)
19237 {
19238         struct wireless_dev *wdev = dev->ieee80211_ptr;
19239         struct wiphy *wiphy = wdev->wiphy;
19240         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19241
19242         ASSERT_WDEV_LOCK(wdev);
19243         WARN_INVALID_LINK_ID(wdev, link_id);
19244
19245         trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19246
19247         switch (wdev->iftype) {
19248         case NL80211_IFTYPE_STATION:
19249         case NL80211_IFTYPE_P2P_CLIENT:
19250                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19251                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19252                                                         chandef->chan);
19253                 break;
19254         case NL80211_IFTYPE_MESH_POINT:
19255                 wdev->u.mesh.chandef = *chandef;
19256                 wdev->u.mesh.preset_chandef = *chandef;
19257                 break;
19258         case NL80211_IFTYPE_AP:
19259         case NL80211_IFTYPE_P2P_GO:
19260                 wdev->links[link_id].ap.chandef = *chandef;
19261                 break;
19262         case NL80211_IFTYPE_ADHOC:
19263                 wdev->u.ibss.chandef = *chandef;
19264                 break;
19265         default:
19266                 WARN_ON(1);
19267                 break;
19268         }
19269
19270         cfg80211_sched_dfs_chan_update(rdev);
19271
19272         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19273                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19274                                  punct_bitmap);
19275 }
19276 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19277
19278 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19279                                        struct cfg80211_chan_def *chandef,
19280                                        unsigned int link_id, u8 count,
19281                                        bool quiet, u16 punct_bitmap)
19282 {
19283         struct wireless_dev *wdev = dev->ieee80211_ptr;
19284         struct wiphy *wiphy = wdev->wiphy;
19285         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19286
19287         ASSERT_WDEV_LOCK(wdev);
19288         WARN_INVALID_LINK_ID(wdev, link_id);
19289
19290         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19291                                                 punct_bitmap);
19292
19293
19294         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19295                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19296                                  count, quiet, punct_bitmap);
19297 }
19298 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19299
19300 int cfg80211_bss_color_notify(struct net_device *dev,
19301                               enum nl80211_commands cmd, u8 count,
19302                               u64 color_bitmap)
19303 {
19304         struct wireless_dev *wdev = dev->ieee80211_ptr;
19305         struct wiphy *wiphy = wdev->wiphy;
19306         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19307         struct sk_buff *msg;
19308         void *hdr;
19309
19310         ASSERT_WDEV_LOCK(wdev);
19311
19312         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19313
19314         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19315         if (!msg)
19316                 return -ENOMEM;
19317
19318         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19319         if (!hdr)
19320                 goto nla_put_failure;
19321
19322         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19323                 goto nla_put_failure;
19324
19325         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19326             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19327                 goto nla_put_failure;
19328
19329         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19330             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19331                               color_bitmap, NL80211_ATTR_PAD))
19332                 goto nla_put_failure;
19333
19334         genlmsg_end(msg, hdr);
19335
19336         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19337                                        msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19338
19339 nla_put_failure:
19340         nlmsg_free(msg);
19341         return -EINVAL;
19342 }
19343 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19344
19345 void
19346 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19347                      const struct cfg80211_chan_def *chandef,
19348                      enum nl80211_radar_event event,
19349                      struct net_device *netdev, gfp_t gfp)
19350 {
19351         struct sk_buff *msg;
19352         void *hdr;
19353
19354         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19355         if (!msg)
19356                 return;
19357
19358         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19359         if (!hdr) {
19360                 nlmsg_free(msg);
19361                 return;
19362         }
19363
19364         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19365                 goto nla_put_failure;
19366
19367         /* NOP and radar events don't need a netdev parameter */
19368         if (netdev) {
19369                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19370
19371                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19372                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19373                                       NL80211_ATTR_PAD))
19374                         goto nla_put_failure;
19375         }
19376
19377         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19378                 goto nla_put_failure;
19379
19380         if (nl80211_send_chandef(msg, chandef))
19381                 goto nla_put_failure;
19382
19383         genlmsg_end(msg, hdr);
19384
19385         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19386                                 NL80211_MCGRP_MLME, gfp);
19387         return;
19388
19389  nla_put_failure:
19390         nlmsg_free(msg);
19391 }
19392
19393 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19394                                        struct sta_opmode_info *sta_opmode,
19395                                        gfp_t gfp)
19396 {
19397         struct sk_buff *msg;
19398         struct wireless_dev *wdev = dev->ieee80211_ptr;
19399         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19400         void *hdr;
19401
