LqxKPSAJ

1/*
2 * This is the new netlink-based wireless configuration interface.
3 *
4 * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5 * Copyright 2013-2014  Intel Mobile Communications GmbH
6 * Copyright 2015	Intel Deutschland GmbH
7 */
8
9#include <linux/if.h>
10#include <linux/module.h>
11#include <linux/err.h>
12#include <linux/slab.h>
13#include <linux/list.h>
14#include <linux/if_ether.h>
15#include <linux/ieee80211.h>
16#include <linux/nl80211.h>
17#include <linux/rtnetlink.h>
18#include <linux/netlink.h>
19#include "/media/belv/sb/bin/source/kernel/nubia/msm8952/include/linux/nospec.h"
20#include <linux/etherdevice.h>
21#include <net/net_namespace.h>
22#include <net/genetlink.h>
23#include <net/cfg80211.h>
24#include <net/sock.h>
25#include <net/inet_connection_sock.h>
26#include "core.h"
27#include "nl80211.h"
28#include "reg.h"
29#include "rdev-ops.h"
30
31static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
32				   struct genl_info *info,
33				   struct cfg80211_crypto_settings *settings,
34				   int cipher_limit);
35
36static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
37			    struct genl_info *info);
38static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
39			      struct genl_info *info);
40
41/* the netlink family */
42static struct genl_family nl80211_fam = {
43	.id = GENL_ID_GENERATE,		/* don't bother with a hardcoded ID */
44	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
45	.hdrsize = 0,			/* no private header */
46	.version = 1,			/* no particular meaning now */
47	.maxattr = NL80211_ATTR_MAX,
48	.netnsok = true,
49	.pre_doit = nl80211_pre_doit,
50	.post_doit = nl80211_post_doit,
51};
52
53/* multicast groups */
54enum nl80211_multicast_groups {
55	NL80211_MCGRP_CONFIG,
56	NL80211_MCGRP_SCAN,
57	NL80211_MCGRP_REGULATORY,
58	NL80211_MCGRP_MLME,
59	NL80211_MCGRP_VENDOR,
60	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
61};
62
63static const struct genl_multicast_group nl80211_mcgrps[] = {
64	[NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
65	[NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
66	[NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
67	[NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
68	[NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
69#ifdef CONFIG_NL80211_TESTMODE
70	[NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
71#endif
72};
73
74/* returns ERR_PTR values */
75static struct wireless_dev *
76__cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
77{
78	struct cfg80211_registered_device *rdev;
79	struct wireless_dev *result = NULL;
80	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
81	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
82	u64 wdev_id;
83	int wiphy_idx = -1;
84	int ifidx = -1;
85
86	ASSERT_RTNL();
87
88	if (!have_ifidx && !have_wdev_id)
89		return ERR_PTR(-EINVAL);
90
91	if (have_ifidx)
92		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
93	if (have_wdev_id) {
94		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
95		wiphy_idx = wdev_id >> 32;
96	}
97
98	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
99		struct wireless_dev *wdev;
100
101		if (wiphy_net(&rdev->wiphy) != netns)
102			continue;
103
104		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
105			continue;
106
107		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
108			if (have_ifidx && wdev->netdev &&
109			    wdev->netdev->ifindex == ifidx) {
110				result = wdev;
111				break;
112			}
113			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
114				result = wdev;
115				break;
116			}
117		}
118
119		if (result)
120			break;
121	}
122
123	if (result)
124		return result;
125	return ERR_PTR(-ENODEV);
126}
127
128static struct cfg80211_registered_device *
129__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
130{
131	struct cfg80211_registered_device *rdev = NULL, *tmp;
132	struct net_device *netdev;
133
134	ASSERT_RTNL();
135
136	if (!attrs[NL80211_ATTR_WIPHY] &&
137	    !attrs[NL80211_ATTR_IFINDEX] &&
138	    !attrs[NL80211_ATTR_WDEV])
139		return ERR_PTR(-EINVAL);
140
141	if (attrs[NL80211_ATTR_WIPHY])
142		rdev = cfg80211_rdev_by_wiphy_idx(
143				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
144
145	if (attrs[NL80211_ATTR_WDEV]) {
146		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
147		struct wireless_dev *wdev;
148		bool found = false;
149
150		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
151		if (tmp) {
152			/* make sure wdev exists */
153			list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
154				if (wdev->identifier != (u32)wdev_id)
155					continue;
156				found = true;
157				break;
158			}
159
160			if (!found)
161				tmp = NULL;
162
163			if (rdev && tmp != rdev)
164				return ERR_PTR(-EINVAL);
165			rdev = tmp;
166		}
167	}
168
169	if (attrs[NL80211_ATTR_IFINDEX]) {
170		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
171		netdev = __dev_get_by_index(netns, ifindex);
172		if (netdev) {
173			if (netdev->ieee80211_ptr)
174				tmp = wiphy_to_rdev(
175					netdev->ieee80211_ptr->wiphy);
176			else
177				tmp = NULL;
178
179			/* not wireless device -- return error */
180			if (!tmp)
181				return ERR_PTR(-EINVAL);
182
183			/* mismatch -- return error */
184			if (rdev && tmp != rdev)
185				return ERR_PTR(-EINVAL);
186
187			rdev = tmp;
188		}
189	}
190
191	if (!rdev)
192		return ERR_PTR(-ENODEV);
193
194	if (netns != wiphy_net(&rdev->wiphy))
195		return ERR_PTR(-ENODEV);
196
197	return rdev;
198}
199
200/*
201 * This function returns a pointer to the driver
202 * that the genl_info item that is passed refers to.
203 *
204 * The result of this can be a PTR_ERR and hence must
205 * be checked with IS_ERR() for errors.
206 */
207static struct cfg80211_registered_device *
208cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
209{
210	return __cfg80211_rdev_from_attrs(netns, info->attrs);
211}
212
213/* policy for the attributes */
214static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
215	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
216	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
217				      .len = 20-1 },
218	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
219
220	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
221	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
222	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
223	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
224	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
225
226	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
227	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
228	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
229	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
230	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
231	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
232
233	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
234	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
235	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
236
237	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
238	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
239
240	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
241	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
242				    .len = WLAN_MAX_KEY_LEN },
243	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
244	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
245	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
246	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
247	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
248
249	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
250	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
251	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
252				       .len = IEEE80211_MAX_DATA_LEN },
253	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
254				       .len = IEEE80211_MAX_DATA_LEN },
255	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
256	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
257	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
258	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
259					       .len = NL80211_MAX_SUPP_RATES },
260	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
261	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
262	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
263	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
264				   .len = IEEE80211_MAX_MESH_ID_LEN },
265	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
266
267	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
268	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
269
270	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
271	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
272	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
273	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
274					   .len = NL80211_MAX_SUPP_RATES },
275	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
276
277	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
278	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
279
280	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
281
282	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
283	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
284			      .len = IEEE80211_MAX_DATA_LEN },
285	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
286	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
287
288	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
289				.len = IEEE80211_MAX_SSID_LEN },
290	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
291	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
292	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
293	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
294	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
295	[NL80211_ATTR_STA_FLAGS2] = {
296		.len = sizeof(struct nl80211_sta_flag_update),
297	},
298	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
299	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
300	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
301	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
302	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
303	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
304	[NL80211_ATTR_PID] = { .type = NLA_U32 },
305	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
306	[NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
307	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
308	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
309	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
310	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
311				 .len = IEEE80211_MAX_DATA_LEN },
312	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
313	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
314	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
315	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
316	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
317	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
318	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
319	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
320	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
321	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
322	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
323	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
324	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
325	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
326	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
327	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
328	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
329	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
330	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
331	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
332					 .len = IEEE80211_MAX_DATA_LEN },
333	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
334					 .len = IEEE80211_MAX_DATA_LEN },
335	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
336	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
337	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
338	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
339	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
340	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
341	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
342	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
343	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
344	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
345	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
346				      .len = IEEE80211_MAX_DATA_LEN },
347	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
348	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
349	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
350		.len = NL80211_HT_CAPABILITY_LEN
351	},
352	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
353	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
354	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
355	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
356	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
357	[NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
358	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
359	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
360	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
361	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
362	[NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
363	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
364	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
365	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
366	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
367	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
368	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
369	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
370		.len = NL80211_VHT_CAPABILITY_LEN,
371	},
372	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
373	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
374				  .len = IEEE80211_MAX_DATA_LEN },
375	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
376	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
377	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
378	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
379	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
380	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
381	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
382	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
383	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
384	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
385	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
386	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
387	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
388	[NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
389				   .len = IEEE80211_QOS_MAP_LEN_MAX },
390	[NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
391	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
392	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
393	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
394	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
395	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
396	[NL80211_ATTR_TSID] = { .type = NLA_U8 },
397	[NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
398	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
399	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
400	[NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
401	[NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
402	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
403	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
404	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
405	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
406	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
407	[NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
408	[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
409	[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
410		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
411	},
412	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
413				    .len = FILS_MAX_KEK_LEN },
414	[NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
415	[NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
416	[NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
417					     .len = FILS_ERP_MAX_USERNAME_LEN },
418	[NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
419					  .len = FILS_ERP_MAX_REALM_LEN },
420	[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
421	[NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
422					.len = FILS_ERP_MAX_RRK_LEN },
423	[NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
424	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
425	[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
426};
427
428/* policy for the key attributes */
429static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
430	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
431	[NL80211_KEY_IDX] = { .type = NLA_U8 },
432	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
433	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
434	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
435	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
436	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
437	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
438};
439
440/* policy for the key default flags */
441static const struct nla_policy
442nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
443	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
444	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
445};
446
447/* policy for WoWLAN attributes */
448static const struct nla_policy
449nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
450	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
451	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
452	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
453	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
454	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
455	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
456	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
457	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
458	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
459	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
460};
461
462static const struct nla_policy
463nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
464	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
465	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
466	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
467	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
468	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
469	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
470	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
471		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
472	},
473	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
474		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
475	},
476	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
477	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
478	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
479};
480
481/* policy for coalesce rule attributes */
482static const struct nla_policy
483nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
484	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
485	[NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
486	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
487};
488
489/* policy for GTK rekey offload attributes */
490static const struct nla_policy
491nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
492	[NL80211_REKEY_DATA_KEK] = { .type = NLA_BINARY,
493				     .len = FILS_MAX_KEK_LEN },
494	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
495	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
496};
497
498static const struct nla_policy
499nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
500	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
501						 .len = IEEE80211_MAX_SSID_LEN },
502	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
503};
504
505static const struct nla_policy
506nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
507	[NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
508	[NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
509};
510
511static const struct nla_policy
512nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
513	[NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
514	[NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
515	[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
516		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
517	},
518};
519
520/* policy for packet pattern attributes */
521static const struct nla_policy
522nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
523	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
524	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
525	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
526};
527
528static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
529				     struct netlink_callback *cb,
530				     struct cfg80211_registered_device **rdev,
531				     struct wireless_dev **wdev)
532{
533	int err;
534
535	if (!cb->args[0]) {
536		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
537				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
538				  nl80211_policy);
539		if (err)
540			return err;
541
542		*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
543						   nl80211_fam.attrbuf);
544		if (IS_ERR(*wdev))
545			return PTR_ERR(*wdev);
546		*rdev = wiphy_to_rdev((*wdev)->wiphy);
547		/* 0 is the first index - add 1 to parse only once */
548		cb->args[0] = (*rdev)->wiphy_idx + 1;
549		cb->args[1] = (*wdev)->identifier;
550	} else {
551		/* subtract the 1 again here */
552		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
553		struct wireless_dev *tmp;
554
555		if (!wiphy)
556			return -ENODEV;
557		*rdev = wiphy_to_rdev(wiphy);
558		*wdev = NULL;
559
560		list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
561			if (tmp->identifier == cb->args[1]) {
562				*wdev = tmp;
563				break;
564			}
565		}
566
567		if (!*wdev)
568			return -ENODEV;
569	}
570
571	return 0;
572}
573
574/* IE validation */
575static bool is_valid_ie_attr(const struct nlattr *attr)
576{
577	const u8 *pos;
578	int len;
579
580	if (!attr)
581		return true;
582
583	pos = nla_data(attr);
584	len = nla_len(attr);
585
586	while (len) {
587		u8 elemlen;
588
589		if (len < 2)
590			return false;
591		len -= 2;
592
593		elemlen = pos[1];
594		if (elemlen > len)
595			return false;
596
597		len -= elemlen;
598		pos += 2 + elemlen;
599	}
600
601	return true;
602}
603
604/* message building helper */
605static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
606				   int flags, u8 cmd)
607{
608	/* since there is no private header just add the generic one */
609	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
610}
611
612static int nl80211_msg_put_channel(struct sk_buff *msg,
613				   struct ieee80211_channel *chan,
614				   bool large)
615{
616	/* Some channels must be completely excluded from the
617	 * list to protect old user-space tools from breaking
618	 */
619	if (!large && chan->flags &
620	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
621		return 0;
622
623	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
624			chan->center_freq))
625		goto nla_put_failure;
626
627	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
628	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
629		goto nla_put_failure;
630	if (chan->flags & IEEE80211_CHAN_NO_IR) {
631		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
632			goto nla_put_failure;
633		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
634			goto nla_put_failure;
635	}
636	if (chan->flags & IEEE80211_CHAN_RADAR) {
637		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
638			goto nla_put_failure;
639		if (large) {
640			u32 time;
641
642			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
643
644			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
645					chan->dfs_state))
646				goto nla_put_failure;
647			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
648					time))
649				goto nla_put_failure;
650			if (nla_put_u32(msg,
651					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
652					chan->dfs_cac_ms))
653				goto nla_put_failure;
654		}
655	}
656
657	if (large) {
658		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
659		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
660			goto nla_put_failure;
661		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
662		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
663			goto nla_put_failure;
664		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
665		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
666			goto nla_put_failure;
667		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
668		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
669			goto nla_put_failure;
670		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
671		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
672			goto nla_put_failure;
673		if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
674		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
675			goto nla_put_failure;
676		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
677		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
678			goto nla_put_failure;
679		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
680		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
681			goto nla_put_failure;
682	}
683
684	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
685			DBM_TO_MBM(chan->max_power)))
686		goto nla_put_failure;
687
688	return 0;
689
690 nla_put_failure:
691	return -ENOBUFS;
692}
693
694/* netlink command implementations */
695
696struct key_parse {
697	struct key_params p;
698	int idx;
699	int type;
700	bool def, defmgmt;
701	bool def_uni, def_multi;
702};
703
704static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
705{
706	struct nlattr *tb[NL80211_KEY_MAX + 1];
707	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
708				   nl80211_key_policy);
709	if (err)
710		return err;
711
712	k->def = !!tb[NL80211_KEY_DEFAULT];
713	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
714
715	if (k->def) {
716		k->def_uni = true;
717		k->def_multi = true;
718	}
719	if (k->defmgmt)
720		k->def_multi = true;
721
722	if (tb[NL80211_KEY_IDX])
723		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
724
725	if (tb[NL80211_KEY_DATA]) {
726		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
727		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
728	}
729
730	if (tb[NL80211_KEY_SEQ]) {
731		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
732		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
733	}
734
735	if (tb[NL80211_KEY_CIPHER])
736		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
737
738	if (tb[NL80211_KEY_TYPE]) {
739		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
740		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
741			return -EINVAL;
742	}
743
744	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
745		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
746		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
747				       tb[NL80211_KEY_DEFAULT_TYPES],
748				       nl80211_key_default_policy);
749		if (err)
750			return err;
751
752		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
753		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
754	}
755
756	return 0;
757}
758
759static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
760{
761	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
762		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
763		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
764	}
765
766	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
767		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
768		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
769	}
770
771	if (info->attrs[NL80211_ATTR_KEY_IDX])
772		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
773
774	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
775		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
776
777	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
778	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
779
780	if (k->def) {
781		k->def_uni = true;
782		k->def_multi = true;
783	}
784	if (k->defmgmt)
785		k->def_multi = true;
786
787	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
788		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
789		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
790			return -EINVAL;
791	}
792
793	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
794		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
795		int err = nla_parse_nested(
796				kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
797				info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
798				nl80211_key_default_policy);
799		if (err)
800			return err;
801
802		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
803		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
804	}
805
806	return 0;
807}
808
809static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
810{
811	int err;
812
813	memset(k, 0, sizeof(*k));
814	k->idx = -1;
815	k->type = -1;
816
817	if (info->attrs[NL80211_ATTR_KEY])
818		err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
819	else
820		err = nl80211_parse_key_old(info, k);
821
822	if (err)
823		return err;
824
825	if (k->def && k->defmgmt)
826		return -EINVAL;
827
828	if (k->defmgmt) {
829		if (k->def_uni || !k->def_multi)
830			return -EINVAL;
831	}
832
833	if (k->idx != -1) {
834		if (k->defmgmt) {
835			if (k->idx < 4 || k->idx > 5)
836				return -EINVAL;
837		} else if (k->def) {
838			if (k->idx < 0 || k->idx > 3)
839				return -EINVAL;
840		} else {
841			if (k->idx < 0 || k->idx > 5)
842				return -EINVAL;
843		}
844	}
845
846	return 0;
847}
848
849static struct cfg80211_cached_keys *
850nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
851		       struct nlattr *keys, bool *no_ht)
852{
853	struct key_parse parse;
854	struct nlattr *key;
855	struct cfg80211_cached_keys *result;
856	int rem, err, def = 0;
857
858	result = kzalloc(sizeof(*result), GFP_KERNEL);
859	if (!result)
860		return ERR_PTR(-ENOMEM);
861
862	result->def = -1;
863	result->defmgmt = -1;
864
865	nla_for_each_nested(key, keys, rem) {
866		memset(&parse, 0, sizeof(parse));
867		parse.idx = -1;
868
869		err = nl80211_parse_key_new(key, &parse);
870		if (err)
871			goto error;
872		err = -EINVAL;
873		if (!parse.p.key)
874			goto error;
875		if (parse.idx < 0 || parse.idx > 4)
876			goto error;
877		if (parse.def) {
878			if (def)
879				goto error;
880			def = 1;
881			result->def = parse.idx;
882			if (!parse.def_uni || !parse.def_multi)
883				goto error;
884		} else if (parse.defmgmt)
885			goto error;
886		err = cfg80211_validate_key_settings(rdev, &parse.p,
887						     parse.idx, false, NULL);
888		if (err)
889			goto error;
890		result->params[parse.idx].cipher = parse.p.cipher;
891		result->params[parse.idx].key_len = parse.p.key_len;
892		result->params[parse.idx].key = result->data[parse.idx];
893		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
894
895		if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
896		    parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
897			if (no_ht)
898				*no_ht = true;
899		}
900	}
901
902	return result;
903 error:
904	kfree(result);
905	return ERR_PTR(err);
906}
907
908static int nl80211_key_allowed(struct wireless_dev *wdev)
909{
910	ASSERT_WDEV_LOCK(wdev);
911
912	switch (wdev->iftype) {
913	case NL80211_IFTYPE_AP:
914	case NL80211_IFTYPE_AP_VLAN:
915	case NL80211_IFTYPE_P2P_GO:
916	case NL80211_IFTYPE_MESH_POINT:
917		break;
918	case NL80211_IFTYPE_ADHOC:
919	case NL80211_IFTYPE_STATION:
920	case NL80211_IFTYPE_P2P_CLIENT:
921		if (!wdev->current_bss)
922			return -ENOLINK;
923		break;
924	case NL80211_IFTYPE_UNSPECIFIED:
925	case NL80211_IFTYPE_OCB:
926	case NL80211_IFTYPE_MONITOR:
927	case NL80211_IFTYPE_P2P_DEVICE:
928	case NL80211_IFTYPE_WDS:
929	case NUM_NL80211_IFTYPES:
930		return -EINVAL;
931	}
932
933	return 0;
934}
935
936static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
937							struct nlattr *tb)
938{
939	struct ieee80211_channel *chan;
940
941	if (tb == NULL)
942		return NULL;
943	chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
944	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
945		return NULL;
946	return chan;
947}
948
949static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
950{
951	struct nlattr *nl_modes = nla_nest_start(msg, attr);
952	int i;
953
954	if (!nl_modes)
955		goto nla_put_failure;
956
957	i = 0;
958	while (ifmodes) {
959		if ((ifmodes & 1) && nla_put_flag(msg, i))
960			goto nla_put_failure;
961		ifmodes >>= 1;
962		i++;
963	}
964
965	nla_nest_end(msg, nl_modes);
966	return 0;
967
968nla_put_failure:
969	return -ENOBUFS;
970}
971
972static int nl80211_put_iface_combinations(struct wiphy *wiphy,
973					  struct sk_buff *msg,
974					  bool large)
975{
976	struct nlattr *nl_combis;
977	int i, j;
978
979	nl_combis = nla_nest_start(msg,
980				NL80211_ATTR_INTERFACE_COMBINATIONS);
981	if (!nl_combis)
982		goto nla_put_failure;
983
984	for (i = 0; i < wiphy->n_iface_combinations; i++) {
985		const struct ieee80211_iface_combination *c;
986		struct nlattr *nl_combi, *nl_limits;
987
988		c = &wiphy->iface_combinations[i];
989
990		nl_combi = nla_nest_start(msg, i + 1);
991		if (!nl_combi)
992			goto nla_put_failure;
993
994		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
995		if (!nl_limits)
996			goto nla_put_failure;
997
998		for (j = 0; j < c->n_limits; j++) {
999			struct nlattr *nl_limit;
1000
1001			nl_limit = nla_nest_start(msg, j + 1);
1002			if (!nl_limit)
1003				goto nla_put_failure;
1004			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1005					c->limits[j].max))
1006				goto nla_put_failure;
1007			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1008						c->limits[j].types))
1009				goto nla_put_failure;
1010			nla_nest_end(msg, nl_limit);
1011		}
1012
1013		nla_nest_end(msg, nl_limits);
1014
1015		if (c->beacon_int_infra_match &&
1016		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1017			goto nla_put_failure;
1018		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1019				c->num_different_channels) ||
1020		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1021				c->max_interfaces))
1022			goto nla_put_failure;
1023		if (large &&
1024		    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1025				c->radar_detect_widths) ||
1026		     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1027				c->radar_detect_regions)))
1028			goto nla_put_failure;
1029		if (c->beacon_int_min_gcd &&
1030		    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1031				c->beacon_int_min_gcd))
1032			goto nla_put_failure;
1033
1034		nla_nest_end(msg, nl_combi);
1035	}
1036
1037	nla_nest_end(msg, nl_combis);
1038
1039	return 0;
1040nla_put_failure:
1041	return -ENOBUFS;
1042}
1043
1044#ifdef CONFIG_PM
1045static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1046					struct sk_buff *msg)
1047{
1048	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1049	struct nlattr *nl_tcp;
1050
1051	if (!tcp)
1052		return 0;
1053
1054	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1055	if (!nl_tcp)
1056		return -ENOBUFS;
1057
1058	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1059			tcp->data_payload_max))
1060		return -ENOBUFS;
1061
1062	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1063			tcp->data_payload_max))
1064		return -ENOBUFS;
1065
1066	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1067		return -ENOBUFS;
1068
1069	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1070				sizeof(*tcp->tok), tcp->tok))
1071		return -ENOBUFS;
1072
1073	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1074			tcp->data_interval_max))
1075		return -ENOBUFS;
1076
1077	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1078			tcp->wake_payload_max))
1079		return -ENOBUFS;
1080
1081	nla_nest_end(msg, nl_tcp);
1082	return 0;
1083}
1084
1085static int nl80211_send_wowlan(struct sk_buff *msg,
1086			       struct cfg80211_registered_device *rdev,
1087			       bool large)
1088{
1089	struct nlattr *nl_wowlan;
1090
1091	if (!rdev->wiphy.wowlan)
1092		return 0;
1093
1094	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1095	if (!nl_wowlan)
1096		return -ENOBUFS;
1097
1098	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1099	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1100	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1101	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1102	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1103	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1104	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1105	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1106	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1107	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1108	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1109	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1110	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1111	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1112	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1113	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1114		return -ENOBUFS;
1115
1116	if (rdev->wiphy.wowlan->n_patterns) {
1117		struct nl80211_pattern_support pat = {
1118			.max_patterns = rdev->wiphy.wowlan->n_patterns,
1119			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1120			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1121			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1122		};
1123
1124		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1125			    sizeof(pat), &pat))
1126			return -ENOBUFS;
1127	}
1128
1129	if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1130	    nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1131			rdev->wiphy.wowlan->max_nd_match_sets))
1132		return -ENOBUFS;
1133
1134	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1135		return -ENOBUFS;
1136
1137	nla_nest_end(msg, nl_wowlan);
1138
1139	return 0;
1140}
1141#endif
1142
1143static int nl80211_send_coalesce(struct sk_buff *msg,
1144				 struct cfg80211_registered_device *rdev)
1145{
1146	struct nl80211_coalesce_rule_support rule;
1147
1148	if (!rdev->wiphy.coalesce)
1149		return 0;
1150
1151	rule.max_rules = rdev->wiphy.coalesce->n_rules;
1152	rule.max_delay = rdev->wiphy.coalesce->max_delay;
1153	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1154	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1155	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1156	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1157
1158	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1159		return -ENOBUFS;
1160
1161	return 0;
1162}
1163
1164static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1165				      struct ieee80211_supported_band *sband)
1166{
1167	struct nlattr *nl_rates, *nl_rate;
1168	struct ieee80211_rate *rate;
1169	int i;
1170
1171	/* add HT info */
1172	if (sband->ht_cap.ht_supported &&
1173	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1174		     sizeof(sband->ht_cap.mcs),
1175		     &sband->ht_cap.mcs) ||
1176	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1177			 sband->ht_cap.cap) ||
1178	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1179			sband->ht_cap.ampdu_factor) ||
1180	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1181			sband->ht_cap.ampdu_density)))
1182		return -ENOBUFS;
1183
1184	/* add VHT info */
1185	if (sband->vht_cap.vht_supported &&
1186	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1187		     sizeof(sband->vht_cap.vht_mcs),
1188		     &sband->vht_cap.vht_mcs) ||
1189	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1190			 sband->vht_cap.cap)))
1191		return -ENOBUFS;
1192
1193	/* add bitrates */
1194	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1195	if (!nl_rates)
1196		return -ENOBUFS;
1197
1198	for (i = 0; i < sband->n_bitrates; i++) {
1199		nl_rate = nla_nest_start(msg, i);
1200		if (!nl_rate)
1201			return -ENOBUFS;
1202
1203		rate = &sband->bitrates[i];
1204		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1205				rate->bitrate))
1206			return -ENOBUFS;
1207		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1208		    nla_put_flag(msg,
1209				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1210			return -ENOBUFS;
1211
1212		nla_nest_end(msg, nl_rate);
1213	}
1214
1215	nla_nest_end(msg, nl_rates);
1216
1217	return 0;
1218}
1219
1220static int
1221nl80211_send_mgmt_stypes(struct sk_buff *msg,
1222			 const struct ieee80211_txrx_stypes *mgmt_stypes)
1223{
1224	u16 stypes;
1225	struct nlattr *nl_ftypes, *nl_ifs;
1226	enum nl80211_iftype ift;
1227	int i;
1228
1229	if (!mgmt_stypes)
1230		return 0;
1231
1232	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1233	if (!nl_ifs)
1234		return -ENOBUFS;
1235
1236	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1237		nl_ftypes = nla_nest_start(msg, ift);
1238		if (!nl_ftypes)
1239			return -ENOBUFS;
1240		i = 0;
1241		stypes = mgmt_stypes[ift].tx;
1242		while (stypes) {
1243			if ((stypes & 1) &&
1244			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1245					(i << 4) | IEEE80211_FTYPE_MGMT))
1246				return -ENOBUFS;
1247			stypes >>= 1;
1248			i++;
1249		}
1250		nla_nest_end(msg, nl_ftypes);
1251	}
1252
1253	nla_nest_end(msg, nl_ifs);
1254
1255	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1256	if (!nl_ifs)
1257		return -ENOBUFS;
1258
1259	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1260		nl_ftypes = nla_nest_start(msg, ift);
1261		if (!nl_ftypes)
1262			return -ENOBUFS;
1263		i = 0;
1264		stypes = mgmt_stypes[ift].rx;
1265		while (stypes) {
1266			if ((stypes & 1) &&
1267			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1268					(i << 4) | IEEE80211_FTYPE_MGMT))
1269				return -ENOBUFS;
1270			stypes >>= 1;
1271			i++;
1272		}
1273		nla_nest_end(msg, nl_ftypes);
1274	}
1275	nla_nest_end(msg, nl_ifs);
1276
1277	return 0;
1278}
1279
1280struct nl80211_dump_wiphy_state {
1281	s64 filter_wiphy;
1282	long start;
1283	long split_start, band_start, chan_start, capa_start;
1284	bool split;
1285};
1286
1287static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1288			      enum nl80211_commands cmd,
1289			      struct sk_buff *msg, u32 portid, u32 seq,
1290			      int flags, struct nl80211_dump_wiphy_state *state)
1291{
1292	void *hdr;
1293	struct nlattr *nl_bands, *nl_band;
1294	struct nlattr *nl_freqs, *nl_freq;
1295	struct nlattr *nl_cmds;
1296	enum nl80211_band band;
1297	struct ieee80211_channel *chan;
1298	int i;
1299	const struct ieee80211_txrx_stypes *mgmt_stypes =
1300				rdev->wiphy.mgmt_stypes;
1301	u32 features;
1302
1303	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1304	if (!hdr)
1305		return -ENOBUFS;
1306
1307	if (WARN_ON(!state))
1308		return -EINVAL;
1309
1310	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1311	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1312			   wiphy_name(&rdev->wiphy)) ||
1313	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
1314			cfg80211_rdev_list_generation))
1315		goto nla_put_failure;
1316
1317	if (cmd != NL80211_CMD_NEW_WIPHY)
1318		goto finish;
1319
1320	switch (state->split_start) {
1321	case 0:
1322		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1323			       rdev->wiphy.retry_short) ||
1324		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1325			       rdev->wiphy.retry_long) ||
1326		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1327				rdev->wiphy.frag_threshold) ||
1328		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1329				rdev->wiphy.rts_threshold) ||
1330		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1331			       rdev->wiphy.coverage_class) ||
1332		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1333			       rdev->wiphy.max_scan_ssids) ||
1334		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1335			       rdev->wiphy.max_sched_scan_ssids) ||
1336		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1337				rdev->wiphy.max_scan_ie_len) ||
1338		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1339				rdev->wiphy.max_sched_scan_ie_len) ||
1340		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1341			       rdev->wiphy.max_match_sets) ||
1342		    nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1343				rdev->wiphy.max_sched_scan_plans) ||
1344		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1345				rdev->wiphy.max_sched_scan_plan_interval) ||
1346		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1347				rdev->wiphy.max_sched_scan_plan_iterations))
1348			goto nla_put_failure;
1349
1350		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1351		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1352			goto nla_put_failure;
1353		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1354		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1355			goto nla_put_failure;
1356		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1357		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1358			goto nla_put_failure;
1359		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1360		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1361			goto nla_put_failure;
1362		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1363		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1364			goto nla_put_failure;
1365		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1366		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1367			goto nla_put_failure;
1368		state->split_start++;
1369		if (state->split)
1370			break;
1371	case 1:
1372		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1373			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
1374			    rdev->wiphy.cipher_suites))
1375			goto nla_put_failure;
1376
1377		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1378			       rdev->wiphy.max_num_pmkids))
1379			goto nla_put_failure;
1380
1381		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1382		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1383			goto nla_put_failure;
1384
1385		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1386				rdev->wiphy.available_antennas_tx) ||
1387		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1388				rdev->wiphy.available_antennas_rx))
1389			goto nla_put_failure;
1390
1391		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1392		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1393				rdev->wiphy.probe_resp_offload))
1394			goto nla_put_failure;
1395
1396		if ((rdev->wiphy.available_antennas_tx ||
1397		     rdev->wiphy.available_antennas_rx) &&
1398		    rdev->ops->get_antenna) {
1399			u32 tx_ant = 0, rx_ant = 0;
1400			int res;
1401			res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1402			if (!res) {
1403				if (nla_put_u32(msg,
1404						NL80211_ATTR_WIPHY_ANTENNA_TX,
1405						tx_ant) ||
1406				    nla_put_u32(msg,
1407						NL80211_ATTR_WIPHY_ANTENNA_RX,
1408						rx_ant))
1409					goto nla_put_failure;
1410			}
1411		}
1412
1413		state->split_start++;
1414		if (state->split)
1415			break;
1416	case 2:
1417		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1418					rdev->wiphy.interface_modes))
1419				goto nla_put_failure;
1420		state->split_start++;
1421		if (state->split)
1422			break;
1423	case 3:
1424		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1425		if (!nl_bands)
1426			goto nla_put_failure;
1427
1428		for (band = state->band_start;
1429		     band < NUM_NL80211_BANDS; band++) {
1430			struct ieee80211_supported_band *sband;
1431
1432			sband = rdev->wiphy.bands[band];
1433
1434			if (!sband)
1435				continue;
1436
1437			nl_band = nla_nest_start(msg, band);
1438			if (!nl_band)
1439				goto nla_put_failure;
1440
1441			switch (state->chan_start) {
1442			case 0:
1443				if (nl80211_send_band_rateinfo(msg, sband))
1444					goto nla_put_failure;
1445				state->chan_start++;
1446				if (state->split)
1447					break;
1448			default:
1449				/* add frequencies */
1450				nl_freqs = nla_nest_start(
1451					msg, NL80211_BAND_ATTR_FREQS);
1452				if (!nl_freqs)
1453					goto nla_put_failure;
1454
1455				for (i = state->chan_start - 1;
1456				     i < sband->n_channels;
1457				     i++) {
1458					nl_freq = nla_nest_start(msg, i);
1459					if (!nl_freq)
1460						goto nla_put_failure;
1461
1462					chan = &sband->channels[i];
1463
1464					if (nl80211_msg_put_channel(
1465							msg, chan,
1466							state->split))
1467						goto nla_put_failure;
1468
1469					nla_nest_end(msg, nl_freq);
1470					if (state->split)
1471						break;
1472				}
1473				if (i < sband->n_channels)
1474					state->chan_start = i + 2;
1475				else
1476					state->chan_start = 0;
1477				nla_nest_end(msg, nl_freqs);
1478			}
1479
1480			nla_nest_end(msg, nl_band);
1481
1482			if (state->split) {
1483				/* start again here */
1484				if (state->chan_start)
1485					band--;
1486				break;
1487			}
1488		}
1489		nla_nest_end(msg, nl_bands);
1490
1491		if (band < NUM_NL80211_BANDS)
1492			state->band_start = band + 1;
1493		else
1494			state->band_start = 0;
1495
1496		/* if bands & channels are done, continue outside */
1497		if (state->band_start == 0 && state->chan_start == 0)
1498			state->split_start++;
1499		if (state->split)
1500			break;
1501	case 4:
1502		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1503		if (!nl_cmds)
1504			goto nla_put_failure;
1505
1506		i = 0;
1507#define CMD(op, n)							\
1508		 do {							\
1509			if (rdev->ops->op) {				\
1510				i++;					\
1511				if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1512					goto nla_put_failure;		\
1513			}						\
1514		} while (0)
1515
1516		CMD(add_virtual_intf, NEW_INTERFACE);
1517		CMD(change_virtual_intf, SET_INTERFACE);
1518		CMD(add_key, NEW_KEY);
1519		CMD(start_ap, START_AP);
1520		CMD(add_station, NEW_STATION);
1521		CMD(add_mpath, NEW_MPATH);
1522		CMD(update_mesh_config, SET_MESH_CONFIG);
1523		CMD(change_bss, SET_BSS);
1524		CMD(auth, AUTHENTICATE);
1525		CMD(assoc, ASSOCIATE);
1526		CMD(deauth, DEAUTHENTICATE);
1527		CMD(disassoc, DISASSOCIATE);
1528		CMD(join_ibss, JOIN_IBSS);
1529		CMD(join_mesh, JOIN_MESH);
1530		CMD(set_pmksa, SET_PMKSA);
1531		CMD(del_pmksa, DEL_PMKSA);
1532		CMD(flush_pmksa, FLUSH_PMKSA);
1533		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1534			CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1535		CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1536		CMD(mgmt_tx, FRAME);
1537		CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1538		if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1539			i++;
1540			if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1541				goto nla_put_failure;
1542		}
1543		if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1544		    rdev->ops->join_mesh) {
1545			i++;
1546			if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1547				goto nla_put_failure;
1548		}
1549		CMD(set_wds_peer, SET_WDS_PEER);
1550		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1551			CMD(tdls_mgmt, TDLS_MGMT);
1552			CMD(tdls_oper, TDLS_OPER);
1553		}
1554		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1555			CMD(sched_scan_start, START_SCHED_SCAN);
1556		CMD(probe_client, PROBE_CLIENT);
1557		CMD(set_noack_map, SET_NOACK_MAP);
1558		if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1559			i++;
1560			if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1561				goto nla_put_failure;
1562		}
1563		CMD(start_p2p_device, START_P2P_DEVICE);
1564		CMD(set_mcast_rate, SET_MCAST_RATE);
1565#ifdef CONFIG_NL80211_TESTMODE
1566		CMD(testmode_cmd, TESTMODE);
1567#endif
1568		if (state->split) {
1569			CMD(crit_proto_start, CRIT_PROTOCOL_START);
1570			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1571			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1572				CMD(channel_switch, CHANNEL_SWITCH);
1573			CMD(set_qos_map, SET_QOS_MAP);
1574			if (rdev->wiphy.features &
1575					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1576				CMD(add_tx_ts, ADD_TX_TS);
1577			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1578		}
1579		/* add into the if now */
1580#undef CMD
1581
1582		if (rdev->ops->connect || rdev->ops->auth) {
1583			i++;
1584			if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1585				goto nla_put_failure;
1586		}
1587
1588		if (rdev->ops->disconnect || rdev->ops->deauth) {
1589			i++;
1590			if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1591				goto nla_put_failure;
1592		}
1593
1594		nla_nest_end(msg, nl_cmds);
1595		state->split_start++;
1596		if (state->split)
1597			break;
1598	case 5:
1599		if (rdev->ops->remain_on_channel &&
1600		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1601		    nla_put_u32(msg,
1602				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1603				rdev->wiphy.max_remain_on_channel_duration))
1604			goto nla_put_failure;
1605
1606		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1607		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1608			goto nla_put_failure;
1609
1610		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1611			goto nla_put_failure;
1612		state->split_start++;
1613		if (state->split)
1614			break;
1615	case 6:
1616#ifdef CONFIG_PM
1617		if (nl80211_send_wowlan(msg, rdev, state->split))
1618			goto nla_put_failure;
1619		state->split_start++;
1620		if (state->split)
1621			break;
1622#else
1623		state->split_start++;
1624#endif
1625	case 7:
1626		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1627					rdev->wiphy.software_iftypes))
1628			goto nla_put_failure;
1629
1630		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1631						   state->split))
1632			goto nla_put_failure;
1633
1634		state->split_start++;
1635		if (state->split)
1636			break;
1637	case 8:
1638		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1639		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1640				rdev->wiphy.ap_sme_capa))
1641			goto nla_put_failure;
1642
1643		features = rdev->wiphy.features;
1644		/*
1645		 * We can only add the per-channel limit information if the
1646		 * dump is split, otherwise it makes it too big. Therefore
1647		 * only advertise it in that case.
1648		 */
1649		if (state->split)
1650			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1651		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1652			goto nla_put_failure;
1653
1654		if (rdev->wiphy.ht_capa_mod_mask &&
1655		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1656			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
1657			    rdev->wiphy.ht_capa_mod_mask))
1658			goto nla_put_failure;
1659
1660		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1661		    rdev->wiphy.max_acl_mac_addrs &&
1662		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1663				rdev->wiphy.max_acl_mac_addrs))
1664			goto nla_put_failure;
1665
1666		/*
1667		 * Any information below this point is only available to
1668		 * applications that can deal with it being split. This
1669		 * helps ensure that newly added capabilities don't break
1670		 * older tools by overrunning their buffers.
1671		 *
1672		 * We still increment split_start so that in the split
1673		 * case we'll continue with more data in the next round,
1674		 * but break unconditionally so unsplit data stops here.
1675		 */
1676		state->split_start++;
1677		break;
1678	case 9:
1679		if (rdev->wiphy.extended_capabilities &&
1680		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1681			     rdev->wiphy.extended_capabilities_len,
1682			     rdev->wiphy.extended_capabilities) ||
1683		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1684			     rdev->wiphy.extended_capabilities_len,
1685			     rdev->wiphy.extended_capabilities_mask)))
1686			goto nla_put_failure;
1687
1688		if (rdev->wiphy.vht_capa_mod_mask &&
1689		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1690			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
1691			    rdev->wiphy.vht_capa_mod_mask))
1692			goto nla_put_failure;
1693
1694		state->split_start++;
1695		break;
1696	case 10:
1697		if (nl80211_send_coalesce(msg, rdev))
1698			goto nla_put_failure;
1699
1700		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1701		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1702		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1703			goto nla_put_failure;
1704
1705		if (rdev->wiphy.max_ap_assoc_sta &&
1706		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1707				rdev->wiphy.max_ap_assoc_sta))
1708			goto nla_put_failure;
1709
1710		state->split_start++;
1711		break;
1712	case 11:
1713		if (rdev->wiphy.n_vendor_commands) {
1714			const struct nl80211_vendor_cmd_info *info;
1715			struct nlattr *nested;
1716
1717			nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1718			if (!nested)
1719				goto nla_put_failure;
1720
1721			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1722				info = &rdev->wiphy.vendor_commands[i].info;
1723				if (nla_put(msg, i + 1, sizeof(*info), info))
1724					goto nla_put_failure;
1725			}
1726			nla_nest_end(msg, nested);
1727		}
1728
1729		if (rdev->wiphy.n_vendor_events) {
1730			const struct nl80211_vendor_cmd_info *info;
1731			struct nlattr *nested;
1732
1733			nested = nla_nest_start(msg,
1734						NL80211_ATTR_VENDOR_EVENTS);
1735			if (!nested)
1736				goto nla_put_failure;
1737
1738			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1739				info = &rdev->wiphy.vendor_events[i];
1740				if (nla_put(msg, i + 1, sizeof(*info), info))
1741					goto nla_put_failure;
1742			}
1743			nla_nest_end(msg, nested);
1744		}
1745		state->split_start++;
1746		break;
1747	case 12:
1748		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1749		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1750			       rdev->wiphy.max_num_csa_counters))
1751			goto nla_put_failure;
1752
1753		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1754		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1755			goto nla_put_failure;
1756
1757		if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1758			    sizeof(rdev->wiphy.ext_features),
1759			    rdev->wiphy.ext_features))
1760			goto nla_put_failure;
1761
1762		state->split_start++;
1763		break;
1764	case 13:
1765		if (rdev->wiphy.num_iftype_ext_capab &&
1766		    rdev->wiphy.iftype_ext_capab) {
1767			struct nlattr *nested_ext_capab, *nested;
1768
1769			nested = nla_nest_start(msg,
1770						NL80211_ATTR_IFTYPE_EXT_CAPA);
1771			if (!nested)
1772				goto nla_put_failure;
1773
1774			for (i = state->capa_start;
1775			     i < rdev->wiphy.num_iftype_ext_capab; i++) {
1776				const struct wiphy_iftype_ext_capab *capab;
1777
1778				capab = &rdev->wiphy.iftype_ext_capab[i];
1779
1780				nested_ext_capab = nla_nest_start(msg, i);
1781				if (!nested_ext_capab ||
1782				    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1783						capab->iftype) ||
1784				    nla_put(msg, NL80211_ATTR_EXT_CAPA,
1785					    capab->extended_capabilities_len,
1786					    capab->extended_capabilities) ||
1787				    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1788					    capab->extended_capabilities_len,
1789					    capab->extended_capabilities_mask))
1790					goto nla_put_failure;
1791
1792				nla_nest_end(msg, nested_ext_capab);
1793				if (state->split)
1794					break;
1795			}
1796			nla_nest_end(msg, nested);
1797			if (i < rdev->wiphy.num_iftype_ext_capab) {
1798				state->capa_start = i + 1;
1799				break;
1800			}
1801		}
1802
1803		if (rdev->wiphy.bss_select_support) {
1804			struct nlattr *nested;
1805			u32 bss_select_support = rdev->wiphy.bss_select_support;
1806
1807			nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1808			if (!nested)
1809				goto nla_put_failure;
1810
1811			i = 0;
1812			while (bss_select_support) {
1813				if ((bss_select_support & 1) &&
1814				    nla_put_flag(msg, i))
1815					goto nla_put_failure;
1816				i++;
1817				bss_select_support >>= 1;
1818			}
1819			nla_nest_end(msg, nested);
1820		}
1821
1822		/* done */
1823		state->split_start = 0;
1824		break;
1825	}
1826 finish:
1827	genlmsg_end(msg, hdr);
1828	return 0;
1829
1830 nla_put_failure:
1831	genlmsg_cancel(msg, hdr);
1832	return -EMSGSIZE;
1833}
1834
1835static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1836				    struct netlink_callback *cb,
1837				    struct nl80211_dump_wiphy_state *state)
1838{
1839	struct nlattr **tb = nl80211_fam.attrbuf;
1840	int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1841			      tb, nl80211_fam.maxattr, nl80211_policy);
1842	/* ignore parse errors for backward compatibility */
1843	if (ret)
1844		return 0;
1845
1846	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1847	if (tb[NL80211_ATTR_WIPHY])
1848		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1849	if (tb[NL80211_ATTR_WDEV])
1850		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1851	if (tb[NL80211_ATTR_IFINDEX]) {
1852		struct net_device *netdev;
1853		struct cfg80211_registered_device *rdev;
1854		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1855
1856		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1857		if (!netdev)
1858			return -ENODEV;
1859		if (netdev->ieee80211_ptr) {
1860			rdev = wiphy_to_rdev(
1861				netdev->ieee80211_ptr->wiphy);
1862			state->filter_wiphy = rdev->wiphy_idx;
1863		}
1864	}
1865
1866	return 0;
1867}
1868
1869static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1870{
1871	int idx = 0, ret;
1872	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1873	struct cfg80211_registered_device *rdev;
1874
1875	rtnl_lock();
1876	if (!state) {
1877		state = kzalloc(sizeof(*state), GFP_KERNEL);
1878		if (!state) {
1879			rtnl_unlock();
1880			return -ENOMEM;
1881		}
1882		state->filter_wiphy = -1;
1883		ret = nl80211_dump_wiphy_parse(skb, cb, state);
1884		if (ret) {
1885			kfree(state);
1886			rtnl_unlock();
1887			return ret;
1888		}
1889		cb->args[0] = (long)state;
1890	}
1891
1892	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1893		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1894			continue;
1895		if (++idx <= state->start)
1896			continue;
1897		if (state->filter_wiphy != -1 &&
1898		    state->filter_wiphy != rdev->wiphy_idx)
1899			continue;
1900		/* attempt to fit multiple wiphy data chunks into the skb */
1901		do {
1902			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1903						 skb,
1904						 NETLINK_CB(cb->skb).portid,
1905						 cb->nlh->nlmsg_seq,
1906						 NLM_F_MULTI, state);
1907			if (ret < 0) {
1908				/*
1909				 * If sending the wiphy data didn't fit (ENOBUFS
1910				 * or EMSGSIZE returned), this SKB is still
1911				 * empty (so it's not too big because another
1912				 * wiphy dataset is already in the skb) and
1913				 * we've not tried to adjust the dump allocation
1914				 * yet ... then adjust the alloc size to be
1915				 * bigger, and return 1 but with the empty skb.
