nl80211.c

    1// SPDX-License-Identifier: GPL-2.0-only
    2/*
    3 * This is the new netlink-based wireless configuration interface.
    4 *
    5 * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
    6 * Copyright 2013-2014  Intel Mobile Communications GmbH
    7 * Copyright 2015-2017	Intel Deutschland GmbH
    8 * Copyright (C) 2018-2025 Intel Corporation
    9 */
   10
   11#include <linux/if.h>
   12#include <linux/module.h>
   13#include <linux/err.h>
   14#include <linux/slab.h>
   15#include <linux/list.h>
   16#include <linux/if_ether.h>
   17#include <linux/ieee80211.h>
   18#include <linux/nl80211.h>
   19#include <linux/rtnetlink.h>
   20#include <linux/netlink.h>
   21#include <linux/nospec.h>
   22#include <linux/etherdevice.h>
   23#include <linux/if_vlan.h>
   24#include <net/net_namespace.h>
   25#include <net/genetlink.h>
   26#include <net/cfg80211.h>
   27#include <net/sock.h>
   28#include <net/inet_connection_sock.h>
   29#include "core.h"
   30#include "nl80211.h"
   31#include "reg.h"
   32#include "rdev-ops.h"
   33
   34static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
   35				   struct genl_info *info,
   36				   struct cfg80211_crypto_settings *settings,
   37				   int cipher_limit);
   38
   39/* the netlink family */
   40static struct genl_family nl80211_fam;
   41
   42/* multicast groups */
   43enum nl80211_multicast_groups {
   44	NL80211_MCGRP_CONFIG,
   45	NL80211_MCGRP_SCAN,
   46	NL80211_MCGRP_REGULATORY,
   47	NL80211_MCGRP_MLME,
   48	NL80211_MCGRP_VENDOR,
   49	NL80211_MCGRP_NAN,
   50	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
   51};
   52
   53static const struct genl_multicast_group nl80211_mcgrps[] = {
   54	[NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
   55	[NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
   56	[NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
   57	[NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
   58	[NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
   59	[NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
   60#ifdef CONFIG_NL80211_TESTMODE
   61	[NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
   62#endif
   63};
   64
   65/* returns ERR_PTR values */
   66static struct wireless_dev *
   67__cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
   68			   struct net *netns, struct nlattr **attrs)
   69{
   70	struct wireless_dev *result = NULL;
   71	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
   72	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
   73	u64 wdev_id = 0;
   74	int wiphy_idx = -1;
   75	int ifidx = -1;
   76
   77	if (!have_ifidx && !have_wdev_id)
   78		return ERR_PTR(-EINVAL);
   79
   80	if (have_ifidx)
   81		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
   82	if (have_wdev_id) {
   83		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
   84		wiphy_idx = wdev_id >> 32;
   85	}
   86
   87	if (rdev) {
   88		struct wireless_dev *wdev;
   89
   90		lockdep_assert_held(&rdev->wiphy.mtx);
   91
   92		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
   93			if (have_ifidx && wdev->netdev &&
   94			    wdev->netdev->ifindex == ifidx) {
   95				result = wdev;
   96				break;
   97			}
   98			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
   99				result = wdev;
  100				break;
  101			}
  102		}
  103
  104		return result ?: ERR_PTR(-ENODEV);
  105	}
  106
  107	ASSERT_RTNL();
  108
  109	for_each_rdev(rdev) {
  110		struct wireless_dev *wdev;
  111
  112		if (wiphy_net(&rdev->wiphy) != netns)
  113			continue;
  114
  115		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  116			continue;
  117
  118		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  119			if (have_ifidx && wdev->netdev &&
  120			    wdev->netdev->ifindex == ifidx) {
  121				result = wdev;
  122				break;
  123			}
  124			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  125				result = wdev;
  126				break;
  127			}
  128		}
  129
  130		if (result)
  131			break;
  132	}
  133
  134	if (result)
  135		return result;
  136	return ERR_PTR(-ENODEV);
  137}
  138
  139static struct cfg80211_registered_device *
  140__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
  141{
  142	struct cfg80211_registered_device *rdev = NULL, *tmp;
  143	struct net_device *netdev;
  144
  145	ASSERT_RTNL();
  146
  147	if (!attrs[NL80211_ATTR_WIPHY] &&
  148	    !attrs[NL80211_ATTR_IFINDEX] &&
  149	    !attrs[NL80211_ATTR_WDEV])
  150		return ERR_PTR(-EINVAL);
  151
  152	if (attrs[NL80211_ATTR_WIPHY])
  153		rdev = cfg80211_rdev_by_wiphy_idx(
  154				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
  155
  156	if (attrs[NL80211_ATTR_WDEV]) {
  157		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  158		struct wireless_dev *wdev;
  159		bool found = false;
  160
  161		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
  162		if (tmp) {
  163			/* make sure wdev exists */
  164			list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
  165				if (wdev->identifier != (u32)wdev_id)
  166					continue;
  167				found = true;
  168				break;
  169			}
  170
  171			if (!found)
  172				tmp = NULL;
  173
  174			if (rdev && tmp != rdev)
  175				return ERR_PTR(-EINVAL);
  176			rdev = tmp;
  177		}
  178	}
  179
  180	if (attrs[NL80211_ATTR_IFINDEX]) {
  181		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  182
  183		netdev = __dev_get_by_index(netns, ifindex);
  184		if (netdev) {
  185			if (netdev->ieee80211_ptr)
  186				tmp = wiphy_to_rdev(
  187					netdev->ieee80211_ptr->wiphy);
  188			else
  189				tmp = NULL;
  190
  191			/* not wireless device -- return error */
  192			if (!tmp)
  193				return ERR_PTR(-EINVAL);
  194
  195			/* mismatch -- return error */
  196			if (rdev && tmp != rdev)
  197				return ERR_PTR(-EINVAL);
  198
  199			rdev = tmp;
  200		}
  201	}
  202
  203	if (!rdev)
  204		return ERR_PTR(-ENODEV);
  205
  206	if (netns != wiphy_net(&rdev->wiphy))
  207		return ERR_PTR(-ENODEV);
  208
  209	return rdev;
  210}
  211
  212/*
  213 * This function returns a pointer to the driver
  214 * that the genl_info item that is passed refers to.
  215 *
  216 * The result of this can be a PTR_ERR and hence must
  217 * be checked with IS_ERR() for errors.
  218 */
  219static struct cfg80211_registered_device *
  220cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
  221{
  222	return __cfg80211_rdev_from_attrs(netns, info->attrs);
  223}
  224
  225static int validate_beacon_head(const struct nlattr *attr,
  226				struct netlink_ext_ack *extack)
  227{
  228	const u8 *data = nla_data(attr);
  229	unsigned int len = nla_len(attr);
  230	const struct element *elem;
  231	const struct ieee80211_mgmt *mgmt = (void *)data;
  232	const struct ieee80211_ext *ext;
  233	unsigned int fixedlen, hdrlen;
  234	bool s1g_bcn;
  235
  236	if (len < offsetofend(typeof(*mgmt), frame_control))
  237		goto err;
  238
  239	s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
  240	if (s1g_bcn) {
  241		ext = (struct ieee80211_ext *)mgmt;
  242		fixedlen =
  243			offsetof(struct ieee80211_ext, u.s1g_beacon.variable) +
  244			ieee80211_s1g_optional_len(ext->frame_control);
  245		hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
  246	} else {
  247		fixedlen = offsetof(struct ieee80211_mgmt,
  248				    u.beacon.variable);
  249		hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
  250	}
  251
  252	if (len < fixedlen)
  253		goto err;
  254
  255	if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
  256		goto err;
  257
  258	data += fixedlen;
  259	len -= fixedlen;
  260
  261	for_each_element(elem, data, len) {
  262		/* nothing */
  263	}
  264
  265	if (for_each_element_completed(elem, data, len))
  266		return 0;
  267
  268err:
  269	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
  270	return -EINVAL;
  271}
  272
  273static int validate_ie_attr(const struct nlattr *attr,
  274			    struct netlink_ext_ack *extack)
  275{
  276	const u8 *data = nla_data(attr);
  277	unsigned int len = nla_len(attr);
  278	const struct element *elem;
  279
  280	for_each_element(elem, data, len) {
  281		/* nothing */
  282	}
  283
  284	if (for_each_element_completed(elem, data, len))
  285		return 0;
  286
  287	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
  288	return -EINVAL;
  289}
  290
  291static int validate_he_capa(const struct nlattr *attr,
  292			    struct netlink_ext_ack *extack)
  293{
  294	if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
  295		return -EINVAL;
  296
  297	return 0;
  298}
  299
  300static int validate_supported_selectors(const struct nlattr *attr,
  301					struct netlink_ext_ack *extack)
  302{
  303	const u8 *supported_selectors = nla_data(attr);
  304	u8 supported_selectors_len = nla_len(attr);
  305
  306	/* The top bit must not be set as it is not part of the selector */
  307	for (int i = 0; i < supported_selectors_len; i++) {
  308		if (supported_selectors[i] & 0x80)
  309			return -EINVAL;
  310	}
  311
  312	return 0;
  313}
  314
  315static int validate_nan_cluster_id(const struct nlattr *attr,
  316				   struct netlink_ext_ack *extack)
  317{
  318	const u8 *data = nla_data(attr);
  319	unsigned int len = nla_len(attr);
  320	static const u8 cluster_id_prefix[4] = {0x50, 0x6f, 0x9a, 0x1};
  321
  322	if (len != ETH_ALEN) {
  323		NL_SET_ERR_MSG_ATTR(extack, attr, "bad cluster id length");
  324		return -EINVAL;
  325	}
  326
  327	if (memcmp(data, cluster_id_prefix, sizeof(cluster_id_prefix))) {
  328		NL_SET_ERR_MSG_ATTR(extack, attr, "invalid cluster id prefix");
  329		return -EINVAL;
  330	}
  331
  332	return 0;
  333}
  334
  335/* policy for the attributes */
  336static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
  337
  338static const struct nla_policy
  339nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
  340	[NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
  341	[NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
  342					.len = U8_MAX },
  343	[NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
  344					     .len = U8_MAX },
  345};
  346
  347static const struct nla_policy
  348nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
  349	[NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
  350	[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
  351	[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
  352		NLA_POLICY_MAX(NLA_U8, 15),
  353	[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
  354	[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
  355		NLA_POLICY_MAX(NLA_U8, 15),
  356	[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] = { .type = NLA_U8 },
  357	[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
  358	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
  359	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
  360	[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
  361	[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
  362	[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
  363	[NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
  364};
  365
  366static const struct nla_policy
  367nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
  368	[NL80211_PMSR_TYPE_FTM] =
  369		NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
  370};
  371
  372static const struct nla_policy
  373nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
  374	[NL80211_PMSR_REQ_ATTR_DATA] =
  375		NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
  376	[NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
  377};
  378
  379static const struct nla_policy
  380nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
  381	[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
  382	[NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
  383	[NL80211_PMSR_PEER_ATTR_REQ] =
  384		NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
  385	[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
  386};
  387
  388static const struct nla_policy
  389nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
  390	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
  391	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
  392	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
  393	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
  394	[NL80211_PMSR_ATTR_PEERS] =
  395		NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
  396};
  397
  398static const struct nla_policy
  399he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
  400	[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
  401		NLA_POLICY_RANGE(NLA_U8, 1, 20),
  402	[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
  403		NLA_POLICY_RANGE(NLA_U8, 1, 20),
  404	[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
  405		NLA_POLICY_RANGE(NLA_U8, 1, 20),
  406	[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
  407		NLA_POLICY_EXACT_LEN(8),
  408	[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
  409		NLA_POLICY_EXACT_LEN(8),
  410	[NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
  411};
  412
  413static const struct nla_policy
  414he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
  415	[NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
  416	[NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
  417	[NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
  418};
  419
  420static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
  421	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
  422				    .len = NL80211_MAX_SUPP_RATES },
  423	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
  424				.len = NL80211_MAX_SUPP_HT_RATES },
  425	[NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
  426	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
  427	[NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
  428	[NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
  429						   NL80211_RATE_INFO_HE_GI_0_8,
  430						   NL80211_RATE_INFO_HE_GI_3_2),
  431	[NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
  432						   NL80211_RATE_INFO_HE_1XLTF,
  433						   NL80211_RATE_INFO_HE_4XLTF),
  434	[NL80211_TXRATE_EHT] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_eht)),
  435	[NL80211_TXRATE_EHT_GI] =  NLA_POLICY_RANGE(NLA_U8,
  436						   NL80211_RATE_INFO_EHT_GI_0_8,
  437						   NL80211_RATE_INFO_EHT_GI_3_2),
  438	[NL80211_TXRATE_EHT_LTF] = NLA_POLICY_RANGE(NLA_U8,
  439						   NL80211_RATE_INFO_EHT_1XLTF,
  440						   NL80211_RATE_INFO_EHT_8XLTF),
  441
  442};
  443
  444static const struct nla_policy
  445nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
  446	[NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
  447	[NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
  448	[NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
  449	[NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
  450	[NL80211_TID_CONFIG_ATTR_NOACK] =
  451			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
  452	[NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
  453	[NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
  454	[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
  455			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
  456	[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
  457			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
  458	[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
  459			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
  460	[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