19402         if (WARN_ON(!mac))
19403                 return;
19404
19405         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19406         if (!msg)
19407                 return;
19408
19409         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19410         if (!hdr) {
19411                 nlmsg_free(msg);
19412                 return;
19413         }
19414
19415         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19416                 goto nla_put_failure;
19417
19418         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19419                 goto nla_put_failure;
19420
19421         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19422                 goto nla_put_failure;
19423
19424         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19425             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19426                 goto nla_put_failure;
19427
19428         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19429             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19430                 goto nla_put_failure;
19431
19432         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19433             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19434                 goto nla_put_failure;
19435
19436         genlmsg_end(msg, hdr);
19437
19438         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19439                                 NL80211_MCGRP_MLME, gfp);
19440
19441         return;
19442
19443 nla_put_failure:
19444         nlmsg_free(msg);
19445 }
19446 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19447
19448 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19449                            u64 cookie, bool acked, s32 ack_signal,
19450                            bool is_valid_ack_signal, gfp_t gfp)
19451 {
19452         struct wireless_dev *wdev = dev->ieee80211_ptr;
19453         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19454         struct sk_buff *msg;
19455         void *hdr;
19456
19457         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19458
19459         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19460
19461         if (!msg)
19462                 return;
19463
19464         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19465         if (!hdr) {
19466                 nlmsg_free(msg);
19467                 return;
19468         }
19469
19470         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19471             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19472             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19473             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19474                               NL80211_ATTR_PAD) ||
19475             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19476             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19477                                                 ack_signal)))
19478                 goto nla_put_failure;
19479
19480         genlmsg_end(msg, hdr);
19481
19482         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19483                                 NL80211_MCGRP_MLME, gfp);
19484         return;
19485
19486  nla_put_failure:
19487         nlmsg_free(msg);
19488 }
19489 EXPORT_SYMBOL(cfg80211_probe_status);
19490
19491 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19492                                      size_t len, int freq, int sig_dbm)
19493 {
19494         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19495         struct sk_buff *msg;
19496         void *hdr;
19497         struct cfg80211_beacon_registration *reg;
19498
19499         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19500
19501         spin_lock_bh(&rdev->beacon_registrations_lock);
19502         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19503                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19504                 if (!msg) {
19505                         spin_unlock_bh(&rdev->beacon_registrations_lock);
19506                         return;
19507                 }
19508
19509                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19510                 if (!hdr)
19511                         goto nla_put_failure;
19512
19513                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19514                     (freq &&
19515                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19516                                   KHZ_TO_MHZ(freq)) ||
19517                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19518                                   freq % 1000))) ||
19519                     (sig_dbm &&
19520                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19521                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19522                         goto nla_put_failure;
19523
19524                 genlmsg_end(msg, hdr);
19525
19526                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19527         }
19528         spin_unlock_bh(&rdev->beacon_registrations_lock);
19529         return;
19530
19531  nla_put_failure:
19532         spin_unlock_bh(&rdev->beacon_registrations_lock);
19533         nlmsg_free(msg);
19534 }
19535 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19536
19537 #ifdef CONFIG_PM
19538 static int cfg80211_net_detect_results(struct sk_buff *msg,
19539                                        struct cfg80211_wowlan_wakeup *wakeup)
19540 {
19541         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19542         struct nlattr *nl_results, *nl_match, *nl_freqs;
19543         int i, j;
19544
19545         nl_results = nla_nest_start_noflag(msg,
19546                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19547         if (!nl_results)
19548                 return -EMSGSIZE;
19549
19550         for (i = 0; i < nd->n_matches; i++) {
19551                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19552
19553                 nl_match = nla_nest_start_noflag(msg, i);
19554                 if (!nl_match)
19555                         break;
19556
19557                 /* The SSID attribute is optional in nl80211, but for
19558                  * simplicity reasons it's always present in the
19559                  * cfg80211 structure.  If a driver can't pass the
19560                  * SSID, that needs to be changed.  A zero length SSID
19561                  * is still a valid SSID (wildcard), so it cannot be
19562                  * used for this purpose.