1916				 * This results in an empty message being RX'ed
1917				 * in userspace, but that is ignored.
1918				 *
1919				 * We can then retry with the larger buffer.
1920				 */
1921				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1922				    !skb->len && !state->split &&
1923				    cb->min_dump_alloc < 4096) {
1924					cb->min_dump_alloc = 4096;
1925					state->split_start = 0;
1926					rtnl_unlock();
1927					return 1;
1928				}
1929				idx--;
1930				break;
1931			}
1932		} while (state->split_start > 0);
1933		break;
1934	}
1935	rtnl_unlock();
1936
1937	state->start = idx;
1938
1939	return skb->len;
1940}
1941
1942static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1943{
1944	kfree((void *)cb->args[0]);
1945	return 0;
1946}
1947
1948static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1949{
1950	struct sk_buff *msg;
1951	struct cfg80211_registered_device *rdev = info->user_ptr[0];
1952	struct nl80211_dump_wiphy_state state = {};
1953
1954	msg = nlmsg_new(4096, GFP_KERNEL);
1955	if (!msg)
1956		return -ENOMEM;
1957
1958	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1959			       info->snd_portid, info->snd_seq, 0,
1960			       &state) < 0) {
1961		nlmsg_free(msg);
1962		return -ENOBUFS;
1963	}
1964
1965	return genlmsg_reply(msg, info);
1966}
1967
1968static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1969	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
1970	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
1971	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
1972	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
1973	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
1974};
1975
1976static int parse_txq_params(struct nlattr *tb[],
1977			    struct ieee80211_txq_params *txq_params)
1978{
1979	u8 ac;
1980
1981	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1982	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1983	    !tb[NL80211_TXQ_ATTR_AIFS])
1984		return -EINVAL;
1985
1986	ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1987	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1988	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1989	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1990	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1991
1992	if (ac >= NL80211_NUM_ACS)
1993		return -EINVAL;
1994	txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
1995	return 0;
1996}
1997
1998static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1999{
2000	/*
2001	 * You can only set the channel explicitly for WDS interfaces,
2002	 * all others have their channel managed via their respective
2003	 * "establish a connection" command (connect, join, ...)
2004	 *
2005	 * For AP/GO and mesh mode, the channel can be set with the
2006	 * channel userspace API, but is only stored and passed to the
2007	 * low-level driver when the AP starts or the mesh is joined.
2008	 * This is for backward compatibility, userspace can also give
2009	 * the channel in the start-ap or join-mesh commands instead.
2010	 *
2011	 * Monitors are special as they are normally slaved to
2012	 * whatever else is going on, so they have their own special
2013	 * operation to set the monitor channel if possible.
2014	 */
2015	return !wdev ||
2016		wdev->iftype == NL80211_IFTYPE_AP ||
2017		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2018		wdev->iftype == NL80211_IFTYPE_MONITOR ||
2019		wdev->iftype == NL80211_IFTYPE_P2P_GO;
2020}
2021
2022static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2023				 struct genl_info *info,
2024				 struct cfg80211_chan_def *chandef)
2025{
2026	u32 control_freq;
2027
2028	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2029		return -EINVAL;
2030
2031	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2032
2033	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2034	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2035	chandef->center_freq1 = control_freq;
2036	chandef->center_freq2 = 0;
2037
2038	/* Primary channel not allowed */
2039	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2040		return -EINVAL;
2041
2042	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2043		enum nl80211_channel_type chantype;
2044
2045		chantype = nla_get_u32(
2046				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2047
2048		switch (chantype) {
2049		case NL80211_CHAN_NO_HT:
2050		case NL80211_CHAN_HT20:
2051		case NL80211_CHAN_HT40PLUS:
2052		case NL80211_CHAN_HT40MINUS:
2053			cfg80211_chandef_create(chandef, chandef->chan,
2054						chantype);
2055			break;
2056		default:
2057			return -EINVAL;
2058		}
2059	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2060		chandef->width =
2061			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2062		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2063			chandef->center_freq1 =
2064				nla_get_u32(
2065					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2066		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2067			chandef->center_freq2 =
2068				nla_get_u32(
2069					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2070	}
2071
2072	if (!cfg80211_chandef_valid(chandef))
2073		return -EINVAL;
2074
2075	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2076				     IEEE80211_CHAN_DISABLED))
2077		return -EINVAL;
2078
2079	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2080	     chandef->width == NL80211_CHAN_WIDTH_10) &&
2081	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2082		return -EINVAL;
2083
2084	return 0;
2085}
2086
2087static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2088				 struct net_device *dev,
2089				 struct genl_info *info)
2090{
2091	struct cfg80211_chan_def chandef;
2092	int result;
2093	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2094	struct wireless_dev *wdev = NULL;
2095
2096	if (dev)
2097		wdev = dev->ieee80211_ptr;
2098	if (!nl80211_can_set_dev_channel(wdev))
2099		return -EOPNOTSUPP;
2100	if (wdev)
2101		iftype = wdev->iftype;
2102
2103	result = nl80211_parse_chandef(rdev, info, &chandef);
2104	if (result)
2105		return result;
2106
2107	switch (iftype) {
2108	case NL80211_IFTYPE_AP:
2109	case NL80211_IFTYPE_P2P_GO:
2110		if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2111						   iftype)) {
2112			result = -EINVAL;
2113			break;
2114		}
2115		if (wdev->beacon_interval) {
2116			if (!dev || !rdev->ops->set_ap_chanwidth ||
2117			    !(rdev->wiphy.features &
2118			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2119				result = -EBUSY;
2120				break;
2121			}
2122
2123			/* Only allow dynamic channel width changes */
2124			if (chandef.chan != wdev->preset_chandef.chan) {
2125				result = -EBUSY;
2126				break;
2127			}
2128			result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2129			if (result)
2130				break;
2131		}
2132		wdev->preset_chandef = chandef;
2133		result = 0;
2134		break;
2135	case NL80211_IFTYPE_MESH_POINT:
2136		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2137		break;
2138	case NL80211_IFTYPE_MONITOR:
2139		result = cfg80211_set_monitor_channel(rdev, &chandef);
2140		break;
2141	default:
2142		result = -EINVAL;
2143	}
2144
2145	return result;
2146}
2147
2148static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2149{
2150	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2151	struct net_device *netdev = info->user_ptr[1];
2152
2153	return __nl80211_set_channel(rdev, netdev, info);
2154}
2155
2156static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2157{
2158	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2159	struct net_device *dev = info->user_ptr[1];
2160	struct wireless_dev *wdev = dev->ieee80211_ptr;
2161	const u8 *bssid;
2162
2163	if (!info->attrs[NL80211_ATTR_MAC])
2164		return -EINVAL;
2165
2166	if (netif_running(dev))
2167		return -EBUSY;
2168
2169	if (!rdev->ops->set_wds_peer)
2170		return -EOPNOTSUPP;
2171
2172	if (wdev->iftype != NL80211_IFTYPE_WDS)
2173		return -EOPNOTSUPP;
2174
2175	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2176	return rdev_set_wds_peer(rdev, dev, bssid);
2177}
2178
2179
2180static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2181{
2182	struct cfg80211_registered_device *rdev;
2183	struct net_device *netdev = NULL;
2184	struct wireless_dev *wdev;
2185	int result = 0, rem_txq_params = 0;
2186	struct nlattr *nl_txq_params;
2187	u32 changed;
2188	u8 retry_short = 0, retry_long = 0;
2189	u32 frag_threshold = 0, rts_threshold = 0;
2190	u8 coverage_class = 0;
2191
2192	ASSERT_RTNL();
2193
2194	/*
2195	 * Try to find the wiphy and netdev. Normally this
2196	 * function shouldn't need the netdev, but this is
2197	 * done for backward compatibility -- previously
2198	 * setting the channel was done per wiphy, but now
2199	 * it is per netdev. Previous userland like hostapd
2200	 * also passed a netdev to set_wiphy, so that it is
2201	 * possible to let that go to the right netdev!
2202	 */
2203
2204	if (info->attrs[NL80211_ATTR_IFINDEX]) {
2205		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2206
2207		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2208		if (netdev && netdev->ieee80211_ptr)
2209			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2210		else
2211			netdev = NULL;
2212	}
2213
2214	if (!netdev) {
2215		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2216						  info->attrs);
2217		if (IS_ERR(rdev))
2218			return PTR_ERR(rdev);
2219		wdev = NULL;
2220		netdev = NULL;
2221		result = 0;
2222	} else
2223		wdev = netdev->ieee80211_ptr;
2224
2225	/*
2226	 * end workaround code, by now the rdev is available
2227	 * and locked, and wdev may or may not be NULL.
2228	 */
2229
2230	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2231		result = cfg80211_dev_rename(
2232			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2233
2234	if (result)
2235		return result;
2236
2237	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2238		struct ieee80211_txq_params txq_params;
2239		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2240
2241		if (!rdev->ops->set_txq_params)
2242			return -EOPNOTSUPP;
2243
2244		if (!netdev)
2245			return -EINVAL;
2246
2247		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2248		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2249			return -EINVAL;
2250
2251		if (!netif_running(netdev))
2252			return -ENETDOWN;
2253
2254		nla_for_each_nested(nl_txq_params,
2255				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2256				    rem_txq_params) {
2257			result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2258					   nla_data(nl_txq_params),
2259					   nla_len(nl_txq_params),
2260					   txq_params_policy);
2261			if (result)
2262				return result;
2263			result = parse_txq_params(tb, &txq_params);
2264			if (result)
2265				return result;
2266
2267			result = rdev_set_txq_params(rdev, netdev,
2268						     &txq_params);
2269			if (result)
2270				return result;
2271		}
2272	}
2273
2274	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2275		result = __nl80211_set_channel(
2276			rdev,
2277			nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2278			info);
2279		if (result)
2280			return result;
2281	}
2282
2283	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2284		struct wireless_dev *txp_wdev = wdev;
2285		enum nl80211_tx_power_setting type;
2286		int idx, mbm = 0;
2287
2288		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2289			txp_wdev = NULL;
2290
2291		if (!rdev->ops->set_tx_power)
2292			return -EOPNOTSUPP;
2293
2294		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2295		type = nla_get_u32(info->attrs[idx]);
2296
2297		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2298		    (type != NL80211_TX_POWER_AUTOMATIC))
2299			return -EINVAL;
2300
2301		if (type != NL80211_TX_POWER_AUTOMATIC) {
2302			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2303			mbm = nla_get_u32(info->attrs[idx]);
2304		}
2305
2306		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2307		if (result)
2308			return result;
2309	}
2310
2311	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2312	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2313		u32 tx_ant, rx_ant;
2314		if ((!rdev->wiphy.available_antennas_tx &&
2315		     !rdev->wiphy.available_antennas_rx) ||
2316		    !rdev->ops->set_antenna)
2317			return -EOPNOTSUPP;
2318
2319		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2320		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2321
2322		/* reject antenna configurations which don't match the
2323		 * available antenna masks, except for the "all" mask */
2324		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2325		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2326			return -EINVAL;
2327
2328		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2329		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2330
2331		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2332		if (result)
2333			return result;
2334	}
2335
2336	changed = 0;
2337
2338	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2339		retry_short = nla_get_u8(
2340			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2341		if (retry_short == 0)
2342			return -EINVAL;
2343
2344		changed |= WIPHY_PARAM_RETRY_SHORT;
2345	}
2346
2347	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2348		retry_long = nla_get_u8(
2349			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2350		if (retry_long == 0)
2351			return -EINVAL;
2352
2353		changed |= WIPHY_PARAM_RETRY_LONG;
2354	}
2355
2356	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2357		frag_threshold = nla_get_u32(
2358			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2359		if (frag_threshold < 256)
2360			return -EINVAL;
2361
2362		if (frag_threshold != (u32) -1) {
2363			/*
2364			 * Fragments (apart from the last one) are required to
2365			 * have even length. Make the fragmentation code
2366			 * simpler by stripping LSB should someone try to use
2367			 * odd threshold value.
2368			 */
2369			frag_threshold &= ~0x1;
2370		}
2371		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2372	}
2373
2374	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2375		rts_threshold = nla_get_u32(
2376			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2377		changed |= WIPHY_PARAM_RTS_THRESHOLD;
2378	}
2379
2380	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2381		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2382			return -EINVAL;
2383
2384		coverage_class = nla_get_u8(
2385			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2386		changed |= WIPHY_PARAM_COVERAGE_CLASS;
2387	}
2388
2389	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2390		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2391			return -EOPNOTSUPP;
2392
2393		changed |= WIPHY_PARAM_DYN_ACK;
2394	}
2395
2396	if (changed) {
2397		u8 old_retry_short, old_retry_long;
2398		u32 old_frag_threshold, old_rts_threshold;
2399		u8 old_coverage_class;
2400
2401		if (!rdev->ops->set_wiphy_params)
2402			return -EOPNOTSUPP;
2403
2404		old_retry_short = rdev->wiphy.retry_short;
2405		old_retry_long = rdev->wiphy.retry_long;
2406		old_frag_threshold = rdev->wiphy.frag_threshold;
2407		old_rts_threshold = rdev->wiphy.rts_threshold;
2408		old_coverage_class = rdev->wiphy.coverage_class;
2409
2410		if (changed & WIPHY_PARAM_RETRY_SHORT)
2411			rdev->wiphy.retry_short = retry_short;
2412		if (changed & WIPHY_PARAM_RETRY_LONG)
2413			rdev->wiphy.retry_long = retry_long;
2414		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2415			rdev->wiphy.frag_threshold = frag_threshold;
2416		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2417			rdev->wiphy.rts_threshold = rts_threshold;
2418		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2419			rdev->wiphy.coverage_class = coverage_class;
2420
2421		result = rdev_set_wiphy_params(rdev, changed);
2422		if (result) {
2423			rdev->wiphy.retry_short = old_retry_short;
2424			rdev->wiphy.retry_long = old_retry_long;
2425			rdev->wiphy.frag_threshold = old_frag_threshold;
2426			rdev->wiphy.rts_threshold = old_rts_threshold;
2427			rdev->wiphy.coverage_class = old_coverage_class;
2428			return result;
2429		}
2430	}
2431	return 0;
2432}
2433
2434static inline u64 wdev_id(struct wireless_dev *wdev)
2435{
2436	return (u64)wdev->identifier |
2437	       ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2438}
2439
2440static int nl80211_send_chandef(struct sk_buff *msg,
2441				const struct cfg80211_chan_def *chandef)
2442{
2443	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2444		return -EINVAL;
2445
2446	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2447			chandef->chan->center_freq))
2448		return -ENOBUFS;
2449	switch (chandef->width) {
2450	case NL80211_CHAN_WIDTH_20_NOHT:
2451	case NL80211_CHAN_WIDTH_20:
2452	case NL80211_CHAN_WIDTH_40:
2453		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2454				cfg80211_get_chandef_type(chandef)))
2455			return -ENOBUFS;
2456		break;
2457	default:
2458		break;
2459	}
2460	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2461		return -ENOBUFS;
2462	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2463		return -ENOBUFS;
2464	if (chandef->center_freq2 &&
2465	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2466		return -ENOBUFS;
2467	return 0;
2468}
2469
2470static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2471			      struct cfg80211_registered_device *rdev,
2472			      struct wireless_dev *wdev, bool removal)
2473{
2474	struct net_device *dev = wdev->netdev;
2475	u8 cmd = NL80211_CMD_NEW_INTERFACE;
2476	void *hdr;
2477
2478	if (removal)
2479		cmd = NL80211_CMD_DEL_INTERFACE;
2480
2481	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2482	if (!hdr)
2483		return -1;
2484
2485	if (dev &&
2486	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2487	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2488		goto nla_put_failure;
2489
2490	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2491	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2492	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2493	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2494	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
2495			rdev->devlist_generation ^
2496			(cfg80211_rdev_list_generation << 2)))
2497		goto nla_put_failure;
2498
2499	if (rdev->ops->get_channel) {
2500		int ret;
2501		struct cfg80211_chan_def chandef;
2502
2503		ret = rdev_get_channel(rdev, wdev, &chandef);
2504		if (ret == 0) {
2505			if (nl80211_send_chandef(msg, &chandef))
2506				goto nla_put_failure;
2507		}
2508	}
2509
2510	if (rdev->ops->get_tx_power) {
2511		int dbm, ret;
2512
2513		ret = rdev_get_tx_power(rdev, wdev, &dbm);
2514		if (ret == 0 &&
2515		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2516				DBM_TO_MBM(dbm)))
2517			goto nla_put_failure;
2518	}
2519
2520	if (wdev->ssid_len) {
2521		if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2522			goto nla_put_failure;
2523	}
2524
2525	genlmsg_end(msg, hdr);
2526	return 0;
2527
2528 nla_put_failure:
2529	genlmsg_cancel(msg, hdr);
2530	return -EMSGSIZE;
2531}
2532
2533static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2534{
2535	int wp_idx = 0;
2536	int if_idx = 0;
2537	int wp_start = cb->args[0];
2538	int if_start = cb->args[1];
2539	struct cfg80211_registered_device *rdev;
2540	struct wireless_dev *wdev;
2541
2542	rtnl_lock();
2543	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2544		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2545			continue;
2546		if (wp_idx < wp_start) {
2547			wp_idx++;
2548			continue;
2549		}
2550		if_idx = 0;
2551
2552		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2553			if (if_idx < if_start) {
2554				if_idx++;
2555				continue;
2556			}
2557			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2558					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2559					       rdev, wdev, false) < 0) {
2560				goto out;
2561			}
2562			if_idx++;
2563		}
2564
2565		wp_idx++;
2566	}
2567 out:
2568	rtnl_unlock();
2569
2570	cb->args[0] = wp_idx;
2571	cb->args[1] = if_idx;
2572
2573	return skb->len;
2574}
2575
2576static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2577{
2578	struct sk_buff *msg;
2579	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2580	struct wireless_dev *wdev = info->user_ptr[1];
2581
2582	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2583	if (!msg)
2584		return -ENOMEM;
2585
2586	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2587			       rdev, wdev, false) < 0) {
2588		nlmsg_free(msg);
2589		return -ENOBUFS;
2590	}
2591
2592	return genlmsg_reply(msg, info);
2593}
2594
2595static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2596	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2597	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2598	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2599	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2600	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2601	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2602};
2603
2604static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2605{
2606	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2607	int flag;
2608
2609	*mntrflags = 0;
2610
2611	if (!nla)
2612		return -EINVAL;
2613
2614	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2615			     nla, mntr_flags_policy))
2616		return -EINVAL;
2617
2618	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2619		if (flags[flag])
2620			*mntrflags |= (1<<flag);
2621
2622	return 0;
2623}
2624
2625static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2626			       struct net_device *netdev, u8 use_4addr,
2627			       enum nl80211_iftype iftype)
2628{
2629	if (!use_4addr) {
2630		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2631			return -EBUSY;
2632		return 0;
2633	}
2634
2635	switch (iftype) {
2636	case NL80211_IFTYPE_AP_VLAN:
2637		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2638			return 0;
2639		break;
2640	case NL80211_IFTYPE_STATION:
2641		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2642			return 0;
2643		break;
2644	default:
2645		break;
2646	}
2647
2648	return -EOPNOTSUPP;
2649}
2650
2651static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2652{
2653	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2654	struct vif_params params;
2655	int err;
2656	enum nl80211_iftype otype, ntype;
2657	struct net_device *dev = info->user_ptr[1];
2658	u32 _flags, *flags = NULL;
2659	bool change = false;
2660
2661	memset(&params, 0, sizeof(params));
2662
2663	otype = ntype = dev->ieee80211_ptr->iftype;
2664
2665	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2666		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2667		if (otype != ntype)
2668			change = true;
2669		if (ntype > NL80211_IFTYPE_MAX)
2670			return -EINVAL;
2671	}
2672
2673	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2674		struct wireless_dev *wdev = dev->ieee80211_ptr;
2675
2676		if (ntype != NL80211_IFTYPE_MESH_POINT)
2677			return -EINVAL;
2678		if (netif_running(dev))
2679			return -EBUSY;
2680
2681		wdev_lock(wdev);
2682		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2683			     IEEE80211_MAX_MESH_ID_LEN);
2684		wdev->mesh_id_up_len =
2685			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2686		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2687		       wdev->mesh_id_up_len);
2688		wdev_unlock(wdev);
2689	}
2690
2691	if (info->attrs[NL80211_ATTR_4ADDR]) {
2692		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2693		change = true;
2694		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2695		if (err)
2696			return err;
2697	} else {
2698		params.use_4addr = -1;
2699	}
2700
2701	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2702		if (ntype != NL80211_IFTYPE_MONITOR)
2703			return -EINVAL;
2704		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2705					  &_flags);
2706		if (err)
2707			return err;
2708
2709		flags = &_flags;
2710		change = true;
2711	}
2712
2713	if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2714	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2715		return -EOPNOTSUPP;
2716
2717	if (change)
2718		err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2719	else
2720		err = 0;
2721
2722	if (!err && params.use_4addr != -1)
2723		dev->ieee80211_ptr->use_4addr = params.use_4addr;
2724
2725	return err;
2726}
2727
2728static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2729{
2730	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2731	struct vif_params params;
2732	struct wireless_dev *wdev;
2733	struct sk_buff *msg, *event;
2734	int err;
2735	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2736	u32 flags;
2737
2738	/* to avoid failing a new interface creation due to pending removal */
2739	cfg80211_destroy_ifaces(rdev);
2740
2741	memset(&params, 0, sizeof(params));
2742
2743	if (!info->attrs[NL80211_ATTR_IFNAME])
2744		return -EINVAL;
2745
2746	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2747		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2748		if (type > NL80211_IFTYPE_MAX)
2749			return -EINVAL;
2750	}
2751
2752	if (!rdev->ops->add_virtual_intf ||
2753	    !(rdev->wiphy.interface_modes & (1 << type)))
2754		return -EOPNOTSUPP;
2755
2756	if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2757	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2758	    info->attrs[NL80211_ATTR_MAC]) {
2759		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2760			   ETH_ALEN);
2761		if (!is_valid_ether_addr(params.macaddr))
2762			return -EADDRNOTAVAIL;
2763	}
2764
2765	if (info->attrs[NL80211_ATTR_4ADDR]) {
2766		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2767		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2768		if (err)
2769			return err;
2770	}
2771
2772	err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2773				  info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2774				  &flags);
2775
2776	if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2777	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2778		return -EOPNOTSUPP;
2779
2780	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2781	if (!msg)
2782		return -ENOMEM;
2783
2784	wdev = rdev_add_virtual_intf(rdev,
2785				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2786				NET_NAME_USER, type, err ? NULL : &flags,
2787				&params);
2788	if (WARN_ON(!wdev)) {
2789		nlmsg_free(msg);
2790		return -EPROTO;
2791	} else if (IS_ERR(wdev)) {
2792		nlmsg_free(msg);
2793		return PTR_ERR(wdev);
2794	}
2795
2796	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2797		wdev->owner_nlportid = info->snd_portid;
2798
2799	switch (type) {
2800	case NL80211_IFTYPE_MESH_POINT:
2801		if (!info->attrs[NL80211_ATTR_MESH_ID])
2802			break;
2803		wdev_lock(wdev);
2804		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2805			     IEEE80211_MAX_MESH_ID_LEN);
2806		wdev->mesh_id_up_len =
2807			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2808		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2809		       wdev->mesh_id_up_len);
2810		wdev_unlock(wdev);
2811		break;
2812	case NL80211_IFTYPE_P2P_DEVICE:
2813		/*
2814		 * P2P Device doesn't have a netdev, so doesn't go
2815		 * through the netdev notifier and must be added here
2816		 */
2817		mutex_init(&wdev->mtx);
2818		INIT_LIST_HEAD(&wdev->event_list);
2819		spin_lock_init(&wdev->event_lock);
2820		INIT_LIST_HEAD(&wdev->mgmt_registrations);
2821		spin_lock_init(&wdev->mgmt_registrations_lock);
2822
2823		wdev->identifier = ++rdev->wdev_id;
2824		list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2825		rdev->devlist_generation++;
2826		break;
2827	default:
2828		break;
2829	}
2830
2831	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2832			       rdev, wdev, false) < 0) {
2833		nlmsg_free(msg);
2834		return -ENOBUFS;
2835	}
2836
2837	event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2838	if (event) {
2839		if (nl80211_send_iface(event, 0, 0, 0,
2840				       rdev, wdev, false) < 0) {
2841			nlmsg_free(event);
2842			goto out;
2843		}
2844
2845		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2846					event, 0, NL80211_MCGRP_CONFIG,
2847					GFP_KERNEL);
2848	}
2849
2850out:
2851	return genlmsg_reply(msg, info);
2852}
2853
2854static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2855{
2856	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2857	struct wireless_dev *wdev = info->user_ptr[1];
2858	struct sk_buff *msg;
2859	int status;
2860
2861	if (!rdev->ops->del_virtual_intf)
2862		return -EOPNOTSUPP;
2863
2864	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2865	if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2866		nlmsg_free(msg);
2867		msg = NULL;
2868	}
2869
2870	/*
2871	 * If we remove a wireless device without a netdev then clear
2872	 * user_ptr[1] so that nl80211_post_doit won't dereference it
2873	 * to check if it needs to do dev_put(). Otherwise it crashes
2874	 * since the wdev has been freed, unlike with a netdev where
2875	 * we need the dev_put() for the netdev to really be freed.
2876	 */
2877	if (!wdev->netdev)
2878		info->user_ptr[1] = NULL;
2879
2880	status = rdev_del_virtual_intf(rdev, wdev);
2881	if (status >= 0 && msg)
2882		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2883					msg, 0, NL80211_MCGRP_CONFIG,
2884					GFP_KERNEL);
2885	else
2886		nlmsg_free(msg);
2887
2888	return status;
2889}
2890
2891static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2892{
2893	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2894	struct net_device *dev = info->user_ptr[1];
2895	u16 noack_map;
2896
2897	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2898		return -EINVAL;
2899
2900	if (!rdev->ops->set_noack_map)
2901		return -EOPNOTSUPP;
2902
2903	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2904
2905	return rdev_set_noack_map(rdev, dev, noack_map);
2906}
2907
2908struct get_key_cookie {
2909	struct sk_buff *msg;
2910	int error;
2911	int idx;
2912};
2913
2914static void get_key_callback(void *c, struct key_params *params)
2915{
2916	struct nlattr *key;
2917	struct get_key_cookie *cookie = c;
2918
2919	if ((params->key &&
2920	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2921		     params->key_len, params->key)) ||
2922	    (params->seq &&
2923	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2924		     params->seq_len, params->seq)) ||
2925	    (params->cipher &&
2926	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2927			 params->cipher)))
2928		goto nla_put_failure;
2929
2930	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2931	if (!key)
2932		goto nla_put_failure;
2933
2934	if ((params->key &&
2935	     nla_put(cookie->msg, NL80211_KEY_DATA,
2936		     params->key_len, params->key)) ||
2937	    (params->seq &&
2938	     nla_put(cookie->msg, NL80211_KEY_SEQ,
2939		     params->seq_len, params->seq)) ||
2940	    (params->cipher &&
2941	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2942			 params->cipher)))
2943		goto nla_put_failure;
2944
2945	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2946		goto nla_put_failure;
2947
2948	nla_nest_end(cookie->msg, key);
2949
2950	return;
2951 nla_put_failure:
2952	cookie->error = 1;
2953}
2954
2955static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2956{
2957	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2958	int err;
2959	struct net_device *dev = info->user_ptr[1];
2960	u8 key_idx = 0;
2961	const u8 *mac_addr = NULL;
2962	bool pairwise;
2963	struct get_key_cookie cookie = {
2964		.error = 0,
2965	};
2966	void *hdr;
2967	struct sk_buff *msg;
2968
2969	if (info->attrs[NL80211_ATTR_KEY_IDX])
2970		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2971
2972	if (key_idx > 5)
2973		return -EINVAL;
2974
2975	if (info->attrs[NL80211_ATTR_MAC])
2976		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2977
2978	pairwise = !!mac_addr;
2979	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2980		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2981		if (kt >= NUM_NL80211_KEYTYPES)
2982			return -EINVAL;
2983		if (kt != NL80211_KEYTYPE_GROUP &&
2984		    kt != NL80211_KEYTYPE_PAIRWISE)
2985			return -EINVAL;
2986		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2987	}
2988
2989	if (!rdev->ops->get_key)
2990		return -EOPNOTSUPP;
2991
2992	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2993		return -ENOENT;
2994
2995	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2996	if (!msg)
2997		return -ENOMEM;
2998
2999	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3000			     NL80211_CMD_NEW_KEY);
3001	if (!hdr)
3002		goto nla_put_failure;
3003
3004	cookie.msg = msg;
3005	cookie.idx = key_idx;
3006
3007	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3008	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3009		goto nla_put_failure;
3010	if (mac_addr &&
3011	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3012		goto nla_put_failure;
3013
3014	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3015			   get_key_callback);
3016
3017	if (err)
3018		goto free_msg;
3019
3020	if (cookie.error)
3021		goto nla_put_failure;
3022
3023	genlmsg_end(msg, hdr);
3024	return genlmsg_reply(msg, info);
3025
3026 nla_put_failure:
3027	err = -ENOBUFS;
3028 free_msg:
3029	nlmsg_free(msg);
3030	return err;
3031}
3032
3033static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3034{
3035	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3036	struct key_parse key;
3037	int err;
3038	struct net_device *dev = info->user_ptr[1];
3039
3040	err = nl80211_parse_key(info, &key);
3041	if (err)
3042		return err;
3043
3044	if (key.idx < 0)
3045		return -EINVAL;
3046
3047	/* only support setting default key */
3048	if (!key.def && !key.defmgmt)
3049		return -EINVAL;
3050
3051	wdev_lock(dev->ieee80211_ptr);
3052
3053	if (key.def) {
3054		if (!rdev->ops->set_default_key) {
3055			err = -EOPNOTSUPP;
3056			goto out;
3057		}
3058
3059		err = nl80211_key_allowed(dev->ieee80211_ptr);
3060		if (err)
3061			goto out;
3062
3063		err = rdev_set_default_key(rdev, dev, key.idx,
3064						 key.def_uni, key.def_multi);
3065
3066		if (err)
3067			goto out;
3068
3069#ifdef CONFIG_CFG80211_WEXT
3070		dev->ieee80211_ptr->wext.default_key = key.idx;
3071#endif
3072	} else {
3073		if (key.def_uni || !key.def_multi) {
3074			err = -EINVAL;
3075			goto out;
3076		}
3077
3078		if (!rdev->ops->set_default_mgmt_key) {
3079			err = -EOPNOTSUPP;
3080			goto out;
3081		}
3082
3083		err = nl80211_key_allowed(dev->ieee80211_ptr);
3084		if (err)
3085			goto out;
3086
3087		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3088		if (err)
3089			goto out;
3090
3091#ifdef CONFIG_CFG80211_WEXT
3092		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3093#endif
3094	}
3095
3096 out:
3097	wdev_unlock(dev->ieee80211_ptr);
3098
3099	return err;
3100}
3101
3102static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3103{
3104	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3105	int err;
3106	struct net_device *dev = info->user_ptr[1];
3107	struct key_parse key;
3108	const u8 *mac_addr = NULL;
3109
3110	err = nl80211_parse_key(info, &key);
3111	if (err)
3112		return err;
3113
3114	if (!key.p.key)
3115		return -EINVAL;
3116
3117	if (info->attrs[NL80211_ATTR_MAC])
3118		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3119
3120	if (key.type == -1) {
3121		if (mac_addr)
3122			key.type = NL80211_KEYTYPE_PAIRWISE;
3123		else
3124			key.type = NL80211_KEYTYPE_GROUP;
3125	}
3126
3127	/* for now */
3128	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3129	    key.type != NL80211_KEYTYPE_GROUP)
3130		return -EINVAL;
3131
3132	if (!rdev->ops->add_key)
3133		return -EOPNOTSUPP;
3134
3135	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3136					   key.type == NL80211_KEYTYPE_PAIRWISE,
3137					   mac_addr))
3138		return -EINVAL;
3139
3140	wdev_lock(dev->ieee80211_ptr);
3141	err = nl80211_key_allowed(dev->ieee80211_ptr);
3142	if (!err)
3143		err = rdev_add_key(rdev, dev, key.idx,
3144				   key.type == NL80211_KEYTYPE_PAIRWISE,
3145				    mac_addr, &key.p);
3146	wdev_unlock(dev->ieee80211_ptr);
3147
3148	return err;
3149}
3150
3151static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3152{
3153	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3154	int err;
3155	struct net_device *dev = info->user_ptr[1];
3156	u8 *mac_addr = NULL;
3157	struct key_parse key;
3158
3159	err = nl80211_parse_key(info, &key);
3160	if (err)
3161		return err;
3162
3163	if (info->attrs[NL80211_ATTR_MAC])
3164		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3165
3166	if (key.type == -1) {
3167		if (mac_addr)
3168			key.type = NL80211_KEYTYPE_PAIRWISE;
3169		else
3170			key.type = NL80211_KEYTYPE_GROUP;
3171	}
3172
3173	/* for now */
3174	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3175	    key.type != NL80211_KEYTYPE_GROUP)
3176		return -EINVAL;
3177
3178	if (!rdev->ops->del_key)
3179		return -EOPNOTSUPP;
3180
3181	wdev_lock(dev->ieee80211_ptr);
3182	err = nl80211_key_allowed(dev->ieee80211_ptr);
3183
3184	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3185	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3186		err = -ENOENT;
3187
3188	if (!err)
3189		err = rdev_del_key(rdev, dev, key.idx,
3190				   key.type == NL80211_KEYTYPE_PAIRWISE,
3191				   mac_addr);
3192
3193#ifdef CONFIG_CFG80211_WEXT
3194	if (!err) {
3195		if (key.idx == dev->ieee80211_ptr->wext.default_key)
3196			dev->ieee80211_ptr->wext.default_key = -1;
3197		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3198			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3199	}
3200#endif
3201	wdev_unlock(dev->ieee80211_ptr);
3202
3203	return err;
3204}
3205
3206/* This function returns an error or the number of nested attributes */
3207static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3208{
3209	struct nlattr *attr;
3210	int n_entries = 0, tmp;
3211
3212	nla_for_each_nested(attr, nl_attr, tmp) {
3213		if (nla_len(attr) != ETH_ALEN)
3214			return -EINVAL;
3215
3216		n_entries++;
3217	}
3218
3219	return n_entries;
3220}
3221
3222/*
3223 * This function parses ACL information and allocates memory for ACL data.
3224 * On successful return, the calling function is responsible to free the
3225 * ACL buffer returned by this function.
3226 */
3227static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3228						struct genl_info *info)
3229{
3230	enum nl80211_acl_policy acl_policy;
3231	struct nlattr *attr;
3232	struct cfg80211_acl_data *acl;
3233	int i = 0, n_entries, tmp;
3234
3235	if (!wiphy->max_acl_mac_addrs)
3236		return ERR_PTR(-EOPNOTSUPP);
3237
3238	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3239		return ERR_PTR(-EINVAL);
3240
3241	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3242	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3243	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3244		return ERR_PTR(-EINVAL);
3245
3246	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3247		return ERR_PTR(-EINVAL);
3248
3249	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3250	if (n_entries < 0)
3251		return ERR_PTR(n_entries);
3252
3253	if (n_entries > wiphy->max_acl_mac_addrs)
3254		return ERR_PTR(-ENOTSUPP);
3255
3256	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3257		      GFP_KERNEL);
3258	if (!acl)
3259		return ERR_PTR(-ENOMEM);
3260
3261	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3262		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3263		i++;
3264	}
3265
3266	acl->n_acl_entries = n_entries;
3267	acl->acl_policy = acl_policy;
3268
3269	return acl;
3270}
3271
3272static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3273{
3274	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3275	struct net_device *dev = info->user_ptr[1];
3276	struct cfg80211_acl_data *acl;
3277	int err;
3278
3279	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3280	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3281		return -EOPNOTSUPP;
3282
3283	if (!dev->ieee80211_ptr->beacon_interval)
3284		return -EINVAL;
3285
3286	acl = parse_acl_data(&rdev->wiphy, info);
3287	if (IS_ERR(acl))
3288		return PTR_ERR(acl);
3289
3290	err = rdev_set_mac_acl(rdev, dev, acl);
3291
3292	kfree(acl);
3293
3294	return err;
3295}
3296
3297static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3298			   u8 *rates, u8 rates_len)
3299{
3300	u8 i;
3301	u32 mask = 0;
3302
3303	for (i = 0; i < rates_len; i++) {
3304		int rate = (rates[i] & 0x7f) * 5;
3305		int ridx;
3306
3307		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3308			struct ieee80211_rate *srate =
3309				&sband->bitrates[ridx];
3310			if (rate == srate->bitrate) {
3311				mask |= 1 << ridx;
3312				break;
3313			}
3314		}
3315		if (ridx == sband->n_bitrates)
3316			return 0; /* rate not found */
3317	}
3318
3319	return mask;
3320}
3321
3322static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3323			       u8 *rates, u8 rates_len,
3324			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3325{
3326	u8 i;
3327
3328	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3329
3330	for (i = 0; i < rates_len; i++) {
3331		int ridx, rbit;
3332
3333		ridx = rates[i] / 8;
3334		rbit = BIT(rates[i] % 8);
3335
3336		/* check validity */
3337		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3338			return false;
3339
3340		/* check availability */
3341		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3342			mcs[ridx] |= rbit;
3343		else
3344			return false;
3345	}
3346
3347	return true;
3348}
3349
3350static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3351{
3352	u16 mcs_mask = 0;
3353
3354	switch (vht_mcs_map) {
3355	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3356		break;
3357	case IEEE80211_VHT_MCS_SUPPORT_0_7:
3358		mcs_mask = 0x00FF;
3359		break;
3360	case IEEE80211_VHT_MCS_SUPPORT_0_8:
3361		mcs_mask = 0x01FF;
3362		break;
3363	case IEEE80211_VHT_MCS_SUPPORT_0_9:
3364		mcs_mask = 0x03FF;
3365		break;
3366	default:
3367		break;
3368	}
3369
3370	return mcs_mask;
3371}
3372
3373static void vht_build_mcs_mask(u16 vht_mcs_map,
3374			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3375{
3376	u8 nss;
3377
3378	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3379		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3380		vht_mcs_map >>= 2;
3381	}
3382}
3383
3384static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3385			     struct nl80211_txrate_vht *txrate,
3386			     u16 mcs[NL80211_VHT_NSS_MAX])
3387{
3388	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3389	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3390	u8 i;
3391
3392	if (!sband->vht_cap.vht_supported)
3393		return false;
3394
3395	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3396
3397	/* Build vht_mcs_mask from VHT capabilities */
3398	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3399
3400	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3401		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3402			mcs[i] = txrate->mcs[i];
3403		else
3404			return false;
3405	}
3406
3407	return true;
3408}
3409
3410static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3411	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3412				    .len = NL80211_MAX_SUPP_RATES },
3413	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3414				.len = NL80211_MAX_SUPP_HT_RATES },
3415	[NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3416	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
3417};
3418
3419static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3420					 struct cfg80211_bitrate_mask *mask)
3421{
3422	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3423	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3424	int rem, i;
3425	struct nlattr *tx_rates;
3426	struct ieee80211_supported_band *sband;
3427	u16 vht_tx_mcs_map;
3428
3429	memset(mask, 0, sizeof(*mask));
3430	/* Default to all rates enabled */
3431	for (i = 0; i < NUM_NL80211_BANDS; i++) {
3432		sband = rdev->wiphy.bands[i];
3433
3434		if (!sband)
3435			continue;
3436
3437		mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3438		memcpy(mask->control[i].ht_mcs,
3439		       sband->ht_cap.mcs.rx_mask,
3440		       sizeof(mask->control[i].ht_mcs));
3441
3442		if (!sband->vht_cap.vht_supported)
3443			continue;
3444
3445		vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3446		vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3447	}
3448
3449	/* if no rates are given set it back to the defaults */
3450	if (!info->attrs[NL80211_ATTR_TX_RATES])
3451		goto out;
3452
3453	/* The nested attribute uses enum nl80211_band as the index. This maps
3454	 * directly to the enum nl80211_band values used in cfg80211.
3455	 */
3456	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3457	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3458		enum nl80211_band band = nla_type(tx_rates);
3459		int err;
3460
3461		if (band < 0 || band >= NUM_NL80211_BANDS)
3462			return -EINVAL;
3463		sband = rdev->wiphy.bands[band];
3464		if (sband == NULL)
3465			return -EINVAL;
3466		err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
3467				nla_len(tx_rates), nl80211_txattr_policy);
3468		if (err)
3469			return err;
3470		if (tb[NL80211_TXRATE_LEGACY]) {
3471			mask->control[band].legacy = rateset_to_mask(
3472				sband,
3473				nla_data(tb[NL80211_TXRATE_LEGACY]),
3474				nla_len(tb[NL80211_TXRATE_LEGACY]));
3475			if ((mask->control[band].legacy == 0) &&
3476			    nla_len(tb[NL80211_TXRATE_LEGACY]))
3477				return -EINVAL;
3478		}
3479		if (tb[NL80211_TXRATE_HT]) {
3480			if (!ht_rateset_to_mask(
3481					sband,
3482					nla_data(tb[NL80211_TXRATE_HT]),
3483					nla_len(tb[NL80211_TXRATE_HT]),
3484					mask->control[band].ht_mcs))
3485				return -EINVAL;
3486		}
3487		if (tb[NL80211_TXRATE_VHT]) {
3488			if (!vht_set_mcs_mask(
3489					sband,
3490					nla_data(tb[NL80211_TXRATE_VHT]),
3491					mask->control[band].vht_mcs))
3492				return -EINVAL;
3493		}
3494		if (tb[NL80211_TXRATE_GI]) {
3495			mask->control[band].gi =
3496				nla_get_u8(tb[NL80211_TXRATE_GI]);
3497			if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3498				return -EINVAL;
3499		}
3500
3501		if (mask->control[band].legacy == 0) {
3502			/* don't allow empty legacy rates if HT or VHT
3503			 * are not even supported.
3504			 */
3505			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3506			      rdev->wiphy.bands[band]->vht_cap.vht_supported))
3507				return -EINVAL;
3508
3509			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3510				if (mask->control[band].ht_mcs[i])
3511					goto out;
3512
3513			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3514				if (mask->control[band].vht_mcs[i])
3515					goto out;
3516
3517			/* legacy and mcs rates may not be both empty */
3518			return -EINVAL;
3519		}
3520	}
3521
3522out:
3523	return 0;
3524}
3525
3526static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3527				   enum nl80211_band band,
3528				   struct cfg80211_bitrate_mask *beacon_rate)
3529{
3530	u32 count_ht, count_vht, i;
3531	u32 rate = beacon_rate->control[band].legacy;
3532
3533	/* Allow only one rate */
3534	if (hweight32(rate) > 1)
3535		return -EINVAL;
3536
3537	count_ht = 0;
3538	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3539		if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3540			return -EINVAL;
3541		} else if (beacon_rate->control[band].ht_mcs[i]) {
3542			count_ht++;
3543			if (count_ht > 1)
3544				return -EINVAL;
3545		}
3546		if (count_ht && rate)
3547			return -EINVAL;
3548	}
3549
3550	count_vht = 0;
3551	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3552		if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3553			return -EINVAL;
3554		} else if (beacon_rate->control[band].vht_mcs[i]) {
3555			count_vht++;
3556			if (count_vht > 1)
3557				return -EINVAL;
3558		}
3559		if (count_vht && rate)
3560			return -EINVAL;
3561	}
3562
3563	if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3564		return -EINVAL;
3565
3566	if (rate &&
3567	    !wiphy_ext_feature_isset(&rdev->wiphy,
3568				     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3569		return -EINVAL;
3570	if (count_ht &&
3571	    !wiphy_ext_feature_isset(&rdev->wiphy,
3572				     NL80211_EXT_FEATURE_BEACON_RATE_HT))
3573		return -EINVAL;
3574	if (count_vht &&
3575	    !wiphy_ext_feature_isset(&rdev->wiphy,
3576				     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3577		return -EINVAL;
3578
3579	return 0;
3580}
3581
3582static int nl80211_parse_beacon(struct nlattr *attrs[],
3583				struct cfg80211_beacon_data *bcn)
3584{
3585	bool haveinfo = false;
3586
3587	if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3588	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3589	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3590	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3591		return -EINVAL;
3592
3593	memset(bcn, 0, sizeof(*bcn));
3594
3595	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3596		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3597		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3598		if (!bcn->head_len)
3599			return -EINVAL;
3600		haveinfo = true;
3601	}
3602
3603	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3604		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3605		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3606		haveinfo = true;
3607	}
3608
3609	if (!haveinfo)
3610		return -EINVAL;
3611
3612	if (attrs[NL80211_ATTR_IE]) {
3613		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3614		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3615	}
3616
3617	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3618		bcn->proberesp_ies =
3619			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3620		bcn->proberesp_ies_len =
3621			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3622	}
3623
3624	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3625		bcn->assocresp_ies =
3626			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3627		bcn->assocresp_ies_len =
3628			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3629	}
3630
3631	if (attrs[NL80211_ATTR_PROBE_RESP]) {
3632		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3633		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3634	}
3635
3636	return 0;
3637}
3638
3639static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3640				   struct cfg80211_ap_settings *params)
3641{
3642	struct wireless_dev *wdev;
3643	bool ret = false;
3644
3645	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3646		if (wdev->iftype != NL80211_IFTYPE_AP &&
3647		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
3648			continue;
3649
3650		if (!wdev->preset_chandef.chan)
3651			continue;
3652
3653		params->chandef = wdev->preset_chandef;
3654		ret = true;
3655		break;
3656	}
3657
3658	return ret;
3659}
3660
3661static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3662				    enum nl80211_auth_type auth_type,
3663				    enum nl80211_commands cmd)
3664{
3665	if (auth_type > NL80211_AUTHTYPE_MAX)
3666		return false;
3667
3668	switch (cmd) {
3669	case NL80211_CMD_AUTHENTICATE:
3670		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3671		    auth_type == NL80211_AUTHTYPE_SAE)
3672			return false;
3673		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3674					     NL80211_EXT_FEATURE_FILS_STA) &&
3675		    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3676		     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3677		     auth_type == NL80211_AUTHTYPE_FILS_PK))
3678			return false;
3679		return true;
3680	case NL80211_CMD_CONNECT:
3681		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3682		    auth_type == NL80211_AUTHTYPE_SAE)
3683			return false;
3684		/* FILS with SK PFS or PK not supported yet */
3685		if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3686		    auth_type == NL80211_AUTHTYPE_FILS_PK)
3687			return false;
3688		if (!wiphy_ext_feature_isset(
3689			    &rdev->wiphy,
3690			    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3691		    auth_type == NL80211_AUTHTYPE_FILS_SK)
3692			return false;
3693		return true;
3694	case NL80211_CMD_START_AP:
3695		/* SAE not supported yet */
3696		if (auth_type == NL80211_AUTHTYPE_SAE)
3697			return false;
3698		/* FILS not supported yet */
3699		if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3700		    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3701		    auth_type == NL80211_AUTHTYPE_FILS_PK)
3702			return false;
3703		return true;
3704	default:
3705		return false;
3706	}
3707}
3708
3709static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3710{
3711	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3712	struct net_device *dev = info->user_ptr[1];
3713	struct wireless_dev *wdev = dev->ieee80211_ptr;
3714	struct cfg80211_ap_settings params;
3715	int err;
3716
3717	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3718	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3719		return -EOPNOTSUPP;
3720
3721	if (!rdev->ops->start_ap)
3722		return -EOPNOTSUPP;
3723
3724	if (wdev->beacon_interval)
3725		return -EALREADY;
3726
3727	memset(&params, 0, sizeof(params));
3728
3729	/* these are required for START_AP */
3730	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3731	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3732	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
3733		return -EINVAL;
3734
3735	err = nl80211_parse_beacon(info->attrs, &params.beacon);
3736	if (err)
3737		return err;
3738
3739	params.beacon_interval =
3740		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3741	params.dtim_period =
3742		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3743
3744	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3745					   params.beacon_interval);
3746	if (err)
3747		return err;
3748
3749	/*
3750	 * In theory, some of these attributes should be required here
3751	 * but since they were not used when the command was originally
3752	 * added, keep them optional for old user space programs to let
3753	 * them continue to work with drivers that do not need the
3754	 * additional information -- drivers must check!