  461			NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
  462	[NL80211_TID_CONFIG_ATTR_TX_RATE] =
  463			NLA_POLICY_NESTED(nl80211_txattr_policy),
  464};
  465
  466static const struct nla_policy
  467nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
  468	[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
  469	[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
  470	[NL80211_FILS_DISCOVERY_ATTR_TMPL] =
  471			NLA_POLICY_RANGE(NLA_BINARY,
  472					 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
  473					 IEEE80211_MAX_DATA_LEN),
  474};
  475
  476static const struct nla_policy
  477nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
  478	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
  479	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
  480						       .len = IEEE80211_MAX_DATA_LEN }
  481};
  482
  483static const struct nla_policy
  484sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
  485	[NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
  486	[NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
  487};
  488
  489static const struct nla_policy
  490sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
  491	[NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
  492	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
  493};
  494
  495static const struct nla_policy
  496nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
  497	[NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
  498	[NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
  499						NLA_POLICY_MIN(NLA_U8, 1),
  500	[NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
  501	[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
  502	[NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
  503	[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID] =
  504		NLA_POLICY_MAX(NLA_U8, IEEE80211_MLD_MAX_NUM_LINKS),
  505};
  506
  507static const struct nla_policy
  508nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
  509	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
  510	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
  511};
  512
  513static const struct nla_policy
  514nl80211_s1g_short_beacon[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1] = {
  515	[NL80211_S1G_SHORT_BEACON_ATTR_HEAD] =
  516		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
  517				       IEEE80211_MAX_DATA_LEN),
  518	[NL80211_S1G_SHORT_BEACON_ATTR_TAIL] =
  519		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
  520				       IEEE80211_MAX_DATA_LEN),
  521};
  522
  523static const struct nla_policy
  524nl80211_nan_band_conf_policy[NL80211_NAN_BAND_CONF_ATTR_MAX + 1] = {
  525	[NL80211_NAN_BAND_CONF_BAND] = NLA_POLICY_MAX(NLA_U8,
  526						      NUM_NL80211_BANDS - 1),
  527	[NL80211_NAN_BAND_CONF_FREQ] = { .type = NLA_U16 },
  528	[NL80211_NAN_BAND_CONF_RSSI_CLOSE] = NLA_POLICY_MIN(NLA_S8, -59),
  529	[NL80211_NAN_BAND_CONF_RSSI_MIDDLE] = NLA_POLICY_MIN(NLA_S8, -74),
  530	[NL80211_NAN_BAND_CONF_WAKE_DW] = NLA_POLICY_MAX(NLA_U8, 5),
  531	[NL80211_NAN_BAND_CONF_DISABLE_SCAN] = { .type = NLA_FLAG },
  532};
  533
  534static const struct nla_policy
  535nl80211_nan_conf_policy[NL80211_NAN_CONF_ATTR_MAX + 1] = {
  536	[NL80211_NAN_CONF_CLUSTER_ID] =
  537		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_nan_cluster_id,
  538				       ETH_ALEN),
  539	[NL80211_NAN_CONF_EXTRA_ATTRS] = { .type = NLA_BINARY,
  540					   .len = IEEE80211_MAX_DATA_LEN},
  541	[NL80211_NAN_CONF_VENDOR_ELEMS] =
  542		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
  543				       IEEE80211_MAX_DATA_LEN),
  544	[NL80211_NAN_CONF_BAND_CONFIGS] =
  545		NLA_POLICY_NESTED_ARRAY(nl80211_nan_band_conf_policy),
  546	[NL80211_NAN_CONF_SCAN_PERIOD] = { .type = NLA_U16 },
  547	[NL80211_NAN_CONF_SCAN_DWELL_TIME] = NLA_POLICY_RANGE(NLA_U16, 50, 512),
  548	[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL] =
  549		NLA_POLICY_RANGE(NLA_U8, 50, 200),
  550	[NL80211_NAN_CONF_NOTIFY_DW] = { .type = NLA_FLAG },
  551};
  552
  553static const struct netlink_range_validation nl80211_punct_bitmap_range = {
  554	.min = 0,
  555	.max = 0xffff,
  556};
  557
  558static const struct netlink_range_validation q_range = {
  559	.max = INT_MAX,
  560};
  561
  562static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
  563	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
  564	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
  565	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
  566				      .len = 20-1 },
  567	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
  568
  569	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
  570	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
  571	[NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
  572						NL80211_EDMG_CHANNELS_MIN,
  573						NL80211_EDMG_CHANNELS_MAX),
  574	[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
  575						NL80211_EDMG_BW_CONFIG_MIN,
  576						NL80211_EDMG_BW_CONFIG_MAX),
  577
  578	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
  579	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
  580	[NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
  581	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
  582
  583	[NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
  584	[NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
  585	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
  586	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
  587	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
  588	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
  589
  590	[NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
  591	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
  592	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
  593
  594	[NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  595	[NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  596
  597	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
  598	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
  599				    .len = WLAN_MAX_KEY_LEN },
  600	[NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
  601	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
  602	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
  603	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
  604	[NL80211_ATTR_KEY_TYPE] =
  605		NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
  606
  607	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
  608	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
  609	[NL80211_ATTR_BEACON_HEAD] =
  610		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
  611				       IEEE80211_MAX_DATA_LEN),
  612	[NL80211_ATTR_BEACON_TAIL] =
  613		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
  614				       IEEE80211_MAX_DATA_LEN),
  615	[NL80211_ATTR_STA_AID] =
  616		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
  617	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
  618	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
  619	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
  620					       .len = NL80211_MAX_SUPP_RATES },
  621	[NL80211_ATTR_STA_PLINK_ACTION] =
  622		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
  623	[NL80211_ATTR_STA_TX_POWER_SETTING] =
  624		NLA_POLICY_RANGE(NLA_U8,
  625				 NL80211_TX_POWER_AUTOMATIC,
  626				 NL80211_TX_POWER_FIXED),
  627	[NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
  628	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
  629	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
  630	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
  631				   .len = IEEE80211_MAX_MESH_ID_LEN },
  632	[NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
  633
  634	/* allow 3 for NUL-termination, we used to declare this NLA_STRING */
  635	[NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
  636	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
  637
  638	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
  639	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
  640	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
  641	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
  642					   .len = NL80211_MAX_SUPP_RATES },
  643	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
  644
  645	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
  646	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
  647
  648	[NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
  649
  650	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
  651	[NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
  652						   validate_ie_attr,
  653						   IEEE80211_MAX_DATA_LEN),
  654	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
  655	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
  656
  657	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
  658				.len = IEEE80211_MAX_SSID_LEN },
  659	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
  660	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
  661	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
  662	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
  663	[NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
  664						  NL80211_MFP_NO,
  665						  NL80211_MFP_OPTIONAL),
  666	[NL80211_ATTR_STA_FLAGS2] =
  667		NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
  668	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
  669	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
  670	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
  671	[NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
  672	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
  673	[NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
  674	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
  675	[NL80211_ATTR_WPA_VERSIONS] =
  676		NLA_POLICY_RANGE(NLA_U32, 0,
  677				 NL80211_WPA_VERSION_1 |
  678				 NL80211_WPA_VERSION_2 |
  679				 NL80211_WPA_VERSION_3),
  680	[NL80211_ATTR_PID] = { .type = NLA_U32 },
  681	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
  682	[NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
  683	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
  684	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
  685	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
  686	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
  687				 .len = IEEE80211_MAX_DATA_LEN },
  688	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
  689	[NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
  690						   NL80211_PS_DISABLED,
  691						   NL80211_PS_ENABLED),
  692	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
  693	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
  694	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
  695	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
  696	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
  697	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
  698	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
  699	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
  700	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
  701	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
  702	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
  703	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
  704	[NL80211_ATTR_STA_PLINK_STATE] =
  705		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
  706	[NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
  707	[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
  708	[NL80211_ATTR_MESH_PEER_AID] =
  709		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
  710	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
  711	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
  712	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
  713	[NL80211_ATTR_HIDDEN_SSID] =
  714		NLA_POLICY_RANGE(NLA_U32,
  715				 NL80211_HIDDEN_SSID_NOT_IN_USE,
  716				 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
  717	[NL80211_ATTR_IE_PROBE_RESP] =
  718		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
  719				       IEEE80211_MAX_DATA_LEN),
  720	[NL80211_ATTR_IE_ASSOC_RESP] =
  721		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
  722				       IEEE80211_MAX_DATA_LEN),
  723	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
  724	[NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
  725	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
  726	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
  727	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
  728	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
  729	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
  730	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
  731	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
  732	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
  733	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
  734	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
  735				      .len = IEEE80211_MAX_DATA_LEN },
  736	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
  737	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
  738	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
  739		.len = NL80211_HT_CAPABILITY_LEN
  740	},
  741	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
  742	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
  743	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
  744	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
  745	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
  746
  747	/* need to include at least Auth Transaction and Status Code */
  748	[NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
  749
  750	[NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
  751	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
  752	[NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
  753	[NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
  754	[NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
  755		NLA_POLICY_RANGE(NLA_U32,
  756				 NL80211_MESH_POWER_UNKNOWN + 1,
  757				 NL80211_MESH_POWER_MAX),
  758	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
  759	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
  760	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
  761	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
  762	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
  763	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
  764	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
  765		.len = NL80211_VHT_CAPABILITY_LEN,
  766	},
  767	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
  768	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
  769				  .len = IEEE80211_MAX_DATA_LEN },
  770	[NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
  771	[NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
  772		NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
  773	[NL80211_ATTR_PEER_AID] =
  774		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
  775	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
  776	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
  777	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
  778	[NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
  779	[NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
  780	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
  781	/*
  782	 * The value of the Length field of the Supported Operating
  783	 * Classes element is between 2 and 253.