19563                  */
19564                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19565                             match->ssid.ssid)) {
19566                         nla_nest_cancel(msg, nl_match);
19567                         goto out;
19568                 }
19569
19570                 if (match->n_channels) {
19571                         nl_freqs = nla_nest_start_noflag(msg,
19572                                                          NL80211_ATTR_SCAN_FREQUENCIES);
19573                         if (!nl_freqs) {
19574                                 nla_nest_cancel(msg, nl_match);
19575                                 goto out;
19576                         }
19577
19578                         for (j = 0; j < match->n_channels; j++) {
19579                                 if (nla_put_u32(msg, j, match->channels[j])) {
19580                                         nla_nest_cancel(msg, nl_freqs);
19581                                         nla_nest_cancel(msg, nl_match);
19582                                         goto out;
19583                                 }
19584                         }
19585
19586                         nla_nest_end(msg, nl_freqs);
19587                 }
19588
19589                 nla_nest_end(msg, nl_match);
19590         }
19591
19592 out:
19593         nla_nest_end(msg, nl_results);
19594         return 0;
19595 }
19596
19597 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19598                                    struct cfg80211_wowlan_wakeup *wakeup,
19599                                    gfp_t gfp)
19600 {
19601         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19602         struct sk_buff *msg;
19603         void *hdr;
19604         int size = 200;
19605
19606         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19607
19608         if (wakeup)
19609                 size += wakeup->packet_present_len;
19610
19611         msg = nlmsg_new(size, gfp);
19612         if (!msg)
19613                 return;
19614
19615         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19616         if (!hdr)
19617                 goto free_msg;
19618
19619         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19620             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19621                               NL80211_ATTR_PAD))
19622                 goto free_msg;
19623
19624         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19625                                         wdev->netdev->ifindex))
19626                 goto free_msg;
19627
19628         if (wakeup) {
19629                 struct nlattr *reasons;
19630
19631                 reasons = nla_nest_start_noflag(msg,
19632                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
19633                 if (!reasons)
19634                         goto free_msg;
19635
19636                 if (wakeup->disconnect &&
19637                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19638                         goto free_msg;
19639                 if (wakeup->magic_pkt &&
19640                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19641                         goto free_msg;
19642                 if (wakeup->gtk_rekey_failure &&
19643                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19644                         goto free_msg;
19645                 if (wakeup->eap_identity_req &&
19646                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19647                         goto free_msg;
19648                 if (wakeup->four_way_handshake &&
19649                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19650                         goto free_msg;
19651                 if (wakeup->rfkill_release &&
19652                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19653                         goto free_msg;
19654
19655                 if (wakeup->pattern_idx >= 0 &&
19656                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19657                                 wakeup->pattern_idx))
19658                         goto free_msg;
19659
19660                 if (wakeup->tcp_match &&
19661                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19662                         goto free_msg;
19663
19664                 if (wakeup->tcp_connlost &&
19665                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19666                         goto free_msg;
19667
19668                 if (wakeup->tcp_nomoretokens &&
19669                     nla_put_flag(msg,
19670                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19671                         goto free_msg;
19672
19673                 if (wakeup->packet) {
19674                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19675                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19676
19677                         if (!wakeup->packet_80211) {
19678                                 pkt_attr =
19679                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19680                                 len_attr =
19681                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19682                         }
19683
19684                         if (wakeup->packet_len &&
19685                             nla_put_u32(msg, len_attr, wakeup->packet_len))
19686                                 goto free_msg;
19687
19688                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19689                                     wakeup->packet))
19690                                 goto free_msg;
19691                 }
19692
19693                 if (wakeup->net_detect &&
19694                     cfg80211_net_detect_results(msg, wakeup))
19695                                 goto free_msg;
19696
19697                 nla_nest_end(msg, reasons);
19698         }
19699
19700         genlmsg_end(msg, hdr);
19701
19702         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19703                                 NL80211_MCGRP_MLME, gfp);
19704         return;
19705
19706  free_msg:
19707         nlmsg_free(msg);
19708 }
19709 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19710 #endif
19711
19712 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19713                                 enum nl80211_tdls_operation oper,
19714                                 u16 reason_code, gfp_t gfp)
19715 {