3755	 */
3756	if (info->attrs[NL80211_ATTR_SSID]) {
3757		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3758		params.ssid_len =
3759			nla_len(info->attrs[NL80211_ATTR_SSID]);
3760		if (params.ssid_len == 0 ||
3761		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
3762			return -EINVAL;
3763	}
3764
3765	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3766		params.hidden_ssid = nla_get_u32(
3767			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3768		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3769		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3770		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3771			return -EINVAL;
3772	}
3773
3774	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3775
3776	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3777		params.auth_type = nla_get_u32(
3778			info->attrs[NL80211_ATTR_AUTH_TYPE]);
3779		if (!nl80211_valid_auth_type(rdev, params.auth_type,
3780					     NL80211_CMD_START_AP))
3781			return -EINVAL;
3782	} else
3783		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3784
3785	err = nl80211_crypto_settings(rdev, info, &params.crypto,
3786				      NL80211_MAX_NR_CIPHER_SUITES);
3787	if (err)
3788		return err;
3789
3790	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3791		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3792			return -EOPNOTSUPP;
3793		params.inactivity_timeout = nla_get_u16(
3794			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3795	}
3796
3797	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3798		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3799			return -EINVAL;
3800		params.p2p_ctwindow =
3801			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3802		if (params.p2p_ctwindow > 127)
3803			return -EINVAL;
3804		if (params.p2p_ctwindow != 0 &&
3805		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3806			return -EINVAL;
3807	}
3808
3809	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3810		u8 tmp;
3811
3812		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3813			return -EINVAL;
3814		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3815		if (tmp > 1)
3816			return -EINVAL;
3817		params.p2p_opp_ps = tmp;
3818		if (params.p2p_opp_ps != 0 &&
3819		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3820			return -EINVAL;
3821	}
3822
3823	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3824		err = nl80211_parse_chandef(rdev, info, &params.chandef);
3825		if (err)
3826			return err;
3827	} else if (wdev->preset_chandef.chan) {
3828		params.chandef = wdev->preset_chandef;
3829	} else if (!nl80211_get_ap_channel(rdev, &params))
3830		return -EINVAL;
3831
3832	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
3833					   wdev->iftype))
3834		return -EINVAL;
3835
3836	if (info->attrs[NL80211_ATTR_TX_RATES]) {
3837		err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
3838		if (err)
3839			return err;
3840
3841		err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
3842					      &params.beacon_rate);
3843		if (err)
3844			return err;
3845	}
3846
3847	if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
3848		params.smps_mode =
3849			nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
3850		switch (params.smps_mode) {
3851		case NL80211_SMPS_OFF:
3852			break;
3853		case NL80211_SMPS_STATIC:
3854			if (!(rdev->wiphy.features &
3855			      NL80211_FEATURE_STATIC_SMPS))
3856				return -EINVAL;
3857			break;
3858		case NL80211_SMPS_DYNAMIC:
3859			if (!(rdev->wiphy.features &
3860			      NL80211_FEATURE_DYNAMIC_SMPS))
3861				return -EINVAL;
3862			break;
3863		default:
3864			return -EINVAL;
3865		}
3866	} else {
3867		params.smps_mode = NL80211_SMPS_OFF;
3868	}
3869
3870	params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
3871	if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
3872		return -EOPNOTSUPP;
3873
3874	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3875		params.acl = parse_acl_data(&rdev->wiphy, info);
3876		if (IS_ERR(params.acl))
3877			return PTR_ERR(params.acl);
3878	}
3879
3880	if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
3881		params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
3882
3883	wdev_lock(wdev);
3884	err = rdev_start_ap(rdev, dev, &params);
3885	if (!err) {
3886		wdev->preset_chandef = params.chandef;
3887		wdev->beacon_interval = params.beacon_interval;
3888		wdev->chandef = params.chandef;
3889		wdev->ssid_len = params.ssid_len;
3890		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3891	}
3892	wdev_unlock(wdev);
3893
3894	kfree(params.acl);
3895
3896	return err;
3897}
3898
3899static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3900{
3901	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3902	struct net_device *dev = info->user_ptr[1];
3903	struct wireless_dev *wdev = dev->ieee80211_ptr;
3904	struct cfg80211_beacon_data params;
3905	int err;
3906
3907	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3908	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3909		return -EOPNOTSUPP;
3910
3911	if (!rdev->ops->change_beacon)
3912		return -EOPNOTSUPP;
3913
3914	if (!wdev->beacon_interval)
3915		return -EINVAL;
3916
3917	err = nl80211_parse_beacon(info->attrs, &params);
3918	if (err)
3919		return err;
3920
3921	wdev_lock(wdev);
3922	err = rdev_change_beacon(rdev, dev, &params);
3923	wdev_unlock(wdev);
3924
3925	return err;
3926}
3927
3928static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3929{
3930	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3931	struct net_device *dev = info->user_ptr[1];
3932
3933	return cfg80211_stop_ap(rdev, dev, false);
3934}
3935
3936static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3937	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3938	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3939	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3940	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3941	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3942	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3943};
3944
3945static int parse_station_flags(struct genl_info *info,
3946			       enum nl80211_iftype iftype,
3947			       struct station_parameters *params)
3948{
3949	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3950	struct nlattr *nla;
3951	int flag;
3952
3953	/*
3954	 * Try parsing the new attribute first so userspace
3955	 * can specify both for older kernels.
3956	 */
3957	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3958	if (nla) {
3959		struct nl80211_sta_flag_update *sta_flags;
3960
3961		sta_flags = nla_data(nla);
3962		params->sta_flags_mask = sta_flags->mask;
3963		params->sta_flags_set = sta_flags->set;
3964		params->sta_flags_set &= params->sta_flags_mask;
3965		if ((params->sta_flags_mask |
3966		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3967			return -EINVAL;
3968		return 0;
3969	}
3970
3971	/* if present, parse the old attribute */
3972
3973	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3974	if (!nla)
3975		return 0;
3976
3977	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3978			     nla, sta_flags_policy))
3979		return -EINVAL;
3980
3981	/*
3982	 * Only allow certain flags for interface types so that
3983	 * other attributes are silently ignored. Remember that
3984	 * this is backward compatibility code with old userspace
3985	 * and shouldn't be hit in other cases anyway.
3986	 */
3987	switch (iftype) {
3988	case NL80211_IFTYPE_AP:
3989	case NL80211_IFTYPE_AP_VLAN:
3990	case NL80211_IFTYPE_P2P_GO:
3991		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3992					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3993					 BIT(NL80211_STA_FLAG_WME) |
3994					 BIT(NL80211_STA_FLAG_MFP);
3995		break;
3996	case NL80211_IFTYPE_P2P_CLIENT:
3997	case NL80211_IFTYPE_STATION:
3998		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3999					 BIT(NL80211_STA_FLAG_TDLS_PEER);
4000		break;
4001	case NL80211_IFTYPE_MESH_POINT:
4002		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4003					 BIT(NL80211_STA_FLAG_MFP) |
4004					 BIT(NL80211_STA_FLAG_AUTHORIZED);
4005		break;
4006	default:
4007		return -EINVAL;
4008	}
4009
4010	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4011		if (flags[flag]) {
4012			params->sta_flags_set |= (1<<flag);
4013
4014			/* no longer support new API additions in old API */
4015			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4016				return -EINVAL;
4017		}
4018	}
4019
4020	return 0;
4021}
4022
4023static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4024				 int attr)
4025{
4026	struct nlattr *rate;
4027	u32 bitrate;
4028	u16 bitrate_compat;
4029	enum nl80211_rate_info rate_flg;
4030
4031	rate = nla_nest_start(msg, attr);
4032	if (!rate)
4033		return false;
4034
4035	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4036	bitrate = cfg80211_calculate_bitrate(info);
4037	/* report 16-bit bitrate only if we can */
4038	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4039	if (bitrate > 0 &&
4040	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4041		return false;
4042	if (bitrate_compat > 0 &&
4043	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4044		return false;
4045
4046	switch (info->bw) {
4047	case RATE_INFO_BW_5:
4048		rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4049		break;
4050	case RATE_INFO_BW_10:
4051		rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4052		break;
4053	default:
4054		WARN_ON(1);
4055		/* fall through */
4056	case RATE_INFO_BW_20:
4057		rate_flg = 0;
4058		break;
4059	case RATE_INFO_BW_40:
4060		rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4061		break;
4062	case RATE_INFO_BW_80:
4063		rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4064		break;
4065	case RATE_INFO_BW_160:
4066		rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4067		break;
4068	}
4069
4070	if (rate_flg && nla_put_flag(msg, rate_flg))
4071		return false;
4072
4073	if (info->flags & RATE_INFO_FLAGS_MCS) {
4074		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4075			return false;
4076		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4077		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4078			return false;
4079	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4080		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4081			return false;
4082		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4083			return false;
4084		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4085		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4086			return false;
4087	}
4088
4089	nla_nest_end(msg, rate);
4090	return true;
4091}
4092
4093static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4094			       int id)
4095{
4096	void *attr;
4097	int i = 0;
4098
4099	if (!mask)
4100		return true;
4101
4102	attr = nla_nest_start(msg, id);
4103	if (!attr)
4104		return false;
4105
4106	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4107		if (!(mask & BIT(i)))
4108			continue;
4109
4110		if (nla_put_u8(msg, i, signal[i]))
4111			return false;
4112	}
4113
4114	nla_nest_end(msg, attr);
4115
4116	return true;
4117}
4118
4119static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4120				u32 seq, int flags,
4121				struct cfg80211_registered_device *rdev,
4122				struct net_device *dev,
4123				const u8 *mac_addr, struct station_info *sinfo)
4124{
4125	void *hdr;
4126	struct nlattr *sinfoattr, *bss_param;
4127
4128	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4129	if (!hdr)
4130		return -1;
4131
4132	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4133	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4134	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4135		goto nla_put_failure;
4136
4137	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4138	if (!sinfoattr)
4139		goto nla_put_failure;
4140
4141#define PUT_SINFO(attr, memb, type) do {				\
4142	if (sinfo->filled & BIT(NL80211_STA_INFO_ ## attr) &&		\
4143	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
4144			     sinfo->memb))				\
4145		goto nla_put_failure;					\
4146	} while (0)
4147
4148	PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4149	PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4150
4151	if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4152			     BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4153	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4154			(u32)sinfo->rx_bytes))
4155		goto nla_put_failure;
4156
4157	if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4158			     BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4159	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4160			(u32)sinfo->tx_bytes))
4161		goto nla_put_failure;
4162
4163	PUT_SINFO(RX_BYTES64, rx_bytes, u64);
4164	PUT_SINFO(TX_BYTES64, tx_bytes, u64);
4165	PUT_SINFO(LLID, llid, u16);
4166	PUT_SINFO(PLID, plid, u16);
4167	PUT_SINFO(PLINK_STATE, plink_state, u8);
4168
4169	switch (rdev->wiphy.signal_type) {
4170	case CFG80211_SIGNAL_TYPE_MBM:
4171		PUT_SINFO(SIGNAL, signal, u8);
4172		PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4173		break;
4174	default:
4175		break;
4176	}
4177	if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4178		if (!nl80211_put_signal(msg, sinfo->chains,
4179					sinfo->chain_signal,
4180					NL80211_STA_INFO_CHAIN_SIGNAL))
4181			goto nla_put_failure;
4182	}
4183	if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4184		if (!nl80211_put_signal(msg, sinfo->chains,
4185					sinfo->chain_signal_avg,
4186					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4187			goto nla_put_failure;
4188	}
4189	if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4190		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4191					  NL80211_STA_INFO_TX_BITRATE))
4192			goto nla_put_failure;
4193	}
4194	if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4195		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4196					  NL80211_STA_INFO_RX_BITRATE))
4197			goto nla_put_failure;
4198	}
4199
4200	PUT_SINFO(RX_PACKETS, rx_packets, u32);
4201	PUT_SINFO(TX_PACKETS, tx_packets, u32);
4202	PUT_SINFO(TX_RETRIES, tx_retries, u32);
4203	PUT_SINFO(TX_FAILED, tx_failed, u32);
4204	PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4205	PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4206	PUT_SINFO(LOCAL_PM, local_pm, u32);
4207	PUT_SINFO(PEER_PM, peer_pm, u32);
4208	PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4209
4210	if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4211		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4212		if (!bss_param)
4213			goto nla_put_failure;
4214
4215		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4216		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4217		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4218		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4219		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4220		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4221		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4222			       sinfo->bss_param.dtim_period) ||
4223		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4224				sinfo->bss_param.beacon_interval))
4225			goto nla_put_failure;
4226
4227		nla_nest_end(msg, bss_param);
4228	}
4229	if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4230	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4231		    sizeof(struct nl80211_sta_flag_update),
4232		    &sinfo->sta_flags))
4233		goto nla_put_failure;
4234
4235	PUT_SINFO(T_OFFSET, t_offset, u64);
4236	PUT_SINFO(RX_DROP_MISC, rx_dropped_misc, u64);
4237	PUT_SINFO(BEACON_RX, rx_beacon, u64);
4238	PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4239
4240#undef PUT_SINFO
4241
4242	if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4243		struct nlattr *tidsattr;
4244		int tid;
4245
4246		tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4247		if (!tidsattr)
4248			goto nla_put_failure;
4249
4250		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4251			struct cfg80211_tid_stats *tidstats;
4252			struct nlattr *tidattr;
4253
4254			tidstats = &sinfo->pertid[tid];
4255
4256			if (!tidstats->filled)
4257				continue;
4258
4259			tidattr = nla_nest_start(msg, tid + 1);
4260			if (!tidattr)
4261				goto nla_put_failure;
4262
4263#define PUT_TIDVAL(attr, memb, type) do {				\
4264	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
4265	    nla_put_ ## type(msg, NL80211_TID_STATS_ ## attr,		\
4266			     tidstats->memb))				\
4267		goto nla_put_failure;					\
4268	} while (0)
4269
4270			PUT_TIDVAL(RX_MSDU, rx_msdu, u64);
4271			PUT_TIDVAL(TX_MSDU, tx_msdu, u64);
4272			PUT_TIDVAL(TX_MSDU_RETRIES, tx_msdu_retries, u64);
4273			PUT_TIDVAL(TX_MSDU_FAILED, tx_msdu_failed, u64);
4274
4275#undef PUT_TIDVAL
4276			nla_nest_end(msg, tidattr);
4277		}
4278
4279		nla_nest_end(msg, tidsattr);
4280	}
4281
4282	nla_nest_end(msg, sinfoattr);
4283
4284	if (sinfo->assoc_req_ies_len &&
4285	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4286		    sinfo->assoc_req_ies))
4287		goto nla_put_failure;
4288
4289	genlmsg_end(msg, hdr);
4290	return 0;
4291
4292 nla_put_failure:
4293	genlmsg_cancel(msg, hdr);
4294	return -EMSGSIZE;
4295}
4296
4297static int nl80211_dump_station(struct sk_buff *skb,
4298				struct netlink_callback *cb)
4299{
4300	struct station_info sinfo;
4301	struct cfg80211_registered_device *rdev;
4302	struct wireless_dev *wdev;
4303	u8 mac_addr[ETH_ALEN];
4304	int sta_idx = cb->args[2];
4305	int err;
4306
4307	rtnl_lock();
4308	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4309	if (err)
4310		goto out_err;
4311
4312	if (!wdev->netdev) {
4313		err = -EINVAL;
4314		goto out_err;
4315	}
4316
4317	if (!rdev->ops->dump_station) {
4318		err = -EOPNOTSUPP;
4319		goto out_err;
4320	}
4321
4322	while (1) {
4323		memset(&sinfo, 0, sizeof(sinfo));
4324		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4325					mac_addr, &sinfo);
4326		if (err == -ENOENT)
4327			break;
4328		if (err)
4329			goto out_err;
4330
4331		if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4332				NETLINK_CB(cb->skb).portid,
4333				cb->nlh->nlmsg_seq, NLM_F_MULTI,
4334				rdev, wdev->netdev, mac_addr,
4335				&sinfo) < 0)
4336			goto out;
4337
4338		sta_idx++;
4339	}
4340
4341
4342 out:
4343	cb->args[2] = sta_idx;
4344	err = skb->len;
4345 out_err:
4346	rtnl_unlock();
4347
4348	return err;
4349}
4350
4351static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4352{
4353	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4354	struct net_device *dev = info->user_ptr[1];
4355	struct station_info sinfo;
4356	struct sk_buff *msg;
4357	u8 *mac_addr = NULL;
4358	int err;
4359
4360	memset(&sinfo, 0, sizeof(sinfo));
4361
4362	if (!info->attrs[NL80211_ATTR_MAC])
4363		return -EINVAL;
4364
4365	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4366
4367	if (!rdev->ops->get_station)
4368		return -EOPNOTSUPP;
4369
4370	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4371	if (err)
4372		return err;
4373
4374	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4375	if (!msg)
4376		return -ENOMEM;
4377
4378	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4379				 info->snd_portid, info->snd_seq, 0,
4380				 rdev, dev, mac_addr, &sinfo) < 0) {
4381		nlmsg_free(msg);
4382		return -ENOBUFS;
4383	}
4384
4385	return genlmsg_reply(msg, info);
4386}
4387
4388int cfg80211_check_station_change(struct wiphy *wiphy,
4389				  struct station_parameters *params,
4390				  enum cfg80211_station_type statype)
4391{
4392	if (params->listen_interval != -1 &&
4393	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4394		return -EINVAL;
4395
4396	if (params->aid &&
4397	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4398	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4399		return -EINVAL;
4400
4401	/* When you run into this, adjust the code below for the new flag */
4402	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4403
4404	switch (statype) {
4405	case CFG80211_STA_MESH_PEER_KERNEL:
4406	case CFG80211_STA_MESH_PEER_USER:
4407		/*
4408		 * No ignoring the TDLS flag here -- the userspace mesh
4409		 * code doesn't have the bug of including TDLS in the
4410		 * mask everywhere.
4411		 */
4412		if (params->sta_flags_mask &
4413				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4414				  BIT(NL80211_STA_FLAG_MFP) |
4415				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
4416			return -EINVAL;
4417		break;
4418	case CFG80211_STA_TDLS_PEER_SETUP:
4419	case CFG80211_STA_TDLS_PEER_ACTIVE:
4420		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4421			return -EINVAL;
4422		/* ignore since it can't change */
4423		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4424		break;
4425	default:
4426		/* disallow mesh-specific things */
4427		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4428			return -EINVAL;
4429		if (params->local_pm)
4430			return -EINVAL;
4431		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4432			return -EINVAL;
4433	}
4434
4435	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4436	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4437		/* TDLS can't be set, ... */
4438		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4439			return -EINVAL;
4440		/*
4441		 * ... but don't bother the driver with it. This works around
4442		 * a hostapd/wpa_supplicant issue -- it always includes the
4443		 * TLDS_PEER flag in the mask even for AP mode.
4444		 */
4445		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4446	}
4447
4448	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4449	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4450		/* reject other things that can't change */
4451		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4452			return -EINVAL;
4453		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4454			return -EINVAL;
4455		if (params->supported_rates)
4456			return -EINVAL;
4457		if (params->ext_capab || params->ht_capa || params->vht_capa)
4458			return -EINVAL;
4459	}
4460
4461	if (statype != CFG80211_STA_AP_CLIENT &&
4462	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4463		if (params->vlan)
4464			return -EINVAL;
4465	}
4466
4467	switch (statype) {
4468	case CFG80211_STA_AP_MLME_CLIENT:
4469		/* Use this only for authorizing/unauthorizing a station */
4470		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4471			return -EOPNOTSUPP;
4472		break;
4473	case CFG80211_STA_AP_CLIENT:
4474	case CFG80211_STA_AP_CLIENT_UNASSOC:
4475		/* accept only the listed bits */
4476		if (params->sta_flags_mask &
4477				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4478				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4479				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
4480				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4481				  BIT(NL80211_STA_FLAG_WME) |
4482				  BIT(NL80211_STA_FLAG_MFP)))
4483			return -EINVAL;
4484
4485		/* but authenticated/associated only if driver handles it */
4486		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4487		    params->sta_flags_mask &
4488				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4489				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4490			return -EINVAL;
4491		break;
4492	case CFG80211_STA_IBSS:
4493	case CFG80211_STA_AP_STA:
4494		/* reject any changes other than AUTHORIZED */
4495		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4496			return -EINVAL;
4497		break;
4498	case CFG80211_STA_TDLS_PEER_SETUP:
4499		/* reject any changes other than AUTHORIZED or WME */
4500		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4501					       BIT(NL80211_STA_FLAG_WME)))
4502			return -EINVAL;
4503		/* force (at least) rates when authorizing */
4504		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4505		    !params->supported_rates)
4506			return -EINVAL;
4507		break;
4508	case CFG80211_STA_TDLS_PEER_ACTIVE:
4509		/* reject any changes */
4510		return -EINVAL;
4511	case CFG80211_STA_MESH_PEER_KERNEL:
4512		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4513			return -EINVAL;
4514		break;
4515	case CFG80211_STA_MESH_PEER_USER:
4516		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4517		    params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4518			return -EINVAL;
4519		break;
4520	}
4521
4522	return 0;
4523}
4524EXPORT_SYMBOL(cfg80211_check_station_change);
4525
4526/*
4527 * Get vlan interface making sure it is running and on the right wiphy.
4528 */
4529static struct net_device *get_vlan(struct genl_info *info,
4530				   struct cfg80211_registered_device *rdev)
4531{
4532	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4533	struct net_device *v;
4534	int ret;
4535
4536	if (!vlanattr)
4537		return NULL;
4538
4539	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4540	if (!v)
4541		return ERR_PTR(-ENODEV);
4542
4543	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4544		ret = -EINVAL;
4545		goto error;
4546	}
4547
4548	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4549	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4550	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4551		ret = -EINVAL;
4552		goto error;
4553	}
4554
4555	if (!netif_running(v)) {
4556		ret = -ENETDOWN;
4557		goto error;
4558	}
4559
4560	return v;
4561 error:
4562	dev_put(v);
4563	return ERR_PTR(ret);
4564}
4565
4566static const struct nla_policy
4567nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4568	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4569	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4570};
4571
4572static int nl80211_parse_sta_wme(struct genl_info *info,
4573				 struct station_parameters *params)
4574{
4575	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4576	struct nlattr *nla;
4577	int err;
4578
4579	/* parse WME attributes if present */
4580	if (!info->attrs[NL80211_ATTR_STA_WME])
4581		return 0;
4582
4583	nla = info->attrs[NL80211_ATTR_STA_WME];
4584	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4585			       nl80211_sta_wme_policy);
4586	if (err)
4587		return err;
4588
4589	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4590		params->uapsd_queues = nla_get_u8(
4591			tb[NL80211_STA_WME_UAPSD_QUEUES]);
4592	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4593		return -EINVAL;
4594
4595	if (tb[NL80211_STA_WME_MAX_SP])
4596		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4597
4598	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4599		return -EINVAL;
4600
4601	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4602
4603	return 0;
4604}
4605
4606static int nl80211_parse_sta_channel_info(struct genl_info *info,
4607				      struct station_parameters *params)
4608{
4609	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4610		params->supported_channels =
4611		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4612		params->supported_channels_len =
4613		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4614		/*
4615		 * Need to include at least one (first channel, number of
4616		 * channels) tuple for each subband, and must have proper
4617		 * tuples for the rest of the data as well.
4618		 */
4619		if (params->supported_channels_len < 2)
4620			return -EINVAL;
4621		if (params->supported_channels_len % 2)
4622			return -EINVAL;
4623	}
4624
4625	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4626		params->supported_oper_classes =
4627		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4628		params->supported_oper_classes_len =
4629		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4630		/*
4631		 * The value of the Length field of the Supported Operating
4632		 * Classes element is between 2 and 253.
4633		 */
4634		if (params->supported_oper_classes_len < 2 ||
4635		    params->supported_oper_classes_len > 253)
4636			return -EINVAL;
4637	}
4638	return 0;
4639}
4640
4641static int nl80211_set_station_tdls(struct genl_info *info,
4642				    struct station_parameters *params)
4643{
4644	int err;
4645	/* Dummy STA entry gets updated once the peer capabilities are known */
4646	if (info->attrs[NL80211_ATTR_PEER_AID])
4647		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4648	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4649		params->ht_capa =
4650			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4651	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4652		params->vht_capa =
4653			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4654
4655	err = nl80211_parse_sta_channel_info(info, params);
4656	if (err)
4657		return err;
4658
4659	return nl80211_parse_sta_wme(info, params);
4660}
4661
4662static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4663{
4664	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4665	struct net_device *dev = info->user_ptr[1];
4666	struct station_parameters params;
4667	u8 *mac_addr;
4668	int err;
4669
4670	memset(&params, 0, sizeof(params));
4671
4672	if (!rdev->ops->change_station)
4673		return -EOPNOTSUPP;
4674
4675	/*
4676	 * AID and listen_interval properties can be set only for unassociated
4677	 * station. Include these parameters here and will check them in
4678	 * cfg80211_check_station_change().
4679	 */
4680	if (info->attrs[NL80211_ATTR_PEER_AID])
4681		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4682
4683	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4684		params.listen_interval =
4685		     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4686	else
4687		params.listen_interval = -1;
4688
4689	if (!info->attrs[NL80211_ATTR_MAC])
4690		return -EINVAL;
4691
4692	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4693
4694	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4695		params.supported_rates =
4696			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4697		params.supported_rates_len =
4698			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4699	}
4700
4701	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4702		params.capability =
4703			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4704		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4705	}
4706
4707	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4708		params.ext_capab =
4709			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4710		params.ext_capab_len =
4711			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4712	}
4713
4714	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4715		return -EINVAL;
4716
4717	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4718		params.plink_action =
4719			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4720		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4721			return -EINVAL;
4722	}
4723
4724	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4725		params.plink_state =
4726			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4727		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4728			return -EINVAL;
4729		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4730	}
4731
4732	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4733		enum nl80211_mesh_power_mode pm = nla_get_u32(
4734			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4735
4736		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4737		    pm > NL80211_MESH_POWER_MAX)
4738			return -EINVAL;
4739
4740		params.local_pm = pm;
4741	}
4742
4743	/* Include parameters for TDLS peer (will check later) */
4744	err = nl80211_set_station_tdls(info, &params);
4745	if (err)
4746		return err;
4747
4748	params.vlan = get_vlan(info, rdev);
4749	if (IS_ERR(params.vlan))
4750		return PTR_ERR(params.vlan);
4751
4752	switch (dev->ieee80211_ptr->iftype) {
4753	case NL80211_IFTYPE_AP:
4754	case NL80211_IFTYPE_AP_VLAN:
4755	case NL80211_IFTYPE_P2P_GO:
4756	case NL80211_IFTYPE_P2P_CLIENT:
4757	case NL80211_IFTYPE_STATION:
4758	case NL80211_IFTYPE_ADHOC:
4759	case NL80211_IFTYPE_MESH_POINT:
4760		break;
4761	default:
4762		err = -EOPNOTSUPP;
4763		goto out_put_vlan;
4764	}
4765
4766	/* driver will call cfg80211_check_station_change() */
4767	err = rdev_change_station(rdev, dev, mac_addr, &params);
4768
4769 out_put_vlan:
4770	if (params.vlan)
4771		dev_put(params.vlan);
4772
4773	return err;
4774}
4775
4776static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4777{
4778	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4779	int err;
4780	struct net_device *dev = info->user_ptr[1];
4781	struct station_parameters params;
4782	u8 *mac_addr = NULL;
4783
4784	memset(&params, 0, sizeof(params));
4785
4786	if (!rdev->ops->add_station)
4787		return -EOPNOTSUPP;
4788
4789	if (!info->attrs[NL80211_ATTR_MAC])
4790		return -EINVAL;
4791
4792	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4793		return -EINVAL;
4794
4795	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4796		return -EINVAL;
4797
4798	if (!info->attrs[NL80211_ATTR_STA_AID] &&
4799	    !info->attrs[NL80211_ATTR_PEER_AID])
4800		return -EINVAL;
4801
4802	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4803	params.supported_rates =
4804		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4805	params.supported_rates_len =
4806		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4807	params.listen_interval =
4808		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4809
4810	if (info->attrs[NL80211_ATTR_PEER_AID])
4811		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4812	else
4813		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4814	if (!params.aid || params.aid > IEEE80211_MAX_AID)
4815		return -EINVAL;
4816
4817	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4818		params.capability =
4819			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4820		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4821	}
4822
4823	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4824		params.ext_capab =
4825			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4826		params.ext_capab_len =
4827			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4828	}
4829
4830	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4831		params.ht_capa =
4832			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4833
4834	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4835		params.vht_capa =
4836			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4837
4838	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4839		params.opmode_notif_used = true;
4840		params.opmode_notif =
4841			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4842	}
4843
4844	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4845		params.plink_action =
4846			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4847		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4848			return -EINVAL;
4849	}
4850
4851	err = nl80211_parse_sta_channel_info(info, &params);
4852	if (err)
4853		return err;
4854
4855	err = nl80211_parse_sta_wme(info, &params);
4856	if (err)
4857		return err;
4858
4859	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4860		return -EINVAL;
4861
4862	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
4863	 * as userspace might just pass through the capabilities from the IEs
4864	 * directly, rather than enforcing this restriction and returning an
4865	 * error in this case.
4866	 */
4867	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
4868		params.ht_capa = NULL;
4869		params.vht_capa = NULL;
4870	}
4871
4872	/* When you run into this, adjust the code below for the new flag */
4873	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4874
4875	switch (dev->ieee80211_ptr->iftype) {
4876	case NL80211_IFTYPE_AP:
4877	case NL80211_IFTYPE_AP_VLAN:
4878	case NL80211_IFTYPE_P2P_GO:
4879		/* ignore WME attributes if iface/sta is not capable */
4880		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4881		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4882			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4883
4884		/* TDLS peers cannot be added */
4885		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4886		    info->attrs[NL80211_ATTR_PEER_AID])
4887			return -EINVAL;
4888		/* but don't bother the driver with it */
4889		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4890
4891		/* allow authenticated/associated only if driver handles it */
4892		if (!(rdev->wiphy.features &
4893				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4894		    params.sta_flags_mask &
4895				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4896				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4897			return -EINVAL;
4898
4899		/* must be last in here for error handling */
4900		params.vlan = get_vlan(info, rdev);
4901		if (IS_ERR(params.vlan))
4902			return PTR_ERR(params.vlan);
4903		break;
4904	case NL80211_IFTYPE_MESH_POINT:
4905		/* ignore uAPSD data */
4906		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4907
4908		/* associated is disallowed */
4909		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4910			return -EINVAL;
4911		/* TDLS peers cannot be added */
4912		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4913		    info->attrs[NL80211_ATTR_PEER_AID])
4914			return -EINVAL;
4915		break;
4916	case NL80211_IFTYPE_STATION:
4917	case NL80211_IFTYPE_P2P_CLIENT:
4918		/* ignore uAPSD data */
4919		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4920
4921		/* these are disallowed */
4922		if (params.sta_flags_mask &
4923				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
4924				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4925			return -EINVAL;
4926		/* Only TDLS peers can be added */
4927		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4928			return -EINVAL;
4929		/* Can only add if TDLS ... */
4930		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4931			return -EOPNOTSUPP;
4932		/* ... with external setup is supported */
4933		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4934			return -EOPNOTSUPP;
4935		/*
4936		 * Older wpa_supplicant versions always mark the TDLS peer
4937		 * as authorized, but it shouldn't yet be.
4938		 */
4939		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4940		break;
4941	default:
4942		return -EOPNOTSUPP;
4943	}
4944
4945	/* be aware of params.vlan when changing code here */
4946
4947	err = rdev_add_station(rdev, dev, mac_addr, &params);
4948
4949	if (params.vlan)
4950		dev_put(params.vlan);
4951	return err;
4952}
4953
4954static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4955{
4956	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4957	struct net_device *dev = info->user_ptr[1];
4958	struct station_del_parameters params;
4959
4960	memset(&params, 0, sizeof(params));
4961
4962	if (info->attrs[NL80211_ATTR_MAC])
4963		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
4964
4965	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4966	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4967	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4968	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4969		return -EINVAL;
4970
4971	if (!rdev->ops->del_station)
4972		return -EOPNOTSUPP;
4973
4974	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
4975		params.subtype =
4976			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
4977		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
4978		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
4979			return -EINVAL;
4980	} else {
4981		/* Default to Deauthentication frame */
4982		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
4983	}
4984
4985	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
4986		params.reason_code =
4987			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
4988		if (params.reason_code == 0)
4989			return -EINVAL; /* 0 is reserved */
4990	} else {
4991		/* Default to reason code 2 */
4992		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
4993	}
4994
4995	return rdev_del_station(rdev, dev, &params);
4996}
4997
4998static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4999				int flags, struct net_device *dev,
5000				u8 *dst, u8 *next_hop,
5001				struct mpath_info *pinfo)
5002{
5003	void *hdr;
5004	struct nlattr *pinfoattr;
5005
5006	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5007	if (!hdr)
5008		return -1;
5009
5010	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5011	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5012	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5013	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5014		goto nla_put_failure;
5015
5016	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5017	if (!pinfoattr)
5018		goto nla_put_failure;
5019	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5020	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5021			pinfo->frame_qlen))
5022		goto nla_put_failure;
5023	if (((pinfo->filled & MPATH_INFO_SN) &&
5024	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5025	    ((pinfo->filled & MPATH_INFO_METRIC) &&
5026	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5027			 pinfo->metric)) ||
5028	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5029	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5030			 pinfo->exptime)) ||
5031	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
5032	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5033			pinfo->flags)) ||
5034	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5035	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5036			 pinfo->discovery_timeout)) ||
5037	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5038	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5039			pinfo->discovery_retries)))
5040		goto nla_put_failure;
5041
5042	nla_nest_end(msg, pinfoattr);
5043
5044	genlmsg_end(msg, hdr);
5045	return 0;
5046
5047 nla_put_failure:
5048	genlmsg_cancel(msg, hdr);
5049	return -EMSGSIZE;
5050}
5051
5052static int nl80211_dump_mpath(struct sk_buff *skb,
5053			      struct netlink_callback *cb)
5054{
5055	struct mpath_info pinfo;
5056	struct cfg80211_registered_device *rdev;
5057	struct wireless_dev *wdev;
5058	u8 dst[ETH_ALEN];
5059	u8 next_hop[ETH_ALEN];
5060	int path_idx = cb->args[2];
5061	int err;
5062
5063	rtnl_lock();
5064	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5065	if (err)
5066		goto out_err;
5067
5068	if (!rdev->ops->dump_mpath) {
5069		err = -EOPNOTSUPP;
5070		goto out_err;
5071	}
5072
5073	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5074		err = -EOPNOTSUPP;
5075		goto out_err;
5076	}
5077
5078	while (1) {
5079		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5080				      next_hop, &pinfo);
5081		if (err == -ENOENT)
5082			break;
5083		if (err)
5084			goto out_err;
5085
5086		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5087				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
5088				       wdev->netdev, dst, next_hop,
5089				       &pinfo) < 0)
5090			goto out;
5091
5092		path_idx++;
5093	}
5094
5095
5096 out:
5097	cb->args[2] = path_idx;
5098	err = skb->len;
5099 out_err:
5100	rtnl_unlock();
5101	return err;
5102}
5103
5104static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5105{
5106	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5107	int err;
5108	struct net_device *dev = info->user_ptr[1];
5109	struct mpath_info pinfo;
5110	struct sk_buff *msg;
5111	u8 *dst = NULL;
5112	u8 next_hop[ETH_ALEN];
5113
5114	memset(&pinfo, 0, sizeof(pinfo));
5115
5116	if (!info->attrs[NL80211_ATTR_MAC])
5117		return -EINVAL;
5118
5119	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5120
5121	if (!rdev->ops->get_mpath)
5122		return -EOPNOTSUPP;
5123
5124	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5125		return -EOPNOTSUPP;
5126
5127	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5128	if (err)
5129		return err;
5130
5131	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5132	if (!msg)
5133		return -ENOMEM;
5134
5135	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5136				 dev, dst, next_hop, &pinfo) < 0) {
5137		nlmsg_free(msg);
5138		return -ENOBUFS;
5139	}
5140
5141	return genlmsg_reply(msg, info);
5142}
5143
5144static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5145{
5146	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5147	struct net_device *dev = info->user_ptr[1];
5148	u8 *dst = NULL;
5149	u8 *next_hop = NULL;
5150
5151	if (!info->attrs[NL80211_ATTR_MAC])
5152		return -EINVAL;
5153
5154	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5155		return -EINVAL;
5156
5157	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5158	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5159
5160	if (!rdev->ops->change_mpath)
5161		return -EOPNOTSUPP;
5162
5163	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5164		return -EOPNOTSUPP;
5165
5166	return rdev_change_mpath(rdev, dev, dst, next_hop);
5167}
5168
5169static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5170{
5171	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5172	struct net_device *dev = info->user_ptr[1];
5173	u8 *dst = NULL;
5174	u8 *next_hop = NULL;
5175
5176	if (!info->attrs[NL80211_ATTR_MAC])
5177		return -EINVAL;
5178
5179	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5180		return -EINVAL;
5181
5182	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5183	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5184
5185	if (!rdev->ops->add_mpath)
5186		return -EOPNOTSUPP;
5187
5188	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5189		return -EOPNOTSUPP;
5190
5191	return rdev_add_mpath(rdev, dev, dst, next_hop);
5192}
5193
5194static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5195{
5196	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5197	struct net_device *dev = info->user_ptr[1];
5198	u8 *dst = NULL;
5199
5200	if (info->attrs[NL80211_ATTR_MAC])
5201		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5202
5203	if (!rdev->ops->del_mpath)
5204		return -EOPNOTSUPP;
5205
5206	return rdev_del_mpath(rdev, dev, dst);
5207}
5208
5209static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5210{
5211	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5212	int err;
5213	struct net_device *dev = info->user_ptr[1];
5214	struct mpath_info pinfo;
5215	struct sk_buff *msg;
5216	u8 *dst = NULL;
5217	u8 mpp[ETH_ALEN];
5218
5219	memset(&pinfo, 0, sizeof(pinfo));
5220
5221	if (!info->attrs[NL80211_ATTR_MAC])
5222		return -EINVAL;
5223
5224	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5225
5226	if (!rdev->ops->get_mpp)
5227		return -EOPNOTSUPP;
5228
5229	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5230		return -EOPNOTSUPP;
5231
5232	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5233	if (err)
5234		return err;
5235
5236	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5237	if (!msg)
5238		return -ENOMEM;
5239
5240	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5241			       dev, dst, mpp, &pinfo) < 0) {
5242		nlmsg_free(msg);
5243		return -ENOBUFS;
5244	}
5245
5246	return genlmsg_reply(msg, info);
5247}
5248
5249static int nl80211_dump_mpp(struct sk_buff *skb,
5250			    struct netlink_callback *cb)
5251{
5252	struct mpath_info pinfo;
5253	struct cfg80211_registered_device *rdev;
5254	struct wireless_dev *wdev;
5255	u8 dst[ETH_ALEN];
5256	u8 mpp[ETH_ALEN];
5257	int path_idx = cb->args[2];
5258	int err;
5259
5260	rtnl_lock();
5261	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5262	if (err)
5263		goto out_err;
5264
5265	if (!rdev->ops->dump_mpp) {
5266		err = -EOPNOTSUPP;
5267		goto out_err;
5268	}
5269
5270	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5271		err = -EOPNOTSUPP;
5272		goto out_err;
5273	}
5274
5275	while (1) {
5276		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5277				    mpp, &pinfo);
5278		if (err == -ENOENT)
5279			break;
5280		if (err)
5281			goto out_err;
5282
5283		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5284				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
5285				       wdev->netdev, dst, mpp,
5286				       &pinfo) < 0)
5287			goto out;
5288
5289		path_idx++;
5290	}
5291
5292 out:
5293	cb->args[2] = path_idx;
5294	err = skb->len;
5295 out_err:
5296	rtnl_unlock();
5297	return err;
5298}
5299
5300static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5301{
5302	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5303	struct net_device *dev = info->user_ptr[1];
5304	struct wireless_dev *wdev = dev->ieee80211_ptr;
5305	struct bss_parameters params;
5306	int err;
5307
5308	memset(&params, 0, sizeof(params));
5309	/* default to not changing parameters */
5310	params.use_cts_prot = -1;
5311	params.use_short_preamble = -1;
5312	params.use_short_slot_time = -1;
5313	params.ap_isolate = -1;
5314	params.ht_opmode = -1;
5315	params.p2p_ctwindow = -1;
5316	params.p2p_opp_ps = -1;
5317
5318	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5319		params.use_cts_prot =
5320		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5321	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5322		params.use_short_preamble =
5323		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5324	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5325		params.use_short_slot_time =
5326		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5327	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5328		params.basic_rates =
5329			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5330		params.basic_rates_len =
5331			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5332	}
5333	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5334		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5335	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5336		params.ht_opmode =
5337			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5338
5339	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5340		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5341			return -EINVAL;
5342		params.p2p_ctwindow =
5343			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5344		if (params.p2p_ctwindow < 0)
5345			return -EINVAL;
5346		if (params.p2p_ctwindow != 0 &&
5347		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5348			return -EINVAL;
5349	}
5350
5351	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5352		u8 tmp;
5353
5354		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5355			return -EINVAL;
5356		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5357		if (tmp > 1)
5358			return -EINVAL;
5359		params.p2p_opp_ps = tmp;
5360		if (params.p2p_opp_ps &&
5361		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5362			return -EINVAL;
5363	}
5364
5365	if (!rdev->ops->change_bss)
5366		return -EOPNOTSUPP;
5367
5368	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5369	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5370		return -EOPNOTSUPP;
5371
5372	wdev_lock(wdev);
5373	err = rdev_change_bss(rdev, dev, &params);
5374	wdev_unlock(wdev);
5375
5376	return err;
5377}
5378
5379static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5380{
5381	char *data = NULL;
5382	bool is_indoor;
5383	enum nl80211_user_reg_hint_type user_reg_hint_type;
5384	u32 owner_nlportid;
5385
5386
5387	/*
5388	 * You should only get this when cfg80211 hasn't yet initialized
5389	 * completely when built-in to the kernel right between the time
5390	 * window between nl80211_init() and regulatory_init(), if that is
5391	 * even possible.