  784	 */
  785	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
  786		NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
  787	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
  788	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
  789	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
  790	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
  791	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
  792	[NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
  793						  IEEE80211_QOS_MAP_LEN_MIN,
  794						  IEEE80211_QOS_MAP_LEN_MAX),
  795	[NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  796	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
  797	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
  798	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
  799	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
  800	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
  801	[NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
  802	[NL80211_ATTR_USER_PRIO] =
  803		NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
  804	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
  805	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
  806	[NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
  807	[NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  808	[NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
  809	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
  810	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
  811	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
  812	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
  813	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
  814	[NL80211_ATTR_STA_SUPPORT_P2P_PS] =
  815		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
  816	[NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
  817		.len = VHT_MUMIMO_GROUPS_DATA_LEN
  818	},
  819	[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  820	[NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
  821	[NL80211_ATTR_BANDS] = { .type = NLA_U32 },
  822	[NL80211_ATTR_NAN_CONFIG] = NLA_POLICY_NESTED(nl80211_nan_conf_policy),
  823	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
  824	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
  825				    .len = FILS_MAX_KEK_LEN },
  826	[NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
  827	[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
  828	[NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  829	[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
  830	[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
  831		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
  832	},
  833	[NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
  834	[NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
  835					     .len = FILS_ERP_MAX_USERNAME_LEN },
  836	[NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
  837					  .len = FILS_ERP_MAX_REALM_LEN },
  838	[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
  839	[NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
  840					.len = FILS_ERP_MAX_RRK_LEN },
  841	[NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
  842	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
  843	[NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
  844	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
  845	[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
  846
  847	[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
  848	[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
  849	[NL80211_ATTR_TXQ_QUANTUM] = NLA_POLICY_FULL_RANGE(NLA_U32, &q_range),
  850	[NL80211_ATTR_HE_CAPABILITY] =
  851		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
  852				       NL80211_HE_MAX_CAPABILITY_LEN),
  853	[NL80211_ATTR_FTM_RESPONDER] =
  854		NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
  855	[NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
  856	[NL80211_ATTR_PEER_MEASUREMENTS] =
  857		NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
  858	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
  859	[NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
  860					.len = SAE_PASSWORD_MAX_LEN },
  861	[NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
  862	[NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
  863	[NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
  864	[NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
  865	[NL80211_ATTR_TID_CONFIG] =
  866		NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
  867	[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
  868	[NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
  869	[NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
  870	[NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
  871	[NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
  872	[NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
  873	[NL80211_ATTR_HE_6GHZ_CAPABILITY] =
  874		NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
  875	[NL80211_ATTR_FILS_DISCOVERY] =
  876		NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
  877	[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
  878		NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
  879	[NL80211_ATTR_S1G_CAPABILITY] =
  880		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
  881	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
  882		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
  883	[NL80211_ATTR_SAE_PWE] =
  884		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
  885				 NL80211_SAE_PWE_BOTH),
  886	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
  887	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
  888	[NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
  889	[NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
  890	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
  891	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
  892	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
  893	[NL80211_ATTR_MBSSID_CONFIG] =
  894			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
  895	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
  896	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
  897	[NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
  898	[NL80211_ATTR_EHT_CAPABILITY] =
  899		NLA_POLICY_RANGE(NLA_BINARY,
  900				 NL80211_EHT_MIN_CAPABILITY_LEN,
  901				 NL80211_EHT_MAX_CAPABILITY_LEN),
  902	[NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
  903	[NL80211_ATTR_MLO_LINKS] =
  904		NLA_POLICY_NESTED_ARRAY(nl80211_policy),
  905	[NL80211_ATTR_MLO_LINK_ID] =
  906		NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS - 1),
  907	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
  908	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
  909	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
  910	[NL80211_ATTR_EML_CAPABILITY] = { .type = NLA_U16 },
  911	[NL80211_ATTR_PUNCT_BITMAP] =
  912		NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
  913
  914	[NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
  915	[NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
  916	[NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
  917	[NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
  918	[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA] = { .type = NLA_FLAG },
  919	[NL80211_ATTR_MLO_TTLM_DLINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  920	[NL80211_ATTR_MLO_TTLM_ULINK] = NLA_POLICY_EXACT_LEN(sizeof(u16) * 8),
  921	[NL80211_ATTR_ASSOC_SPP_AMSDU] = { .type = NLA_FLAG },
  922	[NL80211_ATTR_VIF_RADIO_MASK] = { .type = NLA_U32 },
  923	[NL80211_ATTR_SUPPORTED_SELECTORS] =
  924		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_supported_selectors,
  925				       NL80211_MAX_SUPP_SELECTORS),
  926	[NL80211_ATTR_MLO_RECONF_REM_LINKS] = { .type = NLA_U16 },
  927	[NL80211_ATTR_EPCS] = { .type = NLA_FLAG },
  928	[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS] = { .type = NLA_U16 },
  929	[NL80211_ATTR_WIPHY_RADIO_INDEX] = { .type = NLA_U8 },
  930	[NL80211_ATTR_S1G_LONG_BEACON_PERIOD] = NLA_POLICY_MIN(NLA_U8, 2),
  931	[NL80211_ATTR_S1G_SHORT_BEACON] =
  932		NLA_POLICY_NESTED(nl80211_s1g_short_beacon),
  933	[NL80211_ATTR_BSS_PARAM] = { .type = NLA_FLAG },
  934	[NL80211_ATTR_S1G_PRIMARY_2MHZ] = { .type = NLA_FLAG },
  935};
  936
  937/* policy for the key attributes */
  938static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
  939	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
  940	[NL80211_KEY_IDX] = { .type = NLA_U8 },
  941	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
  942	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
  943	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
  944	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
  945	[NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
  946	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
  947	[NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
  948};
  949
  950/* policy for the key default flags */
  951static const struct nla_policy
  952nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
  953	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
  954	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
  955};
  956
  957#ifdef CONFIG_PM
  958/* policy for WoWLAN attributes */
  959static const struct nla_policy
  960nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
  961	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
  962	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
  963	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
  964	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
  965	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
  966	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
  967	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
  968	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
  969	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
  970	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
  971};
  972
  973static const struct nla_policy
  974nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
  975	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
  976	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
  977	[NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
  978	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
  979	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
  980	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
  981	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
  982		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
  983	},
  984	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
  985		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
  986	},
  987	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
  988	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
  989	[NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
  990};
  991#endif /* CONFIG_PM */
  992
  993/* policy for coalesce rule attributes */
  994static const struct nla_policy
  995nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
  996	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
  997	[NL80211_ATTR_COALESCE_RULE_CONDITION] =
  998		NLA_POLICY_RANGE(NLA_U32,
  999				 NL80211_COALESCE_CONDITION_MATCH,
 1000				 NL80211_COALESCE_CONDITION_NO_MATCH),
 1001	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 1002};
 1003
 1004/* policy for GTK rekey offload attributes */
 1005static const struct nla_policy
 1006nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 1007	[NL80211_REKEY_DATA_KEK] = {
 1008		.type = NLA_BINARY,
 1009		.len = NL80211_KEK_EXT_LEN
 1010	},
 1011	[NL80211_REKEY_DATA_KCK] = {
 1012		.type = NLA_BINARY,
 1013		.len = NL80211_KCK_EXT_LEN_32
 1014	},
 1015	[NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 1016	[NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 1017};
 1018
 1019static const struct nla_policy
 1020nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 1021	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 1022						 .len = IEEE80211_MAX_SSID_LEN },
 1023	[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 1024	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 1025};
 1026
 1027static const struct nla_policy
 1028nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 1029	[NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 1030	[NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 1031};
 1032
 1033static const struct nla_policy
 1034nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 1035	[NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 1036	[NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 1037	[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 1038		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