19716         struct wireless_dev *wdev = dev->ieee80211_ptr;
19717         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19718         struct sk_buff *msg;
19719         void *hdr;
19720
19721         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19722                                          reason_code);
19723
19724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19725         if (!msg)
19726                 return;
19727
19728         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19729         if (!hdr) {
19730                 nlmsg_free(msg);
19731                 return;
19732         }
19733
19734         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19735             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19736             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19737             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19738             (reason_code > 0 &&
19739              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19740                 goto nla_put_failure;
19741
19742         genlmsg_end(msg, hdr);
19743
19744         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19745                                 NL80211_MCGRP_MLME, gfp);
19746         return;
19747
19748  nla_put_failure:
19749         nlmsg_free(msg);
19750 }
19751 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19752
19753 static int nl80211_netlink_notify(struct notifier_block * nb,
19754                                   unsigned long state,
19755                                   void *_notify)
19756 {
19757         struct netlink_notify *notify = _notify;
19758         struct cfg80211_registered_device *rdev;
19759         struct wireless_dev *wdev;
19760         struct cfg80211_beacon_registration *reg, *tmp;
19761
19762         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19763                 return NOTIFY_DONE;
19764
19765         rcu_read_lock();
19766
19767         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19768                 struct cfg80211_sched_scan_request *sched_scan_req;
19769
19770                 list_for_each_entry_rcu(sched_scan_req,
19771                                         &rdev->sched_scan_req_list,
19772                                         list) {
19773                         if (sched_scan_req->owner_nlportid == notify->portid) {
19774                                 sched_scan_req->nl_owner_dead = true;
19775                                 schedule_work(&rdev->sched_scan_stop_wk);
19776                         }
19777                 }
19778
19779                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19780                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
19781
19782                         if (wdev->owner_nlportid == notify->portid) {
19783                                 wdev->nl_owner_dead = true;
19784                                 schedule_work(&rdev->destroy_work);
19785                         } else if (wdev->conn_owner_nlportid == notify->portid) {
19786                                 schedule_work(&wdev->disconnect_wk);
19787                         }
19788
19789                         cfg80211_release_pmsr(wdev, notify->portid);
19790                 }
19791
19792                 spin_lock_bh(&rdev->beacon_registrations_lock);
19793                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19794                                          list) {
19795                         if (reg->nlportid == notify->portid) {
19796                                 list_del(&reg->list);
19797                                 kfree(reg);
19798                                 break;
19799                         }
19800                 }
19801                 spin_unlock_bh(&rdev->beacon_registrations_lock);
19802         }
19803
19804         rcu_read_unlock();
19805
19806         /*
19807          * It is possible that the user space process that is controlling the
19808          * indoor setting disappeared, so notify the regulatory core.
19809          */
19810         regulatory_netlink_notify(notify->portid);
19811         return NOTIFY_OK;
19812 }
19813
19814 static struct notifier_block nl80211_netlink_notifier = {
19815         .notifier_call = nl80211_netlink_notify,
19816 };
19817
19818 void cfg80211_ft_event(struct net_device *netdev,
19819                        struct cfg80211_ft_event_params *ft_event)
19820 {
19821         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19822         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19823         struct sk_buff *msg;
19824         void *hdr;
19825
19826         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19827
19828         if (!ft_event->target_ap)
19829                 return;
19830
19831         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19832                         GFP_KERNEL);
19833         if (!msg)
19834                 return;
19835
19836         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19837         if (!hdr)
19838                 goto out;
19839
19840         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19841             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19842             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19843                 goto out;
19844
19845         if (ft_event->ies &&
19846             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19847                 goto out;
19848         if (ft_event->ric_ies &&
19849             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19850                     ft_event->ric_ies))
19851                 goto out;
19852
19853         genlmsg_end(msg, hdr);
19854
19855         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19856                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19857         return;
19858  out:
19859         nlmsg_free(msg);
19860 }
19861 EXPORT_SYMBOL(cfg80211_ft_event);
19862
19863 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19864 {
19865         struct cfg80211_registered_device *rdev;
19866         struct sk_buff *msg;
19867         void *hdr;
19868         u32 nlportid;
19869
19870         rdev = wiphy_to_rdev(wdev->wiphy);
19871         if (!rdev->crit_proto_nlportid)
19872                 return;
19873
19874         nlportid = rdev->crit_proto_nlportid;
19875         rdev->crit_proto_nlportid = 0;
19876