5392	 */
5393	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5394		return -EINPROGRESS;
5395
5396	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5397		user_reg_hint_type =
5398		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5399	else
5400		user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5401
5402	switch (user_reg_hint_type) {
5403	case NL80211_USER_REG_HINT_USER:
5404	case NL80211_USER_REG_HINT_CELL_BASE:
5405		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5406			return -EINVAL;
5407
5408		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5409		return regulatory_hint_user(data, user_reg_hint_type);
5410	case NL80211_USER_REG_HINT_INDOOR:
5411		if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5412			owner_nlportid = info->snd_portid;
5413			is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5414		} else {
5415			owner_nlportid = 0;
5416			is_indoor = true;
5417		}
5418
5419		return regulatory_hint_indoor(is_indoor, owner_nlportid);
5420	default:
5421		return -EINVAL;
5422	}
5423}
5424
5425static int nl80211_get_mesh_config(struct sk_buff *skb,
5426				   struct genl_info *info)
5427{
5428	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5429	struct net_device *dev = info->user_ptr[1];
5430	struct wireless_dev *wdev = dev->ieee80211_ptr;
5431	struct mesh_config cur_params;
5432	int err = 0;
5433	void *hdr;
5434	struct nlattr *pinfoattr;
5435	struct sk_buff *msg;
5436
5437	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5438		return -EOPNOTSUPP;
5439
5440	if (!rdev->ops->get_mesh_config)
5441		return -EOPNOTSUPP;
5442
5443	wdev_lock(wdev);
5444	/* If not connected, get default parameters */
5445	if (!wdev->mesh_id_len)
5446		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5447	else
5448		err = rdev_get_mesh_config(rdev, dev, &cur_params);
5449	wdev_unlock(wdev);
5450
5451	if (err)
5452		return err;
5453
5454	/* Draw up a netlink message to send back */
5455	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5456	if (!msg)
5457		return -ENOMEM;
5458	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5459			     NL80211_CMD_GET_MESH_CONFIG);
5460	if (!hdr)
5461		goto out;
5462	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5463	if (!pinfoattr)
5464		goto nla_put_failure;
5465	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5466	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5467			cur_params.dot11MeshRetryTimeout) ||
5468	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5469			cur_params.dot11MeshConfirmTimeout) ||
5470	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5471			cur_params.dot11MeshHoldingTimeout) ||
5472	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5473			cur_params.dot11MeshMaxPeerLinks) ||
5474	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5475		       cur_params.dot11MeshMaxRetries) ||
5476	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
5477		       cur_params.dot11MeshTTL) ||
5478	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5479		       cur_params.element_ttl) ||
5480	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5481		       cur_params.auto_open_plinks) ||
5482	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5483			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5484	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5485		       cur_params.dot11MeshHWMPmaxPREQretries) ||
5486	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5487			cur_params.path_refresh_time) ||
5488	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5489			cur_params.min_discovery_timeout) ||
5490	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5491			cur_params.dot11MeshHWMPactivePathTimeout) ||
5492	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5493			cur_params.dot11MeshHWMPpreqMinInterval) ||
5494	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5495			cur_params.dot11MeshHWMPperrMinInterval) ||
5496	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5497			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5498	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5499		       cur_params.dot11MeshHWMPRootMode) ||
5500	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5501			cur_params.dot11MeshHWMPRannInterval) ||
5502	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5503		       cur_params.dot11MeshGateAnnouncementProtocol) ||
5504	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5505		       cur_params.dot11MeshForwarding) ||
5506	    nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5507			cur_params.rssi_threshold) ||
5508	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5509			cur_params.ht_opmode) ||
5510	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5511			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5512	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5513			cur_params.dot11MeshHWMProotInterval) ||
5514	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5515			cur_params.dot11MeshHWMPconfirmationInterval) ||
5516	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5517			cur_params.power_mode) ||
5518	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5519			cur_params.dot11MeshAwakeWindowDuration) ||
5520	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5521			cur_params.plink_timeout))
5522		goto nla_put_failure;
5523	nla_nest_end(msg, pinfoattr);
5524	genlmsg_end(msg, hdr);
5525	return genlmsg_reply(msg, info);
5526
5527 nla_put_failure:
5528	genlmsg_cancel(msg, hdr);
5529 out:
5530	nlmsg_free(msg);
5531	return -ENOBUFS;
5532}
5533
5534static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5535	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5536	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5537	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5538	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5539	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5540	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5541	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5542	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5543	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5544	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5545	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5546	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5547	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5548	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5549	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5550	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5551	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5552	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5553	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5554	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5555	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5556	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5557	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5558	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5559	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5560	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5561	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5562	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5563};
5564
5565static const struct nla_policy
5566	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5567	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5568	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5569	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5570	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5571	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5572	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5573	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5574				    .len = IEEE80211_MAX_DATA_LEN },
5575	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5576};
5577
5578static int nl80211_parse_mesh_config(struct genl_info *info,
5579				     struct mesh_config *cfg,
5580				     u32 *mask_out)
5581{
5582	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5583	u32 mask = 0;
5584
5585#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5586do {									    \
5587	if (tb[attr]) {							    \
5588		if (fn(tb[attr]) < min || fn(tb[attr]) > max)		    \
5589			return -EINVAL;					    \
5590		cfg->param = fn(tb[attr]);				    \
5591		mask |= (1 << (attr - 1));				    \
5592	}								    \
5593} while (0)
5594
5595
5596	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5597		return -EINVAL;
5598	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5599			     info->attrs[NL80211_ATTR_MESH_CONFIG],
5600			     nl80211_meshconf_params_policy))
5601		return -EINVAL;
5602
5603	/* This makes sure that there aren't more than 32 mesh config
5604	 * parameters (otherwise our bitfield scheme would not work.) */
5605	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5606
5607	/* Fill in the params struct */
5608	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5609				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5610				  nla_get_u16);
5611	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5612				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5613				  nla_get_u16);
5614	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5615				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5616				  nla_get_u16);
5617	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5618				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5619				  nla_get_u16);
5620	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5621				  mask, NL80211_MESHCONF_MAX_RETRIES,
5622				  nla_get_u8);
5623	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5624				  mask, NL80211_MESHCONF_TTL, nla_get_u8);
5625	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5626				  mask, NL80211_MESHCONF_ELEMENT_TTL,
5627				  nla_get_u8);
5628	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5629				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5630				  nla_get_u8);
5631	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5632				  1, 255, mask,
5633				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5634				  nla_get_u32);
5635	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5636				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5637				  nla_get_u8);
5638	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5639				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5640				  nla_get_u32);
5641	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5642				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5643				  nla_get_u16);
5644	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5645				  1, 65535, mask,
5646				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5647				  nla_get_u32);
5648	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5649				  1, 65535, mask,
5650				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5651				  nla_get_u16);
5652	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5653				  1, 65535, mask,
5654				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5655				  nla_get_u16);
5656	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5657				  dot11MeshHWMPnetDiameterTraversalTime,
5658				  1, 65535, mask,
5659				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5660				  nla_get_u16);
5661	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5662				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5663				  nla_get_u8);
5664	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5665				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5666				  nla_get_u16);
5667	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5668				  dot11MeshGateAnnouncementProtocol, 0, 1,
5669				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5670				  nla_get_u8);
5671	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5672				  mask, NL80211_MESHCONF_FORWARDING,
5673				  nla_get_u8);
5674	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
5675				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
5676				  nla_get_s32);
5677	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
5678				  mask, NL80211_MESHCONF_HT_OPMODE,
5679				  nla_get_u16);
5680	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
5681				  1, 65535, mask,
5682				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5683				  nla_get_u32);
5684	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
5685				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5686				  nla_get_u16);
5687	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5688				  dot11MeshHWMPconfirmationInterval,
5689				  1, 65535, mask,
5690				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5691				  nla_get_u16);
5692	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
5693				  NL80211_MESH_POWER_ACTIVE,
5694				  NL80211_MESH_POWER_MAX,
5695				  mask, NL80211_MESHCONF_POWER_MODE,
5696				  nla_get_u32);
5697	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5698				  0, 65535, mask,
5699				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5700	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
5701				  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5702				  nla_get_u32);
5703	if (mask_out)
5704		*mask_out = mask;
5705
5706	return 0;
5707
5708#undef FILL_IN_MESH_PARAM_IF_SET
5709}
5710
5711static int nl80211_parse_mesh_setup(struct genl_info *info,
5712				     struct mesh_setup *setup)
5713{
5714	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5715	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5716
5717	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5718		return -EINVAL;
5719	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5720			     info->attrs[NL80211_ATTR_MESH_SETUP],
5721			     nl80211_mesh_setup_params_policy))
5722		return -EINVAL;
5723
5724	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5725		setup->sync_method =
5726		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5727		 IEEE80211_SYNC_METHOD_VENDOR :
5728		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5729
5730	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5731		setup->path_sel_proto =
5732		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5733		 IEEE80211_PATH_PROTOCOL_VENDOR :
5734		 IEEE80211_PATH_PROTOCOL_HWMP;
5735
5736	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5737		setup->path_metric =
5738		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5739		 IEEE80211_PATH_METRIC_VENDOR :
5740		 IEEE80211_PATH_METRIC_AIRTIME;
5741
5742
5743	if (tb[NL80211_MESH_SETUP_IE]) {
5744		struct nlattr *ieattr =
5745			tb[NL80211_MESH_SETUP_IE];
5746		if (!is_valid_ie_attr(ieattr))
5747			return -EINVAL;
5748		setup->ie = nla_data(ieattr);
5749		setup->ie_len = nla_len(ieattr);
5750	}
5751	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5752	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5753		return -EINVAL;
5754	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5755	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5756	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5757	if (setup->is_secure)
5758		setup->user_mpm = true;
5759
5760	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5761		if (!setup->user_mpm)
5762			return -EINVAL;
5763		setup->auth_id =
5764			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5765	}
5766
5767	return 0;
5768}
5769
5770static int nl80211_update_mesh_config(struct sk_buff *skb,
5771				      struct genl_info *info)
5772{
5773	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5774	struct net_device *dev = info->user_ptr[1];
5775	struct wireless_dev *wdev = dev->ieee80211_ptr;
5776	struct mesh_config cfg;
5777	u32 mask;
5778	int err;
5779
5780	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5781		return -EOPNOTSUPP;
5782
5783	if (!rdev->ops->update_mesh_config)
5784		return -EOPNOTSUPP;
5785
5786	err = nl80211_parse_mesh_config(info, &cfg, &mask);
5787	if (err)
5788		return err;
5789
5790	wdev_lock(wdev);
5791	if (!wdev->mesh_id_len)
5792		err = -ENOLINK;
5793
5794	if (!err)
5795		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5796
5797	wdev_unlock(wdev);
5798
5799	return err;
5800}
5801
5802static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
5803			      struct sk_buff *msg)
5804{
5805	struct nlattr *nl_reg_rules;
5806	unsigned int i;
5807
5808	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5809	    (regdom->dfs_region &&
5810	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5811		goto nla_put_failure;
5812
5813	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5814	if (!nl_reg_rules)
5815		goto nla_put_failure;
5816
5817	for (i = 0; i < regdom->n_reg_rules; i++) {
5818		struct nlattr *nl_reg_rule;
5819		const struct ieee80211_reg_rule *reg_rule;
5820		const struct ieee80211_freq_range *freq_range;
5821		const struct ieee80211_power_rule *power_rule;
5822		unsigned int max_bandwidth_khz;
5823
5824		reg_rule = &regdom->reg_rules[i];
5825		freq_range = &reg_rule->freq_range;
5826		power_rule = &reg_rule->power_rule;
5827
5828		nl_reg_rule = nla_nest_start(msg, i);
5829		if (!nl_reg_rule)
5830			goto nla_put_failure;
5831
5832		max_bandwidth_khz = freq_range->max_bandwidth_khz;
5833		if (!max_bandwidth_khz)
5834			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5835								  reg_rule);
5836
5837		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5838				reg_rule->flags) ||
5839		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5840				freq_range->start_freq_khz) ||
5841		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5842				freq_range->end_freq_khz) ||
5843		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5844				max_bandwidth_khz) ||
5845		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5846				power_rule->max_antenna_gain) ||
5847		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5848				power_rule->max_eirp) ||
5849		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5850				reg_rule->dfs_cac_ms))
5851			goto nla_put_failure;
5852
5853		nla_nest_end(msg, nl_reg_rule);
5854	}
5855
5856	nla_nest_end(msg, nl_reg_rules);
5857	return 0;
5858
5859nla_put_failure:
5860	return -EMSGSIZE;
5861}
5862
5863static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
5864{
5865	const struct ieee80211_regdomain *regdom = NULL;
5866	struct cfg80211_registered_device *rdev;
5867	struct wiphy *wiphy = NULL;
5868	struct sk_buff *msg;
5869	void *hdr;
5870
5871	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5872	if (!msg)
5873		return -ENOBUFS;
5874
5875	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5876			     NL80211_CMD_GET_REG);
5877	if (!hdr)
5878		goto put_failure;
5879
5880	if (info->attrs[NL80211_ATTR_WIPHY]) {
5881		bool self_managed;
5882
5883		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
5884		if (IS_ERR(rdev)) {
5885			nlmsg_free(msg);
5886			return PTR_ERR(rdev);
5887		}
5888
5889		wiphy = &rdev->wiphy;
5890		self_managed = wiphy->regulatory_flags &
5891			       REGULATORY_WIPHY_SELF_MANAGED;
5892		regdom = get_wiphy_regdom(wiphy);
5893
5894		/* a self-managed-reg device must have a private regdom */
5895		if (WARN_ON(!regdom && self_managed)) {
5896			nlmsg_free(msg);
5897			return -EINVAL;
5898		}
5899
5900		if (regdom &&
5901		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5902			goto nla_put_failure;
5903	}
5904
5905	if (!wiphy && reg_last_request_cell_base() &&
5906	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5907			NL80211_USER_REG_HINT_CELL_BASE))
5908		goto nla_put_failure;
5909
5910	rcu_read_lock();
5911
5912	if (!regdom)
5913		regdom = rcu_dereference(cfg80211_regdomain);
5914
5915	if (nl80211_put_regdom(regdom, msg))
5916		goto nla_put_failure_rcu;
5917
5918	rcu_read_unlock();
5919
5920	genlmsg_end(msg, hdr);
5921	return genlmsg_reply(msg, info);
5922
5923nla_put_failure_rcu:
5924	rcu_read_unlock();
5925nla_put_failure:
5926	genlmsg_cancel(msg, hdr);
5927put_failure:
5928	nlmsg_free(msg);
5929	return -EMSGSIZE;
5930}
5931
5932static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
5933			       u32 seq, int flags, struct wiphy *wiphy,
5934			       const struct ieee80211_regdomain *regdom)
5935{
5936	void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5937				   NL80211_CMD_GET_REG);
5938
5939	if (!hdr)
5940		return -1;
5941
5942	genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5943
5944	if (nl80211_put_regdom(regdom, msg))
5945		goto nla_put_failure;
5946
5947	if (!wiphy && reg_last_request_cell_base() &&
5948	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5949			NL80211_USER_REG_HINT_CELL_BASE))
5950		goto nla_put_failure;
5951
5952	if (wiphy &&
5953	    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
5954		goto nla_put_failure;
5955
5956	if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
5957	    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
5958		goto nla_put_failure;
5959
5960	genlmsg_end(msg, hdr);
5961	return 0;
5962
5963nla_put_failure:
5964	genlmsg_cancel(msg, hdr);
5965	return -EMSGSIZE;
5966}
5967
5968static int nl80211_get_reg_dump(struct sk_buff *skb,
5969				struct netlink_callback *cb)
5970{
5971	const struct ieee80211_regdomain *regdom = NULL;
5972	struct cfg80211_registered_device *rdev;
5973	int err, reg_idx, start = cb->args[2];
5974
5975	rtnl_lock();
5976
5977	if (cfg80211_regdomain && start == 0) {
5978		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5979					  NLM_F_MULTI, NULL,
5980					  rtnl_dereference(cfg80211_regdomain));
5981		if (err < 0)
5982			goto out_err;
5983	}
5984
5985	/* the global regdom is idx 0 */
5986	reg_idx = 1;
5987	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
5988		regdom = get_wiphy_regdom(&rdev->wiphy);
5989		if (!regdom)
5990			continue;
5991
5992		if (++reg_idx <= start)
5993			continue;
5994
5995		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
5996					  NLM_F_MULTI, &rdev->wiphy, regdom);
5997		if (err < 0) {
5998			reg_idx--;
5999			break;
6000		}
6001	}
6002
6003	cb->args[2] = reg_idx;
6004	err = skb->len;
6005out_err:
6006	rtnl_unlock();
6007	return err;
6008}
6009
6010#ifdef CONFIG_CFG80211_CRDA_SUPPORT
6011static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6012	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
6013	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
6014	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
6015	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
6016	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
6017	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
6018	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
6019};
6020
6021static int parse_reg_rule(struct nlattr *tb[],
6022	struct ieee80211_reg_rule *reg_rule)
6023{
6024	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6025	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6026
6027	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6028		return -EINVAL;
6029	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6030		return -EINVAL;
6031	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6032		return -EINVAL;
6033	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6034		return -EINVAL;
6035	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6036		return -EINVAL;
6037
6038	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6039
6040	freq_range->start_freq_khz =
6041		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6042	freq_range->end_freq_khz =
6043		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6044	freq_range->max_bandwidth_khz =
6045		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6046
6047	power_rule->max_eirp =
6048		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6049
6050	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6051		power_rule->max_antenna_gain =
6052			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6053
6054	if (tb[NL80211_ATTR_DFS_CAC_TIME])
6055		reg_rule->dfs_cac_ms =
6056			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6057
6058	return 0;
6059}
6060
6061static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6062{
6063	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6064	struct nlattr *nl_reg_rule;
6065	char *alpha2;
6066	int rem_reg_rules, r;
6067	u32 num_rules = 0, rule_idx = 0, size_of_regd;
6068	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6069	struct ieee80211_regdomain *rd;
6070
6071	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6072		return -EINVAL;
6073
6074	if (!info->attrs[NL80211_ATTR_REG_RULES])
6075		return -EINVAL;
6076
6077	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6078
6079	if (info->attrs[NL80211_ATTR_DFS_REGION])
6080		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6081
6082	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6083			    rem_reg_rules) {
6084		num_rules++;
6085		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6086			return -EINVAL;
6087	}
6088
6089	if (!reg_is_valid_request(alpha2))
6090		return -EINVAL;
6091
6092	size_of_regd = sizeof(struct ieee80211_regdomain) +
6093		       num_rules * sizeof(struct ieee80211_reg_rule);
6094
6095	rd = kzalloc(size_of_regd, GFP_KERNEL);
6096	if (!rd)
6097		return -ENOMEM;
6098
6099	rd->n_reg_rules = num_rules;
6100	rd->alpha2[0] = alpha2[0];
6101	rd->alpha2[1] = alpha2[1];
6102
6103	/*
6104	 * Disable DFS master mode if the DFS region was
6105	 * not supported or known on this kernel.
6106	 */
6107	if (reg_supported_dfs_region(dfs_region))
6108		rd->dfs_region = dfs_region;
6109
6110	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6111			    rem_reg_rules) {
6112		r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
6113			      nla_data(nl_reg_rule), nla_len(nl_reg_rule),
6114			      reg_rule_policy);
6115		if (r)
6116			goto bad_reg;
6117		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6118		if (r)
6119			goto bad_reg;
6120
6121		rule_idx++;
6122
6123		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6124			r = -EINVAL;
6125			goto bad_reg;
6126		}
6127	}
6128
6129	r = set_regdom(rd, REGD_SOURCE_CRDA);
6130	/* set_regdom took ownership */
6131	rd = NULL;
6132
6133 bad_reg:
6134	kfree(rd);
6135	return r;
6136}
6137#endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6138
6139static int validate_scan_freqs(struct nlattr *freqs)
6140{
6141	struct nlattr *attr1, *attr2;
6142	int n_channels = 0, tmp1, tmp2;
6143
6144	nla_for_each_nested(attr1, freqs, tmp1)
6145		if (nla_len(attr1) != sizeof(u32))
6146			return 0;
6147
6148	nla_for_each_nested(attr1, freqs, tmp1) {
6149		n_channels++;
6150		/*
6151		 * Some hardware has a limited channel list for
6152		 * scanning, and it is pretty much nonsensical
6153		 * to scan for a channel twice, so disallow that
6154		 * and don't require drivers to check that the
6155		 * channel list they get isn't longer than what
6156		 * they can scan, as long as they can scan all
6157		 * the channels they registered at once.
6158		 */
6159		nla_for_each_nested(attr2, freqs, tmp2)
6160			if (attr1 != attr2 &&
6161			    nla_get_u32(attr1) == nla_get_u32(attr2))
6162				return 0;
6163	}
6164
6165	return n_channels;
6166}
6167
6168static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6169{
6170	return b < NUM_NL80211_BANDS && wiphy->bands[b];
6171}
6172
6173static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6174			    struct cfg80211_bss_selection *bss_select)
6175{
6176	struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6177	struct nlattr *nest;
6178	int err;
6179	bool found = false;
6180	int i;
6181
6182	/* only process one nested attribute */
6183	nest = nla_data(nla);
6184	if (!nla_ok(nest, nla_len(nest)))
6185		return -EINVAL;
6186
6187	err = nla_parse(attr, NL80211_BSS_SELECT_ATTR_MAX, nla_data(nest),
6188			nla_len(nest), nl80211_bss_select_policy);
6189	if (err)
6190		return err;
6191
6192	/* only one attribute may be given */
6193	for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6194		if (attr[i]) {
6195			if (found)
6196				return -EINVAL;
6197			found = true;
6198		}
6199	}
6200
6201	bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6202
6203	if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6204		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6205
6206	if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6207		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6208		bss_select->param.band_pref =
6209			nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6210		if (!is_band_valid(wiphy, bss_select->param.band_pref))
6211			return -EINVAL;
6212	}
6213
6214	if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6215		struct nl80211_bss_select_rssi_adjust *adj_param;
6216
6217		adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6218		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6219		bss_select->param.adjust.band = adj_param->band;
6220		bss_select->param.adjust.delta = adj_param->delta;
6221		if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6222			return -EINVAL;
6223	}
6224
6225	/* user-space did not provide behaviour attribute */
6226	if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6227		return -EINVAL;
6228
6229	if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6230		return -EINVAL;
6231
6232	return 0;
6233}
6234
6235static int nl80211_parse_random_mac(struct nlattr **attrs,
6236				    u8 *mac_addr, u8 *mac_addr_mask)
6237{
6238	int i;
6239
6240	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6241		eth_zero_addr(mac_addr);
6242		eth_zero_addr(mac_addr_mask);
6243		mac_addr[0] = 0x2;
6244		mac_addr_mask[0] = 0x3;
6245
6246		return 0;
6247	}
6248
6249	/* need both or none */
6250	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6251		return -EINVAL;
6252
6253	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6254	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6255
6256	/* don't allow or configure an mcast address */
6257	if (!is_multicast_ether_addr(mac_addr_mask) ||
6258	    is_multicast_ether_addr(mac_addr))
6259		return -EINVAL;
6260
6261	/*
6262	 * allow users to pass a MAC address that has bits set outside
6263	 * of the mask, but don't bother drivers with having to deal
6264	 * with such bits
6265	 */
6266	for (i = 0; i < ETH_ALEN; i++)
6267		mac_addr[i] &= mac_addr_mask[i];
6268
6269	return 0;
6270}
6271
6272static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6273{
6274	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6275	struct wireless_dev *wdev = info->user_ptr[1];
6276	struct cfg80211_scan_request *request;
6277	struct nlattr *attr;
6278	struct wiphy *wiphy;
6279	int err, tmp, n_ssids = 0, n_channels, i;
6280	size_t ie_len;
6281
6282	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6283		return -EINVAL;
6284
6285	wiphy = &rdev->wiphy;
6286
6287	if (!rdev->ops->scan)
6288		return -EOPNOTSUPP;
6289
6290	if (rdev->scan_req || rdev->scan_msg) {
6291		err = -EBUSY;
6292		goto unlock;
6293	}
6294
6295	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6296		n_channels = validate_scan_freqs(
6297				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6298		if (!n_channels) {
6299			err = -EINVAL;
6300			goto unlock;
6301		}
6302	} else {
6303		n_channels = ieee80211_get_num_supported_channels(wiphy);
6304	}
6305
6306	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6307		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6308			n_ssids++;
6309
6310	if (n_ssids > wiphy->max_scan_ssids) {
6311		err = -EINVAL;
6312		goto unlock;
6313	}
6314
6315	if (info->attrs[NL80211_ATTR_IE])
6316		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6317	else
6318		ie_len = 0;
6319
6320	if (ie_len > wiphy->max_scan_ie_len) {
6321		err = -EINVAL;
6322		goto unlock;
6323	}
6324
6325	request = kzalloc(sizeof(*request)
6326			+ sizeof(*request->ssids) * n_ssids
6327			+ sizeof(*request->channels) * n_channels
6328			+ ie_len, GFP_KERNEL);
6329	if (!request) {
6330		err = -ENOMEM;
6331		goto unlock;
6332	}
6333
6334	if (n_ssids)
6335		request->ssids = (void *)&request->channels[n_channels];
6336	request->n_ssids = n_ssids;
6337	if (ie_len) {
6338		if (n_ssids)
6339			request->ie = (void *)(request->ssids + n_ssids);
6340		else
6341			request->ie = (void *)(request->channels + n_channels);
6342	}
6343
6344	i = 0;
6345	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6346		/* user specified, bail out if channel not found */
6347		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6348			struct ieee80211_channel *chan;
6349
6350			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6351
6352			if (!chan) {
6353				err = -EINVAL;
6354				goto out_free;
6355			}
6356
6357			/* ignore disabled channels */
6358			if (chan->flags & IEEE80211_CHAN_DISABLED)
6359				continue;
6360
6361			request->channels[i] = chan;
6362			i++;
6363		}
6364	} else {
6365		enum nl80211_band band;
6366
6367		/* all channels */
6368		for (band = 0; band < NUM_NL80211_BANDS; band++) {
6369			int j;
6370			if (!wiphy->bands[band])
6371				continue;
6372			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6373				struct ieee80211_channel *chan;
6374
6375				chan = &wiphy->bands[band]->channels[j];
6376
6377				if (chan->flags & IEEE80211_CHAN_DISABLED)
6378					continue;
6379
6380				request->channels[i] = chan;
6381				i++;
6382			}
6383		}
6384	}
6385
6386	if (!i) {
6387		err = -EINVAL;
6388		goto out_free;
6389	}
6390
6391	request->n_channels = i;
6392
6393	i = 0;
6394	if (n_ssids) {
6395		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6396			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6397				err = -EINVAL;
6398				goto out_free;
6399			}
6400			request->ssids[i].ssid_len = nla_len(attr);
6401			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6402			i++;
6403		}
6404	}
6405
6406	if (info->attrs[NL80211_ATTR_IE]) {
6407		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6408		memcpy((void *)request->ie,
6409		       nla_data(info->attrs[NL80211_ATTR_IE]),
6410		       request->ie_len);
6411	}
6412
6413	for (i = 0; i < NUM_NL80211_BANDS; i++)
6414		if (wiphy->bands[i])
6415			request->rates[i] =
6416				(1 << wiphy->bands[i]->n_bitrates) - 1;
6417
6418	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6419		nla_for_each_nested(attr,
6420				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6421				    tmp) {
6422			enum nl80211_band band = nla_type(attr);
6423
6424			if (band < 0 || band >= NUM_NL80211_BANDS) {
6425				err = -EINVAL;
6426				goto out_free;
6427			}
6428
6429			if (!wiphy->bands[band])
6430				continue;
6431
6432			err = ieee80211_get_ratemask(wiphy->bands[band],
6433						     nla_data(attr),
6434						     nla_len(attr),
6435						     &request->rates[band]);
6436			if (err)
6437				goto out_free;
6438		}
6439	}
6440
6441	if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
6442		request->flags = nla_get_u32(
6443			info->attrs[NL80211_ATTR_SCAN_FLAGS]);
6444		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6445		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6446			err = -EOPNOTSUPP;
6447			goto out_free;
6448		}
6449
6450		if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6451			if (!(wiphy->features &
6452					NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR)) {
6453				err = -EOPNOTSUPP;
6454				goto out_free;
6455			}
6456
6457			if (wdev->current_bss) {
6458				err = -EOPNOTSUPP;
6459				goto out_free;
6460			}
6461
6462			err = nl80211_parse_random_mac(info->attrs,
6463						       request->mac_addr,
6464						       request->mac_addr_mask);
6465			if (err)
6466				goto out_free;
6467		}
6468	}
6469
6470	request->no_cck =
6471		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6472
6473	/* Initial implementation used NL80211_ATTR_MAC to set the specific
6474	 * BSSID to scan for. This was problematic because that same attribute
6475	 * was already used for another purpose (local random MAC address). The
6476	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6477	 * compatibility with older userspace components, also use the
6478	 * NL80211_ATTR_MAC value here if it can be determined to be used for
6479	 * the specific BSSID use case instead of the random MAC address
6480	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6481	 */
6482	if (info->attrs[NL80211_ATTR_BSSID])
6483		memcpy(request->bssid,
6484		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6485	else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6486		 info->attrs[NL80211_ATTR_MAC])
6487		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6488		       ETH_ALEN);
6489	else
6490		eth_broadcast_addr(request->bssid);
6491
6492	request->wdev = wdev;
6493	request->wiphy = &rdev->wiphy;
6494	request->scan_start = jiffies;
6495
6496	rdev->scan_req = request;
6497	err = rdev_scan(rdev, request);
6498
6499	if (!err) {
6500		nl80211_send_scan_start(rdev, wdev);
6501		if (wdev->netdev)
6502			dev_hold(wdev->netdev);
6503	} else {
6504 out_free:
6505		rdev->scan_req = NULL;
6506		kfree(request);
6507	}
6508
6509 unlock:
6510	return err;
6511}
6512
6513static int
6514nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6515			       struct cfg80211_sched_scan_request *request,
6516			       struct nlattr **attrs)
6517{
6518	int tmp, err, i = 0;
6519	struct nlattr *attr;
6520
6521	if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6522		u32 interval;
6523
6524		/*
6525		 * If scan plans are not specified,
6526		 * %NL80211_ATTR_SCHED_SCAN_INTERVAL must be specified. In this
6527		 * case one scan plan will be set with the specified scan
6528		 * interval and infinite number of iterations.
6529		 */
6530		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6531			return -EINVAL;
6532
6533		interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6534		if (!interval)
6535			return -EINVAL;
6536
6537		request->scan_plans[0].interval =
6538			DIV_ROUND_UP(interval, MSEC_PER_SEC);
6539		if (!request->scan_plans[0].interval)
6540			return -EINVAL;
6541
6542		if (request->scan_plans[0].interval >
6543		    wiphy->max_sched_scan_plan_interval)
6544			request->scan_plans[0].interval =
6545				wiphy->max_sched_scan_plan_interval;
6546
6547		return 0;
6548	}
6549
6550	nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
6551		struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
6552
6553		if (WARN_ON(i >= n_plans))
6554			return -EINVAL;
6555
6556		err = nla_parse(plan, NL80211_SCHED_SCAN_PLAN_MAX,
6557				nla_data(attr), nla_len(attr),
6558				nl80211_plan_policy);
6559		if (err)
6560			return err;
6561
6562		if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
6563			return -EINVAL;
6564
6565		request->scan_plans[i].interval =
6566			nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
6567		if (!request->scan_plans[i].interval ||
6568		    request->scan_plans[i].interval >
6569		    wiphy->max_sched_scan_plan_interval)
6570			return -EINVAL;
6571
6572		if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
6573			request->scan_plans[i].iterations =
6574				nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
6575			if (!request->scan_plans[i].iterations ||
6576			    (request->scan_plans[i].iterations >
6577			     wiphy->max_sched_scan_plan_iterations))
6578				return -EINVAL;
6579		} else if (i < n_plans - 1) {
6580			/*
6581			 * All scan plans but the last one must specify
6582			 * a finite number of iterations
6583			 */
6584			return -EINVAL;
6585		}
6586
6587		i++;
6588	}
6589
6590	/*
6591	 * The last scan plan must not specify the number of
6592	 * iterations, it is supposed to run infinitely
6593	 */
6594	if (request->scan_plans[n_plans - 1].iterations)
6595		return  -EINVAL;
6596
6597	return 0;
6598}
6599
6600static struct cfg80211_sched_scan_request *
6601nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
6602			 struct nlattr **attrs)
6603{
6604	struct cfg80211_sched_scan_request *request;
6605	struct nlattr *attr;
6606	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
6607	enum nl80211_band band;
6608	size_t ie_len;
6609	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
6610	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
6611
6612	if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
6613		return ERR_PTR(-EINVAL);
6614
6615	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6616		n_channels = validate_scan_freqs(
6617				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6618		if (!n_channels)
6619			return ERR_PTR(-EINVAL);
6620	} else {
6621		n_channels = ieee80211_get_num_supported_channels(wiphy);
6622	}
6623
6624	if (attrs[NL80211_ATTR_SCAN_SSIDS])
6625		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6626				    tmp)
6627			n_ssids++;
6628
6629	if (n_ssids > wiphy->max_sched_scan_ssids)
6630		return ERR_PTR(-EINVAL);
6631
6632	/*
6633	 * First, count the number of 'real' matchsets. Due to an issue with
6634	 * the old implementation, matchsets containing only the RSSI attribute
6635	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
6636	 * RSSI for all matchsets, rather than their own matchset for reporting
6637	 * all APs with a strong RSSI. This is needed to be compatible with
6638	 * older userspace that treated a matchset with only the RSSI as the
6639	 * global RSSI for all other matchsets - if there are other matchsets.
6640	 */
6641	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6642		nla_for_each_nested(attr,
6643				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6644				    tmp) {
6645			struct nlattr *rssi;
6646
6647			err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6648					nla_data(attr), nla_len(attr),
6649					nl80211_match_policy);
6650			if (err)
6651				return ERR_PTR(err);
6652			/* add other standalone attributes here */
6653			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
6654				n_match_sets++;
6655				continue;
6656			}
6657			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6658			if (rssi)
6659				default_match_rssi = nla_get_s32(rssi);
6660		}
6661	}
6662
6663	/* However, if there's no other matchset, add the RSSI one */
6664	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
6665		n_match_sets = 1;
6666
6667	if (n_match_sets > wiphy->max_match_sets)
6668		return ERR_PTR(-EINVAL);
6669
6670	if (attrs[NL80211_ATTR_IE])
6671		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
6672	else
6673		ie_len = 0;
6674
6675	if (ie_len > wiphy->max_sched_scan_ie_len)
6676		return ERR_PTR(-EINVAL);
6677
6678	if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6679		/*
6680		 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
6681		 * each scan plan already specifies its own interval
6682		 */
6683		if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6684			return ERR_PTR(-EINVAL);
6685
6686		nla_for_each_nested(attr,
6687				    attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
6688			n_plans++;
6689	} else {
6690		/*
6691		 * The scan interval attribute is kept for backward
6692		 * compatibility. If no scan plans are specified and sched scan
6693		 * interval is specified, one scan plan will be set with this
6694		 * scan interval and infinite number of iterations.
6695		 */
6696		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
6697			return ERR_PTR(-EINVAL);
6698
6699		n_plans = 1;
6700	}
6701
6702	if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
6703		return ERR_PTR(-EINVAL);
6704
6705	if (!wiphy_ext_feature_isset(
6706		    wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
6707	    (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
6708	     attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
6709		return ERR_PTR(-EINVAL);
6710
6711	request = kzalloc(sizeof(*request)
6712			+ sizeof(*request->ssids) * n_ssids
6713			+ sizeof(*request->match_sets) * n_match_sets
6714			+ sizeof(*request->scan_plans) * n_plans
6715			+ sizeof(*request->channels) * n_channels
6716			+ ie_len, GFP_KERNEL);
6717	if (!request)
6718		return ERR_PTR(-ENOMEM);
6719
6720	if (n_ssids)
6721		request->ssids = (void *)&request->channels[n_channels];
6722	request->n_ssids = n_ssids;
6723	if (ie_len) {
6724		if (n_ssids)
6725			request->ie = (void *)(request->ssids + n_ssids);
6726		else
6727			request->ie = (void *)(request->channels + n_channels);
6728	}
6729
6730	if (n_match_sets) {
6731		if (request->ie)
6732			request->match_sets = (void *)(request->ie + ie_len);
6733		else if (n_ssids)
6734			request->match_sets =
6735				(void *)(request->ssids + n_ssids);
6736		else
6737			request->match_sets =
6738				(void *)(request->channels + n_channels);
6739	}
6740	request->n_match_sets = n_match_sets;
6741
6742	if (n_match_sets)
6743		request->scan_plans = (void *)(request->match_sets +
6744					       n_match_sets);
6745	else if (request->ie)
6746		request->scan_plans = (void *)(request->ie + ie_len);
6747	else if (n_ssids)
6748		request->scan_plans = (void *)(request->ssids + n_ssids);
6749	else
6750		request->scan_plans = (void *)(request->channels + n_channels);
6751
6752	request->n_scan_plans = n_plans;
6753
6754	i = 0;
6755	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6756		/* user specified, bail out if channel not found */
6757		nla_for_each_nested(attr,
6758				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
6759				    tmp) {
6760			struct ieee80211_channel *chan;
6761
6762			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6763
6764			if (!chan) {
6765				err = -EINVAL;
6766				goto out_free;
6767			}
6768
6769			/* ignore disabled channels */
6770			if (chan->flags & IEEE80211_CHAN_DISABLED)
6771				continue;
6772
6773			request->channels[i] = chan;
6774			i++;
6775		}
6776	} else {
6777		/* all channels */
6778		for (band = 0; band < NUM_NL80211_BANDS; band++) {
6779			int j;
6780			if (!wiphy->bands[band])
6781				continue;
6782			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6783				struct ieee80211_channel *chan;
6784
6785				chan = &wiphy->bands[band]->channels[j];
6786
6787				if (chan->flags & IEEE80211_CHAN_DISABLED)
6788					continue;
6789
6790				request->channels[i] = chan;
6791				i++;
6792			}
6793		}
6794	}
6795
6796	if (!i) {
6797		err = -EINVAL;
6798		goto out_free;
6799	}
6800
6801	request->n_channels = i;
6802
6803	i = 0;
6804	if (n_ssids) {
6805		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
6806				    tmp) {
6807			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6808				err = -EINVAL;
6809				goto out_free;
6810			}
6811			request->ssids[i].ssid_len = nla_len(attr);
6812			memcpy(request->ssids[i].ssid, nla_data(attr),
6813			       nla_len(attr));
6814			i++;
6815		}
6816	}
6817
6818	i = 0;
6819	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
6820		nla_for_each_nested(attr,
6821				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
6822				    tmp) {
6823			struct nlattr *ssid, *rssi;
6824
6825			err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
6826					nla_data(attr), nla_len(attr),
6827					nl80211_match_policy);
6828			if (err)
6829				goto out_free;
6830			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
6831			if (ssid) {
6832				if (WARN_ON(i >= n_match_sets)) {
6833					/* this indicates a programming error,
6834					 * the loop above should have verified
6835					 * things properly
6836					 */
6837					err = -EINVAL;
6838					goto out_free;
6839				}
6840
6841				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
6842					err = -EINVAL;
6843					goto out_free;
6844				}
6845				memcpy(request->match_sets[i].ssid.ssid,
6846				       nla_data(ssid), nla_len(ssid));
6847				request->match_sets[i].ssid.ssid_len =
6848					nla_len(ssid);
6849				/* special attribute - old implemenation w/a */
6850				request->match_sets[i].rssi_thold =
6851					default_match_rssi;
6852				rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
6853				if (rssi)
6854					request->match_sets[i].rssi_thold =
6855						nla_get_s32(rssi);
6856			}
6857			i++;
6858		}
6859
6860		/* there was no other matchset, so the RSSI one is alone */
6861		if (i == 0 && n_match_sets)
6862			request->match_sets[0].rssi_thold = default_match_rssi;
6863
6864		request->min_rssi_thold = INT_MAX;
6865		for (i = 0; i < n_match_sets; i++)
6866			request->min_rssi_thold =
6867				min(request->match_sets[i].rssi_thold,
6868				    request->min_rssi_thold);
6869	} else {
6870		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
6871	}
6872
6873	if (ie_len) {
6874		request->ie_len = ie_len;
6875		memcpy((void *)request->ie,
6876		       nla_data(attrs[NL80211_ATTR_IE]),
6877		       request->ie_len);
6878	}
6879
6880	if (attrs[NL80211_ATTR_SCAN_FLAGS]) {
6881		request->flags = nla_get_u32(
6882			attrs[NL80211_ATTR_SCAN_FLAGS]);
6883		if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6884		    !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
6885			err = -EOPNOTSUPP;
6886			goto out_free;
6887		}
6888
6889		if (request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6890			u32 flg = NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR;
6891
6892			if (!wdev) /* must be net-detect */
6893				flg = NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6894
6895			if (!(wiphy->features & flg)) {
6896				err = -EOPNOTSUPP;
6897				goto out_free;
6898			}
6899
6900			if (wdev && wdev->current_bss) {
6901				err = -EOPNOTSUPP;
6902				goto out_free;
6903			}
6904
6905			err = nl80211_parse_random_mac(attrs, request->mac_addr,
6906						       request->mac_addr_mask);
6907			if (err)
6908				goto out_free;
6909		}
6910	}
6911
6912	if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
6913		request->delay =
6914			nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
6915
6916	if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
6917		request->relative_rssi = nla_get_s8(
6918			attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
6919		request->relative_rssi_set = true;
6920	}
6921
6922	if (request->relative_rssi_set &&
6923	    attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
6924		struct nl80211_bss_select_rssi_adjust *rssi_adjust;
6925
6926		rssi_adjust = nla_data(
6927			attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
6928		request->rssi_adjust.band = rssi_adjust->band;
6929		request->rssi_adjust.delta = rssi_adjust->delta;
6930		if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
6931			err = -EINVAL;
6932			goto out_free;
6933		}
6934	}
6935
6936	err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
6937	if (err)
6938		goto out_free;
6939
6940	request->scan_start = jiffies;
6941
6942	return request;
6943
6944out_free:
6945	kfree(request);
6946	return ERR_PTR(err);
6947}
6948
6949static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6950{
6951	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6952	struct wireless_dev *wdev = info->user_ptr[1];
6953
6954	if (!rdev->ops->abort_scan)
6955		return -EOPNOTSUPP;
6956
6957	if (rdev->scan_msg)
6958		return 0;
6959
6960	if (!rdev->scan_req)
6961		return -ENOENT;
6962
6963	rdev_abort_scan(rdev, wdev);
6964	return 0;
6965}
6966
6967static int nl80211_start_sched_scan(struct sk_buff *skb,
6968				    struct genl_info *info)
6969{
6970	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6971	struct net_device *dev = info->user_ptr[1];
6972	struct wireless_dev *wdev = dev->ieee80211_ptr;
6973	struct cfg80211_sched_scan_request *sched_scan_req;
6974	int err;
6975
6976	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
6977	    !rdev->ops->sched_scan_start)
6978		return -EOPNOTSUPP;
6979
6980	if (rdev->sched_scan_req)
6981		return -EINPROGRESS;
6982
6983	sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
6984						  info->attrs);
6985
6986	err = PTR_ERR_OR_ZERO(sched_scan_req);
6987	if (err)
6988		goto out_err;
6989
6990	err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
6991	if (err)
6992		goto out_free;
6993
6994	sched_scan_req->dev = dev;
6995	sched_scan_req->wiphy = &rdev->wiphy;
6996
6997	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6998		sched_scan_req->owner_nlportid = info->snd_portid;
6999
7000	rcu_assign_pointer(rdev->sched_scan_req, sched_scan_req);
7001
7002	nl80211_send_sched_scan(rdev, dev,
7003				NL80211_CMD_START_SCHED_SCAN);
7004	return 0;
7005
7006out_free:
7007	kfree(sched_scan_req);
7008out_err:
7009	return err;
7010}
7011
7012static int nl80211_stop_sched_scan(struct sk_buff *skb,
7013				   struct genl_info *info)
7014{
7015	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7016
7017	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
7018	    !rdev->ops->sched_scan_stop)
7019		return -EOPNOTSUPP;
7020
7021	return __cfg80211_stop_sched_scan(rdev, false);
7022}
7023
7024static int nl80211_start_radar_detection(struct sk_buff *skb,
7025					 struct genl_info *info)
7026{
7027	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7028	struct net_device *dev = info->user_ptr[1];
7029	struct wireless_dev *wdev = dev->ieee80211_ptr;
7030	struct cfg80211_chan_def chandef;
7031	enum nl80211_dfs_regions dfs_region;
7032	unsigned int cac_time_ms;
7033	int err;
7034
7035	dfs_region = reg_get_dfs_region(wdev->wiphy);
7036	if (dfs_region == NL80211_DFS_UNSET)
7037		return -EINVAL;
7038
7039	err = nl80211_parse_chandef(rdev, info, &chandef);
7040	if (err)
7041		return err;
7042
7043	if (rdev->wiphy.flags & WIPHY_FLAG_DFS_OFFLOAD)
7044		return -EOPNOTSUPP;
7045
7046	if (netif_carrier_ok(dev))
7047		return -EBUSY;
7048
7049	if (wdev->cac_started)
7050		return -EBUSY;
7051
7052	err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7053					    wdev->iftype);
7054	if (err < 0)
7055		return err;
7056
7057	if (err == 0)
7058		return -EINVAL;
7059
7060	if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7061		return -EINVAL;
7062
7063	if (!rdev->ops->start_radar_detection)
7064		return -EOPNOTSUPP;
7065
7066	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7067	if (WARN_ON(!cac_time_ms))
7068		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7069
7070	err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
7071					       cac_time_ms);
7072	if (!err) {
7073		wdev->chandef = chandef;
7074		wdev->cac_started = true;
7075		wdev->cac_start_time = jiffies;
7076		wdev->cac_time_ms = cac_time_ms;
7077	}
7078	return err;
7079}
7080
7081static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7082{
7083	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7084	struct net_device *dev = info->user_ptr[1];
7085	struct wireless_dev *wdev = dev->ieee80211_ptr;
7086	struct cfg80211_csa_settings params;
7087	/* csa_attrs is defined static to avoid waste of stack size - this
7088	 * function is called under RTNL lock, so this should not be a problem.
7089	 */
7090	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7091	int err;
7092	bool need_new_beacon = false;
7093	int len, i;
7094	u32 cs_count;
7095
7096	if (!rdev->ops->channel_switch ||
7097	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7098		return -EOPNOTSUPP;
7099
7100	switch (dev->ieee80211_ptr->iftype) {
7101	case NL80211_IFTYPE_AP:
7102	case NL80211_IFTYPE_P2P_GO:
7103		need_new_beacon = true;
7104
7105		/* useless if AP is not running */
7106		if (!wdev->beacon_interval)
7107			return -ENOTCONN;
7108		break;
7109	case NL80211_IFTYPE_ADHOC:
7110		if (!wdev->ssid_len)
7111			return -ENOTCONN;
7112		break;
7113	case NL80211_IFTYPE_MESH_POINT:
7114		if (!wdev->mesh_id_len)
7115			return -ENOTCONN;
7116		break;
7117	default:
7118		return -EOPNOTSUPP;
7119	}
7120
7121	memset(&params, 0, sizeof(params));
7122
7123	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7124	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7125		return -EINVAL;
7126
7127	/* only important for AP, IBSS and mesh create IEs internally */
7128	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7129		return -EINVAL;
7130
7131	/* Even though the attribute is u32, the specification says
7132	 * u8, so let's make sure we don't overflow.