 1039	},
 1040};
 1041
 1042/* policy for NAN function attributes */
 1043static const struct nla_policy
 1044nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 1045	[NL80211_NAN_FUNC_TYPE] =
 1046		NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 1047	[NL80211_NAN_FUNC_SERVICE_ID] = {
 1048				    .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 1049	[NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 1050	[NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 1051	[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 1052	[NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 1053	[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 1054	[NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 1055	[NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 1056	[NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 1057	[NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 1058			.len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 1059	[NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 1060	[NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 1061	[NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 1062	[NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 1063	[NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 1064};
 1065
 1066/* policy for Service Response Filter attributes */
 1067static const struct nla_policy
 1068nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 1069	[NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 1070	[NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 1071				 .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 1072	[NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 1073	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 1074};
 1075
 1076/* policy for packet pattern attributes */
 1077static const struct nla_policy
 1078nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 1079	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 1080	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 1081	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 1082};
 1083
 1084static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 1085				     struct cfg80211_registered_device **rdev,
 1086				     struct wireless_dev **wdev,
 1087				     struct nlattr **attrbuf)
 1088{
 1089	int err;
 1090
 1091	if (!cb->args[0]) {
 1092		struct nlattr **attrbuf_free = NULL;
 1093
 1094		if (!attrbuf) {
 1095			attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 1096					  GFP_KERNEL);
 1097			if (!attrbuf)
 1098				return -ENOMEM;
 1099			attrbuf_free = attrbuf;
 1100		}
 1101
 1102		err = nlmsg_parse_deprecated(cb->nlh,
 1103					     GENL_HDRLEN + nl80211_fam.hdrsize,
 1104					     attrbuf, nl80211_fam.maxattr,
 1105					     nl80211_policy, NULL);
 1106		if (err) {
 1107			kfree(attrbuf_free);
 1108			return err;
 1109		}
 1110
 1111		rtnl_lock();
 1112		*wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
 1113						   attrbuf);
 1114		kfree(attrbuf_free);
 1115		if (IS_ERR(*wdev)) {
 1116			rtnl_unlock();
 1117			return PTR_ERR(*wdev);
 1118		}
 1119		*rdev = wiphy_to_rdev((*wdev)->wiphy);
 1120		mutex_lock(&(*rdev)->wiphy.mtx);
 1121		rtnl_unlock();
 1122		/* 0 is the first index - add 1 to parse only once */
 1123		cb->args[0] = (*rdev)->wiphy_idx + 1;
 1124		cb->args[1] = (*wdev)->identifier;
 1125	} else {
 1126		/* subtract the 1 again here */
 1127		struct wiphy *wiphy;
 1128		struct wireless_dev *tmp;
 1129
 1130		rtnl_lock();
 1131		wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 1132		if (!wiphy) {
 1133			rtnl_unlock();
 1134			return -ENODEV;
 1135		}
 1136		*rdev = wiphy_to_rdev(wiphy);
 1137		*wdev = NULL;
 1138
 1139		list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 1140			if (tmp->identifier == cb->args[1]) {
 1141				*wdev = tmp;
 1142				break;
 1143			}
 1144		}
 1145
 1146		if (!*wdev) {
 1147			rtnl_unlock();
 1148			return -ENODEV;
 1149		}
 1150		mutex_lock(&(*rdev)->wiphy.mtx);
 1151		rtnl_unlock();
 1152	}
 1153
 1154	return 0;
 1155}
 1156
 1157/* message building helper */
 1158void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 1159		     int flags, u8 cmd)
 1160{
 1161	/* since there is no private header just add the generic one */
 1162	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 1163}
 1164
 1165static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 1166				     const struct ieee80211_reg_rule *rule)
 1167{
 1168	int j;
 1169	struct nlattr *nl_wmm_rules =
 1170		nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 1171
 1172	if (!nl_wmm_rules)
 1173		goto nla_put_failure;
 1174
 1175	for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 1176		struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 1177
 1178		if (!nl_wmm_rule)
 1179			goto nla_put_failure;
 1180
 1181		if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 1182				rule->wmm_rule.client[j].cw_min) ||
 1183		    nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 1184				rule->wmm_rule.client[j].cw_max) ||
 1185		    nla_put_u8(msg, NL80211_WMMR_AIFSN,
 1186			       rule->wmm_rule.client[j].aifsn) ||
 1187		    nla_put_u16(msg, NL80211_WMMR_TXOP,
 1188			        rule->wmm_rule.client[j].cot))
 1189			goto nla_put_failure;
 1190
 1191		nla_nest_end(msg, nl_wmm_rule);
 1192	}
 1193	nla_nest_end(msg, nl_wmm_rules);
 1194
 1195	return 0;
 1196
 1197nla_put_failure:
 1198	return -ENOBUFS;
 1199}
 1200
 1201static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 1202				   struct ieee80211_channel *chan,
 1203				   bool large)
 1204{
 1205	/* Some channels must be completely excluded from the
 1206	 * list to protect old user-space tools from breaking
 1207	 */
 1208	if (!large && chan->flags &
 1209	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 1210		return 0;
 1211	if (!large && chan->freq_offset)
 1212		return 0;
 1213
 1214	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 1215			chan->center_freq))
 1216		goto nla_put_failure;
 1217
 1218	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
 1219		goto nla_put_failure;
 1220
 1221	if ((chan->flags & IEEE80211_CHAN_PSD) &&
 1222	    nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
 1223		goto nla_put_failure;
 1224
 1225	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 1226	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 1227		goto nla_put_failure;
 1228	if (chan->flags & IEEE80211_CHAN_NO_IR) {
 1229		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 1230			goto nla_put_failure;
 1231		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 1232			goto nla_put_failure;
 1233	}
 1234	if (chan->flags & IEEE80211_CHAN_RADAR) {
 1235		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 1236			goto nla_put_failure;
 1237		if (large) {
 1238			u32 time;
 1239
 1240			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 1241
 1242			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 1243					chan->dfs_state))
 1244				goto nla_put_failure;
 1245			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 1246					time))
 1247				goto nla_put_failure;
 1248			if (nla_put_u32(msg,
 1249					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 1250					chan->dfs_cac_ms))
 1251				goto nla_put_failure;
 1252		}
 1253	}
 1254
 1255	if (large) {
 1256		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 1257		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 1258			goto nla_put_failure;
 1259		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 1260		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 1261			goto nla_put_failure;
 1262		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 1263		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 1264			goto nla_put_failure;
 1265		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 1266		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 1267			goto nla_put_failure;
 1268		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 1269		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 1270			goto nla_put_failure;
 1271		if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 1272		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 1273			goto nla_put_failure;
 1274		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 1275		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 1276			goto nla_put_failure;
 1277		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 1278		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 1279			goto nla_put_failure;
 1280		if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
 1281		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
 1282			goto nla_put_failure;
 1283		if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
 1284		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
 1285			goto nla_put_failure;
 1286		if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
 1287		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
 1288			goto nla_put_failure;
 1289		if ((chan->flags & IEEE80211_CHAN_DFS_CONCURRENT) &&
 1290		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DFS_CONCURRENT))
 1291			goto nla_put_failure;
 1292		if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_VLP_CLIENT) &&
 1293		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_VLP_CLIENT))
 1294			goto nla_put_failure;
 1295		if ((chan->flags & IEEE80211_CHAN_NO_6GHZ_AFC_CLIENT) &&
 1296		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_6GHZ_AFC_CLIENT))
 1297			goto nla_put_failure;
 1298		if ((chan->flags & IEEE80211_CHAN_CAN_MONITOR) &&
 1299		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_CAN_MONITOR))
 1300			goto nla_put_failure;
 1301		if ((chan->flags & IEEE80211_CHAN_ALLOW_6GHZ_VLP_AP) &&
 1302		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_ALLOW_6GHZ_VLP_AP))
 1303			goto nla_put_failure;
 1304		if ((chan->flags & IEEE80211_CHAN_ALLOW_20MHZ_ACTIVITY) &&
 1305		    nla_put_flag(msg,
 1306				 NL80211_FREQUENCY_ATTR_ALLOW_20MHZ_ACTIVITY))
 1307			goto nla_put_failure;
 1308		if ((chan->flags & IEEE80211_CHAN_NO_4MHZ) &&
 1309		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_4MHZ))
 1310			goto nla_put_failure;
 1311		if ((chan->flags & IEEE80211_CHAN_NO_8MHZ) &&
 1312		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_8MHZ))
 1313			goto nla_put_failure;
 1314		if ((chan->flags & IEEE80211_CHAN_NO_16MHZ) &&
 1315		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_16MHZ))
 1316			goto nla_put_failure;
 1317	}
 1318
 1319	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 1320			DBM_TO_MBM(chan->max_power)))
 1321		goto nla_put_failure;
 1322
 1323	if (large) {
 1324		const struct ieee80211_reg_rule *rule =
 1325			freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 1326
 1327		if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 1328			if (nl80211_msg_put_wmm_rules(msg, rule))
 1329				goto nla_put_failure;
 1330		}
 1331	}
 1332
 1333	return 0;
 1334
 1335 nla_put_failure:
 1336	return -ENOBUFS;
 1337}
 1338
 1339static bool nl80211_put_txq_stats(struct sk_buff *msg,
 1340				  struct cfg80211_txq_stats *txqstats,
 1341				  int attrtype)
 1342{
 1343	struct nlattr *txqattr;
 1344
 1345#define PUT_TXQVAL_U32(attr, memb) do {					  \
 1346	if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&	  \
 1347	    nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 1348		return false;						  \
 1349	} while (0)
 1350
 1351	txqattr = nla_nest_start_noflag(msg, attrtype);
 1352	if (!txqattr)
 1353		return false;
 1354
 1355	PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 1356	PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 1357	PUT_TXQVAL_U32(FLOWS, flows);
 1358	PUT_TXQVAL_U32(DROPS, drops);
 1359	PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 1360	PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 1361	PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 1362	PUT_TXQVAL_U32(COLLISIONS, collisions);
 1363	PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 1364	PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 1365	PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 1366	nla_nest_end(msg, txqattr);
 1367
 1368#undef PUT_TXQVAL_U32
 1369	return true;
 1370}
 1371
 1372/* netlink command implementations */
 1373
 1374/**
 1375 * nl80211_link_id - return link ID
 1376 * @attrs: attributes to look at
 1377 *
 1378 * Returns: the link ID or 0 if not given
 1379 *
 1380 * Note this function doesn't do any validation of the link
 1381 * ID validity wrt. links that were actually added, so it must
 1382 * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
 1383 * or if additional validation is done.