19877         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19878         if (!msg)
19879                 return;
19880
19881         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19882         if (!hdr)
19883                 goto nla_put_failure;
19884
19885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19886             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19887                               NL80211_ATTR_PAD))
19888                 goto nla_put_failure;
19889
19890         genlmsg_end(msg, hdr);
19891
19892         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19893         return;
19894
19895  nla_put_failure:
19896         nlmsg_free(msg);
19897 }
19898 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
19899
19900 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
19901 {
19902         struct wiphy *wiphy = wdev->wiphy;
19903         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19904         struct sk_buff *msg;
19905         void *hdr;
19906
19907         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19908         if (!msg)
19909                 return;
19910
19911         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
19912         if (!hdr)
19913                 goto out;
19914
19915         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19916             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
19917             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19918                               NL80211_ATTR_PAD) ||
19919             (wdev->valid_links &&
19920              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
19921                 goto out;
19922
19923         genlmsg_end(msg, hdr);
19924
19925         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
19926                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19927         return;
19928  out:
19929         nlmsg_free(msg);
19930 }
19931
19932 int cfg80211_external_auth_request(struct net_device *dev,
19933                                    struct cfg80211_external_auth_params *params,
19934                                    gfp_t gfp)
19935 {
19936         struct wireless_dev *wdev = dev->ieee80211_ptr;
19937         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19938         struct sk_buff *msg;
19939         void *hdr;
19940
19941         if (!wdev->conn_owner_nlportid)
19942                 return -EINVAL;
19943
19944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19945         if (!msg)
19946                 return -ENOMEM;
19947
19948         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
19949         if (!hdr)
19950                 goto nla_put_failure;
19951
19952         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19953             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19954             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
19955             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
19956                         params->action) ||
19957             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
19958             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
19959                     params->ssid.ssid) ||
19960             (!is_zero_ether_addr(params->mld_addr) &&
19961              nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
19962                 goto nla_put_failure;
19963
19964         genlmsg_end(msg, hdr);
19965         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
19966                         wdev->conn_owner_nlportid);
19967         return 0;
19968
19969  nla_put_failure:
19970         nlmsg_free(msg);
19971         return -ENOBUFS;
19972 }
19973 EXPORT_SYMBOL(cfg80211_external_auth_request);
19974
19975 void cfg80211_update_owe_info_event(struct net_device *netdev,
19976                                     struct cfg80211_update_owe_info *owe_info,
19977                                     gfp_t gfp)
19978 {
19979         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19980         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19981         struct sk_buff *msg;
19982         void *hdr;
19983
19984         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
19985
19986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19987         if (!msg)
19988                 return;
19989
19990         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
19991         if (!hdr)
19992                 goto nla_put_failure;
19993
19994         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19995             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19996             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
19997                 goto nla_put_failure;
19998
19999         if (!owe_info->ie_len ||
20000             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20001                 goto nla_put_failure;
20002
20003         if (owe_info->assoc_link_id != -1) {
20004                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20005                                owe_info->assoc_link_id))
20006                         goto nla_put_failure;
20007
20008                 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20009                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20010                             owe_info->peer_mld_addr))
20011                         goto nla_put_failure;
20012         }
20013
20014         genlmsg_end(msg, hdr);
20015
20016         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20017                                 NL80211_MCGRP_MLME, gfp);
20018         return;
20019
20020 nla_put_failure:
20021         genlmsg_cancel(msg, hdr);
20022         nlmsg_free(msg);
20023 }
20024 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20025
20026 /* initialisation/exit functions */
20027
20028 int __init nl80211_init(void)
20029 {
20030         int err;
20031
20032         err = genl_register_family(&nl80211_fam);
20033         if (err)
20034                 return err;
20035
20036         err = netlink_register_notifier(&nl80211_netlink_notifier);
20037         if (err)
20038                 goto err_out;
20039
20040         return 0;
20041  err_out:
20042         genl_unregister_family(&nl80211_fam);
20043         return err;
20044 }
20045
20046 void nl80211_exit(void)
20047 {
20048         netlink_unregister_notifier(&nl80211_netlink_notifier);
20049         genl_unregister_family(&nl80211_fam);
20050 }