7133	 */
7134	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7135	if (cs_count > 255)
7136		return -EINVAL;
7137
7138	params.count = cs_count;
7139
7140	if (!need_new_beacon)
7141		goto skip_beacons;
7142
7143	err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7144	if (err)
7145		return err;
7146
7147	err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7148			       info->attrs[NL80211_ATTR_CSA_IES],
7149			       nl80211_policy);
7150	if (err)
7151		return err;
7152
7153	err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7154	if (err)
7155		return err;
7156
7157	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7158		return -EINVAL;
7159
7160	len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7161	if (!len || (len % sizeof(u16)))
7162		return -EINVAL;
7163
7164	params.n_counter_offsets_beacon = len / sizeof(u16);
7165	if (rdev->wiphy.max_num_csa_counters &&
7166	    (params.n_counter_offsets_beacon >
7167	     rdev->wiphy.max_num_csa_counters))
7168		return -EINVAL;
7169
7170	params.counter_offsets_beacon =
7171		nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7172
7173	/* sanity checks - counters should fit and be the same */
7174	for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7175		u16 offset = params.counter_offsets_beacon[i];
7176
7177		if (offset >= params.beacon_csa.tail_len)
7178			return -EINVAL;
7179
7180		if (params.beacon_csa.tail[offset] != params.count)
7181			return -EINVAL;
7182	}
7183
7184	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7185		len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7186		if (!len || (len % sizeof(u16)))
7187			return -EINVAL;
7188
7189		params.n_counter_offsets_presp = len / sizeof(u16);
7190		if (rdev->wiphy.max_num_csa_counters &&
7191		    (params.n_counter_offsets_presp >
7192		     rdev->wiphy.max_num_csa_counters))
7193			return -EINVAL;
7194
7195		params.counter_offsets_presp =
7196			nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7197
7198		/* sanity checks - counters should fit and be the same */
7199		for (i = 0; i < params.n_counter_offsets_presp; i++) {
7200			u16 offset = params.counter_offsets_presp[i];
7201
7202			if (offset >= params.beacon_csa.probe_resp_len)
7203				return -EINVAL;
7204
7205			if (params.beacon_csa.probe_resp[offset] !=
7206			    params.count)
7207				return -EINVAL;
7208		}
7209	}
7210
7211skip_beacons:
7212	err = nl80211_parse_chandef(rdev, info, &params.chandef);
7213	if (err)
7214		return err;
7215
7216	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7217					   wdev->iftype))
7218		return -EINVAL;
7219
7220	err = cfg80211_chandef_dfs_required(wdev->wiphy,
7221					    &params.chandef,
7222					    wdev->iftype);
7223	if (err < 0)
7224		return err;
7225
7226	if (err > 0)
7227		params.radar_required = true;
7228
7229	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7230		params.block_tx = true;
7231
7232	wdev_lock(wdev);
7233	err = rdev_channel_switch(rdev, dev, &params);
7234	wdev_unlock(wdev);
7235
7236	return err;
7237}
7238
7239static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7240			    u32 seq, int flags,
7241			    struct cfg80211_registered_device *rdev,
7242			    struct wireless_dev *wdev,
7243			    struct cfg80211_internal_bss *intbss)
7244{
7245	struct cfg80211_bss *res = &intbss->pub;
7246	const struct cfg80211_bss_ies *ies;
7247	void *hdr;
7248	struct nlattr *bss;
7249
7250	ASSERT_WDEV_LOCK(wdev);
7251
7252	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7253			     NL80211_CMD_NEW_SCAN_RESULTS);
7254	if (!hdr)
7255		return -1;
7256
7257	genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7258
7259	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7260		goto nla_put_failure;
7261	if (wdev->netdev &&
7262	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7263		goto nla_put_failure;
7264	if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
7265		goto nla_put_failure;
7266
7267	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7268	if (!bss)
7269		goto nla_put_failure;
7270	if ((!is_zero_ether_addr(res->bssid) &&
7271	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7272		goto nla_put_failure;
7273
7274	rcu_read_lock();
7275	/* indicate whether we have probe response data or not */
7276	if (rcu_access_pointer(res->proberesp_ies) &&
7277	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7278		goto fail_unlock_rcu;
7279
7280	/* this pointer prefers to be pointed to probe response data
7281	 * but is always valid
7282	 */
7283	ies = rcu_dereference(res->ies);
7284	if (ies) {
7285		if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
7286			goto fail_unlock_rcu;
7287		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7288					ies->len, ies->data))
7289			goto fail_unlock_rcu;
7290	}
7291
7292	/* and this pointer is always (unless driver didn't know) beacon data */
7293	ies = rcu_dereference(res->beacon_ies);
7294	if (ies && ies->from_beacon) {
7295		if (nla_put_u64(msg, NL80211_BSS_BEACON_TSF, ies->tsf))
7296			goto fail_unlock_rcu;
7297		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7298					ies->len, ies->data))
7299			goto fail_unlock_rcu;
7300	}
7301	rcu_read_unlock();
7302
7303	if (res->beacon_interval &&
7304	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7305		goto nla_put_failure;
7306	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7307	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7308	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7309	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7310			jiffies_to_msecs(jiffies - intbss->ts)))
7311		goto nla_put_failure;
7312
7313	if (intbss->ts_boottime &&
7314	    nla_put_u64(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7315			intbss->ts_boottime))
7316		goto nla_put_failure;
7317
7318	switch (rdev->wiphy.signal_type) {
7319	case CFG80211_SIGNAL_TYPE_MBM:
7320		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7321			goto nla_put_failure;
7322		break;
7323	case CFG80211_SIGNAL_TYPE_UNSPEC:
7324		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7325			goto nla_put_failure;
7326		break;
7327	default:
7328		break;
7329	}
7330
7331	switch (wdev->iftype) {
7332	case NL80211_IFTYPE_P2P_CLIENT:
7333	case NL80211_IFTYPE_STATION:
7334		if (intbss == wdev->current_bss &&
7335		    nla_put_u32(msg, NL80211_BSS_STATUS,
7336				NL80211_BSS_STATUS_ASSOCIATED))
7337			goto nla_put_failure;
7338		break;
7339	case NL80211_IFTYPE_ADHOC:
7340		if (intbss == wdev->current_bss &&
7341		    nla_put_u32(msg, NL80211_BSS_STATUS,
7342				NL80211_BSS_STATUS_IBSS_JOINED))
7343			goto nla_put_failure;
7344		break;
7345	default:
7346		break;
7347	}
7348
7349	nla_nest_end(msg, bss);
7350
7351	genlmsg_end(msg, hdr);
7352	return 0;
7353
7354 fail_unlock_rcu:
7355	rcu_read_unlock();
7356 nla_put_failure:
7357	genlmsg_cancel(msg, hdr);
7358	return -EMSGSIZE;
7359}
7360
7361static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7362{
7363	struct cfg80211_registered_device *rdev;
7364	struct cfg80211_internal_bss *scan;
7365	struct wireless_dev *wdev;
7366	int start = cb->args[2], idx = 0;
7367	int err;
7368
7369	rtnl_lock();
7370	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7371	if (err) {
7372		rtnl_unlock();
7373		return err;
7374	}
7375
7376	wdev_lock(wdev);
7377	spin_lock_bh(&rdev->bss_lock);
7378	cfg80211_bss_expire(rdev);
7379
7380	cb->seq = rdev->bss_generation;
7381
7382	list_for_each_entry(scan, &rdev->bss_list, list) {
7383		if (++idx <= start)
7384			continue;
7385		if (nl80211_send_bss(skb, cb,
7386				cb->nlh->nlmsg_seq, NLM_F_MULTI,
7387				rdev, wdev, scan) < 0) {
7388			idx--;
7389			break;
7390		}
7391	}
7392
7393	spin_unlock_bh(&rdev->bss_lock);
7394	wdev_unlock(wdev);
7395
7396	cb->args[2] = idx;
7397	rtnl_unlock();
7398
7399	return skb->len;
7400}
7401
7402static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7403			       int flags, struct net_device *dev,
7404			       bool allow_radio_stats,
7405			       struct survey_info *survey)
7406{
7407	void *hdr;
7408	struct nlattr *infoattr;
7409
7410	/* skip radio stats if userspace didn't request them */
7411	if (!survey->channel && !allow_radio_stats)
7412		return 0;
7413
7414	hdr = nl80211hdr_put(msg, portid, seq, flags,
7415			     NL80211_CMD_NEW_SURVEY_RESULTS);
7416	if (!hdr)
7417		return -ENOMEM;
7418
7419	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7420		goto nla_put_failure;
7421
7422	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7423	if (!infoattr)
7424		goto nla_put_failure;
7425
7426	if (survey->channel &&
7427	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7428			survey->channel->center_freq))
7429		goto nla_put_failure;
7430
7431	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7432	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7433		goto nla_put_failure;
7434	if ((survey->filled & SURVEY_INFO_IN_USE) &&
7435	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7436		goto nla_put_failure;
7437	if ((survey->filled & SURVEY_INFO_TIME) &&
7438	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME,
7439			survey->time))
7440		goto nla_put_failure;
7441	if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7442	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7443			survey->time_busy))
7444		goto nla_put_failure;
7445	if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7446	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7447			survey->time_ext_busy))
7448		goto nla_put_failure;
7449	if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7450	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_RX,
7451			survey->time_rx))
7452		goto nla_put_failure;
7453	if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7454	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_TX,
7455			survey->time_tx))
7456		goto nla_put_failure;
7457	if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7458	    nla_put_u64(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7459			survey->time_scan))
7460		goto nla_put_failure;
7461
7462	nla_nest_end(msg, infoattr);
7463
7464	genlmsg_end(msg, hdr);
7465	return 0;
7466
7467 nla_put_failure:
7468	genlmsg_cancel(msg, hdr);
7469	return -EMSGSIZE;
7470}
7471
7472static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7473{
7474	struct survey_info survey;
7475	struct cfg80211_registered_device *rdev;
7476	struct wireless_dev *wdev;
7477	int survey_idx = cb->args[2];
7478	int res;
7479	bool radio_stats;
7480
7481	rtnl_lock();
7482	res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7483	if (res)
7484		goto out_err;
7485
7486	/* prepare_wdev_dump parsed the attributes */
7487	radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7488
7489	if (!wdev->netdev) {
7490		res = -EINVAL;
7491		goto out_err;
7492	}
7493
7494	if (!rdev->ops->dump_survey) {
7495		res = -EOPNOTSUPP;
7496		goto out_err;
7497	}
7498
7499	while (1) {
7500		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7501		if (res == -ENOENT)
7502			break;
7503		if (res)
7504			goto out_err;
7505
7506		/* don't send disabled channels, but do send non-channel data */
7507		if (survey.channel &&
7508		    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7509			survey_idx++;
7510			continue;
7511		}
7512
7513		if (nl80211_send_survey(skb,
7514				NETLINK_CB(cb->skb).portid,
7515				cb->nlh->nlmsg_seq, NLM_F_MULTI,
7516				wdev->netdev, radio_stats, &survey) < 0)
7517			goto out;
7518		survey_idx++;
7519	}
7520
7521 out:
7522	cb->args[2] = survey_idx;
7523	res = skb->len;
7524 out_err:
7525	rtnl_unlock();
7526	return res;
7527}
7528
7529static bool nl80211_valid_wpa_versions(u32 wpa_versions)
7530{
7531	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
7532				  NL80211_WPA_VERSION_2));
7533}
7534
7535static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
7536{
7537	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7538	struct net_device *dev = info->user_ptr[1];
7539	struct ieee80211_channel *chan;
7540	const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
7541	int err, ssid_len, ie_len = 0, auth_data_len = 0;
7542	enum nl80211_auth_type auth_type;
7543	struct key_parse key;
7544	bool local_state_change;
7545
7546	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7547		return -EINVAL;
7548
7549	if (!info->attrs[NL80211_ATTR_MAC])
7550		return -EINVAL;
7551
7552	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
7553		return -EINVAL;
7554
7555	if (!info->attrs[NL80211_ATTR_SSID])
7556		return -EINVAL;
7557
7558	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7559		return -EINVAL;
7560
7561	err = nl80211_parse_key(info, &key);
7562	if (err)
7563		return err;
7564
7565	if (key.idx >= 0) {
7566		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
7567			return -EINVAL;
7568		if (!key.p.key || !key.p.key_len)
7569			return -EINVAL;
7570		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
7571		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
7572		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
7573		     key.p.key_len != WLAN_KEY_LEN_WEP104))
7574			return -EINVAL;
7575		if (key.idx > 4)
7576			return -EINVAL;
7577	} else {
7578		key.p.key_len = 0;
7579		key.p.key = NULL;
7580	}
7581
7582	if (key.idx >= 0) {
7583		int i;
7584		bool ok = false;
7585		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
7586			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
7587				ok = true;
7588				break;
7589			}
7590		}
7591		if (!ok)
7592			return -EINVAL;
7593	}
7594
7595	if (!rdev->ops->auth)
7596		return -EOPNOTSUPP;
7597
7598	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7599	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7600		return -EOPNOTSUPP;
7601
7602	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7603	chan = nl80211_get_valid_chan(&rdev->wiphy,
7604				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7605	if (!chan)
7606		return -EINVAL;
7607
7608	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7609	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7610
7611	if (info->attrs[NL80211_ATTR_IE]) {
7612		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7613		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7614	}
7615
7616	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7617	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
7618		return -EINVAL;
7619
7620	if ((auth_type == NL80211_AUTHTYPE_SAE ||
7621	     auth_type == NL80211_AUTHTYPE_FILS_SK ||
7622	     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
7623	     auth_type == NL80211_AUTHTYPE_FILS_PK) &&
7624	    !info->attrs[NL80211_ATTR_AUTH_DATA])
7625		return -EINVAL;
7626
7627	if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
7628		if (auth_type != NL80211_AUTHTYPE_SAE &&
7629		    auth_type != NL80211_AUTHTYPE_FILS_SK &&
7630		    auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
7631		    auth_type != NL80211_AUTHTYPE_FILS_PK)
7632			return -EINVAL;
7633		auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
7634		auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
7635		/* need to include at least Auth Transaction and Status Code */
7636		if (auth_data_len < 4)
7637			return -EINVAL;
7638	}
7639
7640	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7641
7642	/*
7643	 * Since we no longer track auth state, ignore
7644	 * requests to only change local state.
7645	 */
7646	if (local_state_change)
7647		return 0;
7648
7649	wdev_lock(dev->ieee80211_ptr);
7650	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
7651				 ssid, ssid_len, ie, ie_len,
7652				 key.p.key, key.p.key_len, key.idx,
7653				 auth_data, auth_data_len);
7654	wdev_unlock(dev->ieee80211_ptr);
7655	return err;
7656}
7657
7658static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
7659				   struct genl_info *info,
7660				   struct cfg80211_crypto_settings *settings,
7661				   int cipher_limit)
7662{
7663	memset(settings, 0, sizeof(*settings));
7664
7665	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
7666
7667	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
7668		u16 proto;
7669		proto = nla_get_u16(
7670			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
7671		settings->control_port_ethertype = cpu_to_be16(proto);
7672		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
7673		    proto != ETH_P_PAE)
7674			return -EINVAL;
7675		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
7676			settings->control_port_no_encrypt = true;
7677	} else
7678		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
7679
7680	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
7681		void *data;
7682		int len, i;
7683
7684		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7685		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
7686		settings->n_ciphers_pairwise = len / sizeof(u32);
7687
7688		if (len % sizeof(u32))
7689			return -EINVAL;
7690
7691		if (settings->n_ciphers_pairwise > cipher_limit)
7692			return -EINVAL;
7693
7694		if (len > sizeof(u32) * NL80211_MAX_NR_CIPHER_SUITES)
7695			return -EINVAL;
7696
7697		memcpy(settings->ciphers_pairwise, data, len);
7698
7699		for (i = 0; i < settings->n_ciphers_pairwise; i++)
7700			if (!cfg80211_supported_cipher_suite(
7701					&rdev->wiphy,
7702					settings->ciphers_pairwise[i]))
7703				return -EINVAL;
7704	}
7705
7706	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
7707		settings->cipher_group =
7708			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
7709		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
7710						     settings->cipher_group))
7711			return -EINVAL;
7712	}
7713
7714	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
7715		settings->wpa_versions =
7716			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
7717		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
7718			return -EINVAL;
7719	}
7720
7721	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
7722		void *data;
7723		int len;
7724
7725		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
7726		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
7727		settings->n_akm_suites = len / sizeof(u32);
7728
7729		if (len % sizeof(u32))
7730			return -EINVAL;
7731
7732		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
7733			return -EINVAL;
7734
7735		memcpy(settings->akm_suites, data, len);
7736	}
7737
7738	return 0;
7739}
7740
7741static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
7742{
7743	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7744	struct net_device *dev = info->user_ptr[1];
7745	struct ieee80211_channel *chan;
7746	struct cfg80211_assoc_request req = {};
7747	const u8 *bssid, *ssid;
7748	int err, ssid_len = 0;
7749
7750	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7751		return -EINVAL;
7752
7753	if (!info->attrs[NL80211_ATTR_MAC] ||
7754	    !info->attrs[NL80211_ATTR_SSID] ||
7755	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
7756		return -EINVAL;
7757
7758	if (!rdev->ops->assoc)
7759		return -EOPNOTSUPP;
7760
7761	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7762	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7763		return -EOPNOTSUPP;
7764
7765	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7766
7767	chan = nl80211_get_valid_chan(&rdev->wiphy,
7768				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7769	if (!chan)
7770		return -EINVAL;
7771
7772	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7773	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7774
7775	if (info->attrs[NL80211_ATTR_IE]) {
7776		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7777		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7778	}
7779
7780	if (info->attrs[NL80211_ATTR_USE_MFP]) {
7781		enum nl80211_mfp mfp =
7782			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7783		if (mfp == NL80211_MFP_REQUIRED)
7784			req.use_mfp = true;
7785		else if (mfp != NL80211_MFP_NO)
7786			return -EINVAL;
7787	}
7788
7789	if (info->attrs[NL80211_ATTR_PREV_BSSID])
7790		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
7791
7792	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7793		req.flags |= ASSOC_REQ_DISABLE_HT;
7794
7795	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7796		memcpy(&req.ht_capa_mask,
7797		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7798		       sizeof(req.ht_capa_mask));
7799
7800	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7801		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7802			return -EINVAL;
7803		memcpy(&req.ht_capa,
7804		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7805		       sizeof(req.ht_capa));
7806	}
7807
7808	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7809		req.flags |= ASSOC_REQ_DISABLE_VHT;
7810
7811	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7812		memcpy(&req.vht_capa_mask,
7813		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7814		       sizeof(req.vht_capa_mask));
7815
7816	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7817		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7818			return -EINVAL;
7819		memcpy(&req.vht_capa,
7820		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7821		       sizeof(req.vht_capa));
7822	}
7823
7824	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
7825		if (!(rdev->wiphy.features &
7826		      NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
7827		    !(rdev->wiphy.features & NL80211_FEATURE_QUIET))
7828			return -EINVAL;
7829		req.flags |= ASSOC_REQ_USE_RRM;
7830	}
7831
7832	if (info->attrs[NL80211_ATTR_FILS_KEK]) {
7833		req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
7834		req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
7835		if (!info->attrs[NL80211_ATTR_FILS_NONCES])
7836			return -EINVAL;
7837		req.fils_nonces =
7838			nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
7839	}
7840
7841	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
7842	if (!err) {
7843		wdev_lock(dev->ieee80211_ptr);
7844
7845		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
7846					  ssid, ssid_len, &req);
7847
7848		if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7849			dev->ieee80211_ptr->conn_owner_nlportid =
7850				info->snd_portid;
7851			memcpy(dev->ieee80211_ptr->disconnect_bssid,
7852			       bssid, ETH_ALEN);
7853		}
7854
7855		wdev_unlock(dev->ieee80211_ptr);
7856	}
7857
7858	return err;
7859}
7860
7861static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
7862{
7863	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7864	struct net_device *dev = info->user_ptr[1];
7865	const u8 *ie = NULL, *bssid;
7866	int ie_len = 0, err;
7867	u16 reason_code;
7868	bool local_state_change;
7869
7870	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7871		return -EINVAL;
7872
7873	if (!info->attrs[NL80211_ATTR_MAC])
7874		return -EINVAL;
7875
7876	if (!info->attrs[NL80211_ATTR_REASON_CODE])
7877		return -EINVAL;
7878
7879	if (!rdev->ops->deauth)
7880		return -EOPNOTSUPP;
7881
7882	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7883	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7884		return -EOPNOTSUPP;
7885
7886	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7887
7888	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7889	if (reason_code == 0) {
7890		/* Reason Code 0 is reserved */
7891		return -EINVAL;
7892	}
7893
7894	if (info->attrs[NL80211_ATTR_IE]) {
7895		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7896		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7897	}
7898
7899	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7900
7901	wdev_lock(dev->ieee80211_ptr);
7902	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
7903				   local_state_change);
7904	wdev_unlock(dev->ieee80211_ptr);
7905	return err;
7906}
7907
7908static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
7909{
7910	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7911	struct net_device *dev = info->user_ptr[1];
7912	const u8 *ie = NULL, *bssid;
7913	int ie_len = 0, err;
7914	u16 reason_code;
7915	bool local_state_change;
7916
7917	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7918		return -EINVAL;
7919
7920	if (!info->attrs[NL80211_ATTR_MAC])
7921		return -EINVAL;
7922
7923	if (!info->attrs[NL80211_ATTR_REASON_CODE])
7924		return -EINVAL;
7925
7926	if (!rdev->ops->disassoc)
7927		return -EOPNOTSUPP;
7928
7929	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7930	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7931		return -EOPNOTSUPP;
7932
7933	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7934
7935	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7936	if (reason_code == 0) {
7937		/* Reason Code 0 is reserved */
7938		return -EINVAL;
7939	}
7940
7941	if (info->attrs[NL80211_ATTR_IE]) {
7942		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7943		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7944	}
7945
7946	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
7947
7948	wdev_lock(dev->ieee80211_ptr);
7949	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
7950				     local_state_change);
7951	wdev_unlock(dev->ieee80211_ptr);
7952	return err;
7953}
7954
7955static bool
7956nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
7957			 int mcast_rate[NUM_NL80211_BANDS],
7958			 int rateval)
7959{
7960	struct wiphy *wiphy = &rdev->wiphy;
7961	bool found = false;
7962	int band, i;
7963
7964	for (band = 0; band < NUM_NL80211_BANDS; band++) {
7965		struct ieee80211_supported_band *sband;
7966
7967		sband = wiphy->bands[band];
7968		if (!sband)
7969			continue;
7970
7971		for (i = 0; i < sband->n_bitrates; i++) {
7972			if (sband->bitrates[i].bitrate == rateval) {
7973				mcast_rate[band] = i + 1;
7974				found = true;
7975				break;
7976			}
7977		}
7978	}
7979
7980	return found;
7981}
7982
7983static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
7984{
7985	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7986	struct net_device *dev = info->user_ptr[1];
7987	struct cfg80211_ibss_params ibss;
7988	struct wiphy *wiphy;
7989	struct cfg80211_cached_keys *connkeys = NULL;
7990	int err;
7991
7992	memset(&ibss, 0, sizeof(ibss));
7993
7994	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7995		return -EINVAL;
7996
7997	if (!info->attrs[NL80211_ATTR_SSID] ||
7998	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
7999		return -EINVAL;
8000
8001	ibss.beacon_interval = 100;
8002
8003	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8004		ibss.beacon_interval =
8005			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8006
8007	err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8008					   ibss.beacon_interval);
8009	if (err)
8010		return err;
8011
8012	if (!rdev->ops->join_ibss)
8013		return -EOPNOTSUPP;
8014
8015	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8016		return -EOPNOTSUPP;
8017
8018	wiphy = &rdev->wiphy;
8019
8020	if (info->attrs[NL80211_ATTR_MAC]) {
8021		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8022
8023		if (!is_valid_ether_addr(ibss.bssid))
8024			return -EINVAL;
8025	}
8026	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8027	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8028
8029	if (info->attrs[NL80211_ATTR_IE]) {
8030		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8031		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8032	}
8033
8034	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8035	if (err)
8036		return err;
8037
8038	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8039				     NL80211_IFTYPE_ADHOC))
8040		return -EINVAL;
8041
8042	switch (ibss.chandef.width) {
8043	case NL80211_CHAN_WIDTH_5:
8044	case NL80211_CHAN_WIDTH_10:
8045	case NL80211_CHAN_WIDTH_20_NOHT:
8046		break;
8047	case NL80211_CHAN_WIDTH_20:
8048	case NL80211_CHAN_WIDTH_40:
8049		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8050			return -EINVAL;
8051		break;
8052	case NL80211_CHAN_WIDTH_80:
8053	case NL80211_CHAN_WIDTH_80P80:
8054	case NL80211_CHAN_WIDTH_160:
8055		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8056			return -EINVAL;
8057		if (!wiphy_ext_feature_isset(&rdev->wiphy,
8058					     NL80211_EXT_FEATURE_VHT_IBSS))
8059			return -EINVAL;
8060		break;
8061	default:
8062		return -EINVAL;
8063	}
8064
8065	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8066	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8067
8068	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8069		u8 *rates =
8070			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8071		int n_rates =
8072			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8073		struct ieee80211_supported_band *sband =
8074			wiphy->bands[ibss.chandef.chan->band];
8075
8076		err = ieee80211_get_ratemask(sband, rates, n_rates,
8077					     &ibss.basic_rates);
8078		if (err)
8079			return err;
8080	}
8081
8082	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8083		memcpy(&ibss.ht_capa_mask,
8084		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8085		       sizeof(ibss.ht_capa_mask));
8086
8087	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8088		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8089			return -EINVAL;
8090		memcpy(&ibss.ht_capa,
8091		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8092		       sizeof(ibss.ht_capa));
8093	}
8094
8095	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8096	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8097			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8098		return -EINVAL;
8099
8100	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8101		bool no_ht = false;
8102
8103		connkeys = nl80211_parse_connkeys(rdev,
8104					  info->attrs[NL80211_ATTR_KEYS],
8105					  &no_ht);
8106		if (IS_ERR(connkeys))
8107			return PTR_ERR(connkeys);
8108
8109		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8110		    no_ht) {
8111			kfree(connkeys);
8112			return -EINVAL;
8113		}
8114	}
8115
8116	ibss.control_port =
8117		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8118
8119	ibss.userspace_handles_dfs =
8120		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8121
8122	err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8123	if (err)
8124		kzfree(connkeys);
8125	return err;
8126}
8127
8128static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8129{
8130	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8131	struct net_device *dev = info->user_ptr[1];
8132
8133	if (!rdev->ops->leave_ibss)
8134		return -EOPNOTSUPP;
8135
8136	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8137		return -EOPNOTSUPP;
8138
8139	return cfg80211_leave_ibss(rdev, dev, false);
8140}
8141
8142static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8143{
8144	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8145	struct net_device *dev = info->user_ptr[1];
8146	int mcast_rate[NUM_NL80211_BANDS];
8147	u32 nla_rate;
8148	int err;
8149
8150	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8151	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8152	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8153		return -EOPNOTSUPP;
8154
8155	if (!rdev->ops->set_mcast_rate)
8156		return -EOPNOTSUPP;
8157
8158	memset(mcast_rate, 0, sizeof(mcast_rate));
8159
8160	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8161		return -EINVAL;
8162
8163	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8164	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8165		return -EINVAL;
8166
8167	err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
8168
8169	return err;
8170}
8171
8172static struct sk_buff *
8173__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8174			    struct wireless_dev *wdev, int approxlen,
8175			    u32 portid, u32 seq, enum nl80211_commands cmd,
8176			    enum nl80211_attrs attr,
8177			    const struct nl80211_vendor_cmd_info *info,
8178			    gfp_t gfp)
8179{
8180	struct sk_buff *skb;
8181	void *hdr;
8182	struct nlattr *data;
8183
8184	skb = nlmsg_new(approxlen + 100, gfp);
8185	if (!skb)
8186		return NULL;
8187
8188	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8189	if (!hdr) {
8190		kfree_skb(skb);
8191		return NULL;
8192	}
8193
8194	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8195		goto nla_put_failure;
8196
8197	if (info) {
8198		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8199				info->vendor_id))
8200			goto nla_put_failure;
8201		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8202				info->subcmd))
8203			goto nla_put_failure;
8204	}
8205
8206	if (wdev) {
8207		if (nla_put_u64(skb, NL80211_ATTR_WDEV,
8208				wdev_id(wdev)))
8209			goto nla_put_failure;
8210		if (wdev->netdev &&
8211		    nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8212				wdev->netdev->ifindex))
8213			goto nla_put_failure;
8214	}
8215
8216	data = nla_nest_start(skb, attr);
8217
8218	((void **)skb->cb)[0] = rdev;
8219	((void **)skb->cb)[1] = hdr;
8220	((void **)skb->cb)[2] = data;
8221
8222	return skb;
8223
8224 nla_put_failure:
8225	kfree_skb(skb);
8226	return NULL;
8227}
8228
8229struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8230					   struct wireless_dev *wdev,
8231					   enum nl80211_commands cmd,
8232					   enum nl80211_attrs attr,
8233					   int vendor_event_idx,
8234					   int approxlen, gfp_t gfp)
8235{
8236	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8237	const struct nl80211_vendor_cmd_info *info;
8238
8239	switch (cmd) {
8240	case NL80211_CMD_TESTMODE:
8241		if (WARN_ON(vendor_event_idx != -1))
8242			return NULL;
8243		info = NULL;
8244		break;
8245	case NL80211_CMD_VENDOR:
8246		if (WARN_ON(vendor_event_idx < 0 ||
8247			    vendor_event_idx >= wiphy->n_vendor_events))
8248			return NULL;
8249		info = &wiphy->vendor_events[vendor_event_idx];
8250		break;
8251	default:
8252		WARN_ON(1);
8253		return NULL;
8254	}
8255
8256	return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8257					   cmd, attr, info, gfp);
8258}
8259EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8260
8261void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8262{
8263	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8264	void *hdr = ((void **)skb->cb)[1];
8265	struct nlattr *data = ((void **)skb->cb)[2];
8266	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8267
8268	/* clear CB data for netlink core to own from now on */
8269	memset(skb->cb, 0, sizeof(skb->cb));
8270
8271	nla_nest_end(skb, data);
8272	genlmsg_end(skb, hdr);
8273
8274	if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8275		mcgrp = NL80211_MCGRP_VENDOR;
8276
8277	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8278				mcgrp, gfp);
8279}
8280EXPORT_SYMBOL(__cfg80211_send_event_skb);
8281
8282#ifdef CONFIG_NL80211_TESTMODE
8283static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8284{
8285	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8286	struct wireless_dev *wdev =
8287		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8288	int err;
8289
8290	if (!rdev->ops->testmode_cmd)
8291		return -EOPNOTSUPP;
8292
8293	if (IS_ERR(wdev)) {
8294		err = PTR_ERR(wdev);
8295		if (err != -EINVAL)
8296			return err;
8297		wdev = NULL;
8298	} else if (wdev->wiphy != &rdev->wiphy) {
8299		return -EINVAL;
8300	}
8301
8302	if (!info->attrs[NL80211_ATTR_TESTDATA])
8303		return -EINVAL;
8304
8305	rdev->cur_cmd_info = info;
8306	err = rdev_testmode_cmd(rdev, wdev,
8307				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8308				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8309	rdev->cur_cmd_info = NULL;
8310
8311	return err;
8312}
8313
8314static int nl80211_testmode_dump(struct sk_buff *skb,
8315				 struct netlink_callback *cb)
8316{
8317	struct cfg80211_registered_device *rdev;
8318	int err;
8319	long phy_idx;
8320	void *data = NULL;
8321	int data_len = 0;
8322
8323	rtnl_lock();
8324
8325	if (cb->args[0]) {
8326		/*
8327		 * 0 is a valid index, but not valid for args[0],
8328		 * so we need to offset by 1.
8329		 */
8330		phy_idx = cb->args[0] - 1;
8331	} else {
8332		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8333				  nl80211_fam.attrbuf, nl80211_fam.maxattr,
8334				  nl80211_policy);
8335		if (err)
8336			goto out_err;
8337
8338		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
8339						  nl80211_fam.attrbuf);
8340		if (IS_ERR(rdev)) {
8341			err = PTR_ERR(rdev);
8342			goto out_err;
8343		}
8344		phy_idx = rdev->wiphy_idx;
8345		rdev = NULL;
8346
8347		if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
8348			cb->args[1] =
8349				(long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
8350	}
8351
8352	if (cb->args[1]) {
8353		data = nla_data((void *)cb->args[1]);
8354		data_len = nla_len((void *)cb->args[1]);
8355	}
8356
8357	rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8358	if (!rdev) {
8359		err = -ENOENT;
8360		goto out_err;
8361	}
8362
8363	if (!rdev->ops->testmode_dump) {
8364		err = -EOPNOTSUPP;
8365		goto out_err;
8366	}
8367
8368	while (1) {
8369		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8370					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
8371					   NL80211_CMD_TESTMODE);
8372		struct nlattr *tmdata;
8373
8374		if (!hdr)
8375			break;
8376
8377		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8378			genlmsg_cancel(skb, hdr);
8379			break;
8380		}
8381
8382		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8383		if (!tmdata) {
8384			genlmsg_cancel(skb, hdr);
8385			break;
8386		}
8387		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8388		nla_nest_end(skb, tmdata);
8389
8390		if (err == -ENOBUFS || err == -ENOENT) {
8391			genlmsg_cancel(skb, hdr);
8392			break;
8393		} else if (err) {
8394			genlmsg_cancel(skb, hdr);
8395			goto out_err;
8396		}
8397
8398		genlmsg_end(skb, hdr);
8399	}
8400
8401	err = skb->len;
8402	/* see above */
8403	cb->args[0] = phy_idx + 1;
8404 out_err:
8405	rtnl_unlock();
8406	return err;
8407}
8408#endif
8409
8410static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8411{
8412	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8413	struct net_device *dev = info->user_ptr[1];
8414	struct cfg80211_connect_params connect;
8415	struct wiphy *wiphy;
8416	struct cfg80211_cached_keys *connkeys = NULL;
8417	int err;
8418
8419	memset(&connect, 0, sizeof(connect));
8420
8421	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8422		return -EINVAL;
8423
8424	if (!info->attrs[NL80211_ATTR_SSID] ||
8425	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
8426		return -EINVAL;
8427
8428	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8429		connect.auth_type =
8430			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8431		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8432					     NL80211_CMD_CONNECT))
8433			return -EINVAL;
8434	} else
8435		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8436
8437	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8438
8439	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8440				      NL80211_MAX_NR_CIPHER_SUITES);
8441	if (err)
8442		return err;
8443
8444	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8445	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8446		return -EOPNOTSUPP;
8447
8448	wiphy = &rdev->wiphy;
8449
8450	connect.bg_scan_period = -1;
8451	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8452		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8453		connect.bg_scan_period =
8454			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8455	}
8456
8457	if (info->attrs[NL80211_ATTR_MAC])
8458		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8459	else if (info->attrs[NL80211_ATTR_MAC_HINT])
8460		connect.bssid_hint =
8461			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8462	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8463	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8464
8465	if (info->attrs[NL80211_ATTR_IE]) {
8466		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8467		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8468	}
8469
8470	if (info->attrs[NL80211_ATTR_USE_MFP]) {
8471		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8472		if (connect.mfp != NL80211_MFP_REQUIRED &&
8473		    connect.mfp != NL80211_MFP_NO)
8474			return -EINVAL;
8475	} else {
8476		connect.mfp = NL80211_MFP_NO;
8477	}
8478
8479	if (info->attrs[NL80211_ATTR_PREV_BSSID])
8480		connect.prev_bssid =
8481			nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8482
8483	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8484		connect.channel = nl80211_get_valid_chan(
8485			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8486		if (!connect.channel)
8487			return -EINVAL;
8488	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8489		connect.channel_hint = nl80211_get_valid_chan(
8490			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8491		if (!connect.channel_hint)
8492			return -EINVAL;
8493	}
8494
8495	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8496		connkeys = nl80211_parse_connkeys(rdev,
8497					  info->attrs[NL80211_ATTR_KEYS], NULL);
8498		if (IS_ERR(connkeys))
8499			return PTR_ERR(connkeys);
8500	}
8501
8502	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8503		connect.flags |= ASSOC_REQ_DISABLE_HT;
8504
8505	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8506		memcpy(&connect.ht_capa_mask,
8507		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8508		       sizeof(connect.ht_capa_mask));
8509
8510	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8511		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
8512			kzfree(connkeys);
8513			return -EINVAL;
8514		}
8515		memcpy(&connect.ht_capa,
8516		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8517		       sizeof(connect.ht_capa));
8518	}
8519
8520	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8521		connect.flags |= ASSOC_REQ_DISABLE_VHT;
8522
8523	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8524		memcpy(&connect.vht_capa_mask,
8525		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8526		       sizeof(connect.vht_capa_mask));
8527
8528	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8529		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
8530			kzfree(connkeys);
8531			return -EINVAL;
8532		}
8533		memcpy(&connect.vht_capa,
8534		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8535		       sizeof(connect.vht_capa));
8536	}
8537
8538	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8539		if (!(rdev->wiphy.features &
8540		      NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) ||
8541		    !(rdev->wiphy.features & NL80211_FEATURE_QUIET)) {
8542			kzfree(connkeys);
8543			return -EINVAL;
8544		}
8545		connect.flags |= ASSOC_REQ_USE_RRM;
8546	}
8547
8548	connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
8549	if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
8550		kzfree(connkeys);
8551		return -EOPNOTSUPP;
8552	}
8553
8554	if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
8555		/* bss selection makes no sense if bssid is set */
8556		if (connect.bssid) {
8557			kzfree(connkeys);
8558			return -EINVAL;
8559		}
8560
8561		err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
8562				       wiphy, &connect.bss_select);
8563		if (err) {
8564			kzfree(connkeys);
8565			return err;
8566		}
8567	}
8568
8569	if (wiphy_ext_feature_isset(&rdev->wiphy,
8570				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
8571	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
8572	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
8573	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
8574	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
8575		connect.fils_erp_username =
8576			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
8577		connect.fils_erp_username_len =
8578			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
8579		connect.fils_erp_realm =
8580			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
8581		connect.fils_erp_realm_len =
8582			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
8583		connect.fils_erp_next_seq_num =
8584			nla_get_u16(
8585			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
8586		connect.fils_erp_rrk =
8587			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
8588		connect.fils_erp_rrk_len =
8589			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
8590	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
8591		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
8592		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
8593		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
8594		kzfree(connkeys);
8595		return -EINVAL;
8596	}
8597
8598	if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
8599		if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8600			kzfree(connkeys);
8601			return -EINVAL;
8602		}
8603		connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
8604	}
8605
8606	wdev_lock(dev->ieee80211_ptr);
8607	err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
8608	if (err)
8609		kzfree(connkeys);
8610
8611	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8612		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
8613		if (connect.bssid)
8614			memcpy(dev->ieee80211_ptr->disconnect_bssid,
8615			       connect.bssid, ETH_ALEN);
8616		else
8617			memset(dev->ieee80211_ptr->disconnect_bssid,
8618			       0, ETH_ALEN);
8619	}
8620
8621	wdev_unlock(dev->ieee80211_ptr);
8622
8623	return err;
8624}
8625
8626static int nl80211_update_connect_params(struct sk_buff *skb,
8627					 struct genl_info *info)
8628{
8629	struct cfg80211_connect_params connect = {};
8630	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8631	struct net_device *dev = info->user_ptr[1];
8632	struct wireless_dev *wdev = dev->ieee80211_ptr;
8633	u32 changed = 0;
8634	int ret;
8635
8636	if (!rdev->ops->update_connect_params)
8637		return -EOPNOTSUPP;
8638
8639	if (info->attrs[NL80211_ATTR_IE]) {
8640		if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8641			return -EINVAL;
8642		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8643		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8644		changed |= UPDATE_ASSOC_IES;
8645	}
8646
8647	if (wiphy_ext_feature_isset(&rdev->wiphy,
8648				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
8649	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
8650	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
8651	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
8652	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
8653		connect.fils_erp_username =
8654			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
8655		connect.fils_erp_username_len =
8656			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
8657		connect.fils_erp_realm =
8658			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
8659		connect.fils_erp_realm_len =
8660			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
8661		connect.fils_erp_next_seq_num =
8662			nla_get_u16(
8663			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
8664		connect.fils_erp_rrk =
8665			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
8666		connect.fils_erp_rrk_len =
8667			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
8668		changed |= UPDATE_FILS_ERP_INFO;
8669	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
8670		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
8671		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
8672		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
8673		return -EINVAL;
8674	}
8675
8676	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8677		u32 auth_type =
8678			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8679		if (!nl80211_valid_auth_type(rdev, auth_type,
8680					     NL80211_CMD_CONNECT))
8681			return -EINVAL;
8682		connect.auth_type = auth_type;
8683		changed |= UPDATE_AUTH_TYPE;
8684	}
8685
8686	wdev_lock(dev->ieee80211_ptr);
8687	if (!wdev->current_bss)
8688		ret = -ENOLINK;
8689	else
8690		ret = rdev_update_connect_params(rdev, dev, &connect, changed);
8691	wdev_unlock(dev->ieee80211_ptr);
8692
8693	return ret;
8694}
8695
8696static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
8697{
8698	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8699	struct net_device *dev = info->user_ptr[1];
8700	u16 reason;
8701	int ret;
8702
8703	if (!info->attrs[NL80211_ATTR_REASON_CODE])
8704		reason = WLAN_REASON_DEAUTH_LEAVING;
8705	else
8706		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8707
8708	if (reason == 0)
8709		return -EINVAL;
8710
8711	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8712	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8713		return -EOPNOTSUPP;
8714
8715	wdev_lock(dev->ieee80211_ptr);
8716	ret = cfg80211_disconnect(rdev, dev, reason, true);
8717	wdev_unlock(dev->ieee80211_ptr);
8718	return ret;
8719}
8720
8721static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
8722{
8723	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8724	struct net *net;
8725	int err;
8726
8727	if (info->attrs[NL80211_ATTR_PID]) {
8728		u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
8729
8730		net = get_net_ns_by_pid(pid);
8731	} else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
8732		u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
8733
8734		net = get_net_ns_by_fd(fd);
8735	} else {
8736		return -EINVAL;
8737	}
8738
8739	if (IS_ERR(net))
8740		return PTR_ERR(net);
8741
8742	err = 0;
8743
8744	/* check if anything to do */
8745	if (!net_eq(wiphy_net(&rdev->wiphy), net))
8746		err = cfg80211_switch_netns(rdev, net);
8747
8748	put_net(net);
8749	return err;
8750}
8751
8752static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
8753{
8754	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8755	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
8756			struct cfg80211_pmksa *pmksa) = NULL;
8757	struct net_device *dev = info->user_ptr[1];
8758	struct cfg80211_pmksa pmksa;
8759
8760	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
8761
8762	if (!info->attrs[NL80211_ATTR_PMKID])
8763		return -EINVAL;
8764
8765	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
8766
8767	if (info->attrs[NL80211_ATTR_MAC]) {
8768		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8769	} else if (info->attrs[NL80211_ATTR_SSID] &&
8770		   info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
8771		   (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
8772		    info->attrs[NL80211_ATTR_PMK])) {
8773		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8774		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8775		pmksa.cache_id =
8776			nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
8777	} else {
8778		return -EINVAL;
8779	}
8780	if (info->attrs[NL80211_ATTR_PMK]) {
8781		pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8782		pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
8783	}
8784
8785	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8786	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
8787	    !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
8788	      wiphy_ext_feature_isset(&rdev->wiphy,
8789				      NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
8790		return -EOPNOTSUPP;
8791
8792	switch (info->genlhdr->cmd) {
8793	case NL80211_CMD_SET_PMKSA:
8794		rdev_ops = rdev->ops->set_pmksa;
8795		break;
8796	case NL80211_CMD_DEL_PMKSA:
8797		rdev_ops = rdev->ops->del_pmksa;
8798		break;
8799	default:
8800		WARN_ON(1);
8801		break;
8802	}
8803
8804	if (!rdev_ops)
8805		return -EOPNOTSUPP;
8806
8807	return rdev_ops(&rdev->wiphy, dev, &pmksa);
8808}
8809
8810static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
8811{
8812	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8813	struct net_device *dev = info->user_ptr[1];
8814
8815	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8816	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8817		return -EOPNOTSUPP;
8818
8819	if (!rdev->ops->flush_pmksa)
8820		return -EOPNOTSUPP;
8821
8822	return rdev_flush_pmksa(rdev, dev);
8823}
8824
8825static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
8826{
8827	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8828	struct net_device *dev = info->user_ptr[1];
8829	u8 action_code, dialog_token;
8830	u32 peer_capability = 0;
8831	u16 status_code;
8832	u8 *peer;
8833	bool initiator;
8834
8835	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8836	    !rdev->ops->tdls_mgmt)
8837		return -EOPNOTSUPP;
8838
8839	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
8840	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
8841	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
8842	    !info->attrs[NL80211_ATTR_IE] ||
8843	    !info->attrs[NL80211_ATTR_MAC])
8844		return -EINVAL;
8845
8846	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8847	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
8848	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
8849	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
8850	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
8851	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
8852		peer_capability =
8853			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
8854
8855	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
8856			      dialog_token, status_code, peer_capability,
8857			      initiator,
8858			      nla_data(info->attrs[NL80211_ATTR_IE]),
8859			      nla_len(info->attrs[NL80211_ATTR_IE]));
8860}
8861
8862static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
8863{
8864	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8865	struct net_device *dev = info->user_ptr[1];
8866	enum nl80211_tdls_operation operation;
8867	u8 *peer;
8868
8869	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
8870	    !rdev->ops->tdls_oper)
8871		return -EOPNOTSUPP;
8872
8873	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
8874	    !info->attrs[NL80211_ATTR_MAC])
8875		return -EINVAL;
8876
8877	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
8878	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
8879
8880	return rdev_tdls_oper(rdev, dev, peer, operation);
8881}
8882
8883static int nl80211_remain_on_channel(struct sk_buff *skb,
8884				     struct genl_info *info)
8885{
8886	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8887	struct wireless_dev *wdev = info->user_ptr[1];
8888	struct cfg80211_chan_def chandef;
8889	struct sk_buff *msg;
8890	void *hdr;
8891	u64 cookie;
8892	u32 duration;
8893	int err;
8894
8895	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8896	    !info->attrs[NL80211_ATTR_DURATION])
8897		return -EINVAL;
8898
8899	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
8900
8901	if (!rdev->ops->remain_on_channel ||
8902	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
8903		return -EOPNOTSUPP;
8904
8905	/*
8906	 * We should be on that channel for at least a minimum amount of
8907	 * time (10ms) but no longer than the driver supports.
8908	 */
8909	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
8910	    duration > rdev->wiphy.max_remain_on_channel_duration)
8911		return -EINVAL;
8912
8913	err = nl80211_parse_chandef(rdev, info, &chandef);
8914	if (err)
8915		return err;
8916
8917	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8918	if (!msg)
8919		return -ENOMEM;
8920
8921	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8922			     NL80211_CMD_REMAIN_ON_CHANNEL);
8923	if (!hdr) {
8924		err = -ENOBUFS;
8925		goto free_msg;
8926	}
8927
8928	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
8929				     duration, &cookie);
8930
8931	if (err)
8932		goto free_msg;
8933
8934	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8935		goto nla_put_failure;
8936
8937	genlmsg_end(msg, hdr);
8938
8939	return genlmsg_reply(msg, info);
8940
8941 nla_put_failure:
8942	err = -ENOBUFS;
8943 free_msg:
8944	nlmsg_free(msg);
8945	return err;
8946}
8947
8948static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
8949					    struct genl_info *info)
8950{
8951	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8952	struct wireless_dev *wdev = info->user_ptr[1];
8953	u64 cookie;
8954
8955	if (!info->attrs[NL80211_ATTR_COOKIE])
8956		return -EINVAL;
8957
8958	if (!rdev->ops->cancel_remain_on_channel)
8959		return -EOPNOTSUPP;
8960
8961	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8962
8963	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
8964}
8965
8966static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
8967				       struct genl_info *info)
8968{
8969	struct cfg80211_bitrate_mask mask;
8970	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8971	struct net_device *dev = info->user_ptr[1];
8972	int err;
8973
8974	if (!rdev->ops->set_bitrate_mask)
8975		return -EOPNOTSUPP;
8976
8977	err = nl80211_parse_tx_bitrate_mask(info, &mask);
8978	if (err)
8979		return err;
8980
8981	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
8982}
8983
8984static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
8985{
8986	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8987	struct wireless_dev *wdev = info->user_ptr[1];
8988	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
8989
8990	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
8991		return -EINVAL;
8992
8993	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
8994		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
8995
8996	switch (wdev->iftype) {
8997	case NL80211_IFTYPE_STATION:
8998	case NL80211_IFTYPE_ADHOC:
8999	case NL80211_IFTYPE_P2P_CLIENT:
9000	case NL80211_IFTYPE_AP:
9001	case NL80211_IFTYPE_AP_VLAN:
9002	case NL80211_IFTYPE_MESH_POINT:
9003	case NL80211_IFTYPE_P2P_GO:
9004	case NL80211_IFTYPE_P2P_DEVICE:
9005		break;
9006	default:
9007		return -EOPNOTSUPP;
9008	}
9009
9010	/* not much point in registering if we can't reply */
9011	if (!rdev->ops->mgmt_tx)
9012		return -EOPNOTSUPP;
9013
9014	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9015			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9016			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9017}
9018
9019static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9020{
9021	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9022	struct wireless_dev *wdev = info->user_ptr[1];
9023	struct cfg80211_chan_def chandef;
9024	int err;
9025	void *hdr = NULL;
9026	u64 cookie;
9027	struct sk_buff *msg = NULL;
9028	struct cfg80211_mgmt_tx_params params = {
9029		.dont_wait_for_ack =
9030			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9031	};
9032
9033	if (!info->attrs[NL80211_ATTR_FRAME])
9034		return -EINVAL;
9035
9036	if (!rdev->ops->mgmt_tx)
9037		return -EOPNOTSUPP;
9038
9039	switch (wdev->iftype) {
9040	case NL80211_IFTYPE_P2P_DEVICE:
9041		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9042			return -EINVAL;
9043	case NL80211_IFTYPE_STATION:
9044	case NL80211_IFTYPE_ADHOC:
9045	case NL80211_IFTYPE_P2P_CLIENT:
9046	case NL80211_IFTYPE_AP:
9047	case NL80211_IFTYPE_AP_VLAN:
9048	case NL80211_IFTYPE_MESH_POINT:
9049	case NL80211_IFTYPE_P2P_GO:
9050		break;
9051	default:
9052		return -EOPNOTSUPP;
9053	}
9054
9055	if (info->attrs[NL80211_ATTR_DURATION]) {
9056		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9057			return -EINVAL;
9058		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9059
9060		/*
9061		 * We should wait on the channel for at least a minimum amount
9062		 * of time (10ms) but no longer than the driver supports.