 1384 */
 1385static unsigned int nl80211_link_id(struct nlattr **attrs)
 1386{
 1387	struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
 1388
 1389	return nla_get_u8_default(linkid, 0);
 1390}
 1391
 1392static int nl80211_link_id_or_invalid(struct nlattr **attrs)
 1393{
 1394	struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
 1395
 1396	if (!linkid)
 1397		return -1;
 1398
 1399	return nla_get_u8(linkid);
 1400}
 1401
 1402struct key_parse {
 1403	struct key_params p;
 1404	int idx;
 1405	int type;
 1406	bool def, defmgmt, defbeacon;
 1407	bool def_uni, def_multi;
 1408};
 1409
 1410static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 1411				 struct key_parse *k)
 1412{
 1413	struct nlattr *tb[NL80211_KEY_MAX + 1];
 1414	int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
 1415					      nl80211_key_policy,
 1416					      info->extack);
 1417	if (err)
 1418		return err;
 1419
 1420	k->def = !!tb[NL80211_KEY_DEFAULT];
 1421	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 1422	k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
 1423
 1424	if (k->def) {
 1425		k->def_uni = true;
 1426		k->def_multi = true;
 1427	}
 1428	if (k->defmgmt || k->defbeacon)
 1429		k->def_multi = true;
 1430
 1431	if (tb[NL80211_KEY_IDX])
 1432		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 1433
 1434	if (tb[NL80211_KEY_DATA]) {
 1435		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 1436		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 1437	}
 1438
 1439	if (tb[NL80211_KEY_SEQ]) {
 1440		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 1441		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 1442	}
 1443
 1444	if (tb[NL80211_KEY_CIPHER])
 1445		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 1446
 1447	if (tb[NL80211_KEY_TYPE])
 1448		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 1449
 1450	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 1451		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 1452
 1453		err = nla_parse_nested_deprecated(kdt,
 1454						  NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 1455						  tb[NL80211_KEY_DEFAULT_TYPES],
 1456						  nl80211_key_default_policy,
 1457						  info->extack);
 1458		if (err)
 1459			return err;
 1460
 1461		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 1462		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 1463	}
 1464
 1465	if (tb[NL80211_KEY_MODE])
 1466		k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
 1467
 1468	return 0;
 1469}
 1470
 1471static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 1472{
 1473	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 1474		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 1475		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 1476	}
 1477
 1478	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 1479		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 1480		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 1481	}
 1482
 1483	if (info->attrs[NL80211_ATTR_KEY_IDX])
 1484		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 1485
 1486	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 1487		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 1488
 1489	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 1490	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 1491
 1492	if (k->def) {
 1493		k->def_uni = true;
 1494		k->def_multi = true;
 1495	}
 1496	if (k->defmgmt)
 1497		k->def_multi = true;
 1498
 1499	if (info->attrs[NL80211_ATTR_KEY_TYPE])
 1500		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 1501
 1502	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 1503		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 1504		int err = nla_parse_nested_deprecated(kdt,
 1505						      NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 1506						      info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 1507						      nl80211_key_default_policy,
 1508						      info->extack);
 1509		if (err)
 1510			return err;
 1511
 1512		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 1513		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 1514	}
 1515
 1516	return 0;
 1517}
 1518
 1519static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 1520{
 1521	int err;
 1522
 1523	memset(k, 0, sizeof(*k));
 1524	k->idx = -1;
 1525	k->type = -1;
 1526
 1527	if (info->attrs[NL80211_ATTR_KEY])
 1528		err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 1529	else
 1530		err = nl80211_parse_key_old(info, k);
 1531
 1532	if (err)
 1533		return err;
 1534
 1535	if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
 1536	    (k->defbeacon ? 1 : 0) > 1) {
 1537		GENL_SET_ERR_MSG(info,
 1538				 "key with multiple default flags is invalid");
 1539		return -EINVAL;
 1540	}
 1541
 1542	if (k->defmgmt || k->defbeacon) {
 1543		if (k->def_uni || !k->def_multi) {
 1544			GENL_SET_ERR_MSG(info,
 1545					 "defmgmt/defbeacon key must be mcast");
 1546			return -EINVAL;
 1547		}
 1548	}
 1549
 1550	if (k->idx != -1) {
 1551		if (k->defmgmt) {
 1552			if (k->idx < 4 || k->idx > 5) {
 1553				GENL_SET_ERR_MSG(info,
 1554						 "defmgmt key idx not 4 or 5");
 1555				return -EINVAL;
 1556			}
 1557		} else if (k->defbeacon) {
 1558			if (k->idx < 6 || k->idx > 7) {
 1559				GENL_SET_ERR_MSG(info,
 1560						 "defbeacon key idx not 6 or 7");
 1561				return -EINVAL;
 1562			}
 1563		} else if (k->def) {
 1564			if (k->idx < 0 || k->idx > 3) {
 1565				GENL_SET_ERR_MSG(info, "def key idx not 0-3");
 1566				return -EINVAL;
 1567			}
 1568		} else {
 1569			if (k->idx < 0 || k->idx > 7) {
 1570				GENL_SET_ERR_MSG(info, "key idx not 0-7");
 1571				return -EINVAL;
 1572			}
 1573		}
 1574	}
 1575
 1576	return 0;
 1577}
 1578
 1579static struct cfg80211_cached_keys *
 1580nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 1581		       struct genl_info *info, bool *no_ht)
 1582{
 1583	struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
 1584	struct key_parse parse;
 1585	struct nlattr *key;
 1586	struct cfg80211_cached_keys *result;
 1587	int rem, err, def = 0;
 1588	bool have_key = false;
 1589
 1590	nla_for_each_nested(key, keys, rem) {
 1591		have_key = true;
 1592		break;
 1593	}
 1594
 1595	if (!have_key)
 1596		return NULL;
 1597
 1598	result = kzalloc(sizeof(*result), GFP_KERNEL);
 1599	if (!result)
 1600		return ERR_PTR(-ENOMEM);
 1601
 1602	result->def = -1;
 1603
 1604	nla_for_each_nested(key, keys, rem) {
 1605		memset(&parse, 0, sizeof(parse));
 1606		parse.idx = -1;
 1607
 1608		err = nl80211_parse_key_new(info, key, &parse);
 1609		if (err)
 1610			goto error;
 1611		err = -EINVAL;
 1612		if (!parse.p.key)
 1613			goto error;
 1614		if (parse.idx < 0 || parse.idx > 3) {
 1615			GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
 1616			goto error;
 1617		}
 1618		if (parse.def) {
 1619			if (def) {
 1620				GENL_SET_ERR_MSG(info,
 1621						 "only one key can be default");
 1622				goto error;
 1623			}
 1624			def = 1;
 1625			result->def = parse.idx;
 1626			if (!parse.def_uni || !parse.def_multi)
 1627				goto error;
 1628		} else if (parse.defmgmt)
 1629			goto error;
 1630		err = cfg80211_validate_key_settings(rdev, &parse.p,
 1631						     parse.idx, false, NULL);
 1632		if (err)
 1633			goto error;
 1634		if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 1635		    parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 1636			GENL_SET_ERR_MSG(info, "connect key must be WEP");
 1637			err = -EINVAL;
 1638			goto error;
 1639		}
 1640		result->params[parse.idx].cipher = parse.p.cipher;
 1641		result->params[parse.idx].key_len = parse.p.key_len;
 1642		result->params[parse.idx].key = result->data[parse.idx];
 1643		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 1644
 1645		/* must be WEP key if we got here */
 1646		if (no_ht)
 1647			*no_ht = true;
 1648	}
 1649
 1650	if (result->def < 0) {
 1651		err = -EINVAL;
 1652		GENL_SET_ERR_MSG(info, "need a default/TX key");
 1653		goto error;
 1654	}
 1655
 1656	return result;
 1657 error:
 1658	kfree_sensitive(result);
 1659	return ERR_PTR(err);
 1660}
 1661
 1662static int nl80211_key_allowed(struct wireless_dev *wdev)
 1663{
 1664	lockdep_assert_wiphy(wdev->wiphy);
 1665
 1666	switch (wdev->iftype) {
 1667	case NL80211_IFTYPE_AP:
 1668	case NL80211_IFTYPE_AP_VLAN:
 1669	case NL80211_IFTYPE_P2P_GO:
 1670	case NL80211_IFTYPE_MESH_POINT:
 1671		break;
 1672	case NL80211_IFTYPE_ADHOC:
 1673		if (wdev->u.ibss.current_bss)
 1674			return 0;
 1675		return -ENOLINK;
 1676	case NL80211_IFTYPE_STATION:
 1677	case NL80211_IFTYPE_P2P_CLIENT:
 1678		if (wdev->connected)
 1679			return 0;
 1680		return -ENOLINK;
 1681	case NL80211_IFTYPE_NAN:
 1682		if (wiphy_ext_feature_isset(wdev->wiphy,
 1683					    NL80211_EXT_FEATURE_SECURE_NAN))
 1684			return 0;
 1685		return -EINVAL;
 1686	case NL80211_IFTYPE_UNSPECIFIED:
 1687	case NL80211_IFTYPE_OCB:
 1688	case NL80211_IFTYPE_MONITOR:
 1689	case NL80211_IFTYPE_P2P_DEVICE:
 1690	case NL80211_IFTYPE_WDS:
 1691	case NUM_NL80211_IFTYPES:
 1692		return -EINVAL;
 1693	}
 1694
 1695	return 0;
 1696}
 1697
 1698static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 1699							u32 freq)
 1700{
 1701	struct ieee80211_channel *chan;
 1702
 1703	chan = ieee80211_get_channel_khz(wiphy, freq);
 1704	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 1705		return NULL;
 1706	return chan;
 1707}
 1708
 1709static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 1710{
 1711	struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
 1712	int i;
 1713
 1714	if (!nl_modes)
 1715		goto nla_put_failure;
 1716
 1717	i = 0;
 1718	while (ifmodes) {
 1719		if ((ifmodes & 1) && nla_put_flag(msg, i))
 1720			goto nla_put_failure;
 1721		ifmodes >>= 1;
 1722		i++;
 1723	}
 1724
 1725	nla_nest_end(msg, nl_modes);
 1726	return 0;
 1727
 1728nla_put_failure:
 1729	return -ENOBUFS;
 1730}
 1731
 1732static int nl80211_put_ifcomb_data(struct sk_buff *msg, bool large, int idx,
 1733				   const struct ieee80211_iface_combination *c,
 1734				   u16 nested)
 1735{
 1736	struct nlattr *nl_combi, *nl_limits;
 1737	int i;
 1738
 1739	nl_combi = nla_nest_start_noflag(msg, idx | nested);
 1740	if (!nl_combi)
 1741		goto nla_put_failure;
 1742
 1743	nl_limits = nla_nest_start_noflag(msg, NL80211_IFACE_COMB_LIMITS |
 1744					       nested);
 1745	if (!nl_limits)
 1746		goto nla_put_failure;
 1747
 1748	for (i = 0; i < c->n_limits; i++) {
 1749		struct nlattr *nl_limit;
 1750
 1751		nl_limit = nla_nest_start_noflag(msg, i + 1);
 1752		if (!nl_limit)
 1753			goto nla_put_failure;
 1754		if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX, c->limits[i].max))
 1755			goto nla_put_failure;
 1756		if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 1757					c->limits[i].types))
 1758			goto nla_put_failure;
 1759		nla_nest_end(msg, nl_limit);
 1760	}
 1761
 1762	nla_nest_end(msg, nl_limits);
 1763
 1764	if (c->beacon_int_infra_match &&
 1765	    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 1766		goto nla_put_failure;
 1767	if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 1768			c->num_different_channels) ||
 1769	    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 1770			c->max_interfaces))
 1771		goto nla_put_failure;
 1772	if (large &&
 1773	    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 1774			c->radar_detect_widths) ||
 1775	     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 1776			c->radar_detect_regions)))
 1777		goto nla_put_failure;
 1778	if (c->beacon_int_min_gcd &&
 1779	    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
 1780			c->beacon_int_min_gcd))
 1781		goto nla_put_failure;
 1782
 1783	nla_nest_end(msg, nl_combi);
 1784
 1785	return 0;
 1786nla_put_failure:
 1787	return -ENOBUFS;
 1788}
 1789
 1790static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 1791					  struct sk_buff *msg,
 1792					  int attr, int radio,
 1793					  bool large, u16 nested)
 1794{
 1795	const struct ieee80211_iface_combination *c;
 1796	struct nlattr *nl_combis;
 1797	int i, n;
 1798
 1799	nl_combis = nla_nest_start_noflag(msg, attr | nested);
 1800	if (!nl_combis)
 1801		goto nla_put_failure;
 1802
 1803	if (radio >= 0) {
 1804		c = wiphy->radio[0].iface_combinations;
 1805		n = wiphy->radio[0].n_iface_combinations;
 1806	} else {
 1807		c = wiphy->iface_combinations;
 1808		n = wiphy->n_iface_combinations;
 1809	}
 1810	for (i = 0; i < n; i++)
 1811		if (nl80211_put_ifcomb_data(msg, large, i + 1, &c[i], nested))
 1812			goto nla_put_failure;