9063		 */
9064		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9065		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
9066			return -EINVAL;
9067
9068	}
9069
9070	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9071
9072	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9073		return -EINVAL;
9074
9075	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9076
9077	/* get the channel if any has been specified, otherwise pass NULL to
9078	 * the driver. The latter will use the current one
9079	 */
9080	chandef.chan = NULL;
9081	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9082		err = nl80211_parse_chandef(rdev, info, &chandef);
9083		if (err)
9084			return err;
9085	}
9086
9087	if (!chandef.chan && params.offchan)
9088		return -EINVAL;
9089
9090	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9091	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9092
9093	if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9094		int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9095		int i;
9096
9097		if (len % sizeof(u16))
9098			return -EINVAL;
9099
9100		params.n_csa_offsets = len / sizeof(u16);
9101		params.csa_offsets =
9102			nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9103
9104		/* check that all the offsets fit the frame */
9105		for (i = 0; i < params.n_csa_offsets; i++) {
9106			if (params.csa_offsets[i] >= params.len)
9107				return -EINVAL;
9108		}
9109	}
9110
9111	if (!params.dont_wait_for_ack) {
9112		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9113		if (!msg)
9114			return -ENOMEM;
9115
9116		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9117				     NL80211_CMD_FRAME);
9118		if (!hdr) {
9119			err = -ENOBUFS;
9120			goto free_msg;
9121		}
9122	}
9123
9124	params.chan = chandef.chan;
9125	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9126	if (err)
9127		goto free_msg;
9128
9129	if (msg) {
9130		if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
9131			goto nla_put_failure;
9132
9133		genlmsg_end(msg, hdr);
9134		return genlmsg_reply(msg, info);
9135	}
9136
9137	return 0;
9138
9139 nla_put_failure:
9140	err = -ENOBUFS;
9141 free_msg:
9142	nlmsg_free(msg);
9143	return err;
9144}
9145
9146static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9147{
9148	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9149	struct wireless_dev *wdev = info->user_ptr[1];
9150	u64 cookie;
9151
9152	if (!info->attrs[NL80211_ATTR_COOKIE])
9153		return -EINVAL;
9154
9155	if (!rdev->ops->mgmt_tx_cancel_wait)
9156		return -EOPNOTSUPP;
9157
9158	switch (wdev->iftype) {
9159	case NL80211_IFTYPE_STATION:
9160	case NL80211_IFTYPE_ADHOC:
9161	case NL80211_IFTYPE_P2P_CLIENT:
9162	case NL80211_IFTYPE_AP:
9163	case NL80211_IFTYPE_AP_VLAN:
9164	case NL80211_IFTYPE_P2P_GO:
9165	case NL80211_IFTYPE_P2P_DEVICE:
9166		break;
9167	default:
9168		return -EOPNOTSUPP;
9169	}
9170
9171	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9172
9173	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9174}
9175
9176static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9177{
9178	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9179	struct wireless_dev *wdev;
9180	struct net_device *dev = info->user_ptr[1];
9181	u8 ps_state;
9182	bool state;
9183	int err;
9184
9185	if (!info->attrs[NL80211_ATTR_PS_STATE])
9186		return -EINVAL;
9187
9188	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9189
9190	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9191		return -EINVAL;
9192
9193	wdev = dev->ieee80211_ptr;
9194
9195	if (!rdev->ops->set_power_mgmt)
9196		return -EOPNOTSUPP;
9197
9198	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9199
9200	if (state == wdev->ps)
9201		return 0;
9202
9203	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9204	if (!err)
9205		wdev->ps = state;
9206	return err;
9207}
9208
9209static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9210{
9211	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9212	enum nl80211_ps_state ps_state;
9213	struct wireless_dev *wdev;
9214	struct net_device *dev = info->user_ptr[1];
9215	struct sk_buff *msg;
9216	void *hdr;
9217	int err;
9218
9219	wdev = dev->ieee80211_ptr;
9220
9221	if (!rdev->ops->set_power_mgmt)
9222		return -EOPNOTSUPP;
9223
9224	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9225	if (!msg)
9226		return -ENOMEM;
9227
9228	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9229			     NL80211_CMD_GET_POWER_SAVE);
9230	if (!hdr) {
9231		err = -ENOBUFS;
9232		goto free_msg;
9233	}
9234
9235	if (wdev->ps)
9236		ps_state = NL80211_PS_ENABLED;
9237	else
9238		ps_state = NL80211_PS_DISABLED;
9239
9240	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9241		goto nla_put_failure;
9242
9243	genlmsg_end(msg, hdr);
9244	return genlmsg_reply(msg, info);
9245
9246 nla_put_failure:
9247	err = -ENOBUFS;
9248 free_msg:
9249	nlmsg_free(msg);
9250	return err;
9251}
9252
9253static const struct nla_policy
9254nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9255	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
9256	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9257	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9258	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9259	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9260	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9261};
9262
9263static int nl80211_set_cqm_txe(struct genl_info *info,
9264			       u32 rate, u32 pkts, u32 intvl)
9265{
9266	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9267	struct net_device *dev = info->user_ptr[1];
9268	struct wireless_dev *wdev = dev->ieee80211_ptr;
9269
9270	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9271		return -EINVAL;
9272
9273	if (!rdev->ops->set_cqm_txe_config)
9274		return -EOPNOTSUPP;
9275
9276	if (wdev->iftype != NL80211_IFTYPE_STATION &&
9277	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9278		return -EOPNOTSUPP;
9279
9280	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9281}
9282
9283static int nl80211_set_cqm_rssi(struct genl_info *info,
9284				s32 threshold, u32 hysteresis)
9285{
9286	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9287	struct net_device *dev = info->user_ptr[1];
9288	struct wireless_dev *wdev = dev->ieee80211_ptr;
9289
9290	if (threshold > 0)
9291		return -EINVAL;
9292
9293	/* disabling - hysteresis should also be zero then */
9294	if (threshold == 0)
9295		hysteresis = 0;
9296
9297	if (!rdev->ops->set_cqm_rssi_config)
9298		return -EOPNOTSUPP;
9299
9300	if (wdev->iftype != NL80211_IFTYPE_STATION &&
9301	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9302		return -EOPNOTSUPP;
9303
9304	return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
9305}
9306
9307static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9308{
9309	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9310	struct nlattr *cqm;
9311	int err;
9312
9313	cqm = info->attrs[NL80211_ATTR_CQM];
9314	if (!cqm)
9315		return -EINVAL;
9316
9317	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9318			       nl80211_attr_cqm_policy);
9319	if (err)
9320		return err;
9321
9322	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9323	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9324		s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9325		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9326
9327		return nl80211_set_cqm_rssi(info, threshold, hysteresis);
9328	}
9329
9330	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9331	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9332	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9333		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9334		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9335		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9336
9337		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9338	}
9339
9340	return -EINVAL;
9341}
9342
9343static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9344{
9345	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9346	struct net_device *dev = info->user_ptr[1];
9347	struct ocb_setup setup = {};
9348	int err;
9349
9350	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9351	if (err)
9352		return err;
9353
9354	return cfg80211_join_ocb(rdev, dev, &setup);
9355}
9356
9357static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9358{
9359	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9360	struct net_device *dev = info->user_ptr[1];
9361
9362	return cfg80211_leave_ocb(rdev, dev);
9363}
9364
9365static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9366{
9367	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9368	struct net_device *dev = info->user_ptr[1];
9369	struct mesh_config cfg;
9370	struct mesh_setup setup;
9371	int err;
9372
9373	/* start with default */
9374	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9375	memcpy(&setup, &default_mesh_setup, sizeof(setup));
9376
9377	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9378		/* and parse parameters if given */
9379		err = nl80211_parse_mesh_config(info, &cfg, NULL);
9380		if (err)
9381			return err;
9382	}
9383
9384	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9385	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9386		return -EINVAL;
9387
9388	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9389	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9390
9391	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9392	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9393			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9394			return -EINVAL;
9395
9396	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9397		setup.beacon_interval =
9398			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9399
9400		err = cfg80211_validate_beacon_int(rdev,
9401						   NL80211_IFTYPE_MESH_POINT,
9402						   setup.beacon_interval);
9403		if (err)
9404			return err;
9405	}
9406
9407	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9408		setup.dtim_period =
9409			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9410		if (setup.dtim_period < 1 || setup.dtim_period > 100)
9411			return -EINVAL;
9412	}
9413
9414	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9415		/* parse additional setup parameters if given */
9416		err = nl80211_parse_mesh_setup(info, &setup);
9417		if (err)
9418			return err;
9419	}
9420
9421	if (setup.user_mpm)
9422		cfg.auto_open_plinks = false;
9423
9424	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9425		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9426		if (err)
9427			return err;
9428	} else {
9429		/* cfg80211_join_mesh() will sort it out */
9430		setup.chandef.chan = NULL;
9431	}
9432
9433	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9434		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9435		int n_rates =
9436			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9437		struct ieee80211_supported_band *sband;
9438
9439		if (!setup.chandef.chan)
9440			return -EINVAL;
9441
9442		sband = rdev->wiphy.bands[setup.chandef.chan->band];
9443
9444		err = ieee80211_get_ratemask(sband, rates, n_rates,
9445					     &setup.basic_rates);
9446		if (err)
9447			return err;
9448	}
9449
9450	if (info->attrs[NL80211_ATTR_TX_RATES] && setup.chandef.chan != NULL) {
9451		err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
9452		if (err)
9453			return err;
9454
9455		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
9456					      &setup.beacon_rate);
9457		if (err)
9458			return err;
9459	}
9460
9461	return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
9462}
9463
9464static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
9465{
9466	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9467	struct net_device *dev = info->user_ptr[1];
9468
9469	return cfg80211_leave_mesh(rdev, dev);
9470}
9471
9472#ifdef CONFIG_PM
9473static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
9474					struct cfg80211_registered_device *rdev)
9475{
9476	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
9477	struct nlattr *nl_pats, *nl_pat;
9478	int i, pat_len;
9479
9480	if (!wowlan->n_patterns)
9481		return 0;
9482
9483	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
9484	if (!nl_pats)
9485		return -ENOBUFS;
9486
9487	for (i = 0; i < wowlan->n_patterns; i++) {
9488		nl_pat = nla_nest_start(msg, i + 1);
9489		if (!nl_pat)
9490			return -ENOBUFS;
9491		pat_len = wowlan->patterns[i].pattern_len;
9492		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
9493			    wowlan->patterns[i].mask) ||
9494		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
9495			    wowlan->patterns[i].pattern) ||
9496		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
9497				wowlan->patterns[i].pkt_offset))
9498			return -ENOBUFS;
9499		nla_nest_end(msg, nl_pat);
9500	}
9501	nla_nest_end(msg, nl_pats);
9502
9503	return 0;
9504}
9505
9506static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
9507				   struct cfg80211_wowlan_tcp *tcp)
9508{
9509	struct nlattr *nl_tcp;
9510
9511	if (!tcp)
9512		return 0;
9513
9514	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
9515	if (!nl_tcp)
9516		return -ENOBUFS;
9517
9518	if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
9519	    nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
9520	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
9521	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
9522	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
9523	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
9524		    tcp->payload_len, tcp->payload) ||
9525	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
9526			tcp->data_interval) ||
9527	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
9528		    tcp->wake_len, tcp->wake_data) ||
9529	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
9530		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
9531		return -ENOBUFS;
9532
9533	if (tcp->payload_seq.len &&
9534	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
9535		    sizeof(tcp->payload_seq), &tcp->payload_seq))
9536		return -ENOBUFS;
9537
9538	if (tcp->payload_tok.len &&
9539	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
9540		    sizeof(tcp->payload_tok) + tcp->tokens_size,
9541		    &tcp->payload_tok))
9542		return -ENOBUFS;
9543
9544	nla_nest_end(msg, nl_tcp);
9545
9546	return 0;
9547}
9548
9549static int nl80211_send_wowlan_nd(struct sk_buff *msg,
9550				  struct cfg80211_sched_scan_request *req)
9551{
9552	struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
9553	int i;
9554
9555	if (!req)
9556		return 0;
9557
9558	nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
9559	if (!nd)
9560		return -ENOBUFS;
9561
9562	if (req->n_scan_plans == 1 &&
9563	    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
9564			req->scan_plans[0].interval * 1000))
9565		return -ENOBUFS;
9566
9567	if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
9568		return -ENOBUFS;
9569
9570	if (req->relative_rssi_set) {
9571		struct nl80211_bss_select_rssi_adjust rssi_adjust;
9572
9573		if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
9574			       req->relative_rssi))
9575			return -ENOBUFS;
9576
9577		rssi_adjust.band = req->rssi_adjust.band;
9578		rssi_adjust.delta = req->rssi_adjust.delta;
9579		if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
9580			    sizeof(rssi_adjust), &rssi_adjust))
9581			return -ENOBUFS;
9582	}
9583
9584	freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9585	if (!freqs)
9586		return -ENOBUFS;
9587
9588	for (i = 0; i < req->n_channels; i++)
9589		nla_put_u32(msg, i, req->channels[i]->center_freq);
9590
9591	nla_nest_end(msg, freqs);
9592
9593	if (req->n_match_sets) {
9594		matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
9595		for (i = 0; i < req->n_match_sets; i++) {
9596			match = nla_nest_start(msg, i);
9597			nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
9598				req->match_sets[i].ssid.ssid_len,
9599				req->match_sets[i].ssid.ssid);
9600			nla_nest_end(msg, match);
9601		}
9602		nla_nest_end(msg, matches);
9603	}
9604
9605	scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
9606	if (!scan_plans)
9607		return -ENOBUFS;
9608
9609	for (i = 0; i < req->n_scan_plans; i++) {
9610		scan_plan = nla_nest_start(msg, i + 1);
9611		if (!scan_plan ||
9612		    nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
9613				req->scan_plans[i].interval) ||
9614		    (req->scan_plans[i].iterations &&
9615		     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
9616				 req->scan_plans[i].iterations)))
9617			return -ENOBUFS;
9618		nla_nest_end(msg, scan_plan);
9619	}
9620	nla_nest_end(msg, scan_plans);
9621
9622	nla_nest_end(msg, nd);
9623
9624	return 0;
9625}
9626
9627static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
9628{
9629	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9630	struct sk_buff *msg;
9631	void *hdr;
9632	u32 size = NLMSG_DEFAULT_SIZE;
9633
9634	if (!rdev->wiphy.wowlan)
9635		return -EOPNOTSUPP;
9636
9637	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
9638		/* adjust size to have room for all the data */
9639		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
9640			rdev->wiphy.wowlan_config->tcp->payload_len +
9641			rdev->wiphy.wowlan_config->tcp->wake_len +
9642			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
9643	}
9644
9645	msg = nlmsg_new(size, GFP_KERNEL);
9646	if (!msg)
9647		return -ENOMEM;
9648
9649	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9650			     NL80211_CMD_GET_WOWLAN);
9651	if (!hdr)
9652		goto nla_put_failure;
9653
9654	if (rdev->wiphy.wowlan_config) {
9655		struct nlattr *nl_wowlan;
9656
9657		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
9658		if (!nl_wowlan)
9659			goto nla_put_failure;
9660
9661		if ((rdev->wiphy.wowlan_config->any &&
9662		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
9663		    (rdev->wiphy.wowlan_config->disconnect &&
9664		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
9665		    (rdev->wiphy.wowlan_config->magic_pkt &&
9666		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
9667		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
9668		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
9669		    (rdev->wiphy.wowlan_config->eap_identity_req &&
9670		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
9671		    (rdev->wiphy.wowlan_config->four_way_handshake &&
9672		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
9673		    (rdev->wiphy.wowlan_config->rfkill_release &&
9674		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
9675			goto nla_put_failure;
9676
9677		if (nl80211_send_wowlan_patterns(msg, rdev))
9678			goto nla_put_failure;
9679
9680		if (nl80211_send_wowlan_tcp(msg,
9681					    rdev->wiphy.wowlan_config->tcp))
9682			goto nla_put_failure;
9683
9684		if (nl80211_send_wowlan_nd(
9685			    msg,
9686			    rdev->wiphy.wowlan_config->nd_config))
9687			goto nla_put_failure;
9688
9689		nla_nest_end(msg, nl_wowlan);
9690	}
9691
9692	genlmsg_end(msg, hdr);
9693	return genlmsg_reply(msg, info);
9694
9695nla_put_failure:
9696	nlmsg_free(msg);
9697	return -ENOBUFS;
9698}
9699
9700static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
9701				    struct nlattr *attr,
9702				    struct cfg80211_wowlan *trig)
9703{
9704	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
9705	struct cfg80211_wowlan_tcp *cfg;
9706	struct nl80211_wowlan_tcp_data_token *tok = NULL;
9707	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
9708	u32 size;
9709	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
9710	int err, port;
9711
9712	if (!rdev->wiphy.wowlan->tcp)
9713		return -EINVAL;
9714
9715	err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
9716			nla_data(attr), nla_len(attr),
9717			nl80211_wowlan_tcp_policy);
9718	if (err)
9719		return err;
9720
9721	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
9722	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
9723	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
9724	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
9725	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
9726	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
9727	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
9728	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
9729		return -EINVAL;
9730
9731	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
9732	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
9733		return -EINVAL;
9734
9735	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
9736			rdev->wiphy.wowlan->tcp->data_interval_max ||
9737	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
9738		return -EINVAL;
9739
9740	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
9741	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
9742		return -EINVAL;
9743
9744	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
9745	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
9746		return -EINVAL;
9747
9748	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
9749		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9750
9751		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
9752		tokens_size = tokln - sizeof(*tok);
9753
9754		if (!tok->len || tokens_size % tok->len)
9755			return -EINVAL;
9756		if (!rdev->wiphy.wowlan->tcp->tok)
9757			return -EINVAL;
9758		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
9759			return -EINVAL;
9760		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
9761			return -EINVAL;
9762		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
9763			return -EINVAL;
9764		if (tok->offset + tok->len > data_size)
9765			return -EINVAL;
9766	}
9767
9768	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
9769		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
9770		if (!rdev->wiphy.wowlan->tcp->seq)
9771			return -EINVAL;
9772		if (seq->len == 0 || seq->len > 4)
9773			return -EINVAL;
9774		if (seq->len + seq->offset > data_size)
9775			return -EINVAL;
9776	}
9777
9778	size = sizeof(*cfg);
9779	size += data_size;
9780	size += wake_size + wake_mask_size;
9781	size += tokens_size;
9782
9783	cfg = kzalloc(size, GFP_KERNEL);
9784	if (!cfg)
9785		return -ENOMEM;
9786	cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
9787	cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
9788	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
9789	       ETH_ALEN);
9790	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
9791		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
9792	else
9793		port = 0;
9794#ifdef CONFIG_INET
9795	/* allocate a socket and port for it and use it */
9796	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
9797			    IPPROTO_TCP, &cfg->sock, 1);
9798	if (err) {
9799		kfree(cfg);
9800		return err;
9801	}
9802	if (inet_csk_get_port(cfg->sock->sk, port)) {
9803		sock_release(cfg->sock);
9804		kfree(cfg);
9805		return -EADDRINUSE;
9806	}
9807	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
9808#else
9809	if (!port) {
9810		kfree(cfg);
9811		return -EINVAL;
9812	}
9813	cfg->src_port = port;
9814#endif
9815
9816	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
9817	cfg->payload_len = data_size;
9818	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
9819	memcpy((void *)cfg->payload,
9820	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
9821	       data_size);
9822	if (seq)
9823		cfg->payload_seq = *seq;
9824	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
9825	cfg->wake_len = wake_size;
9826	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
9827	memcpy((void *)cfg->wake_data,
9828	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
9829	       wake_size);
9830	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
9831			 data_size + wake_size;
9832	memcpy((void *)cfg->wake_mask,
9833	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
9834	       wake_mask_size);
9835	if (tok) {
9836		cfg->tokens_size = tokens_size;
9837		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
9838	}
9839
9840	trig->tcp = cfg;
9841
9842	return 0;
9843}
9844
9845static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
9846				   const struct wiphy_wowlan_support *wowlan,
9847				   struct nlattr *attr,
9848				   struct cfg80211_wowlan *trig)
9849{
9850	struct nlattr **tb;
9851	int err;
9852
9853	tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
9854	if (!tb)
9855		return -ENOMEM;
9856
9857	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
9858		err = -EOPNOTSUPP;
9859		goto out;
9860	}
9861
9862	err = nla_parse(tb, NL80211_ATTR_MAX,
9863			nla_data(attr), nla_len(attr),
9864			nl80211_policy);
9865	if (err)
9866		goto out;
9867
9868	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb);
9869	err = PTR_ERR_OR_ZERO(trig->nd_config);
9870	if (err)
9871		trig->nd_config = NULL;
9872
9873out:
9874	kfree(tb);
9875	return err;
9876}
9877
9878static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
9879{
9880	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9881	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
9882	struct cfg80211_wowlan new_triggers = {};
9883	struct cfg80211_wowlan *ntrig;
9884	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
9885	int err, i;
9886	bool prev_enabled = rdev->wiphy.wowlan_config;
9887	bool regular = false;
9888
9889	if (!wowlan)
9890		return -EOPNOTSUPP;
9891
9892	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
9893		cfg80211_rdev_free_wowlan(rdev);
9894		rdev->wiphy.wowlan_config = NULL;
9895		goto set_wakeup;
9896	}
9897
9898	err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
9899			nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9900			nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
9901			nl80211_wowlan_policy);
9902	if (err)
9903		return err;
9904
9905	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
9906		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
9907			return -EINVAL;
9908		new_triggers.any = true;
9909	}
9910
9911	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
9912		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
9913			return -EINVAL;
9914		new_triggers.disconnect = true;
9915		regular = true;
9916	}
9917
9918	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
9919		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
9920			return -EINVAL;
9921		new_triggers.magic_pkt = true;
9922		regular = true;
9923	}
9924
9925	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
9926		return -EINVAL;
9927
9928	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
9929		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
9930			return -EINVAL;
9931		new_triggers.gtk_rekey_failure = true;
9932		regular = true;
9933	}
9934
9935	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
9936		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
9937			return -EINVAL;
9938		new_triggers.eap_identity_req = true;
9939		regular = true;
9940	}
9941
9942	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
9943		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
9944			return -EINVAL;
9945		new_triggers.four_way_handshake = true;
9946		regular = true;
9947	}
9948
9949	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
9950		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
9951			return -EINVAL;
9952		new_triggers.rfkill_release = true;
9953		regular = true;
9954	}
9955
9956	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
9957		struct nlattr *pat;
9958		int n_patterns = 0;
9959		int rem, pat_len, mask_len, pkt_offset;
9960		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
9961
9962		regular = true;
9963
9964		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9965				    rem)
9966			n_patterns++;
9967		if (n_patterns > wowlan->n_patterns)
9968			return -EINVAL;
9969
9970		new_triggers.patterns = kcalloc(n_patterns,
9971						sizeof(new_triggers.patterns[0]),
9972						GFP_KERNEL);
9973		if (!new_triggers.patterns)
9974			return -ENOMEM;
9975
9976		new_triggers.n_patterns = n_patterns;
9977		i = 0;
9978
9979		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
9980				    rem) {
9981			u8 *mask_pat;
9982
9983			nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
9984				  nla_len(pat), nl80211_packet_pattern_policy);
9985			err = -EINVAL;
9986			if (!pat_tb[NL80211_PKTPAT_MASK] ||
9987			    !pat_tb[NL80211_PKTPAT_PATTERN])
9988				goto error;
9989			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
9990			mask_len = DIV_ROUND_UP(pat_len, 8);
9991			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
9992				goto error;
9993			if (pat_len > wowlan->pattern_max_len ||
9994			    pat_len < wowlan->pattern_min_len)
9995				goto error;
9996
9997			if (!pat_tb[NL80211_PKTPAT_OFFSET])
9998				pkt_offset = 0;
9999			else
10000				pkt_offset = nla_get_u32(
10001					pat_tb[NL80211_PKTPAT_OFFSET]);
10002			if (pkt_offset > wowlan->max_pkt_offset)
10003				goto error;
10004			new_triggers.patterns[i].pkt_offset = pkt_offset;
10005
10006			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10007			if (!mask_pat) {
10008				err = -ENOMEM;
10009				goto error;
10010			}
10011			new_triggers.patterns[i].mask = mask_pat;
10012			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10013			       mask_len);
10014			mask_pat += mask_len;
10015			new_triggers.patterns[i].pattern = mask_pat;
10016			new_triggers.patterns[i].pattern_len = pat_len;
10017			memcpy(mask_pat,
10018			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10019			       pat_len);
10020			i++;
10021		}
10022	}
10023
10024	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10025		regular = true;
10026		err = nl80211_parse_wowlan_tcp(
10027			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10028			&new_triggers);
10029		if (err)
10030			goto error;
10031	}
10032
10033	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10034		regular = true;
10035		err = nl80211_parse_wowlan_nd(
10036			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10037			&new_triggers);
10038		if (err)
10039			goto error;
10040	}
10041
10042	/* The 'any' trigger means the device continues operating more or less
10043	 * as in its normal operation mode and wakes up the host on most of the
10044	 * normal interrupts (like packet RX, ...)
10045	 * It therefore makes little sense to combine with the more constrained
10046	 * wakeup trigger modes.
10047	 */
10048	if (new_triggers.any && regular) {
10049		err = -EINVAL;
10050		goto error;
10051	}
10052
10053	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10054	if (!ntrig) {
10055		err = -ENOMEM;
10056		goto error;
10057	}
10058	cfg80211_rdev_free_wowlan(rdev);
10059	rdev->wiphy.wowlan_config = ntrig;
10060
10061 set_wakeup:
10062	if (rdev->ops->set_wakeup &&
10063	    prev_enabled != !!rdev->wiphy.wowlan_config)
10064		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10065
10066	return 0;
10067 error:
10068	for (i = 0; i < new_triggers.n_patterns; i++)
10069		kfree(new_triggers.patterns[i].mask);
10070	kfree(new_triggers.patterns);
10071	if (new_triggers.tcp && new_triggers.tcp->sock)
10072		sock_release(new_triggers.tcp->sock);
10073	kfree(new_triggers.tcp);
10074	kfree(new_triggers.nd_config);
10075	return err;
10076}
10077#endif
10078
10079static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10080				       struct cfg80211_registered_device *rdev)
10081{
10082	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10083	int i, j, pat_len;
10084	struct cfg80211_coalesce_rules *rule;
10085
10086	if (!rdev->coalesce->n_rules)
10087		return 0;
10088
10089	nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10090	if (!nl_rules)
10091		return -ENOBUFS;
10092
10093	for (i = 0; i < rdev->coalesce->n_rules; i++) {
10094		nl_rule = nla_nest_start(msg, i + 1);
10095		if (!nl_rule)
10096			return -ENOBUFS;
10097
10098		rule = &rdev->coalesce->rules[i];
10099		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10100				rule->delay))
10101			return -ENOBUFS;
10102
10103		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10104				rule->condition))
10105			return -ENOBUFS;
10106
10107		nl_pats = nla_nest_start(msg,
10108				NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10109		if (!nl_pats)
10110			return -ENOBUFS;
10111
10112		for (j = 0; j < rule->n_patterns; j++) {
10113			nl_pat = nla_nest_start(msg, j + 1);
10114			if (!nl_pat)
10115				return -ENOBUFS;
10116			pat_len = rule->patterns[j].pattern_len;
10117			if (nla_put(msg, NL80211_PKTPAT_MASK,
10118				    DIV_ROUND_UP(pat_len, 8),
10119				    rule->patterns[j].mask) ||
10120			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10121				    rule->patterns[j].pattern) ||
10122			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10123					rule->patterns[j].pkt_offset))
10124				return -ENOBUFS;
10125			nla_nest_end(msg, nl_pat);
10126		}
10127		nla_nest_end(msg, nl_pats);
10128		nla_nest_end(msg, nl_rule);
10129	}
10130	nla_nest_end(msg, nl_rules);
10131
10132	return 0;
10133}
10134
10135static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10136{
10137	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10138	struct sk_buff *msg;
10139	void *hdr;
10140
10141	if (!rdev->wiphy.coalesce)
10142		return -EOPNOTSUPP;
10143
10144	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10145	if (!msg)
10146		return -ENOMEM;
10147
10148	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10149			     NL80211_CMD_GET_COALESCE);
10150	if (!hdr)
10151		goto nla_put_failure;
10152
10153	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10154		goto nla_put_failure;
10155
10156	genlmsg_end(msg, hdr);
10157	return genlmsg_reply(msg, info);
10158
10159nla_put_failure:
10160	nlmsg_free(msg);
10161	return -ENOBUFS;
10162}
10163
10164void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10165{
10166	struct cfg80211_coalesce *coalesce = rdev->coalesce;
10167	int i, j;
10168	struct cfg80211_coalesce_rules *rule;
10169
10170	if (!coalesce)
10171		return;
10172
10173	for (i = 0; i < coalesce->n_rules; i++) {
10174		rule = &coalesce->rules[i];
10175		for (j = 0; j < rule->n_patterns; j++)
10176			kfree(rule->patterns[j].mask);
10177		kfree(rule->patterns);
10178	}
10179	kfree(coalesce->rules);
10180	kfree(coalesce);
10181	rdev->coalesce = NULL;
10182}
10183
10184static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10185				       struct nlattr *rule,
10186				       struct cfg80211_coalesce_rules *new_rule)
10187{
10188	int err, i;
10189	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10190	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10191	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10192	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10193
10194	err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
10195			nla_len(rule), nl80211_coalesce_policy);
10196	if (err)
10197		return err;
10198
10199	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10200		new_rule->delay =
10201			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10202	if (new_rule->delay > coalesce->max_delay)
10203		return -EINVAL;
10204
10205	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10206		new_rule->condition =
10207			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10208	if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10209	    new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10210		return -EINVAL;
10211
10212	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10213		return -EINVAL;
10214
10215	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10216			    rem)
10217		n_patterns++;
10218	if (n_patterns > coalesce->n_patterns)
10219		return -EINVAL;
10220
10221	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10222				     GFP_KERNEL);
10223	if (!new_rule->patterns)
10224		return -ENOMEM;
10225
10226	new_rule->n_patterns = n_patterns;
10227	i = 0;
10228
10229	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10230			    rem) {
10231		u8 *mask_pat;
10232
10233		nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
10234			  nla_len(pat), nl80211_packet_pattern_policy);
10235		if (!pat_tb[NL80211_PKTPAT_MASK] ||
10236		    !pat_tb[NL80211_PKTPAT_PATTERN])
10237			return -EINVAL;
10238		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10239		mask_len = DIV_ROUND_UP(pat_len, 8);
10240		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10241			return -EINVAL;
10242		if (pat_len > coalesce->pattern_max_len ||
10243		    pat_len < coalesce->pattern_min_len)
10244			return -EINVAL;
10245
10246		if (!pat_tb[NL80211_PKTPAT_OFFSET])
10247			pkt_offset = 0;
10248		else
10249			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10250		if (pkt_offset > coalesce->max_pkt_offset)
10251			return -EINVAL;
10252		new_rule->patterns[i].pkt_offset = pkt_offset;
10253
10254		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10255		if (!mask_pat)
10256			return -ENOMEM;
10257
10258		new_rule->patterns[i].mask = mask_pat;
10259		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10260		       mask_len);
10261
10262		mask_pat += mask_len;
10263		new_rule->patterns[i].pattern = mask_pat;
10264		new_rule->patterns[i].pattern_len = pat_len;
10265		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10266		       pat_len);
10267		i++;
10268	}
10269
10270	return 0;
10271}
10272
10273static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10274{
10275	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10276	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10277	struct cfg80211_coalesce new_coalesce = {};
10278	struct cfg80211_coalesce *n_coalesce;
10279	int err, rem_rule, n_rules = 0, i, j;
10280	struct nlattr *rule;
10281	struct cfg80211_coalesce_rules *tmp_rule;
10282
10283	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10284		return -EOPNOTSUPP;
10285
10286	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10287		cfg80211_rdev_free_coalesce(rdev);
10288		rdev->ops->set_coalesce(&rdev->wiphy, NULL);
10289		return 0;
10290	}
10291
10292	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10293			    rem_rule)
10294		n_rules++;
10295	if (n_rules > coalesce->n_rules)
10296		return -EINVAL;
10297
10298	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10299				     GFP_KERNEL);
10300	if (!new_coalesce.rules)
10301		return -ENOMEM;
10302
10303	new_coalesce.n_rules = n_rules;
10304	i = 0;
10305
10306	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10307			    rem_rule) {
10308		err = nl80211_parse_coalesce_rule(rdev, rule,
10309						  &new_coalesce.rules[i]);
10310		if (err)
10311			goto error;
10312
10313		i++;
10314	}
10315
10316	err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
10317	if (err)
10318		goto error;
10319
10320	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10321	if (!n_coalesce) {
10322		err = -ENOMEM;
10323		goto error;
10324	}
10325	cfg80211_rdev_free_coalesce(rdev);
10326	rdev->coalesce = n_coalesce;
10327
10328	return 0;
10329error:
10330	for (i = 0; i < new_coalesce.n_rules; i++) {
10331		tmp_rule = &new_coalesce.rules[i];
10332		for (j = 0; j < tmp_rule->n_patterns; j++)
10333			kfree(tmp_rule->patterns[j].mask);
10334		kfree(tmp_rule->patterns);
10335	}
10336	kfree(new_coalesce.rules);
10337
10338	return err;
10339}
10340
10341static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10342{
10343	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10344	struct net_device *dev = info->user_ptr[1];
10345	struct wireless_dev *wdev = dev->ieee80211_ptr;
10346	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10347	struct cfg80211_gtk_rekey_data rekey_data;
10348	int err;
10349
10350	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10351		return -EINVAL;
10352
10353	err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
10354			nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
10355			nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
10356			nl80211_rekey_policy);
10357	if (err)
10358		return err;
10359
10360	if (!tb[NL80211_REKEY_DATA_KEK] || !tb[NL80211_REKEY_DATA_REPLAY_CTR] ||
10361	    (!wiphy_ext_feature_isset(&rdev->wiphy,
10362				      NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10363	     !wiphy_ext_feature_isset(&rdev->wiphy,
10364				      NL80211_EXT_FEATURE_FILS_STA) &&
10365	     !tb[NL80211_REKEY_DATA_KCK]))
10366		return -EINVAL;
10367
10368	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10369		return -ERANGE;
10370	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) < NL80211_KEK_LEN)
10371		return -ERANGE;
10372	if (tb[NL80211_REKEY_DATA_KCK] &&
10373	    nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10374		return -ERANGE;
10375
10376	memset(&rekey_data, 0, sizeof(rekey_data));
10377	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10378	rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
10379	if (tb[NL80211_REKEY_DATA_KCK])
10380		rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10381	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10382
10383	wdev_lock(wdev);
10384	if (!wdev->current_bss) {
10385		err = -ENOTCONN;
10386		goto out;
10387	}
10388
10389	if (!rdev->ops->set_rekey_data) {
10390		err = -EOPNOTSUPP;
10391		goto out;
10392	}
10393
10394	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10395 out:
10396	wdev_unlock(wdev);
10397	return err;
10398}
10399
10400static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10401					     struct genl_info *info)
10402{
10403	struct net_device *dev = info->user_ptr[1];
10404	struct wireless_dev *wdev = dev->ieee80211_ptr;
10405
10406	if (wdev->iftype != NL80211_IFTYPE_AP &&
10407	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
10408		return -EINVAL;
10409
10410	if (wdev->ap_unexpected_nlportid)
10411		return -EBUSY;
10412
10413	wdev->ap_unexpected_nlportid = info->snd_portid;
10414	return 0;
10415}
10416
10417static int nl80211_probe_client(struct sk_buff *skb,
10418				struct genl_info *info)
10419{
10420	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10421	struct net_device *dev = info->user_ptr[1];
10422	struct wireless_dev *wdev = dev->ieee80211_ptr;
10423	struct sk_buff *msg;
10424	void *hdr;
10425	const u8 *addr;
10426	u64 cookie;
10427	int err;
10428
10429	if (wdev->iftype != NL80211_IFTYPE_AP &&
10430	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
10431		return -EOPNOTSUPP;
10432
10433	if (!info->attrs[NL80211_ATTR_MAC])
10434		return -EINVAL;
10435
10436	if (!rdev->ops->probe_client)
10437		return -EOPNOTSUPP;
10438
10439	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10440	if (!msg)
10441		return -ENOMEM;
10442
10443	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10444			     NL80211_CMD_PROBE_CLIENT);
10445	if (!hdr) {
10446		err = -ENOBUFS;
10447		goto free_msg;
10448	}
10449
10450	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
10451
10452	err = rdev_probe_client(rdev, dev, addr, &cookie);
10453	if (err)
10454		goto free_msg;
10455
10456	if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10457		goto nla_put_failure;
10458
10459	genlmsg_end(msg, hdr);
10460
10461	return genlmsg_reply(msg, info);
10462
10463 nla_put_failure:
10464	err = -ENOBUFS;
10465 free_msg:
10466	nlmsg_free(msg);
10467	return err;
10468}
10469
10470static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
10471{
10472	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10473	struct cfg80211_beacon_registration *reg, *nreg;
10474	int rv;
10475
10476	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
10477		return -EOPNOTSUPP;
10478
10479	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
10480	if (!nreg)
10481		return -ENOMEM;
10482
10483	/* First, check if already registered. */
10484	spin_lock_bh(&rdev->beacon_registrations_lock);
10485	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
10486		if (reg->nlportid == info->snd_portid) {
10487			rv = -EALREADY;
10488			goto out_err;
10489		}
10490	}
10491	/* Add it to the list */
10492	nreg->nlportid = info->snd_portid;
10493	list_add(&nreg->list, &rdev->beacon_registrations);
10494
10495	spin_unlock_bh(&rdev->beacon_registrations_lock);
10496
10497	return 0;
10498out_err:
10499	spin_unlock_bh(&rdev->beacon_registrations_lock);
10500	kfree(nreg);
10501	return rv;
10502}
10503
10504static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
10505{
10506	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10507	struct wireless_dev *wdev = info->user_ptr[1];
10508	int err;
10509
10510	if (!rdev->ops->start_p2p_device)
10511		return -EOPNOTSUPP;
10512
10513	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10514		return -EOPNOTSUPP;
10515
10516	if (wdev->p2p_started)
10517		return 0;
10518
10519	if (rfkill_blocked(rdev->rfkill))
10520		return -ERFKILL;
10521
10522	err = rdev_start_p2p_device(rdev, wdev);
10523	if (err)
10524		return err;
10525
10526	wdev->p2p_started = true;
10527	rdev->opencount++;
10528
10529	return 0;
10530}
10531
10532static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
10533{
10534	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10535	struct wireless_dev *wdev = info->user_ptr[1];
10536
10537	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
10538		return -EOPNOTSUPP;
10539
10540	if (!rdev->ops->stop_p2p_device)
10541		return -EOPNOTSUPP;
10542
10543	cfg80211_stop_p2p_device(rdev, wdev);
10544
10545	return 0;
10546}
10547
10548static int nl80211_get_protocol_features(struct sk_buff *skb,
10549					 struct genl_info *info)
10550{
10551	void *hdr;
10552	struct sk_buff *msg;
10553
10554	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10555	if (!msg)
10556		return -ENOMEM;
10557
10558	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10559			     NL80211_CMD_GET_PROTOCOL_FEATURES);
10560	if (!hdr)
10561		goto nla_put_failure;
10562
10563	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
10564			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
10565		goto nla_put_failure;
10566
10567	genlmsg_end(msg, hdr);
10568	return genlmsg_reply(msg, info);
10569
10570 nla_put_failure:
10571	kfree_skb(msg);
10572	return -ENOBUFS;
10573}
10574
10575static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
10576{
10577	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10578	struct cfg80211_update_ft_ies_params ft_params;
10579	struct net_device *dev = info->user_ptr[1];
10580
10581	if (!rdev->ops->update_ft_ies)
10582		return -EOPNOTSUPP;
10583
10584	if (!info->attrs[NL80211_ATTR_MDID] ||
10585	    !info->attrs[NL80211_ATTR_IE] ||
10586	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
10587		return -EINVAL;
10588
10589	memset(&ft_params, 0, sizeof(ft_params));
10590	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
10591	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10592	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10593
10594	return rdev_update_ft_ies(rdev, dev, &ft_params);
10595}
10596
10597static int nl80211_crit_protocol_start(struct sk_buff *skb,
10598				       struct genl_info *info)
10599{
10600	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10601	struct wireless_dev *wdev = info->user_ptr[1];
10602	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
10603	u16 duration;
10604	int ret;
10605
10606	if (!rdev->ops->crit_proto_start)
10607		return -EOPNOTSUPP;
10608
10609	if (WARN_ON(!rdev->ops->crit_proto_stop))
10610		return -EINVAL;
10611
10612	if (rdev->crit_proto_nlportid)
10613		return -EBUSY;
10614
10615	/* determine protocol if provided */
10616	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
10617		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
10618
10619	if (proto >= NUM_NL80211_CRIT_PROTO)
10620		return -EINVAL;
10621
10622	/* timeout must be provided */
10623	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
10624		return -EINVAL;
10625
10626	duration =
10627		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
10628
10629	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
10630		return -ERANGE;
10631
10632	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
10633	if (!ret)
10634		rdev->crit_proto_nlportid = info->snd_portid;
10635
10636	return ret;
10637}
10638
10639static int nl80211_crit_protocol_stop(struct sk_buff *skb,
10640				      struct genl_info *info)
10641{
10642	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10643	struct wireless_dev *wdev = info->user_ptr[1];
10644
10645	if (!rdev->ops->crit_proto_stop)
10646		return -EOPNOTSUPP;
10647
10648	if (rdev->crit_proto_nlportid) {
10649		rdev->crit_proto_nlportid = 0;
10650		rdev_crit_proto_stop(rdev, wdev);
10651	}
10652	return 0;
10653}
10654
10655static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
10656{
10657	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10658	struct wireless_dev *wdev =
10659		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
10660	int i, err;
10661	u32 vid, subcmd;
10662
10663	if (!rdev->wiphy.vendor_commands)
10664		return -EOPNOTSUPP;
10665
10666	if (IS_ERR(wdev)) {
10667		err = PTR_ERR(wdev);
10668		if (err != -EINVAL)
10669			return err;
10670		wdev = NULL;
10671	} else if (wdev->wiphy != &rdev->wiphy) {
10672		return -EINVAL;
10673	}
10674
10675	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
10676	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
10677		return -EINVAL;
10678
10679	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
10680	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
10681	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
10682		const struct wiphy_vendor_command *vcmd;
10683		void *data = NULL;
10684		int len = 0;
10685
10686		vcmd = &rdev->wiphy.vendor_commands[i];
10687
10688		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10689			continue;
10690
10691		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10692				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10693			if (!wdev)
10694				return -EINVAL;
10695			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10696			    !wdev->netdev)
10697				return -EINVAL;
10698
10699			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10700				if (wdev->netdev &&
10701				    !netif_running(wdev->netdev))
10702					return -ENETDOWN;
10703				if (!wdev->netdev && !wdev->p2p_started)
10704					return -ENETDOWN;
10705			}
10706
10707			if (!vcmd->doit)
10708				return -EOPNOTSUPP;
10709		} else {
10710			wdev = NULL;
10711		}
10712
10713		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
10714			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10715			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
10716		}
10717
10718		rdev->cur_cmd_info = info;
10719		err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
10720							  data, len);
10721		rdev->cur_cmd_info = NULL;
10722		return err;
10723	}
10724
10725	return -EOPNOTSUPP;
10726}
10727
10728static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
10729				       struct netlink_callback *cb,
10730				       struct cfg80211_registered_device **rdev,
10731				       struct wireless_dev **wdev)
10732{
10733	u32 vid, subcmd;
10734	unsigned int i;
10735	int vcmd_idx = -1;
10736	int err;
10737	void *data = NULL;
10738	unsigned int data_len = 0;
10739
10740	if (cb->args[0]) {
10741		/* subtract the 1 again here */
10742		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
10743		struct wireless_dev *tmp;
10744
10745		if (!wiphy)
10746			return -ENODEV;
10747		*rdev = wiphy_to_rdev(wiphy);
10748		*wdev = NULL;
10749
10750		if (cb->args[1]) {
10751			list_for_each_entry(tmp, &wiphy->wdev_list, list) {
10752				if (tmp->identifier == cb->args[1] - 1) {
10753					*wdev = tmp;
10754					break;
10755				}
10756			}
10757		}
10758
10759		/* keep rtnl locked in successful case */
10760		return 0;
10761	}
10762
10763	err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
10764			  nl80211_fam.attrbuf, nl80211_fam.maxattr,
10765			  nl80211_policy);
10766	if (err)
10767		return err;
10768
10769	if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] ||
10770	    !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
10771		return -EINVAL;
10772
10773	*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
10774					   nl80211_fam.attrbuf);
10775	if (IS_ERR(*wdev))
10776		*wdev = NULL;
10777
10778	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
10779					   nl80211_fam.attrbuf);
10780	if (IS_ERR(*rdev))
10781		return PTR_ERR(*rdev);
10782
10783	vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]);
10784	subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
10785
10786	for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
10787		const struct wiphy_vendor_command *vcmd;
10788
10789		vcmd = &(*rdev)->wiphy.vendor_commands[i];
10790
10791		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
10792			continue;
10793
10794		if (!vcmd->dumpit)
10795			return -EOPNOTSUPP;
10796
10797		vcmd_idx = i;
10798		break;
10799	}
10800
10801	if (vcmd_idx < 0)
10802		return -EOPNOTSUPP;
10803
10804	if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) {
10805		data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10806		data_len = nla_len(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]);
10807	}
10808
10809	/* 0 is the first index - add 1 to parse only once */
10810	cb->args[0] = (*rdev)->wiphy_idx + 1;
10811	/* add 1 to know if it was NULL */
10812	cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
10813	cb->args[2] = vcmd_idx;
10814	cb->args[3] = (unsigned long)data;
10815	cb->args[4] = data_len;
10816
10817	/* keep rtnl locked in successful case */
10818	return 0;
10819}
10820
10821static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
10822				   struct netlink_callback *cb)
10823{
10824	struct cfg80211_registered_device *rdev;
10825	struct wireless_dev *wdev;
10826	unsigned int vcmd_idx;
10827	const struct wiphy_vendor_command *vcmd;
10828	void *data;
10829	int data_len;
10830	int err;
10831	struct nlattr *vendor_data;
10832
10833	rtnl_lock();
10834	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
10835	if (err)
10836		goto out;
10837
10838	vcmd_idx = cb->args[2];
10839	data = (void *)cb->args[3];
10840	data_len = cb->args[4];
10841	vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
10842
10843	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
10844			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
10845		if (!wdev) {
10846			err = -EINVAL;
10847			goto out;
10848		}
10849		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
10850		    !wdev->netdev) {
10851			err = -EINVAL;
10852			goto out;
10853		}
10854
10855		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
10856			if (wdev->netdev &&
10857			    !netif_running(wdev->netdev)) {
10858				err = -ENETDOWN;
10859				goto out;
10860			}
10861			if (!wdev->netdev && !wdev->p2p_started) {
10862				err = -ENETDOWN;
10863				goto out;
10864			}
10865		}
10866	}
10867
10868	while (1) {
10869		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10870					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
10871					   NL80211_CMD_VENDOR);
10872		if (!hdr)
10873			break;
10874
10875		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10876		    (wdev && nla_put_u64(skb, NL80211_ATTR_WDEV,
10877					 wdev_id(wdev)))) {
10878			genlmsg_cancel(skb, hdr);
10879			break;
10880		}
10881
10882		vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
10883		if (!vendor_data) {
10884			genlmsg_cancel(skb, hdr);
10885			break;
10886		}
10887
10888		err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
10889				   (unsigned long *)&cb->args[5]);
10890		nla_nest_end(skb, vendor_data);
10891
10892		if (err == -ENOBUFS || err == -ENOENT) {
10893			genlmsg_cancel(skb, hdr);
10894			break;
10895		} else if (err) {
10896			genlmsg_cancel(skb, hdr);
10897			goto out;
10898		}
10899
10900		genlmsg_end(skb, hdr);
10901	}
10902
10903	err = skb->len;
10904 out:
10905	rtnl_unlock();
10906	return err;
10907}
10908
10909struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
10910					   enum nl80211_commands cmd,
10911					   enum nl80211_attrs attr,
10912					   int approxlen)
10913{
10914	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10915
10916	if (WARN_ON(!rdev->cur_cmd_info))
10917		return NULL;
10918
10919	return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
10920					   rdev->cur_cmd_info->snd_portid,
10921					   rdev->cur_cmd_info->snd_seq,
10922					   cmd, attr, NULL, GFP_KERNEL);
10923}
10924EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
10925
10926int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
10927{
10928	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10929	void *hdr = ((void **)skb->cb)[1];
10930	struct nlattr *data = ((void **)skb->cb)[2];
10931
10932	/* clear CB data for netlink core to own from now on */
10933	memset(skb->cb, 0, sizeof(skb->cb));
10934
10935	if (WARN_ON(!rdev->cur_cmd_info)) {
10936		kfree_skb(skb);
10937		return -EINVAL;
10938	}
10939
10940	nla_nest_end(skb, data);
10941	genlmsg_end(skb, hdr);
10942	return genlmsg_reply(skb, rdev->cur_cmd_info);
10943}
10944EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
10945
10946
10947static int nl80211_set_qos_map(struct sk_buff *skb,
10948			       struct genl_info *info)
10949{
10950	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10951	struct cfg80211_qos_map *qos_map = NULL;
10952	struct net_device *dev = info->user_ptr[1];
10953	u8 *pos, len, num_des, des_len, des;
10954	int ret;
10955
10956	if (!rdev->ops->set_qos_map)
10957		return -EOPNOTSUPP;
10958
10959	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
10960		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
10961		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
10962
10963		if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
10964		    len > IEEE80211_QOS_MAP_LEN_MAX)
10965			return -EINVAL;
10966
10967		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
10968		if (!qos_map)
10969			return -ENOMEM;
10970
10971		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
10972		if (num_des) {
10973			des_len = num_des *
10974				sizeof(struct cfg80211_dscp_exception);
10975			memcpy(qos_map->dscp_exception, pos, des_len);
10976			qos_map->num_des = num_des;
10977			for (des = 0; des < num_des; des++) {
10978				if (qos_map->dscp_exception[des].up > 7) {
10979					kfree(qos_map);
10980					return -EINVAL;
10981				}
10982			}
10983			pos += des_len;
10984		}
10985		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
10986	}
10987
10988	wdev_lock(dev->ieee80211_ptr);
10989	ret = nl80211_key_allowed(dev->ieee80211_ptr);
10990	if (!ret)
10991		ret = rdev_set_qos_map(rdev, dev, qos_map);
10992	wdev_unlock(dev->ieee80211_ptr);
10993
10994	kfree(qos_map);
10995	return ret;
10996}
10997
10998static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
10999{
11000	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11001	struct net_device *dev = info->user_ptr[1];
11002	struct wireless_dev *wdev = dev->ieee80211_ptr;
11003	const u8 *peer;
11004	u8 tsid, up;
11005	u16 admitted_time = 0;
11006	int err;
11007
11008	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
11009		return -EOPNOTSUPP;
11010
11011	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
11012	    !info->attrs[NL80211_ATTR_USER_PRIO])
11013		return -EINVAL;
11014
11015	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11016	if (tsid >= IEEE80211_NUM_TIDS)
11017		return -EINVAL;
11018
11019	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
11020	if (up >= IEEE80211_NUM_UPS)
11021		return -EINVAL;
11022
11023	/* WMM uses TIDs 0-7 even for TSPEC */
11024	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
11025		/* TODO: handle 802.11 TSPEC/admission control
11026		 * need more attributes for that (e.g. BA session requirement);
11027		 * change the WMM adminssion test above to allow both then
11028		 */
11029		return -EINVAL;
11030	}
11031
11032	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11033
11034	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
11035		admitted_time =
11036			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
11037		if (!admitted_time)
11038			return -EINVAL;
11039	}
11040
11041	wdev_lock(wdev);
11042	switch (wdev->iftype) {
11043	case NL80211_IFTYPE_STATION:
11044	case NL80211_IFTYPE_P2P_CLIENT:
11045		if (wdev->current_bss)
11046			break;
11047		err = -ENOTCONN;
11048		goto out;
11049	default:
11050		err = -EOPNOTSUPP;
11051		goto out;
11052	}
11053
11054	err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
11055
11056 out:
11057	wdev_unlock(wdev);
11058	return err;
11059}
11060
11061static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
11062{
11063	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11064	struct net_device *dev = info->user_ptr[1];
11065	struct wireless_dev *wdev = dev->ieee80211_ptr;
11066	const u8 *peer;
11067	u8 tsid;
11068	int err;
11069
11070	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
11071		return -EINVAL;
11072
11073	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
11074	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11075
11076	wdev_lock(wdev);
11077	err = rdev_del_tx_ts(rdev, dev, tsid, peer);
11078	wdev_unlock(wdev);
11079
11080	return err;
11081}
11082
11083static int nl80211_tdls_channel_switch(struct sk_buff *skb,
11084				       struct genl_info *info)
11085{
11086	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11087	struct net_device *dev = info->user_ptr[1];
11088	struct wireless_dev *wdev = dev->ieee80211_ptr;
11089	struct cfg80211_chan_def chandef = {};
11090	const u8 *addr;
11091	u8 oper_class;
11092	int err;
11093
11094	if (!rdev->ops->tdls_channel_switch ||
11095	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11096		return -EOPNOTSUPP;
11097
11098	switch (dev->ieee80211_ptr->iftype) {
11099	case NL80211_IFTYPE_STATION:
11100	case NL80211_IFTYPE_P2P_CLIENT:
11101		break;
11102	default:
11103		return -EOPNOTSUPP;
11104	}
11105
11106	if (!info->attrs[NL80211_ATTR_MAC] ||
11107	    !info->attrs[NL80211_ATTR_OPER_CLASS])
11108		return -EINVAL;
11109
11110	err = nl80211_parse_chandef(rdev, info, &chandef);
11111	if (err)
11112		return err;
11113
11114	/*
11115	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
11116	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
11117	 * specification is not defined for them.
11118	 */
11119	if (chandef.chan->band == NL80211_BAND_2GHZ &&
11120	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
11121	    chandef.width != NL80211_CHAN_WIDTH_20)
11122		return -EINVAL;
11123
11124	/* we will be active on the TDLS link */
11125	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
11126					   wdev->iftype))
11127		return -EINVAL;
11128
11129	/* don't allow switching to DFS channels */
11130	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
11131		return -EINVAL;
11132
11133	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11134	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
11135
11136	wdev_lock(wdev);
11137	err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
11138	wdev_unlock(wdev);
11139
11140	return err;
11141}
11142
11143static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
11144					      struct genl_info *info)
11145{
11146	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11147	struct net_device *dev = info->user_ptr[1];
11148	struct wireless_dev *wdev = dev->ieee80211_ptr;
11149	const u8 *addr;
11150
11151	if (!rdev->ops->tdls_channel_switch ||
11152	    !rdev->ops->tdls_cancel_channel_switch ||
11153	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
11154		return -EOPNOTSUPP;
11155
11156	switch (dev->ieee80211_ptr->iftype) {
11157	case NL80211_IFTYPE_STATION:
11158	case NL80211_IFTYPE_P2P_CLIENT:
11159		break;
11160	default:
11161		return -EOPNOTSUPP;
11162	}
11163
11164	if (!info->attrs[NL80211_ATTR_MAC])
11165		return -EINVAL;
11166
11167	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11168
11169	wdev_lock(wdev);
11170	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
11171	wdev_unlock(wdev);
11172
11173	return 0;
11174}
11175
11176static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
11177{
11178	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11179	struct net_device *dev = info->user_ptr[1];
11180	struct cfg80211_external_auth_params params;
11181
11182	if (!rdev->ops->external_auth)
11183		return -EOPNOTSUPP;
11184
11185	if (!info->attrs[NL80211_ATTR_SSID] &&
11186	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
11187	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
11188		return -EINVAL;
11189
11190	if (!info->attrs[NL80211_ATTR_BSSID])
11191		return -EINVAL;
11192
11193	if (!info->attrs[NL80211_ATTR_STATUS_CODE])
11194		return -EINVAL;
11195
11196	memset(&params, 0, sizeof(params));
11197
11198	if (info->attrs[NL80211_ATTR_SSID]) {
11199		params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11200		if (params.ssid.ssid_len == 0 ||
11201		    params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
11202			return -EINVAL;
11203		memcpy(params.ssid.ssid,
11204		       nla_data(info->attrs[NL80211_ATTR_SSID]),
11205		       params.ssid.ssid_len);
11206	}
11207
11208	memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
11209	       ETH_ALEN);
11210
11211	params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11212
11213	if (info->attrs[NL80211_ATTR_PMKID])
11214		params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11215
11216	return rdev_external_auth(rdev, dev, &params);
11217}
11218
11219static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
11220{
11221	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11222	struct cfg80211_update_owe_info owe_info;
11223	struct net_device *dev = info->user_ptr[1];
11224
11225	if (!rdev->ops->update_owe_info)
11226		return -EOPNOTSUPP;
11227
11228	if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
11229	    !info->attrs[NL80211_ATTR_MAC])
11230		return -EINVAL;
11231
11232	memset(&owe_info, 0, sizeof(owe_info));
11233	owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11234	nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
11235
11236	if (info->attrs[NL80211_ATTR_IE]) {
11237		owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11238		owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11239	}
11240
11241	return rdev_update_owe_info(rdev, dev, &owe_info);
11242}
11243
11244#define NL80211_FLAG_NEED_WIPHY		0x01
11245#define NL80211_FLAG_NEED_NETDEV	0x02
11246#define NL80211_FLAG_NEED_RTNL		0x04
11247#define NL80211_FLAG_CHECK_NETDEV_UP	0x08
11248#define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
11249					 NL80211_FLAG_CHECK_NETDEV_UP)
11250#define NL80211_FLAG_NEED_WDEV		0x10
11251/* If a netdev is associated, it must be UP, P2P must be started */
11252#define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
11253					 NL80211_FLAG_CHECK_NETDEV_UP)
11254#define NL80211_FLAG_CLEAR_SKB		0x20
11255
11256static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
11257			    struct genl_info *info)
11258{
11259	struct cfg80211_registered_device *rdev;
11260	struct wireless_dev *wdev;
11261	struct net_device *dev;
11262	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
11263
11264	if (rtnl)
11265		rtnl_lock();
11266
11267	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
11268		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
11269		if (IS_ERR(rdev)) {
11270			if (rtnl)
11271				rtnl_unlock();
11272			return PTR_ERR(rdev);
11273		}
11274		info->user_ptr[0] = rdev;
11275	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
11276		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11277		ASSERT_RTNL();
11278
11279		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
11280						  info->attrs);
11281		if (IS_ERR(wdev)) {
11282			if (rtnl)
11283				rtnl_unlock();
11284			return PTR_ERR(wdev);
11285		}
11286
11287		dev = wdev->netdev;
11288		rdev = wiphy_to_rdev(wdev->wiphy);
11289
11290		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
11291			if (!dev) {
11292				if (rtnl)
11293					rtnl_unlock();
11294				return -EINVAL;
11295			}
11296
11297			info->user_ptr[1] = dev;
11298		} else {
11299			info->user_ptr[1] = wdev;
11300		}
11301
11302		if (dev) {
11303			if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
11304			    !netif_running(dev)) {
11305				if (rtnl)
11306					rtnl_unlock();
11307				return -ENETDOWN;
11308			}
11309
11310			dev_hold(dev);
11311		} else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
11312			if (!wdev->p2p_started) {
11313				if (rtnl)
11314					rtnl_unlock();
11315				return -ENETDOWN;
11316			}
11317		}
11318
11319		info->user_ptr[0] = rdev;
11320	}
11321
11322	return 0;
11323}
11324
11325static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
11326			      struct genl_info *info)
11327{
11328	if (info->user_ptr[1]) {
11329		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
11330			struct wireless_dev *wdev = info->user_ptr[1];
11331
11332			if (wdev->netdev)
11333				dev_put(wdev->netdev);
11334		} else {
11335			dev_put(info->user_ptr[1]);
11336		}
11337	}
11338
11339	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
11340		rtnl_unlock();
11341
11342	/* If needed, clear the netlink message payload from the SKB
11343	 * as it might contain key data that shouldn't stick around on
11344	 * the heap after the SKB is freed. The netlink message header
11345	 * is still needed for further processing, so leave it intact.
11346	 */
11347	if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
11348		struct nlmsghdr *nlh = nlmsg_hdr(skb);
11349
11350		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
11351	}
11352}
11353
11354static const struct genl_ops nl80211_ops[] = {
11355	{
11356		.cmd = NL80211_CMD_GET_WIPHY,
11357		.doit = nl80211_get_wiphy,
11358		.dumpit = nl80211_dump_wiphy,
11359		.done = nl80211_dump_wiphy_done,
11360		.policy = nl80211_policy,
11361		/* can be retrieved by unprivileged users */
11362		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11363				  NL80211_FLAG_NEED_RTNL,
11364	},
11365	{
11366		.cmd = NL80211_CMD_SET_WIPHY,
11367		.doit = nl80211_set_wiphy,
11368		.policy = nl80211_policy,
11369		.flags = GENL_ADMIN_PERM,
11370		.internal_flags = NL80211_FLAG_NEED_RTNL,
11371	},
11372	{
11373		.cmd = NL80211_CMD_GET_INTERFACE,
11374		.doit = nl80211_get_interface,
11375		.dumpit = nl80211_dump_interface,
11376		.policy = nl80211_policy,
11377		/* can be retrieved by unprivileged users */
11378		.internal_flags = NL80211_FLAG_NEED_WDEV |
11379				  NL80211_FLAG_NEED_RTNL,
11380	},
11381	{
11382		.cmd = NL80211_CMD_SET_INTERFACE,
11383		.doit = nl80211_set_interface,
11384		.policy = nl80211_policy,
11385		.flags = GENL_ADMIN_PERM,
11386		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11387				  NL80211_FLAG_NEED_RTNL,
11388	},
11389	{
11390		.cmd = NL80211_CMD_NEW_INTERFACE,
11391		.doit = nl80211_new_interface,
11392		.policy = nl80211_policy,
11393		.flags = GENL_ADMIN_PERM,
11394		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11395				  NL80211_FLAG_NEED_RTNL,
11396	},
11397	{
11398		.cmd = NL80211_CMD_DEL_INTERFACE,
11399		.doit = nl80211_del_interface,
11400		.policy = nl80211_policy,
11401		.flags = GENL_ADMIN_PERM,
11402		.internal_flags = NL80211_FLAG_NEED_WDEV |
11403				  NL80211_FLAG_NEED_RTNL,
11404	},
11405	{
11406		.cmd = NL80211_CMD_GET_KEY,
11407		.doit = nl80211_get_key,
11408		.policy = nl80211_policy,
11409		.flags = GENL_ADMIN_PERM,
11410		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11411				  NL80211_FLAG_NEED_RTNL,
11412	},
11413	{
11414		.cmd = NL80211_CMD_SET_KEY,
11415		.doit = nl80211_set_key,
11416		.policy = nl80211_policy,
11417		.flags = GENL_ADMIN_PERM,
11418		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11419				  NL80211_FLAG_NEED_RTNL |
11420				  NL80211_FLAG_CLEAR_SKB,
11421	},
11422	{
11423		.cmd = NL80211_CMD_NEW_KEY,
11424		.doit = nl80211_new_key,
11425		.policy = nl80211_policy,
11426		.flags = GENL_ADMIN_PERM,
11427		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11428				  NL80211_FLAG_NEED_RTNL |
11429				  NL80211_FLAG_CLEAR_SKB,
11430	},
11431	{
11432		.cmd = NL80211_CMD_DEL_KEY,
11433		.doit = nl80211_del_key,
11434		.policy = nl80211_policy,
11435		.flags = GENL_ADMIN_PERM,
11436		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11437				  NL80211_FLAG_NEED_RTNL,
11438	},
11439	{
11440		.cmd = NL80211_CMD_SET_BEACON,
11441		.policy = nl80211_policy,
11442		.flags = GENL_ADMIN_PERM,
11443		.doit = nl80211_set_beacon,
11444		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11445				  NL80211_FLAG_NEED_RTNL,
11446	},
11447	{
11448		.cmd = NL80211_CMD_START_AP,
11449		.policy = nl80211_policy,
11450		.flags = GENL_ADMIN_PERM,
11451		.doit = nl80211_start_ap,
11452		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11453				  NL80211_FLAG_NEED_RTNL,
11454	},
11455	{
11456		.cmd = NL80211_CMD_STOP_AP,
11457		.policy = nl80211_policy,
11458		.flags = GENL_ADMIN_PERM,
11459		.doit = nl80211_stop_ap,
11460		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11461				  NL80211_FLAG_NEED_RTNL,
11462	},
11463	{
11464		.cmd = NL80211_CMD_GET_STATION,
11465		.doit = nl80211_get_station,
11466		.dumpit = nl80211_dump_station,
11467		.policy = nl80211_policy,
11468		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11469				  NL80211_FLAG_NEED_RTNL,
11470	},
11471	{
11472		.cmd = NL80211_CMD_SET_STATION,
11473		.doit = nl80211_set_station,
11474		.policy = nl80211_policy,
11475		.flags = GENL_ADMIN_PERM,
11476		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11477				  NL80211_FLAG_NEED_RTNL,
11478	},
11479	{
11480		.cmd = NL80211_CMD_NEW_STATION,
11481		.doit = nl80211_new_station,
11482		.policy = nl80211_policy,
11483		.flags = GENL_ADMIN_PERM,
11484		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11485				  NL80211_FLAG_NEED_RTNL,
11486	},
11487	{
11488		.cmd = NL80211_CMD_DEL_STATION,
11489		.doit = nl80211_del_station,
11490		.policy = nl80211_policy,
11491		.flags = GENL_ADMIN_PERM,
11492		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11493				  NL80211_FLAG_NEED_RTNL,
11494	},
11495	{
11496		.cmd = NL80211_CMD_GET_MPATH,
11497		.doit = nl80211_get_mpath,
11498		.dumpit = nl80211_dump_mpath,
11499		.policy = nl80211_policy,
11500		.flags = GENL_ADMIN_PERM,
11501		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11502				  NL80211_FLAG_NEED_RTNL,
11503	},
11504	{
11505		.cmd = NL80211_CMD_GET_MPP,
11506		.doit = nl80211_get_mpp,
11507		.dumpit = nl80211_dump_mpp,
11508		.policy = nl80211_policy,
11509		.flags = GENL_ADMIN_PERM,
11510		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11511				  NL80211_FLAG_NEED_RTNL,
11512	},
11513	{
11514		.cmd = NL80211_CMD_SET_MPATH,
11515		.doit = nl80211_set_mpath,
11516		.policy = nl80211_policy,
11517		.flags = GENL_ADMIN_PERM,
11518		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11519				  NL80211_FLAG_NEED_RTNL,
11520	},
11521	{
11522		.cmd = NL80211_CMD_NEW_MPATH,
11523		.doit = nl80211_new_mpath,
11524		.policy = nl80211_policy,
11525		.flags = GENL_ADMIN_PERM,
11526		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11527				  NL80211_FLAG_NEED_RTNL,
11528	},
11529	{
11530		.cmd = NL80211_CMD_DEL_MPATH,
11531		.doit = nl80211_del_mpath,
11532		.policy = nl80211_policy,
11533		.flags = GENL_ADMIN_PERM,
11534		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11535				  NL80211_FLAG_NEED_RTNL,
11536	},
11537	{
11538		.cmd = NL80211_CMD_SET_BSS,
11539		.doit = nl80211_set_bss,
11540		.policy = nl80211_policy,
11541		.flags = GENL_ADMIN_PERM,
11542		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11543				  NL80211_FLAG_NEED_RTNL,
11544	},
11545	{
11546		.cmd = NL80211_CMD_GET_REG,
11547		.doit = nl80211_get_reg_do,
11548		.dumpit = nl80211_get_reg_dump,
11549		.policy = nl80211_policy,
11550		.internal_flags = NL80211_FLAG_NEED_RTNL,
11551		/* can be retrieved by unprivileged users */
11552	},
11553#ifdef CONFIG_CFG80211_CRDA_SUPPORT
11554	{
11555		.cmd = NL80211_CMD_SET_REG,
11556		.doit = nl80211_set_reg,
11557		.policy = nl80211_policy,
11558		.flags = GENL_ADMIN_PERM,
11559		.internal_flags = NL80211_FLAG_NEED_RTNL,
11560	},
11561#endif
11562	{
11563		.cmd = NL80211_CMD_REQ_SET_REG,
11564		.doit = nl80211_req_set_reg,
11565		.policy = nl80211_policy,
11566		.flags = GENL_ADMIN_PERM,
11567	},
11568	{
11569		.cmd = NL80211_CMD_GET_MESH_CONFIG,
11570		.doit = nl80211_get_mesh_config,
11571		.policy = nl80211_policy,
11572		/* can be retrieved by unprivileged users */
11573		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11574				  NL80211_FLAG_NEED_RTNL,
11575	},
11576	{
11577		.cmd = NL80211_CMD_SET_MESH_CONFIG,
11578		.doit = nl80211_update_mesh_config,
11579		.policy = nl80211_policy,
11580		.flags = GENL_ADMIN_PERM,
11581		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11582				  NL80211_FLAG_NEED_RTNL,
11583	},
11584	{
11585		.cmd = NL80211_CMD_TRIGGER_SCAN,
11586		.doit = nl80211_trigger_scan,
11587		.policy = nl80211_policy,
11588		.flags = GENL_ADMIN_PERM,
11589		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11590				  NL80211_FLAG_NEED_RTNL,
11591	},
11592	{
11593		.cmd = NL80211_CMD_ABORT_SCAN,
11594		.doit = nl80211_abort_scan,
11595		.policy = nl80211_policy,
11596		.flags = GENL_ADMIN_PERM,
11597		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11598				  NL80211_FLAG_NEED_RTNL,
11599	},
11600	{
11601		.cmd = NL80211_CMD_GET_SCAN,
11602		.policy = nl80211_policy,
11603		.dumpit = nl80211_dump_scan,
11604	},
11605	{
11606		.cmd = NL80211_CMD_START_SCHED_SCAN,
11607		.doit = nl80211_start_sched_scan,
11608		.policy = nl80211_policy,
11609		.flags = GENL_ADMIN_PERM,
11610		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11611				  NL80211_FLAG_NEED_RTNL,
11612	},
11613	{
11614		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
11615		.doit = nl80211_stop_sched_scan,
11616		.policy = nl80211_policy,
11617		.flags = GENL_ADMIN_PERM,
11618		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11619				  NL80211_FLAG_NEED_RTNL,
11620	},
11621	{
11622		.cmd = NL80211_CMD_AUTHENTICATE,
11623		.doit = nl80211_authenticate,
11624		.policy = nl80211_policy,
11625		.flags = GENL_ADMIN_PERM,
11626		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11627				  NL80211_FLAG_NEED_RTNL |
11628				  NL80211_FLAG_CLEAR_SKB,
11629	},
11630	{
11631		.cmd = NL80211_CMD_ASSOCIATE,
11632		.doit = nl80211_associate,
11633		.policy = nl80211_policy,
11634		.flags = GENL_ADMIN_PERM,
11635		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11636				  NL80211_FLAG_NEED_RTNL,
11637	},
11638	{
11639		.cmd = NL80211_CMD_DEAUTHENTICATE,
11640		.doit = nl80211_deauthenticate,
11641		.policy = nl80211_policy,
11642		.flags = GENL_ADMIN_PERM,
11643		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11644				  NL80211_FLAG_NEED_RTNL,
11645	},
11646	{
11647		.cmd = NL80211_CMD_DISASSOCIATE,
11648		.doit = nl80211_disassociate,
11649		.policy = nl80211_policy,
11650		.flags = GENL_ADMIN_PERM,
11651		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11652				  NL80211_FLAG_NEED_RTNL,
11653	},
11654	{
11655		.cmd = NL80211_CMD_JOIN_IBSS,
11656		.doit = nl80211_join_ibss,
11657		.policy = nl80211_policy,
11658		.flags = GENL_ADMIN_PERM,
11659		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11660				  NL80211_FLAG_NEED_RTNL,
11661	},
11662	{
11663		.cmd = NL80211_CMD_LEAVE_IBSS,
11664		.doit = nl80211_leave_ibss,
11665		.policy = nl80211_policy,
11666		.flags = GENL_ADMIN_PERM,
11667		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11668				  NL80211_FLAG_NEED_RTNL,
11669	},
11670#ifdef CONFIG_NL80211_TESTMODE
11671	{
11672		.cmd = NL80211_CMD_TESTMODE,
11673		.doit = nl80211_testmode_do,
11674		.dumpit = nl80211_testmode_dump,
11675		.policy = nl80211_policy,
11676		.flags = GENL_ADMIN_PERM,
11677		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11678				  NL80211_FLAG_NEED_RTNL,
11679	},
11680#endif
11681	{
11682		.cmd = NL80211_CMD_CONNECT,
11683		.doit = nl80211_connect,
11684		.policy = nl80211_policy,
11685		.flags = GENL_ADMIN_PERM,
11686		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11687				  NL80211_FLAG_NEED_RTNL,
11688	},
11689	{
11690		.cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
11691		.doit = nl80211_update_connect_params,
11692		.policy = nl80211_policy,
11693		.flags = GENL_ADMIN_PERM,
11694		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11695				  NL80211_FLAG_NEED_RTNL,
11696	},
11697	{
11698		.cmd = NL80211_CMD_DISCONNECT,
11699		.doit = nl80211_disconnect,
11700		.policy = nl80211_policy,
11701		.flags = GENL_ADMIN_PERM,
11702		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11703				  NL80211_FLAG_NEED_RTNL,
11704	},
11705	{
11706		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
11707		.doit = nl80211_wiphy_netns,
11708		.policy = nl80211_policy,
11709		.flags = GENL_ADMIN_PERM,
11710		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11711				  NL80211_FLAG_NEED_RTNL,
11712	},
11713	{
11714		.cmd = NL80211_CMD_GET_SURVEY,
11715		.policy = nl80211_policy,
11716		.dumpit = nl80211_dump_survey,
11717	},
11718	{
11719		.cmd = NL80211_CMD_SET_PMKSA,
11720		.doit = nl80211_setdel_pmksa,
11721		.policy = nl80211_policy,
11722		.flags = GENL_ADMIN_PERM,
11723		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11724				  NL80211_FLAG_NEED_RTNL,
11725	},
11726	{
11727		.cmd = NL80211_CMD_DEL_PMKSA,
11728		.doit = nl80211_setdel_pmksa,
11729		.policy = nl80211_policy,
11730		.flags = GENL_ADMIN_PERM,
11731		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11732				  NL80211_FLAG_NEED_RTNL,
11733	},
11734	{
11735		.cmd = NL80211_CMD_FLUSH_PMKSA,
11736		.doit = nl80211_flush_pmksa,
11737		.policy = nl80211_policy,
11738		.flags = GENL_ADMIN_PERM,
11739		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11740				  NL80211_FLAG_NEED_RTNL,
11741	},
11742	{
11743		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
11744		.doit = nl80211_remain_on_channel,
11745		.policy = nl80211_policy,
11746		.flags = GENL_ADMIN_PERM,
11747		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11748				  NL80211_FLAG_NEED_RTNL,
11749	},
11750	{
11751		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
11752		.doit = nl80211_cancel_remain_on_channel,
11753		.policy = nl80211_policy,
11754		.flags = GENL_ADMIN_PERM,
11755		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11756				  NL80211_FLAG_NEED_RTNL,
11757	},
11758	{
11759		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
11760		.doit = nl80211_set_tx_bitrate_mask,
11761		.policy = nl80211_policy,
11762		.flags = GENL_ADMIN_PERM,
11763		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11764				  NL80211_FLAG_NEED_RTNL,
11765	},
11766	{
11767		.cmd = NL80211_CMD_REGISTER_FRAME,
11768		.doit = nl80211_register_mgmt,
11769		.policy = nl80211_policy,
11770		.flags = GENL_ADMIN_PERM,
11771		.internal_flags = NL80211_FLAG_NEED_WDEV |
11772				  NL80211_FLAG_NEED_RTNL,
11773	},
11774	{
11775		.cmd = NL80211_CMD_FRAME,
11776		.doit = nl80211_tx_mgmt,
11777		.policy = nl80211_policy,
11778		.flags = GENL_ADMIN_PERM,
11779		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11780				  NL80211_FLAG_NEED_RTNL,
11781	},
11782	{
11783		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
11784		.doit = nl80211_tx_mgmt_cancel_wait,
11785		.policy = nl80211_policy,
11786		.flags = GENL_ADMIN_PERM,
11787		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11788				  NL80211_FLAG_NEED_RTNL,
11789	},
11790	{
11791		.cmd = NL80211_CMD_SET_POWER_SAVE,
11792		.doit = nl80211_set_power_save,
11793		.policy = nl80211_policy,
11794		.flags = GENL_ADMIN_PERM,
11795		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11796				  NL80211_FLAG_NEED_RTNL,
11797	},
11798	{
11799		.cmd = NL80211_CMD_GET_POWER_SAVE,
11800		.doit = nl80211_get_power_save,
11801		.policy = nl80211_policy,
11802		/* can be retrieved by unprivileged users */
11803		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11804				  NL80211_FLAG_NEED_RTNL,
11805	},
11806	{
11807		.cmd = NL80211_CMD_SET_CQM,
11808		.doit = nl80211_set_cqm,
11809		.policy = nl80211_policy,
11810		.flags = GENL_ADMIN_PERM,
11811		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11812				  NL80211_FLAG_NEED_RTNL,
11813	},
11814	{
11815		.cmd = NL80211_CMD_SET_CHANNEL,
11816		.doit = nl80211_set_channel,
11817		.policy = nl80211_policy,
11818		.flags = GENL_ADMIN_PERM,
11819		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11820				  NL80211_FLAG_NEED_RTNL,
11821	},
11822	{
11823		.cmd = NL80211_CMD_SET_WDS_PEER,
11824		.doit = nl80211_set_wds_peer,
11825		.policy = nl80211_policy,
11826		.flags = GENL_ADMIN_PERM,
11827		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11828				  NL80211_FLAG_NEED_RTNL,
11829	},
11830	{
11831		.cmd = NL80211_CMD_JOIN_MESH,
11832		.doit = nl80211_join_mesh,
11833		.policy = nl80211_policy,
11834		.flags = GENL_ADMIN_PERM,
11835		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11836				  NL80211_FLAG_NEED_RTNL,
11837	},
11838	{
11839		.cmd = NL80211_CMD_LEAVE_MESH,
11840		.doit = nl80211_leave_mesh,
11841		.policy = nl80211_policy,
11842		.flags = GENL_ADMIN_PERM,
11843		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11844				  NL80211_FLAG_NEED_RTNL,
11845	},
11846	{
11847		.cmd = NL80211_CMD_JOIN_OCB,
11848		.doit = nl80211_join_ocb,
11849		.policy = nl80211_policy,
11850		.flags = GENL_ADMIN_PERM,
11851		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11852				  NL80211_FLAG_NEED_RTNL,
11853	},
11854	{
11855		.cmd = NL80211_CMD_LEAVE_OCB,
11856		.doit = nl80211_leave_ocb,
11857		.policy = nl80211_policy,
11858		.flags = GENL_ADMIN_PERM,
11859		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11860				  NL80211_FLAG_NEED_RTNL,
11861	},
11862#ifdef CONFIG_PM
11863	{
11864		.cmd = NL80211_CMD_GET_WOWLAN,
11865		.doit = nl80211_get_wowlan,
11866		.policy = nl80211_policy,
11867		/* can be retrieved by unprivileged users */
11868		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11869				  NL80211_FLAG_NEED_RTNL,
11870	},
11871	{
11872		.cmd = NL80211_CMD_SET_WOWLAN,
11873		.doit = nl80211_set_wowlan,
11874		.policy = nl80211_policy,
11875		.flags = GENL_ADMIN_PERM,
11876		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11877				  NL80211_FLAG_NEED_RTNL,
11878	},
11879#endif
11880	{
11881		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
11882		.doit = nl80211_set_rekey_data,
11883		.policy = nl80211_policy,
11884		.flags = GENL_ADMIN_PERM,
11885		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11886				  NL80211_FLAG_NEED_RTNL |
11887				  NL80211_FLAG_CLEAR_SKB,
11888	},
11889	{
11890		.cmd = NL80211_CMD_TDLS_MGMT,
11891		.doit = nl80211_tdls_mgmt,
11892		.policy = nl80211_policy,
11893		.flags = GENL_ADMIN_PERM,
11894		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11895				  NL80211_FLAG_NEED_RTNL,
11896	},
11897	{
11898		.cmd = NL80211_CMD_TDLS_OPER,
11899		.doit = nl80211_tdls_oper,
11900		.policy = nl80211_policy,
11901		.flags = GENL_ADMIN_PERM,
11902		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11903				  NL80211_FLAG_NEED_RTNL,
11904	},
11905	{
11906		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
11907		.doit = nl80211_register_unexpected_frame,
11908		.policy = nl80211_policy,
11909		.flags = GENL_ADMIN_PERM,
11910		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11911				  NL80211_FLAG_NEED_RTNL,
11912	},
11913	{
11914		.cmd = NL80211_CMD_PROBE_CLIENT,
11915		.doit = nl80211_probe_client,
11916		.policy = nl80211_policy,
11917		.flags = GENL_ADMIN_PERM,
11918		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11919				  NL80211_FLAG_NEED_RTNL,
11920	},
11921	{
11922		.cmd = NL80211_CMD_REGISTER_BEACONS,
11923		.doit = nl80211_register_beacons,
11924		.policy = nl80211_policy,
11925		.flags = GENL_ADMIN_PERM,
11926		.internal_flags = NL80211_FLAG_NEED_WIPHY |
11927				  NL80211_FLAG_NEED_RTNL,
11928	},
11929	{
11930		.cmd = NL80211_CMD_SET_NOACK_MAP,
11931		.doit = nl80211_set_noack_map,
11932		.policy = nl80211_policy,
11933		.flags = GENL_ADMIN_PERM,
11934		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11935				  NL80211_FLAG_NEED_RTNL,
11936	},
11937	{
11938		.cmd = NL80211_CMD_START_P2P_DEVICE,
11939		.doit = nl80211_start_p2p_device,
11940		.policy = nl80211_policy,
11941		.flags = GENL_ADMIN_PERM,
11942		.internal_flags = NL80211_FLAG_NEED_WDEV |
11943				  NL80211_FLAG_NEED_RTNL,
11944	},
11945	{
11946		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
11947		.doit = nl80211_stop_p2p_device,
11948		.policy = nl80211_policy,
11949		.flags = GENL_ADMIN_PERM,
11950		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11951				  NL80211_FLAG_NEED_RTNL,
11952	},
11953	{
11954		.cmd = NL80211_CMD_SET_MCAST_RATE,
11955		.doit = nl80211_set_mcast_rate,
11956		.policy = nl80211_policy,
11957		.flags = GENL_ADMIN_PERM,
11958		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11959				  NL80211_FLAG_NEED_RTNL,
11960	},
11961	{
11962		.cmd = NL80211_CMD_SET_MAC_ACL,
11963		.doit = nl80211_set_mac_acl,
11964		.policy = nl80211_policy,
11965		.flags = GENL_ADMIN_PERM,
11966		.internal_flags = NL80211_FLAG_NEED_NETDEV |
11967				  NL80211_FLAG_NEED_RTNL,
11968	},
11969	{
11970		.cmd = NL80211_CMD_RADAR_DETECT,
11971		.doit = nl80211_start_radar_detection,
11972		.policy = nl80211_policy,
11973		.flags = GENL_ADMIN_PERM,
11974		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11975				  NL80211_FLAG_NEED_RTNL,
11976	},
11977	{
11978		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
11979		.doit = nl80211_get_protocol_features,
11980		.policy = nl80211_policy,
11981	},
11982	{
11983		.cmd = NL80211_CMD_UPDATE_FT_IES,
11984		.doit = nl80211_update_ft_ies,
11985		.policy = nl80211_policy,
11986		.flags = GENL_ADMIN_PERM,
11987		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
11988				  NL80211_FLAG_NEED_RTNL,
11989	},
11990	{
11991		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
11992		.doit = nl80211_crit_protocol_start,
11993		.policy = nl80211_policy,
11994		.flags = GENL_ADMIN_PERM,
11995		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
11996				  NL80211_FLAG_NEED_RTNL,
11997	},
11998	{
11999		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
12000		.doit = nl80211_crit_protocol_stop,
12001		.policy = nl80211_policy,
12002		.flags = GENL_ADMIN_PERM,
12003		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12004				  NL80211_FLAG_NEED_RTNL,
12005	},
12006	{
12007		.cmd = NL80211_CMD_GET_COALESCE,
12008		.doit = nl80211_get_coalesce,
12009		.policy = nl80211_policy,
12010		.internal_flags = NL80211_FLAG_NEED_WIPHY |
12011				  NL80211_FLAG_NEED_RTNL,
12012	},
12013	{
12014		.cmd = NL80211_CMD_SET_COALESCE,
12015		.doit = nl80211_set_coalesce,
12016		.policy = nl80211_policy,
12017		.flags = GENL_ADMIN_PERM,
12018		.internal_flags = NL80211_FLAG_NEED_WIPHY |
12019				  NL80211_FLAG_NEED_RTNL,
12020	},
12021	{
12022		.cmd = NL80211_CMD_CHANNEL_SWITCH,
12023		.doit = nl80211_channel_switch,
12024		.policy = nl80211_policy,
12025		.flags = GENL_ADMIN_PERM,
12026		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12027				  NL80211_FLAG_NEED_RTNL,
12028	},
12029	{
12030		.cmd = NL80211_CMD_VENDOR,
12031		.doit = nl80211_vendor_cmd,
12032		.dumpit = nl80211_vendor_cmd_dump,
12033		.policy = nl80211_policy,
12034		.flags = GENL_ADMIN_PERM,
12035		.internal_flags = NL80211_FLAG_NEED_WIPHY |
12036				  NL80211_FLAG_NEED_RTNL,
12037	},
12038	{
12039		.cmd = NL80211_CMD_SET_QOS_MAP,
12040		.doit = nl80211_set_qos_map,
12041		.policy = nl80211_policy,
12042		.flags = GENL_ADMIN_PERM,
12043		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12044				  NL80211_FLAG_NEED_RTNL,
12045	},
12046	{
12047		.cmd = NL80211_CMD_ADD_TX_TS,
12048		.doit = nl80211_add_tx_ts,
12049		.policy = nl80211_policy,
12050		.flags = GENL_ADMIN_PERM,
12051		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12052				  NL80211_FLAG_NEED_RTNL,
12053	},
12054	{
12055		.cmd = NL80211_CMD_DEL_TX_TS,
12056		.doit = nl80211_del_tx_ts,
12057		.policy = nl80211_policy,
12058		.flags = GENL_ADMIN_PERM,
12059		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12060				  NL80211_FLAG_NEED_RTNL,
12061	},
12062	{
12063		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
12064		.doit = nl80211_tdls_channel_switch,
12065		.policy = nl80211_policy,
12066		.flags = GENL_ADMIN_PERM,
12067		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12068				  NL80211_FLAG_NEED_RTNL,
12069	},
12070	{
12071		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
12072		.doit = nl80211_tdls_cancel_channel_switch,
12073		.policy = nl80211_policy,
12074		.flags = GENL_ADMIN_PERM,
12075		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12076				  NL80211_FLAG_NEED_RTNL,
12077	},
12078	{
12079		.cmd = NL80211_CMD_EXTERNAL_AUTH,
12080		.doit = nl80211_external_auth,
12081		.policy = nl80211_policy,
12082		.flags = GENL_ADMIN_PERM,
12083		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12084				  NL80211_FLAG_NEED_RTNL,
12085	},
12086	{
12087		.cmd = NL80211_CMD_UPDATE_OWE_INFO,
12088		.doit = nl80211_update_owe_info,
12089		.flags = GENL_ADMIN_PERM,
12090		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12091				  NL80211_FLAG_NEED_RTNL,
12092	},
12093};
12094
12095/* notification functions */
12096
12097void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
12098			  enum nl80211_commands cmd)
12099{
12100	struct sk_buff *msg;
12101	struct nl80211_dump_wiphy_state state = {};
12102
12103	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
12104		cmd != NL80211_CMD_DEL_WIPHY);
12105
12106	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12107	if (!msg)
12108		return;
12109
12110	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
12111		nlmsg_free(msg);
12112		return;
12113	}
12114
12115	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12116				NL80211_MCGRP_CONFIG, GFP_KERNEL);
12117}
12118
12119static int nl80211_add_scan_req(struct sk_buff *msg,
12120				struct cfg80211_registered_device *rdev)
12121{
12122	struct cfg80211_scan_request *req = rdev->scan_req;
12123	struct nlattr *nest;
12124	int i;
12125
12126	if (WARN_ON(!req))
12127		return 0;
12128
12129	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
12130	if (!nest)
12131		goto nla_put_failure;
12132	for (i = 0; i < req->n_ssids; i++) {
12133		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
12134			goto nla_put_failure;
12135	}
12136	nla_nest_end(msg, nest);
12137
12138	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12139	if (!nest)
12140		goto nla_put_failure;
12141	for (i = 0; i < req->n_channels; i++) {
12142		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12143			goto nla_put_failure;
12144	}
12145	nla_nest_end(msg, nest);
12146
12147	if (req->ie &&
12148	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
12149		goto nla_put_failure;
12150
12151	if (req->flags &&
12152	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
12153		goto nla_put_failure;
12154
12155	return 0;
12156 nla_put_failure:
12157	return -ENOBUFS;
12158}
12159
12160static int nl80211_send_scan_msg(struct sk_buff *msg,
12161				 struct cfg80211_registered_device *rdev,
12162				 struct wireless_dev *wdev,
12163				 u32 portid, u32 seq, int flags,
12164				 u32 cmd)
12165{
12166	void *hdr;
12167
12168	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12169	if (!hdr)
12170		return -1;
12171
12172	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12173	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12174					 wdev->netdev->ifindex)) ||
12175	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
12176		goto nla_put_failure;
12177
12178	/* ignore errors and send incomplete event anyway */
12179	nl80211_add_scan_req(msg, rdev);
12180
12181	genlmsg_end(msg, hdr);
12182	return 0;
12183
12184 nla_put_failure:
12185	genlmsg_cancel(msg, hdr);
12186	return -EMSGSIZE;
12187}
12188
12189static int
12190nl80211_send_sched_scan_msg(struct sk_buff *msg,
12191			    struct cfg80211_registered_device *rdev,
12192			    struct net_device *netdev,
12193			    u32 portid, u32 seq, int flags, u32 cmd)
12194{
12195	void *hdr;
12196
12197	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
12198	if (!hdr)
12199		return -1;
12200
12201	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12202	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
12203		goto nla_put_failure;
12204
12205	genlmsg_end(msg, hdr);
12206	return 0;
12207
12208 nla_put_failure:
12209	genlmsg_cancel(msg, hdr);
12210	return -EMSGSIZE;
12211}
12212
12213void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
12214			     struct wireless_dev *wdev)
12215{
12216	struct sk_buff *msg;
12217
12218	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12219	if (!msg)
12220		return;
12221
12222	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12223				  NL80211_CMD_TRIGGER_SCAN) < 0) {
12224		nlmsg_free(msg);
12225		return;
12226	}
12227
12228	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12229				NL80211_MCGRP_SCAN, GFP_KERNEL);
12230}
12231
12232struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
12233				       struct wireless_dev *wdev, bool aborted)
12234{
12235	struct sk_buff *msg;
12236
12237	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12238	if (!msg)
12239		return NULL;
12240
12241	if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
12242				  aborted ? NL80211_CMD_SCAN_ABORTED :
12243					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
12244		nlmsg_free(msg);
12245		return NULL;
12246	}
12247
12248	return msg;
12249}
12250
12251void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
12252			      struct sk_buff *msg)
12253{
12254	if (!msg)
12255		return;
12256
12257	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12258				NL80211_MCGRP_SCAN, GFP_KERNEL);
12259}
12260
12261void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
12262				     struct net_device *netdev)
12263{
12264	struct sk_buff *msg;
12265
12266	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12267	if (!msg)
12268		return;
12269
12270	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
12271					NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
12272		nlmsg_free(msg);
12273		return;
12274	}
12275
12276	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12277				NL80211_MCGRP_SCAN, GFP_KERNEL);
12278}
12279
12280void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
12281			     struct net_device *netdev, u32 cmd)
12282{
12283	struct sk_buff *msg;
12284
12285	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12286	if (!msg)
12287		return;
12288
12289	if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
12290		nlmsg_free(msg);
12291		return;
12292	}
12293
12294	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12295				NL80211_MCGRP_SCAN, GFP_KERNEL);
12296}
12297
12298static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
12299					  struct regulatory_request *request)
12300{
12301	/* Userspace can always count this one always being set */
12302	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
12303		goto nla_put_failure;
12304
12305	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
12306		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12307			       NL80211_REGDOM_TYPE_WORLD))
12308			goto nla_put_failure;
12309	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
12310		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12311			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
12312			goto nla_put_failure;
12313	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
12314		   request->intersect) {
12315		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12316			       NL80211_REGDOM_TYPE_INTERSECTION))
12317			goto nla_put_failure;
12318	} else {
12319		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
12320			       NL80211_REGDOM_TYPE_COUNTRY) ||
12321		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
12322				   request->alpha2))
12323			goto nla_put_failure;
12324	}
12325
12326	if (request->wiphy_idx != WIPHY_IDX_INVALID) {
12327		struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
12328
12329		if (wiphy &&
12330		    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
12331			goto nla_put_failure;
12332
12333		if (wiphy &&
12334		    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
12335		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
12336			goto nla_put_failure;
12337	}
12338
12339	return true;
12340
12341nla_put_failure:
12342	return false;
12343}
12344
12345/*
12346 * This can happen on global regulatory changes or device specific settings
12347 * based on custom regulatory domains.