 1813
 1814	nla_nest_end(msg, nl_combis);
 1815
 1816	return 0;
 1817nla_put_failure:
 1818	return -ENOBUFS;
 1819}
 1820
 1821#ifdef CONFIG_PM
 1822static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 1823					struct sk_buff *msg)
 1824{
 1825	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 1826	struct nlattr *nl_tcp;
 1827
 1828	if (!tcp)
 1829		return 0;
 1830
 1831	nl_tcp = nla_nest_start_noflag(msg,
 1832				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 1833	if (!nl_tcp)
 1834		return -ENOBUFS;
 1835
 1836	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 1837			tcp->data_payload_max))
 1838		return -ENOBUFS;
 1839
 1840	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 1841			tcp->data_payload_max))
 1842		return -ENOBUFS;
 1843
 1844	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 1845		return -ENOBUFS;
 1846
 1847	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 1848				sizeof(*tcp->tok), tcp->tok))
 1849		return -ENOBUFS;
 1850
 1851	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 1852			tcp->data_interval_max))
 1853		return -ENOBUFS;
 1854
 1855	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 1856			tcp->wake_payload_max))
 1857		return -ENOBUFS;
 1858
 1859	nla_nest_end(msg, nl_tcp);
 1860	return 0;
 1861}
 1862
 1863static int nl80211_send_wowlan(struct sk_buff *msg,
 1864			       struct cfg80211_registered_device *rdev,
 1865			       bool large)
 1866{
 1867	struct nlattr *nl_wowlan;
 1868
 1869	if (!rdev->wiphy.wowlan)
 1870		return 0;
 1871
 1872	nl_wowlan = nla_nest_start_noflag(msg,
 1873					  NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 1874	if (!nl_wowlan)
 1875		return -ENOBUFS;
 1876
 1877	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
 1878	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
 1879	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
 1880	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
 1881	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
 1882	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
 1883	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
 1884	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
 1885	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
 1886	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
 1887	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
 1888	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
 1889	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
 1890	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
 1891	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
 1892	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
 1893		return -ENOBUFS;
 1894
 1895	if (rdev->wiphy.wowlan->n_patterns) {
 1896		struct nl80211_pattern_support pat = {
 1897			.max_patterns = rdev->wiphy.wowlan->n_patterns,
 1898			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
 1899			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
 1900			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
 1901		};
 1902
 1903		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
 1904			    sizeof(pat), &pat))
 1905			return -ENOBUFS;
 1906	}
 1907
 1908	if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
 1909	    nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
 1910			rdev->wiphy.wowlan->max_nd_match_sets))
 1911		return -ENOBUFS;
 1912
 1913	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
 1914		return -ENOBUFS;
 1915
 1916	nla_nest_end(msg, nl_wowlan);
 1917
 1918	return 0;
 1919}
 1920#endif
 1921
 1922static int nl80211_send_coalesce(struct sk_buff *msg,
 1923				 struct cfg80211_registered_device *rdev)
 1924{
 1925	struct nl80211_coalesce_rule_support rule;
 1926
 1927	if (!rdev->wiphy.coalesce)
 1928		return 0;
 1929
 1930	rule.max_rules = rdev->wiphy.coalesce->n_rules;
 1931	rule.max_delay = rdev->wiphy.coalesce->max_delay;
 1932	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
 1933	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
 1934	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
 1935	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
 1936
 1937	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
 1938		return -ENOBUFS;
 1939
 1940	return 0;
 1941}
 1942
 1943static int
 1944nl80211_send_iftype_data(struct sk_buff *msg,
 1945			 const struct ieee80211_supported_band *sband,
 1946			 const struct ieee80211_sband_iftype_data *iftdata)
 1947{
 1948	const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
 1949	const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
 1950
 1951	if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
 1952				iftdata->types_mask))
 1953		return -ENOBUFS;
 1954
 1955	if (he_cap->has_he) {
 1956		if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
 1957			    sizeof(he_cap->he_cap_elem.mac_cap_info),
 1958			    he_cap->he_cap_elem.mac_cap_info) ||
 1959		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
 1960			    sizeof(he_cap->he_cap_elem.phy_cap_info),
 1961			    he_cap->he_cap_elem.phy_cap_info) ||
 1962		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
 1963			    sizeof(he_cap->he_mcs_nss_supp),
 1964			    &he_cap->he_mcs_nss_supp) ||
 1965		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
 1966			    sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
 1967			return -ENOBUFS;
 1968	}
 1969
 1970	if (eht_cap->has_eht && he_cap->has_he) {
 1971		u8 mcs_nss_size, ppe_thresh_size;
 1972		u16 ppe_thres_hdr;
 1973		bool is_ap;
 1974
 1975		is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
 1976			iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
 1977
 1978		mcs_nss_size =
 1979			ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 1980						   &eht_cap->eht_cap_elem,
 1981						   is_ap);
 1982
 1983		ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
 1984		ppe_thresh_size =
 1985			ieee80211_eht_ppe_size(ppe_thres_hdr,
 1986					       eht_cap->eht_cap_elem.phy_cap_info);
 1987
 1988		if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
 1989			    sizeof(eht_cap->eht_cap_elem.mac_cap_info),
 1990			    eht_cap->eht_cap_elem.mac_cap_info) ||
 1991		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
 1992			    sizeof(eht_cap->eht_cap_elem.phy_cap_info),
 1993			    eht_cap->eht_cap_elem.phy_cap_info) ||
 1994		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
 1995			    mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
 1996		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
 1997			    ppe_thresh_size, eht_cap->eht_ppe_thres))
 1998			return -ENOBUFS;
 1999	}
 2000
 2001	if (sband->band == NL80211_BAND_6GHZ &&
 2002	    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
 2003		    sizeof(iftdata->he_6ghz_capa),
 2004		    &iftdata->he_6ghz_capa))
 2005		return -ENOBUFS;
 2006
 2007	if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
 2008	    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
 2009		    iftdata->vendor_elems.len, iftdata->vendor_elems.data))
 2010		return -ENOBUFS;
 2011
 2012	return 0;
 2013}
 2014
 2015static int nl80211_send_band_rateinfo(struct sk_buff *msg,
 2016				      struct ieee80211_supported_band *sband,
 2017				      bool large)
 2018{
 2019	struct nlattr *nl_rates, *nl_rate;
 2020	struct ieee80211_rate *rate;
 2021	int i;
 2022
 2023	/* add HT info */
 2024	if (sband->ht_cap.ht_supported &&
 2025	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
 2026		     sizeof(sband->ht_cap.mcs),
 2027		     &sband->ht_cap.mcs) ||
 2028	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
 2029			 sband->ht_cap.cap) ||
 2030	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
 2031			sband->ht_cap.ampdu_factor) ||
 2032	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
 2033			sband->ht_cap.ampdu_density)))
 2034		return -ENOBUFS;
 2035
 2036	/* add VHT info */
 2037	if (sband->vht_cap.vht_supported &&
 2038	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
 2039		     sizeof(sband->vht_cap.vht_mcs),
 2040		     &sband->vht_cap.vht_mcs) ||
 2041	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
 2042			 sband->vht_cap.cap)))
 2043		return -ENOBUFS;
 2044
 2045	if (large && sband->n_iftype_data) {
 2046		struct nlattr *nl_iftype_data =
 2047			nla_nest_start_noflag(msg,
 2048					      NL80211_BAND_ATTR_IFTYPE_DATA);
 2049		const struct ieee80211_sband_iftype_data *iftd;
 2050		int err;
 2051
 2052		if (!nl_iftype_data)
 2053			return -ENOBUFS;
 2054
 2055		for_each_sband_iftype_data(sband, i, iftd) {
 2056			struct nlattr *iftdata;
 2057
 2058			iftdata = nla_nest_start_noflag(msg, i + 1);
 2059			if (!iftdata)
 2060				return -ENOBUFS;
 2061
 2062			err = nl80211_send_iftype_data(msg, sband, iftd);
 2063			if (err)
 2064				return err;
 2065
 2066			nla_nest_end(msg, iftdata);
 2067		}
 2068
 2069		nla_nest_end(msg, nl_iftype_data);
 2070	}
 2071
 2072	/* add EDMG info */
 2073	if (large && sband->edmg_cap.channels &&
 2074	    (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
 2075		       sband->edmg_cap.channels) ||
 2076	    nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
 2077		       sband->edmg_cap.bw_config)))
 2078
 2079		return -ENOBUFS;
 2080
 2081	/* add bitrates */
 2082	nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
 2083	if (!nl_rates)
 2084		return -ENOBUFS;
 2085
 2086	for (i = 0; i < sband->n_bitrates; i++) {
 2087		nl_rate = nla_nest_start_noflag(msg, i);
 2088		if (!nl_rate)
 2089			return -ENOBUFS;
 2090
 2091		rate = &sband->bitrates[i];
 2092		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
 2093				rate->bitrate))
 2094			return -ENOBUFS;
 2095		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
 2096		    nla_put_flag(msg,
 2097				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
 2098			return -ENOBUFS;
 2099
 2100		nla_nest_end(msg, nl_rate);
 2101	}
 2102
 2103	nla_nest_end(msg, nl_rates);
 2104
 2105	/* S1G capabilities */
 2106	if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
 2107	    (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
 2108		     sizeof(sband->s1g_cap.cap),
 2109		     sband->s1g_cap.cap) ||
 2110	     nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
 2111		     sizeof(sband->s1g_cap.nss_mcs),
 2112		     sband->s1g_cap.nss_mcs)))
 2113		return -ENOBUFS;
 2114
 2115	return 0;
 2116}
 2117
 2118static int
 2119nl80211_send_mgmt_stypes(struct sk_buff *msg,
 2120			 const struct ieee80211_txrx_stypes *mgmt_stypes)
 2121{
 2122	u16 stypes;
 2123	struct nlattr *nl_ftypes, *nl_ifs;
 2124	enum nl80211_iftype ift;
 2125	int i;
 2126
 2127	if (!mgmt_stypes)
 2128		return 0;
 2129
 2130	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
 2131	if (!nl_ifs)
 2132		return -ENOBUFS;
 2133
 2134	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 2135		nl_ftypes = nla_nest_start_noflag(msg, ift);
 2136		if (!nl_ftypes)
 2137			return -ENOBUFS;
 2138		i = 0;
 2139		stypes = mgmt_stypes[ift].tx;
 2140		while (stypes) {
 2141			if ((stypes & 1) &&
 2142			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
 2143					(i << 4) | IEEE80211_FTYPE_MGMT))
 2144				return -ENOBUFS;
 2145			stypes >>= 1;
 2146			i++;
 2147		}
 2148		nla_nest_end(msg, nl_ftypes);
 2149	}
 2150
 2151	nla_nest_end(msg, nl_ifs);
 2152
 2153	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
 2154	if (!nl_ifs)
 2155		return -ENOBUFS;
 2156
 2157	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
 2158		nl_ftypes = nla_nest_start_noflag(msg, ift);
 2159		if (!nl_ftypes)
 2160			return -ENOBUFS;
 2161		i = 0;
 2162		stypes = mgmt_stypes[ift].rx;
 2163		while (stypes) {
 2164			if ((stypes & 1) &&
 2165			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
 2166					(i << 4) | IEEE80211_FTYPE_MGMT))
 2167				return -ENOBUFS;
 2168			stypes >>= 1;
 2169			i++;
 2170		}
 2171		nla_nest_end(msg, nl_ftypes);
 2172	}
 2173	nla_nest_end(msg, nl_ifs);
 2174
 2175	return 0;
 2176}
 2177
 2178#define CMD(op, n)							\
 2179	 do {								\
 2180		if (rdev->ops->op) {					\
 2181			i++;						\
 2182			if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) 	\
 2183				goto nla_put_failure;			\
 2184		}							\
 2185	} while (0)
 2186
 2187static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
 2188					struct sk_buff *msg)
 2189{
 2190	int i = 0;
 2191
 2192	/*
 2193	 * do *NOT* add anything into this function, new things need to be
 2194	 * advertised only to new versions of userspace that can deal with
 2195	 * the split (and they can't possibly care about new features...