12348 */
12349void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
12350				     struct regulatory_request *request)
12351{
12352	struct sk_buff *msg;
12353	void *hdr;
12354
12355	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12356	if (!msg)
12357		return;
12358
12359	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
12360	if (!hdr) {
12361		nlmsg_free(msg);
12362		return;
12363	}
12364
12365	if (nl80211_reg_change_event_fill(msg, request) == false)
12366		goto nla_put_failure;
12367
12368	genlmsg_end(msg, hdr);
12369
12370	rcu_read_lock();
12371	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12372				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12373	rcu_read_unlock();
12374
12375	return;
12376
12377nla_put_failure:
12378	genlmsg_cancel(msg, hdr);
12379	nlmsg_free(msg);
12380}
12381
12382static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
12383				    struct net_device *netdev,
12384				    const u8 *buf, size_t len,
12385				    enum nl80211_commands cmd, gfp_t gfp,
12386				    int uapsd_queues)
12387{
12388	struct sk_buff *msg;
12389	void *hdr;
12390
12391	msg = nlmsg_new(100 + len, gfp);
12392	if (!msg)
12393		return;
12394
12395	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12396	if (!hdr) {
12397		nlmsg_free(msg);
12398		return;
12399	}
12400
12401	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12402	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12403	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
12404		goto nla_put_failure;
12405
12406	if (uapsd_queues >= 0) {
12407		struct nlattr *nla_wmm =
12408			nla_nest_start(msg, NL80211_ATTR_STA_WME);
12409		if (!nla_wmm)
12410			goto nla_put_failure;
12411
12412		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
12413			       uapsd_queues))
12414			goto nla_put_failure;
12415
12416		nla_nest_end(msg, nla_wmm);
12417	}
12418
12419	genlmsg_end(msg, hdr);
12420
12421	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12422				NL80211_MCGRP_MLME, gfp);
12423	return;
12424
12425 nla_put_failure:
12426	genlmsg_cancel(msg, hdr);
12427	nlmsg_free(msg);
12428}
12429
12430void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
12431			  struct net_device *netdev, const u8 *buf,
12432			  size_t len, gfp_t gfp)
12433{
12434	nl80211_send_mlme_event(rdev, netdev, buf, len,
12435				NL80211_CMD_AUTHENTICATE, gfp, -1);
12436}
12437
12438void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
12439			   struct net_device *netdev, const u8 *buf,
12440			   size_t len, gfp_t gfp, int uapsd_queues)
12441{
12442	nl80211_send_mlme_event(rdev, netdev, buf, len,
12443				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
12444}
12445
12446void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
12447			 struct net_device *netdev, const u8 *buf,
12448			 size_t len, gfp_t gfp)
12449{
12450	nl80211_send_mlme_event(rdev, netdev, buf, len,
12451				NL80211_CMD_DEAUTHENTICATE, gfp, -1);
12452}
12453
12454void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
12455			   struct net_device *netdev, const u8 *buf,
12456			   size_t len, gfp_t gfp)
12457{
12458	nl80211_send_mlme_event(rdev, netdev, buf, len,
12459				NL80211_CMD_DISASSOCIATE, gfp, -1);
12460}
12461
12462void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
12463				  size_t len)
12464{
12465	struct wireless_dev *wdev = dev->ieee80211_ptr;
12466	struct wiphy *wiphy = wdev->wiphy;
12467	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12468	const struct ieee80211_mgmt *mgmt = (void *)buf;
12469	u32 cmd;
12470
12471	if (WARN_ON(len < 2))
12472		return;
12473
12474	if (ieee80211_is_deauth(mgmt->frame_control))
12475		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
12476	else
12477		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
12478
12479	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
12480	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
12481}
12482EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
12483
12484static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
12485				      struct net_device *netdev, int cmd,
12486				      const u8 *addr, gfp_t gfp)
12487{
12488	struct sk_buff *msg;
12489	void *hdr;
12490
12491	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12492	if (!msg)
12493		return;
12494
12495	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12496	if (!hdr) {
12497		nlmsg_free(msg);
12498		return;
12499	}
12500
12501	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12502	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12503	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
12504	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
12505		goto nla_put_failure;
12506
12507	genlmsg_end(msg, hdr);
12508
12509	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12510				NL80211_MCGRP_MLME, gfp);
12511	return;
12512
12513 nla_put_failure:
12514	genlmsg_cancel(msg, hdr);
12515	nlmsg_free(msg);
12516}
12517
12518void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
12519			       struct net_device *netdev, const u8 *addr,
12520			       gfp_t gfp)
12521{
12522	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
12523				  addr, gfp);
12524}
12525
12526void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
12527				struct net_device *netdev, const u8 *addr,
12528				gfp_t gfp)
12529{
12530	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
12531				  addr, gfp);
12532}
12533
12534void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
12535				 struct net_device *netdev,
12536				 struct cfg80211_connect_resp_params *cr,
12537				 gfp_t gfp)
12538{
12539	struct sk_buff *msg;
12540	void *hdr;
12541
12542	msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
12543			cr->fils_kek_len + cr->pmk_len +
12544			(cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
12545	if (!msg)
12546		return;
12547
12548	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
12549	if (!hdr) {
12550		nlmsg_free(msg);
12551		return;
12552	}
12553
12554	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12555	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12556	    (cr->bssid &&
12557	     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
12558	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
12559			cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
12560			cr->status) ||
12561	    (cr->status < 0 &&
12562	     (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
12563	      nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
12564			  cr->timeout_reason))) ||
12565	    (cr->req_ie &&
12566	     nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
12567	    (cr->resp_ie &&
12568	     nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
12569		     cr->resp_ie)) ||
12570	    (cr->update_erp_next_seq_num &&
12571	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
12572			 cr->fils_erp_next_seq_num)) ||
12573	    (cr->status == WLAN_STATUS_SUCCESS &&
12574	     ((cr->fils_kek &&
12575	       nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
12576		       cr->fils_kek)) ||
12577	      (cr->pmk &&
12578	       nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
12579	      (cr->pmkid &&
12580	       nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
12581		goto nla_put_failure;
12582
12583	genlmsg_end(msg, hdr);
12584
12585	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12586				NL80211_MCGRP_MLME, gfp);
12587	return;
12588
12589 nla_put_failure:
12590	genlmsg_cancel(msg, hdr);
12591	nlmsg_free(msg);
12592
12593}
12594
12595void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
12596			 struct net_device *netdev, const u8 *bssid,
12597			 const u8 *req_ie, size_t req_ie_len,
12598			 const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
12599{
12600	struct sk_buff *msg;
12601	void *hdr;
12602
12603	msg = nlmsg_new(100 + req_ie_len + resp_ie_len, gfp);
12604	if (!msg)
12605		return;
12606
12607	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
12608	if (!hdr) {
12609		nlmsg_free(msg);
12610		return;
12611	}
12612
12613	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12614	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12615	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
12616	    (req_ie &&
12617	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
12618	    (resp_ie &&
12619	     nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
12620		goto nla_put_failure;
12621
12622	genlmsg_end(msg, hdr);
12623
12624	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12625				NL80211_MCGRP_MLME, gfp);
12626	return;
12627
12628 nla_put_failure:
12629	genlmsg_cancel(msg, hdr);
12630	nlmsg_free(msg);
12631
12632}
12633
12634void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
12635			       struct net_device *netdev, u16 reason,
12636			       const u8 *ie, size_t ie_len, bool from_ap)
12637{
12638	struct sk_buff *msg;
12639	void *hdr;
12640
12641	msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
12642	if (!msg)
12643		return;
12644
12645	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
12646	if (!hdr) {
12647		nlmsg_free(msg);
12648		return;
12649	}
12650
12651	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12652	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12653	    (from_ap && reason &&
12654	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
12655	    (from_ap &&
12656	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
12657	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
12658		goto nla_put_failure;
12659
12660	genlmsg_end(msg, hdr);
12661
12662	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12663				NL80211_MCGRP_MLME, GFP_KERNEL);
12664	return;
12665
12666 nla_put_failure:
12667	genlmsg_cancel(msg, hdr);
12668	nlmsg_free(msg);
12669
12670}
12671
12672void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
12673			     struct net_device *netdev, const u8 *bssid,
12674			     gfp_t gfp)
12675{
12676	struct sk_buff *msg;
12677	void *hdr;
12678
12679	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12680	if (!msg)
12681		return;
12682
12683	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
12684	if (!hdr) {
12685		nlmsg_free(msg);
12686		return;
12687	}
12688
12689	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12690	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12691	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
12692		goto nla_put_failure;
12693
12694	genlmsg_end(msg, hdr);
12695
12696	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12697				NL80211_MCGRP_MLME, gfp);
12698	return;
12699
12700 nla_put_failure:
12701	genlmsg_cancel(msg, hdr);
12702	nlmsg_free(msg);
12703}
12704
12705void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
12706					const u8* ie, u8 ie_len, gfp_t gfp)
12707{
12708	struct wireless_dev *wdev = dev->ieee80211_ptr;
12709	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
12710	struct sk_buff *msg;
12711	void *hdr;
12712
12713	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
12714		return;
12715
12716	trace_cfg80211_notify_new_peer_candidate(dev, addr);
12717
12718	msg = nlmsg_new(100 + ie_len, gfp);
12719	if (!msg)
12720		return;
12721
12722	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
12723	if (!hdr) {
12724		nlmsg_free(msg);
12725		return;
12726	}
12727
12728	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12729	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12730	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
12731	    (ie_len && ie &&
12732	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
12733		goto nla_put_failure;
12734
12735	genlmsg_end(msg, hdr);
12736
12737	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12738				NL80211_MCGRP_MLME, gfp);
12739	return;
12740
12741 nla_put_failure:
12742	genlmsg_cancel(msg, hdr);
12743	nlmsg_free(msg);
12744}
12745EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
12746
12747void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
12748				 struct net_device *netdev, const u8 *addr,
12749				 enum nl80211_key_type key_type, int key_id,
12750				 const u8 *tsc, gfp_t gfp)
12751{
12752	struct sk_buff *msg;
12753	void *hdr;
12754
12755	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12756	if (!msg)
12757		return;
12758
12759	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
12760	if (!hdr) {
12761		nlmsg_free(msg);
12762		return;
12763	}
12764
12765	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12766	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
12767	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
12768	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
12769	    (key_id != -1 &&
12770	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
12771	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
12772		goto nla_put_failure;
12773
12774	genlmsg_end(msg, hdr);
12775
12776	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12777				NL80211_MCGRP_MLME, gfp);
12778	return;
12779
12780 nla_put_failure:
12781	genlmsg_cancel(msg, hdr);
12782	nlmsg_free(msg);
12783}
12784
12785void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
12786				    struct ieee80211_channel *channel_before,
12787				    struct ieee80211_channel *channel_after)
12788{
12789	struct sk_buff *msg;
12790	void *hdr;
12791	struct nlattr *nl_freq;
12792
12793	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
12794	if (!msg)
12795		return;
12796
12797	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
12798	if (!hdr) {
12799		nlmsg_free(msg);
12800		return;
12801	}
12802
12803	/*
12804	 * Since we are applying the beacon hint to a wiphy we know its
12805	 * wiphy_idx is valid
12806	 */
12807	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
12808		goto nla_put_failure;
12809
12810	/* Before */
12811	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
12812	if (!nl_freq)
12813		goto nla_put_failure;
12814	if (nl80211_msg_put_channel(msg, channel_before, false))
12815		goto nla_put_failure;
12816	nla_nest_end(msg, nl_freq);
12817
12818	/* After */
12819	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
12820	if (!nl_freq)
12821		goto nla_put_failure;
12822	if (nl80211_msg_put_channel(msg, channel_after, false))
12823		goto nla_put_failure;
12824	nla_nest_end(msg, nl_freq);
12825
12826	genlmsg_end(msg, hdr);
12827
12828	rcu_read_lock();
12829	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
12830				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
12831	rcu_read_unlock();
12832
12833	return;
12834
12835nla_put_failure:
12836	genlmsg_cancel(msg, hdr);
12837	nlmsg_free(msg);
12838}
12839
12840static void nl80211_send_remain_on_chan_event(
12841	int cmd, struct cfg80211_registered_device *rdev,
12842	struct wireless_dev *wdev, u64 cookie,
12843	struct ieee80211_channel *chan,
12844	unsigned int duration, gfp_t gfp)
12845{
12846	struct sk_buff *msg;
12847	void *hdr;
12848
12849	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12850	if (!msg)
12851		return;
12852
12853	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
12854	if (!hdr) {
12855		nlmsg_free(msg);
12856		return;
12857	}
12858
12859	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12860	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12861					 wdev->netdev->ifindex)) ||
12862	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
12863	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
12864	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
12865			NL80211_CHAN_NO_HT) ||
12866	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
12867		goto nla_put_failure;
12868
12869	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
12870	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
12871		goto nla_put_failure;
12872
12873	genlmsg_end(msg, hdr);
12874
12875	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12876				NL80211_MCGRP_MLME, gfp);
12877	return;
12878
12879 nla_put_failure:
12880	genlmsg_cancel(msg, hdr);
12881	nlmsg_free(msg);
12882}
12883
12884void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
12885			       struct ieee80211_channel *chan,
12886			       unsigned int duration, gfp_t gfp)
12887{
12888	struct wiphy *wiphy = wdev->wiphy;
12889	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12890
12891	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
12892	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
12893					  rdev, wdev, cookie, chan,
12894					  duration, gfp);
12895}
12896EXPORT_SYMBOL(cfg80211_ready_on_channel);
12897
12898void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
12899					struct ieee80211_channel *chan,
12900					gfp_t gfp)
12901{
12902	struct wiphy *wiphy = wdev->wiphy;
12903	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12904
12905	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
12906	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12907					  rdev, wdev, cookie, chan, 0, gfp);
12908}
12909EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
12910
12911void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
12912		      struct station_info *sinfo, gfp_t gfp)
12913{
12914	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12915	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12916	struct sk_buff *msg;
12917
12918	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
12919
12920	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12921	if (!msg)
12922		return;
12923
12924	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
12925				 rdev, dev, mac_addr, sinfo) < 0) {
12926		nlmsg_free(msg);
12927		return;
12928	}
12929
12930	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12931				NL80211_MCGRP_MLME, gfp);
12932}
12933EXPORT_SYMBOL(cfg80211_new_sta);
12934
12935void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
12936			    struct station_info *sinfo, gfp_t gfp)
12937{
12938	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12939	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12940	struct sk_buff *msg;
12941	struct station_info empty_sinfo = {};
12942
12943	if (!sinfo)
12944		sinfo = &empty_sinfo;
12945
12946	trace_cfg80211_del_sta(dev, mac_addr);
12947
12948	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12949	if (!msg)
12950		return;
12951
12952	if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
12953				 rdev, dev, mac_addr, sinfo) < 0) {
12954		nlmsg_free(msg);
12955		return;
12956	}
12957
12958	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12959				NL80211_MCGRP_MLME, gfp);
12960}
12961EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
12962
12963void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
12964			  enum nl80211_connect_failed_reason reason,
12965			  gfp_t gfp)
12966{
12967	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
12968	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12969	struct sk_buff *msg;
12970	void *hdr;
12971
12972	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
12973	if (!msg)
12974		return;
12975
12976	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
12977	if (!hdr) {
12978		nlmsg_free(msg);
12979		return;
12980	}
12981
12982	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
12983	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
12984	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
12985		goto nla_put_failure;
12986
12987	genlmsg_end(msg, hdr);
12988
12989	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
12990				NL80211_MCGRP_MLME, gfp);
12991	return;
12992
12993 nla_put_failure:
12994	genlmsg_cancel(msg, hdr);
12995	nlmsg_free(msg);
12996}
12997EXPORT_SYMBOL(cfg80211_conn_failed);
12998
12999static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
13000				       const u8 *addr, gfp_t gfp)
13001{
13002	struct wireless_dev *wdev = dev->ieee80211_ptr;
13003	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13004	struct sk_buff *msg;
13005	void *hdr;
13006	u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
13007
13008	if (!nlportid)
13009		return false;
13010
13011	msg = nlmsg_new(100, gfp);
13012	if (!msg)
13013		return true;
13014
13015	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13016	if (!hdr) {
13017		nlmsg_free(msg);
13018		return true;
13019	}
13020
13021	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13022	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13023	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13024		goto nla_put_failure;
13025
13026	genlmsg_end(msg, hdr);
13027	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13028	return true;
13029
13030 nla_put_failure:
13031	genlmsg_cancel(msg, hdr);
13032	nlmsg_free(msg);
13033	return true;
13034}
13035
13036bool cfg80211_rx_spurious_frame(struct net_device *dev,
13037				const u8 *addr, gfp_t gfp)
13038{
13039	struct wireless_dev *wdev = dev->ieee80211_ptr;
13040	bool ret;
13041
13042	trace_cfg80211_rx_spurious_frame(dev, addr);
13043
13044	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13045		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
13046		trace_cfg80211_return_bool(false);
13047		return false;
13048	}
13049	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
13050					 addr, gfp);
13051	trace_cfg80211_return_bool(ret);
13052	return ret;
13053}
13054EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
13055
13056bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
13057					const u8 *addr, gfp_t gfp)
13058{
13059	struct wireless_dev *wdev = dev->ieee80211_ptr;
13060	bool ret;
13061
13062	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
13063
13064	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
13065		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
13066		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
13067		trace_cfg80211_return_bool(false);
13068		return false;
13069	}
13070	ret = __nl80211_unexpected_frame(dev,
13071					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
13072					 addr, gfp);
13073	trace_cfg80211_return_bool(ret);
13074	return ret;
13075}
13076EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
13077
13078int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
13079		      struct wireless_dev *wdev, u32 nlportid,
13080		      int freq, int sig_dbm,
13081		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
13082{
13083	struct net_device *netdev = wdev->netdev;
13084	struct sk_buff *msg;
13085	void *hdr;
13086
13087	msg = nlmsg_new(100 + len, gfp);
13088	if (!msg)
13089		return -ENOMEM;
13090
13091	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13092	if (!hdr) {
13093		nlmsg_free(msg);
13094		return -ENOMEM;
13095	}
13096
13097	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13098	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13099					netdev->ifindex)) ||
13100	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
13101	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
13102	    (sig_dbm &&
13103	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13104	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13105	    (flags &&
13106	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
13107		goto nla_put_failure;
13108
13109	genlmsg_end(msg, hdr);
13110
13111	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
13112
13113 nla_put_failure:
13114	genlmsg_cancel(msg, hdr);
13115	nlmsg_free(msg);
13116	return -ENOBUFS;
13117}
13118
13119void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
13120			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
13121{
13122	struct wiphy *wiphy = wdev->wiphy;
13123	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13124	struct net_device *netdev = wdev->netdev;
13125	struct sk_buff *msg;
13126	void *hdr;
13127
13128	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
13129
13130	msg = nlmsg_new(100 + len, gfp);
13131	if (!msg)
13132		return;
13133
13134	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
13135	if (!hdr) {
13136		nlmsg_free(msg);
13137		return;
13138	}
13139
13140	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13141	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13142				   netdev->ifindex)) ||
13143	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
13144	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
13145	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
13146	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
13147		goto nla_put_failure;
13148
13149	genlmsg_end(msg, hdr);
13150
13151	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13152				NL80211_MCGRP_MLME, gfp);
13153	return;
13154
13155 nla_put_failure:
13156	genlmsg_cancel(msg, hdr);
13157	nlmsg_free(msg);
13158}
13159EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
13160
13161static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
13162					    const char *mac, gfp_t gfp)
13163{
13164	struct wireless_dev *wdev = dev->ieee80211_ptr;
13165	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13166	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13167	void **cb;
13168
13169	if (!msg)
13170		return NULL;
13171
13172	cb = (void **)msg->cb;
13173
13174	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
13175	if (!cb[0]) {
13176		nlmsg_free(msg);
13177		return NULL;
13178	}
13179
13180	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13181	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13182		goto nla_put_failure;
13183
13184	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
13185		goto nla_put_failure;
13186
13187	cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
13188	if (!cb[1])
13189		goto nla_put_failure;
13190
13191	cb[2] = rdev;
13192
13193	return msg;
13194 nla_put_failure:
13195	nlmsg_free(msg);
13196	return NULL;
13197}
13198
13199static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
13200{
13201	void **cb = (void **)msg->cb;
13202	struct cfg80211_registered_device *rdev = cb[2];
13203
13204	nla_nest_end(msg, cb[1]);
13205	genlmsg_end(msg, cb[0]);
13206
13207	memset(msg->cb, 0, sizeof(msg->cb));
13208
13209	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13210				NL80211_MCGRP_MLME, gfp);
13211}
13212
13213void cfg80211_cqm_rssi_notify(struct net_device *dev,
13214			      enum nl80211_cqm_rssi_threshold_event rssi_event,
13215			      gfp_t gfp)
13216{
13217	struct sk_buff *msg;
13218
13219	trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
13220
13221	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
13222		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
13223		return;
13224
13225	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13226	if (!msg)
13227		return;
13228
13229	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
13230			rssi_event))
13231		goto nla_put_failure;
13232
13233	cfg80211_send_cqm(msg, gfp);
13234
13235	return;
13236
13237 nla_put_failure:
13238	nlmsg_free(msg);
13239}
13240EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
13241
13242void cfg80211_cqm_txe_notify(struct net_device *dev,
13243			     const u8 *peer, u32 num_packets,
13244			     u32 rate, u32 intvl, gfp_t gfp)
13245{
13246	struct sk_buff *msg;
13247
13248	msg = cfg80211_prepare_cqm(dev, peer, gfp);
13249	if (!msg)
13250		return;
13251
13252	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
13253		goto nla_put_failure;
13254
13255	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
13256		goto nla_put_failure;
13257
13258	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
13259		goto nla_put_failure;
13260
13261	cfg80211_send_cqm(msg, gfp);
13262	return;
13263
13264 nla_put_failure:
13265	nlmsg_free(msg);
13266}
13267EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
13268
13269void cfg80211_cqm_pktloss_notify(struct net_device *dev,
13270				 const u8 *peer, u32 num_packets, gfp_t gfp)
13271{
13272	struct sk_buff *msg;
13273
13274	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
13275
13276	msg = cfg80211_prepare_cqm(dev, peer, gfp);
13277	if (!msg)
13278		return;
13279
13280	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
13281		goto nla_put_failure;
13282
13283	cfg80211_send_cqm(msg, gfp);
13284	return;
13285
13286 nla_put_failure:
13287	nlmsg_free(msg);
13288}
13289EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
13290
13291void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
13292{
13293	struct sk_buff *msg;
13294
13295	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
13296	if (!msg)
13297		return;
13298
13299	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
13300		goto nla_put_failure;
13301
13302	cfg80211_send_cqm(msg, gfp);
13303	return;
13304
13305 nla_put_failure:
13306	nlmsg_free(msg);
13307}
13308EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
13309
13310static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
13311				     struct net_device *netdev, const u8 *bssid,
13312				     const u8 *replay_ctr, gfp_t gfp)
13313{
13314	struct sk_buff *msg;
13315	struct nlattr *rekey_attr;
13316	void *hdr;
13317
13318	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13319	if (!msg)
13320		return;
13321
13322	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
13323	if (!hdr) {
13324		nlmsg_free(msg);
13325		return;
13326	}
13327
13328	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13329	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13330	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13331		goto nla_put_failure;
13332
13333	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
13334	if (!rekey_attr)
13335		goto nla_put_failure;
13336
13337	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
13338		    NL80211_REPLAY_CTR_LEN, replay_ctr))
13339		goto nla_put_failure;
13340
13341	nla_nest_end(msg, rekey_attr);
13342
13343	genlmsg_end(msg, hdr);
13344
13345	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13346				NL80211_MCGRP_MLME, gfp);
13347	return;
13348
13349 nla_put_failure:
13350	genlmsg_cancel(msg, hdr);
13351	nlmsg_free(msg);
13352}
13353
13354void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
13355			       const u8 *replay_ctr, gfp_t gfp)
13356{
13357	struct wireless_dev *wdev = dev->ieee80211_ptr;
13358	struct wiphy *wiphy = wdev->wiphy;
13359	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13360
13361	trace_cfg80211_gtk_rekey_notify(dev, bssid);
13362	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
13363}
13364EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
13365
13366static void
13367nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
13368			       struct net_device *netdev, int index,
13369			       const u8 *bssid, bool preauth, gfp_t gfp)
13370{
13371	struct sk_buff *msg;
13372	struct nlattr *attr;
13373	void *hdr;
13374
13375	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13376	if (!msg)
13377		return;
13378
13379	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
13380	if (!hdr) {
13381		nlmsg_free(msg);
13382		return;
13383	}
13384
13385	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13386	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13387		goto nla_put_failure;
13388
13389	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
13390	if (!attr)
13391		goto nla_put_failure;
13392
13393	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
13394	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
13395	    (preauth &&
13396	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
13397		goto nla_put_failure;
13398
13399	nla_nest_end(msg, attr);
13400
13401	genlmsg_end(msg, hdr);
13402
13403	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13404				NL80211_MCGRP_MLME, gfp);
13405	return;
13406
13407 nla_put_failure:
13408	genlmsg_cancel(msg, hdr);
13409	nlmsg_free(msg);
13410}
13411
13412void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
13413				     const u8 *bssid, bool preauth, gfp_t gfp)
13414{
13415	struct wireless_dev *wdev = dev->ieee80211_ptr;
13416	struct wiphy *wiphy = wdev->wiphy;
13417	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13418
13419	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
13420	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
13421}
13422EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
13423
13424static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
13425				     struct net_device *netdev,
13426				     struct cfg80211_chan_def *chandef,
13427				     gfp_t gfp,
13428				     enum nl80211_commands notif,
13429				     u8 count)
13430{
13431	struct sk_buff *msg;
13432	void *hdr;
13433
13434	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13435	if (!msg)
13436		return;
13437
13438	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
13439	if (!hdr) {
13440		nlmsg_free(msg);
13441		return;
13442	}
13443
13444	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
13445		goto nla_put_failure;
13446
13447	if (nl80211_send_chandef(msg, chandef))
13448		goto nla_put_failure;
13449
13450	if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
13451	    (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
13452			goto nla_put_failure;
13453
13454	genlmsg_end(msg, hdr);
13455
13456	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13457				NL80211_MCGRP_MLME, gfp);
13458	return;
13459
13460 nla_put_failure:
13461	genlmsg_cancel(msg, hdr);
13462	nlmsg_free(msg);
13463}
13464
13465void cfg80211_ch_switch_notify(struct net_device *dev,
13466			       struct cfg80211_chan_def *chandef)
13467{
13468	struct wireless_dev *wdev = dev->ieee80211_ptr;
13469	struct wiphy *wiphy = wdev->wiphy;
13470	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13471
13472	ASSERT_WDEV_LOCK(wdev);
13473
13474	trace_cfg80211_ch_switch_notify(dev, chandef);
13475
13476	wdev->chandef = *chandef;
13477	wdev->preset_chandef = *chandef;
13478
13479	if (wdev->iftype == NL80211_IFTYPE_STATION &&
13480	    !WARN_ON(!wdev->current_bss))
13481		wdev->current_bss->pub.channel = chandef->chan;
13482
13483	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13484				 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
13485}
13486EXPORT_SYMBOL(cfg80211_ch_switch_notify);
13487
13488void cfg80211_ch_switch_started_notify(struct net_device *dev,
13489				       struct cfg80211_chan_def *chandef,
13490				       u8 count)
13491{
13492	struct wireless_dev *wdev = dev->ieee80211_ptr;
13493	struct wiphy *wiphy = wdev->wiphy;
13494	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13495
13496	trace_cfg80211_ch_switch_started_notify(dev, chandef);
13497
13498	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
13499				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
13500}
13501EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
13502
13503void
13504nl80211_radar_notify(struct cfg80211_registered_device *rdev,
13505		     const struct cfg80211_chan_def *chandef,
13506		     enum nl80211_radar_event event,
13507		     struct net_device *netdev, gfp_t gfp)
13508{
13509	struct sk_buff *msg;
13510	void *hdr;
13511
13512	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13513	if (!msg)
13514		return;
13515
13516	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
13517	if (!hdr) {
13518		nlmsg_free(msg);
13519		return;
13520	}
13521
13522	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
13523		goto nla_put_failure;
13524
13525	/* NOP and radar events don't need a netdev parameter */
13526	if (netdev) {
13527		struct wireless_dev *wdev = netdev->ieee80211_ptr;
13528
13529		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13530		    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13531			goto nla_put_failure;
13532	}
13533
13534	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
13535		goto nla_put_failure;
13536
13537	if (nl80211_send_chandef(msg, chandef))
13538		goto nla_put_failure;
13539
13540	genlmsg_end(msg, hdr);
13541
13542	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13543				NL80211_MCGRP_MLME, gfp);
13544	return;
13545
13546 nla_put_failure:
13547	genlmsg_cancel(msg, hdr);
13548	nlmsg_free(msg);
13549}
13550
13551void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
13552			   u64 cookie, bool acked, gfp_t gfp)
13553{
13554	struct wireless_dev *wdev = dev->ieee80211_ptr;
13555	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13556	struct sk_buff *msg;
13557	void *hdr;
13558
13559	trace_cfg80211_probe_status(dev, addr, cookie, acked);
13560
13561	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13562
13563	if (!msg)
13564		return;
13565
13566	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
13567	if (!hdr) {
13568		nlmsg_free(msg);
13569		return;
13570	}
13571
13572	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13573	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13574	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
13575	    nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
13576	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
13577		goto nla_put_failure;
13578
13579	genlmsg_end(msg, hdr);
13580
13581	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13582				NL80211_MCGRP_MLME, gfp);
13583	return;
13584
13585 nla_put_failure:
13586	genlmsg_cancel(msg, hdr);
13587	nlmsg_free(msg);
13588}
13589EXPORT_SYMBOL(cfg80211_probe_status);
13590
13591void cfg80211_report_obss_beacon(struct wiphy *wiphy,
13592				 const u8 *frame, size_t len,
13593				 int freq, int sig_dbm)
13594{
13595	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13596	struct sk_buff *msg;
13597	void *hdr;
13598	struct cfg80211_beacon_registration *reg;
13599
13600	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
13601
13602	spin_lock_bh(&rdev->beacon_registrations_lock);
13603	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13604		msg = nlmsg_new(len + 100, GFP_ATOMIC);
13605		if (!msg) {
13606			spin_unlock_bh(&rdev->beacon_registrations_lock);
13607			return;
13608		}
13609
13610		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
13611		if (!hdr)
13612			goto nla_put_failure;
13613
13614		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13615		    (freq &&
13616		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
13617		    (sig_dbm &&
13618		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
13619		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
13620			goto nla_put_failure;
13621
13622		genlmsg_end(msg, hdr);
13623
13624		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
13625	}
13626	spin_unlock_bh(&rdev->beacon_registrations_lock);
13627	return;
13628
13629 nla_put_failure:
13630	spin_unlock_bh(&rdev->beacon_registrations_lock);
13631	if (hdr)
13632		genlmsg_cancel(msg, hdr);
13633	nlmsg_free(msg);
13634}
13635EXPORT_SYMBOL(cfg80211_report_obss_beacon);
13636
13637#ifdef CONFIG_PM
13638static int cfg80211_net_detect_results(struct sk_buff *msg,
13639				       struct cfg80211_wowlan_wakeup *wakeup)
13640{
13641	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
13642	struct nlattr *nl_results, *nl_match, *nl_freqs;
13643	int i, j;
13644
13645	nl_results = nla_nest_start(
13646		msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
13647	if (!nl_results)
13648		return -EMSGSIZE;
13649
13650	for (i = 0; i < nd->n_matches; i++) {
13651		struct cfg80211_wowlan_nd_match *match = nd->matches[i];
13652
13653		nl_match = nla_nest_start(msg, i);
13654		if (!nl_match)
13655			break;
13656
13657		/* The SSID attribute is optional in nl80211, but for
13658		 * simplicity reasons it's always present in the
13659		 * cfg80211 structure.  If a driver can't pass the
13660		 * SSID, that needs to be changed.  A zero length SSID
13661		 * is still a valid SSID (wildcard), so it cannot be
13662		 * used for this purpose.
13663		 */
13664		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
13665			    match->ssid.ssid)) {
13666			nla_nest_cancel(msg, nl_match);
13667			goto out;
13668		}
13669
13670		if (match->n_channels) {
13671			nl_freqs = nla_nest_start(
13672				msg, NL80211_ATTR_SCAN_FREQUENCIES);
13673			if (!nl_freqs) {
13674				nla_nest_cancel(msg, nl_match);
13675				goto out;
13676			}
13677
13678			for (j = 0; j < match->n_channels; j++) {
13679				if (nla_put_u32(msg, j, match->channels[j])) {
13680					nla_nest_cancel(msg, nl_freqs);
13681					nla_nest_cancel(msg, nl_match);
13682					goto out;
13683				}
13684			}
13685
13686			nla_nest_end(msg, nl_freqs);
13687		}
13688
13689		nla_nest_end(msg, nl_match);
13690	}
13691
13692out:
13693	nla_nest_end(msg, nl_results);
13694	return 0;
13695}
13696
13697void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
13698				   struct cfg80211_wowlan_wakeup *wakeup,
13699				   gfp_t gfp)
13700{
13701	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13702	struct sk_buff *msg;
13703	void *hdr;
13704	int size = 200;
13705
13706	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
13707
13708	if (wakeup)
13709		size += wakeup->packet_present_len;
13710
13711	msg = nlmsg_new(size, gfp);
13712	if (!msg)
13713		return;
13714
13715	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
13716	if (!hdr)
13717		goto free_msg;
13718
13719	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13720	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13721		goto free_msg;
13722
13723	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13724					wdev->netdev->ifindex))
13725		goto free_msg;
13726
13727	if (wakeup) {
13728		struct nlattr *reasons;
13729
13730		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
13731		if (!reasons)
13732			goto free_msg;
13733
13734		if (wakeup->disconnect &&
13735		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
13736			goto free_msg;
13737		if (wakeup->magic_pkt &&
13738		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
13739			goto free_msg;
13740		if (wakeup->gtk_rekey_failure &&
13741		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
13742			goto free_msg;
13743		if (wakeup->eap_identity_req &&
13744		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
13745			goto free_msg;
13746		if (wakeup->four_way_handshake &&
13747		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
13748			goto free_msg;
13749		if (wakeup->rfkill_release &&
13750		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
13751			goto free_msg;
13752
13753		if (wakeup->pattern_idx >= 0 &&
13754		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
13755				wakeup->pattern_idx))
13756			goto free_msg;
13757
13758		if (wakeup->tcp_match &&
13759		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
13760			goto free_msg;
13761
13762		if (wakeup->tcp_connlost &&
13763		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
13764			goto free_msg;
13765
13766		if (wakeup->tcp_nomoretokens &&
13767		    nla_put_flag(msg,
13768				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
13769			goto free_msg;
13770
13771		if (wakeup->packet) {
13772			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
13773			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
13774
13775			if (!wakeup->packet_80211) {
13776				pkt_attr =
13777					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
13778				len_attr =
13779					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
13780			}
13781
13782			if (wakeup->packet_len &&
13783			    nla_put_u32(msg, len_attr, wakeup->packet_len))
13784				goto free_msg;
13785
13786			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
13787				    wakeup->packet))
13788				goto free_msg;
13789		}
13790
13791		if (wakeup->net_detect &&
13792		    cfg80211_net_detect_results(msg, wakeup))
13793				goto free_msg;
13794
13795		nla_nest_end(msg, reasons);
13796	}
13797
13798	genlmsg_end(msg, hdr);
13799
13800	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13801				NL80211_MCGRP_MLME, gfp);
13802	return;
13803
13804 free_msg:
13805	nlmsg_free(msg);
13806}
13807EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
13808#endif
13809
13810void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
13811				enum nl80211_tdls_operation oper,
13812				u16 reason_code, gfp_t gfp)
13813{
13814	struct wireless_dev *wdev = dev->ieee80211_ptr;
13815	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13816	struct sk_buff *msg;
13817	void *hdr;
13818
13819	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
13820					 reason_code);
13821
13822	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13823	if (!msg)
13824		return;
13825
13826	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
13827	if (!hdr) {
13828		nlmsg_free(msg);
13829		return;
13830	}
13831
13832	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13833	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13834	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
13835	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
13836	    (reason_code > 0 &&
13837	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
13838		goto nla_put_failure;
13839
13840	genlmsg_end(msg, hdr);
13841
13842	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13843				NL80211_MCGRP_MLME, gfp);
13844	return;
13845
13846 nla_put_failure:
13847	genlmsg_cancel(msg, hdr);
13848	nlmsg_free(msg);
13849}
13850EXPORT_SYMBOL(cfg80211_tdls_oper_request);
13851
13852static int nl80211_netlink_notify(struct notifier_block * nb,
13853				  unsigned long state,
13854				  void *_notify)
13855{
13856	struct netlink_notify *notify = _notify;
13857	struct cfg80211_registered_device *rdev;
13858	struct wireless_dev *wdev;
13859	struct cfg80211_beacon_registration *reg, *tmp;
13860
13861	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
13862		return NOTIFY_DONE;
13863
13864	rcu_read_lock();
13865
13866	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
13867		bool schedule_destroy_work = false;
13868		struct cfg80211_sched_scan_request *sched_scan_req =
13869			rcu_dereference(rdev->sched_scan_req);
13870
13871		if (sched_scan_req && notify->portid &&
13872		    sched_scan_req->owner_nlportid == notify->portid) {
13873			sched_scan_req->owner_nlportid = 0;
13874
13875			if (rdev->ops->sched_scan_stop &&
13876			    rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
13877				schedule_work(&rdev->sched_scan_stop_wk);
13878		}
13879
13880		list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
13881			cfg80211_mlme_unregister_socket(wdev, notify->portid);
13882
13883			if (wdev->owner_nlportid == notify->portid)
13884				schedule_destroy_work = true;
13885			else if (wdev->conn_owner_nlportid == notify->portid)
13886				schedule_work(&wdev->disconnect_wk);
13887		}
13888
13889		spin_lock_bh(&rdev->beacon_registrations_lock);
13890		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
13891					 list) {
13892			if (reg->nlportid == notify->portid) {
13893				list_del(&reg->list);
13894				kfree(reg);
13895				break;
13896			}
13897		}
13898		spin_unlock_bh(&rdev->beacon_registrations_lock);
13899
13900		if (schedule_destroy_work) {
13901			struct cfg80211_iface_destroy *destroy;
13902
13903			destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
13904			if (destroy) {
13905				destroy->nlportid = notify->portid;
13906				spin_lock(&rdev->destroy_list_lock);
13907				list_add(&destroy->list, &rdev->destroy_list);
13908				spin_unlock(&rdev->destroy_list_lock);
13909				schedule_work(&rdev->destroy_work);
13910			}
13911		}
13912	}
13913
13914	rcu_read_unlock();
13915
13916	/*
13917	 * It is possible that the user space process that is controlling the
13918	 * indoor setting disappeared, so notify the regulatory core.
13919	 */
13920	regulatory_netlink_notify(notify->portid);
13921	return NOTIFY_OK;
13922}
13923
13924static struct notifier_block nl80211_netlink_notifier = {
13925	.notifier_call = nl80211_netlink_notify,
13926};
13927
13928void cfg80211_ft_event(struct net_device *netdev,
13929		       struct cfg80211_ft_event_params *ft_event)
13930{
13931	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
13932	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13933	struct sk_buff *msg;
13934	void *hdr;
13935
13936	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
13937
13938	if (!ft_event->target_ap)
13939		return;
13940
13941	msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
13942			GFP_KERNEL);
13943	if (!msg)
13944		return;
13945
13946	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
13947	if (!hdr)
13948		goto out;
13949
13950	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13951	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13952	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
13953		goto out;
13954
13955	if (ft_event->ies &&
13956	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
13957		goto out;
13958	if (ft_event->ric_ies &&
13959	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
13960		    ft_event->ric_ies))
13961		goto out;
13962
13963	genlmsg_end(msg, hdr);
13964
13965	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13966				NL80211_MCGRP_MLME, GFP_KERNEL);
13967	return;
13968 out:
13969	nlmsg_free(msg);
13970}
13971EXPORT_SYMBOL(cfg80211_ft_event);
13972
13973void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
13974{
13975	struct cfg80211_registered_device *rdev;
13976	struct sk_buff *msg;
13977	void *hdr;
13978	u32 nlportid;
13979
13980	rdev = wiphy_to_rdev(wdev->wiphy);
13981	if (!rdev->crit_proto_nlportid)
13982		return;
13983
13984	nlportid = rdev->crit_proto_nlportid;
13985	rdev->crit_proto_nlportid = 0;
13986
13987	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13988	if (!msg)
13989		return;
13990
13991	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
13992	if (!hdr)
13993		goto nla_put_failure;
13994
13995	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13996	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
13997		goto nla_put_failure;
13998
13999	genlmsg_end(msg, hdr);
14000
14001	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14002	return;
14003
14004 nla_put_failure:
14005	if (hdr)
14006		genlmsg_cancel(msg, hdr);
14007	nlmsg_free(msg);
14008
14009}
14010EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
14011
14012void nl80211_send_ap_stopped(struct wireless_dev *wdev)
14013{
14014	struct wiphy *wiphy = wdev->wiphy;
14015	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14016	struct sk_buff *msg;
14017	void *hdr;
14018
14019	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14020	if (!msg)
14021		return;
14022
14023	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
14024	if (!hdr)
14025		goto out;
14026
14027	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14028	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
14029	    nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
14030		goto out;
14031
14032	genlmsg_end(msg, hdr);
14033
14034	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
14035				NL80211_MCGRP_MLME, GFP_KERNEL);
14036	return;
14037 out:
14038	nlmsg_free(msg);
14039}
14040
14041void cfg80211_ap_stopped(struct net_device *netdev, gfp_t gfp)
14042{
14043	struct wireless_dev *wdev = netdev->ieee80211_ptr;
14044	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14045
14046	nl80211_send_mlme_event(rdev, netdev, NULL, 0,
14047				NL80211_CMD_STOP_AP, gfp, -1);
14048}
14049EXPORT_SYMBOL(cfg80211_ap_stopped);
14050
14051int cfg80211_external_auth_request(struct net_device *dev,
14052				   struct cfg80211_external_auth_params *params,
14053				   gfp_t gfp)
14054{
14055	struct wireless_dev *wdev = dev->ieee80211_ptr;
14056	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14057	struct sk_buff *msg;
14058	void *hdr;
14059
14060	if (!wdev->conn_owner_nlportid)
14061		return -EINVAL;
14062
14063	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14064	if (!msg)
14065		return -ENOMEM;
14066
14067	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
14068	if (!hdr)
14069		goto nla_put_failure;
14070
14071	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14072	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14073	    nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
14074	    nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
14075			params->action) ||
14076	    nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
14077	    nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
14078		    params->ssid.ssid))
14079		goto nla_put_failure;
14080
14081	genlmsg_end(msg, hdr);
14082	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14083			wdev->conn_owner_nlportid);
14084	return 0;
14085
14086 nla_put_failure:
14087	nlmsg_free(msg);
14088	return -ENOBUFS;
14089}
14090EXPORT_SYMBOL(cfg80211_external_auth_request);
14091
14092void cfg80211_update_owe_info_event(struct net_device *netdev,
14093				    struct cfg80211_update_owe_info *owe_info,
14094				    gfp_t gfp)
14095{
14096	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
14097	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14098	struct sk_buff *msg;
14099	void *hdr;
14100
14101	trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
14102
14103	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14104	if (!msg)
14105		return;
14106
14107	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
14108	if (!hdr)
14109		goto nla_put_failure;
14110
14111	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14112	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14113	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
14114		goto nla_put_failure;
14115
14116	if (!owe_info->ie_len ||
14117	    nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
14118		goto nla_put_failure;
14119
14120	genlmsg_end(msg, hdr);
14121
14122	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14123				NL80211_MCGRP_MLME, gfp);
14124	return;
14125
14126nla_put_failure:
14127	genlmsg_cancel(msg, hdr);
14128	nlmsg_free(msg);
14129}
14130EXPORT_SYMBOL(cfg80211_update_owe_info_event);
14131
14132/* initialisation/exit functions */
14133
14134int nl80211_init(void)
14135{
14136	int err;
14137
14138	err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
14139						   nl80211_mcgrps);
14140	if (err)
14141		return err;
14142
14143	err = netlink_register_notifier(&nl80211_netlink_notifier);
14144	if (err)
14145		goto err_out;
14146
14147	return 0;
14148 err_out:
14149	genl_unregister_family(&nl80211_fam);
14150	return err;
14151}
14152
14153void nl80211_exit(void)
14154{
14155	netlink_unregister_notifier(&nl80211_netlink_notifier);
14156	genl_unregister_family(&nl80211_fam);
14157}