 2196	 */
 2197	CMD(add_virtual_intf, NEW_INTERFACE);
 2198	CMD(change_virtual_intf, SET_INTERFACE);
 2199	CMD(add_key, NEW_KEY);
 2200	CMD(start_ap, START_AP);
 2201	CMD(add_station, NEW_STATION);
 2202	CMD(add_mpath, NEW_MPATH);
 2203	CMD(update_mesh_config, SET_MESH_CONFIG);
 2204	CMD(change_bss, SET_BSS);
 2205	CMD(auth, AUTHENTICATE);
 2206	CMD(assoc, ASSOCIATE);
 2207	CMD(deauth, DEAUTHENTICATE);
 2208	CMD(disassoc, DISASSOCIATE);
 2209	CMD(join_ibss, JOIN_IBSS);
 2210	CMD(join_mesh, JOIN_MESH);
 2211	CMD(set_pmksa, SET_PMKSA);
 2212	CMD(del_pmksa, DEL_PMKSA);
 2213	CMD(flush_pmksa, FLUSH_PMKSA);
 2214	if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
 2215		CMD(remain_on_channel, REMAIN_ON_CHANNEL);
 2216	CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
 2217	CMD(mgmt_tx, FRAME);
 2218	CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
 2219	if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
 2220		i++;
 2221		if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
 2222			goto nla_put_failure;
 2223	}
 2224	if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
 2225	    rdev->ops->join_mesh) {
 2226		i++;
 2227		if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
 2228			goto nla_put_failure;
 2229	}
 2230	if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
 2231		CMD(tdls_mgmt, TDLS_MGMT);
 2232		CMD(tdls_oper, TDLS_OPER);
 2233	}
 2234	if (rdev->wiphy.max_sched_scan_reqs)
 2235		CMD(sched_scan_start, START_SCHED_SCAN);
 2236	CMD(probe_client, PROBE_CLIENT);
 2237	CMD(set_noack_map, SET_NOACK_MAP);
 2238	if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
 2239		i++;
 2240		if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
 2241			goto nla_put_failure;
 2242	}
 2243	CMD(start_p2p_device, START_P2P_DEVICE);
 2244	CMD(set_mcast_rate, SET_MCAST_RATE);
 2245#ifdef CONFIG_NL80211_TESTMODE
 2246	CMD(testmode_cmd, TESTMODE);
 2247#endif
 2248
 2249	if (rdev->ops->connect || rdev->ops->auth) {
 2250		i++;
 2251		if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
 2252			goto nla_put_failure;
 2253	}
 2254
 2255	if (rdev->ops->disconnect || rdev->ops->deauth) {
 2256		i++;
 2257		if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
 2258			goto nla_put_failure;
 2259	}
 2260
 2261	return i;
 2262 nla_put_failure:
 2263	return -ENOBUFS;
 2264}
 2265
 2266static int
 2267nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
 2268			   struct sk_buff *msg)
 2269{
 2270	struct nlattr *ftm;
 2271
 2272	if (!cap->ftm.supported)
 2273		return 0;
 2274
 2275	ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
 2276	if (!ftm)
 2277		return -ENOBUFS;
 2278
 2279	if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
 2280		return -ENOBUFS;
 2281	if (cap->ftm.non_asap &&
 2282	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
 2283		return -ENOBUFS;
 2284	if (cap->ftm.request_lci &&
 2285	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
 2286		return -ENOBUFS;
 2287	if (cap->ftm.request_civicloc &&
 2288	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
 2289		return -ENOBUFS;
 2290	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
 2291			cap->ftm.preambles))
 2292		return -ENOBUFS;
 2293	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
 2294			cap->ftm.bandwidths))
 2295		return -ENOBUFS;
 2296	if (cap->ftm.max_bursts_exponent >= 0 &&
 2297	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
 2298			cap->ftm.max_bursts_exponent))
 2299		return -ENOBUFS;
 2300	if (cap->ftm.max_ftms_per_burst &&
 2301	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
 2302			cap->ftm.max_ftms_per_burst))
 2303		return -ENOBUFS;
 2304	if (cap->ftm.trigger_based &&
 2305	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
 2306		return -ENOBUFS;
 2307	if (cap->ftm.non_trigger_based &&
 2308	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
 2309		return -ENOBUFS;
 2310
 2311	nla_nest_end(msg, ftm);
 2312	return 0;
 2313}
 2314
 2315static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
 2316				  struct sk_buff *msg)
 2317{
 2318	const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
 2319	struct nlattr *pmsr, *caps;
 2320
 2321	if (!cap)
 2322		return 0;
 2323
 2324	/*
 2325	 * we don't need to clean up anything here since the caller
 2326	 * will genlmsg_cancel() if we fail
 2327	 */
 2328
 2329	pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
 2330	if (!pmsr)
 2331		return -ENOBUFS;
 2332
 2333	if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
 2334		return -ENOBUFS;
 2335
 2336	if (cap->report_ap_tsf &&
 2337	    nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
 2338		return -ENOBUFS;
 2339
 2340	if (cap->randomize_mac_addr &&
 2341	    nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
 2342		return -ENOBUFS;
 2343
 2344	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
 2345	if (!caps)
 2346		return -ENOBUFS;
 2347
 2348	if (nl80211_send_pmsr_ftm_capa(cap, msg))
 2349		return -ENOBUFS;
 2350
 2351	nla_nest_end(msg, caps);
 2352	nla_nest_end(msg, pmsr);
 2353
 2354	return 0;
 2355}
 2356
 2357static int
 2358nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
 2359			      struct sk_buff *msg)
 2360{
 2361	int i;
 2362	struct nlattr *nested, *nested_akms;
 2363	const struct wiphy_iftype_akm_suites *iftype_akms;
 2364
 2365	if (!rdev->wiphy.num_iftype_akm_suites ||
 2366	    !rdev->wiphy.iftype_akm_suites)
 2367		return 0;
 2368
 2369	nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
 2370	if (!nested)
 2371		return -ENOBUFS;
 2372
 2373	for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
 2374		nested_akms = nla_nest_start(msg, i + 1);
 2375		if (!nested_akms)
 2376			return -ENOBUFS;
 2377
 2378		iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
 2379
 2380		if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
 2381					iftype_akms->iftypes_mask))
 2382			return -ENOBUFS;
 2383
 2384		if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
 2385			    sizeof(u32) * iftype_akms->n_akm_suites,
 2386			    iftype_akms->akm_suites)) {
 2387			return -ENOBUFS;
 2388		}
 2389		nla_nest_end(msg, nested_akms);
 2390	}
 2391
 2392	nla_nest_end(msg, nested);
 2393
 2394	return 0;
 2395}
 2396
 2397static int
 2398nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
 2399			       struct sk_buff *msg)
 2400{
 2401	struct nlattr *supp;
 2402
 2403	if (!rdev->wiphy.tid_config_support.vif &&
 2404	    !rdev->wiphy.tid_config_support.peer)
 2405		return 0;
 2406
 2407	supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
 2408	if (!supp)
 2409		return -ENOSPC;
 2410
 2411	if (rdev->wiphy.tid_config_support.vif &&
 2412	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
 2413			      rdev->wiphy.tid_config_support.vif,
 2414			      NL80211_TID_CONFIG_ATTR_PAD))
 2415		goto fail;
 2416
 2417	if (rdev->wiphy.tid_config_support.peer &&
 2418	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
 2419			      rdev->wiphy.tid_config_support.peer,
 2420			      NL80211_TID_CONFIG_ATTR_PAD))
 2421		goto fail;
 2422
 2423	/* for now we just use the same value ... makes more sense */
 2424	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
 2425		       rdev->wiphy.tid_config_support.max_retry))
 2426		goto fail;
 2427	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
 2428		       rdev->wiphy.tid_config_support.max_retry))
 2429		goto fail;
 2430
 2431	nla_nest_end(msg, supp);
 2432
 2433	return 0;
 2434fail:
 2435	nla_nest_cancel(msg, supp);
 2436	return -ENOBUFS;
 2437}
 2438
 2439static int
 2440nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
 2441		      struct sk_buff *msg)
 2442{
 2443	struct nlattr *sar_capa, *specs, *sub_freq_range;
 2444	u8 num_freq_ranges;
 2445	int i;
 2446
 2447	if (!rdev->wiphy.sar_capa)
 2448		return 0;
 2449
 2450	num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
 2451
 2452	sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
 2453	if (!sar_capa)
 2454		return -ENOSPC;
 2455
 2456	if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
 2457		goto fail;
 2458
 2459	specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
 2460	if (!specs)
 2461		goto fail;
 2462
 2463	/* report supported freq_ranges */
 2464	for (i = 0; i < num_freq_ranges; i++) {
 2465		sub_freq_range = nla_nest_start(msg, i + 1);
 2466		if (!sub_freq_range)
 2467			goto fail;
 2468
 2469		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
 2470				rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
 2471			goto fail;
 2472
 2473		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
 2474				rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
 2475			goto fail;
 2476
 2477		nla_nest_end(msg, sub_freq_range);
 2478	}
 2479
 2480	nla_nest_end(msg, specs);
 2481	nla_nest_end(msg, sar_capa);
 2482
 2483	return 0;
 2484fail:
 2485	nla_nest_cancel(msg, sar_capa);
 2486	return -ENOBUFS;
 2487}
 2488
 2489static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
 2490{
 2491	struct nlattr *config;
 2492
 2493	if (!wiphy->mbssid_max_interfaces)
 2494		return 0;
 2495
 2496	config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
 2497	if (!config)
 2498		return -ENOBUFS;
 2499
 2500	if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
 2501		       wiphy->mbssid_max_interfaces))
 2502		goto fail;
 2503
 2504	if (wiphy->ema_max_profile_periodicity &&
 2505	    nla_put_u8(msg,
 2506		       NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
 2507		       wiphy->ema_max_profile_periodicity))
 2508		goto fail;
 2509
 2510	nla_nest_end(msg, config);
 2511	return 0;
 2512
 2513fail:
 2514	nla_nest_cancel(msg, config);
 2515	return -ENOBUFS;
 2516}
 2517
 2518static int nl80211_put_radio(struct wiphy *wiphy, struct sk_buff *msg, int idx)
 2519{
 2520	const struct wiphy_radio *r = &wiphy->radio[idx];
 2521	const struct wiphy_radio_cfg *rcfg = &wiphy->radio_cfg[idx];
 2522	struct nlattr *radio, *freq;
 2523	int i;
 2524
 2525	radio = nla_nest_start(msg, idx);
 2526	if (!radio)
 2527		return -ENOBUFS;
 2528
 2529	if (nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_INDEX, idx))
 2530		goto nla_put_failure;
 2531
 2532	if (rcfg->rts_threshold &&
 2533	    nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_RTS_THRESHOLD,
 2534			rcfg->rts_threshold))
 2535		goto nla_put_failure;
 2536
 2537	if (r->antenna_mask &&
 2538	    nla_put_u32(msg, NL80211_WIPHY_RADIO_ATTR_ANTENNA_MASK,
 2539			r->antenna_mask))
 2540		goto nla_put_failure;
 2541
 2542	for (i = 0; i < r->n_freq_range; i++) {
 2543		const struct wiphy_radio_freq_range *range = &r->freq_range[i];
 2544
 2545		freq = nla_nest_start(msg, NL80211_WIPHY_RADIO_ATTR_FREQ_RANGE);
 2546		if (!freq)
 2547			goto nla_put_failure;
 2548
 2549		if (nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_START,
 2550				range->start_freq) ||
 2551		    nla_put_u32(msg, NL80211_WIPHY_RADIO_FREQ_ATTR_END,
 2552				range->end_freq))
 2553			goto nla_put_failure;
 2554
 2555		nla_nest_end(msg, freq);
 2556	}
 2557
 2558	for (i = 0; i < r->n_iface_combinations; i++)
 2559		if (nl80211_put_ifcomb_data(msg, true,
 2560					    NL80211_WIPHY_RADIO_ATTR_INTERFACE_COMBINATION,
 2561					    &r->iface_combinations[i],
 2562					    NLA_F_NESTED))
 2563			goto nla_put_failure;
 2564
 2565	nla_nest_end(msg, radio);
 2566
 2567	return 0;
 2568
 2569nla_put_failure:
 2570	return -ENOBUFS;
 2571}
 2572
 2573static int nl80211_put_radios(struct wiphy *wiphy, struct sk_buff *msg)
 2574{
 2575	struct nlattr *radios;
 2576	int i;
 2577
 2578	if (!wiphy->n_radio)
 2579		return 0;
 2580
 2581	radios = nla_nest_start(msg, NL80211_ATTR_WIPHY_RADIOS);
 2582	if (!radios)
 2583		return -ENOBUFS;
 2584
 2585	for (i = 0; i < wiphy->n_radio; i++)
 2586		if (nl80211_put_radio(wiphy, msg, i))
 2587			goto fail;
 2588
 2589	nla_nest_end(msg, radios);
 2590
 2591	if (nl80211_put_iface_combinations(wiphy, msg,
 2592					   NL80211_ATTR_WIPHY_INTERFACE_COMBINATIONS,
 2593					   -1, true, NLA_F_NESTED))
 2594		return -ENOBUFS;
 2595
 2596	return 0;
 2597
 2598fail:
 2599	nla_nest_cancel(msg, radios);
 2600	return -ENOBUFS;
 2601}
 2602
 2603static int nl80211_put_nan_capa(struct wiphy *wiphy, struct sk_buff *msg)
 2604{
 2605	struct nlattr *nan_caps;
 2606
 2607	nan_caps = nla_nest_start(msg, NL80211_ATTR_NAN_CAPABILITIES);
 2608	if (!nan_caps)
 2609		return -ENOBUFS;
 2610
 2611	if (wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_CONFIGURABLE_SYNC &&
 2612	    nla_put_flag(msg, NL80211_NAN_CAPA_CONFIGURABLE_SYNC))
 2613		goto fail;
 2614
 2615	if ((wiphy->nan_capa.flags & WIPHY_NAN_FLAGS_USERSPACE_DE) &&
 2616	    nla_put_flag(msg, NL80211_NAN_CAPA_USERSPACE_DE))
 2617		goto fail;
 2618
 2619	if (nla_put_u8(msg, NL80211_NAN_CAPA_OP_MODE,
 2620		       wiphy->nan_capa.op_mode) ||
 2621	    nla_put_u8(msg, NL80211_NAN_CAPA_NUM_ANTENNAS,
 2622		       wiphy->nan_capa.n_antennas) ||
 2623	    nla_put_u16(msg, NL80211_NAN_CAPA_MAX_CHANNEL_SWITCH_TIME,
 2624			wiphy->nan_capa.max_channel_switch_time) ||
 2625	    nla_put_u8(msg, NL80211_NAN_CAPA_CAPABILITIES,
 2626		       wiphy->nan_capa.dev_capabilities))
 2627		goto fail;
 2628
 2629	nla_nest_end(msg, nan_caps);
 2630
 2631	return 0;
 2632
 2633fail:
 2634	nla_nest_cancel(msg, nan_caps);
 2635	return -ENOBUFS;
 2636}
 2637
 2638struct nl80211_dump_wiphy_state {
 2639	s64 filter_wiphy;
 2640	long start;
 2641	long split_start, band_start, chan_start, capa_start;
 2642	bool split;
 2643};
 2644
 2645static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
 2646			      enum nl80211_commands cmd,
 2647			      struct sk_buff *msg, u32 portid, u32 seq,
 2648			      int flags, struct nl80211_dump_wiphy_state *state)
 2649{
 2650	void *hdr;
 2651	struct nlattr *nl_bands, *nl_band;
 2652	struct nlattr *nl_freqs, *nl_freq;
 2653	struct nlattr *nl_cmds;
 2654	enum nl80211_band band;
 2655	struct ieee80211_channel *chan;
 2656	int i;
 2657	const struct ieee80211_txrx_stypes *mgmt_stypes =
 2658				rdev->wiphy.mgmt_stypes;
 2659	u32 features;
 2660
 2661	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
 2662	if (!hdr)
 2663		return -ENOBUFS;
 2664
 2665	if (WARN_ON(!state))
 2666		return -EINVAL;
 2667
 2668	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 2669	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
 2670			   wiphy_name(&rdev->wiphy)) ||
 2671	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
 2672			cfg80211_rdev_list_generation))
 2673		goto nla_put_failure;
 2674
 2675	if (cmd != NL80211_CMD_NEW_WIPHY)
 2676		goto finish;
 2677
 2678	switch (state->split_start) {
 2679	case 0:
 2680		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
 2681			       rdev->wiphy.retry_short) ||
 2682		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
 2683			       rdev->wiphy.retry_long) ||
 2684		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
 2685				rdev->wiphy.frag_threshold) ||
 2686		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
 2687				rdev->wiphy.rts_threshold) ||
 2688		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
 2689			       rdev->wiphy.coverage_class) ||
 2690		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
 2691			       rdev->wiphy.max_scan_ssids) ||
 2692		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
 2693			       rdev->wiphy.max_sched_scan_ssids) ||
 2694		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
 2695				rdev->wiphy.max_scan_ie_len) ||
 2696		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
 2697				rdev->wiphy.max_sched_scan_ie_len) ||
 2698		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
 2699			       rdev->wiphy.max_match_sets))
 2700			goto nla_put_failure;
 2701
 2702		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
 2703		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
 2704			goto nla_put_failure;
 2705		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
 2706		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
 2707			goto nla_put_failure;
 2708		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
 2709		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
 2710			goto nla_put_failure;
 2711		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
 2712		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
 2713			goto nla_put_failure;
 2714		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
 2715		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
 2716			goto nla_put_failure;
 2717		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
 2718		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
 2719			goto nla_put_failure;
 2720		state->split_start++;
 2721		if (state->split)
 2722			break;
 2723		fallthrough;
 2724	case 1:
 2725		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
 2726			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
 2727			    rdev->wiphy.cipher_suites))
 2728			goto nla_put_failure;
 2729
 2730		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
 2731			       rdev->wiphy.max_num_pmkids))
 2732			goto nla_put_failure;
 2733
 2734		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
 2735		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
 2736			goto nla_put_failure;
 2737
 2738		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
 2739				rdev->wiphy.available_antennas_tx) ||
 2740		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
 2741				rdev->wiphy.available_antennas_rx))
 2742			goto nla_put_failure;
 2743
 2744		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
 2745		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
 2746				rdev->wiphy.probe_resp_offload))
 2747			goto nla_put_failure;
 2748
 2749		if ((rdev->wiphy.available_antennas_tx ||
 2750		     rdev->wiphy.available_antennas_rx) &&
 2751		    rdev->ops->get_antenna) {
 2752			u32 tx_ant = 0, rx_ant = 0;
 2753			int res;
 2754
 2755			res = rdev_get_antenna(rdev, -1, &tx_ant, &rx_ant);
 2756			if (!res) {
 2757				if (nla_put_u32(msg,
 2758						NL80211_ATTR_WIPHY_ANTENNA_TX,
 2759						tx_ant) ||
 2760				    nla_put_u32(msg,
 2761						NL80211_ATTR_WIPHY_ANTENNA_RX,
 2762						rx_ant))
 2763					goto nla_put_failure;
 2764			}
 2765		}
 2766
 2767		state->split_start++;
 2768		if (state->split)
 2769			break;
 2770		fallthrough;
 2771	case 2:
 2772		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
 2773					rdev->wiphy.interface_modes))
 2774				goto nla_put_failure;
 2775		state->split_start++;
 2776		if (state->split)
 2777			break;
 2778		fallthrough;
 2779	case 3:
 2780		nl_bands = nla_nest_start_noflag(msg,
 2781						 NL80211_ATTR_WIPHY_BANDS);
 2782		if (!nl_bands)
 2783			goto nla_put_failure;
 2784
 2785		for (band = state->band_start;
 2786		     band < (state->split ?
 2787				NUM_NL80211_BANDS :
 2788				NL80211_BAND_60GHZ + 1);
 2789		     band++) {
 2790			struct ieee80211_supported_band *sband;
 2791
 2792			/* omit higher bands for ancient software */
 2793			if (band > NL80211_BAND_5GHZ && !state->split)
 2794				break;
 2795
 2796			sband = rdev->wiphy.bands[band];
 2797
 2798			if (!sband)
 2799				continue;
 2800
 2801			nl_band = nla_nest_start_noflag(msg, band);
 2802			if (!nl_band)
 2803				goto nla_put_failure;
 2804
 2805			switch (state->chan_start) {
 2806			case 0:
 2807				if (nl80211_send_band_rateinfo(msg, sband,
 2808							       state->split))
 2809					goto nla_put_failure;
 2810				state->chan_start++;
 2811				if (state->split)
 2812					break;
 2813				fallthrough;
 2814			default:
 2815				/* add frequencies */
 2816				nl_freqs = nla_nest_start_noflag(msg,
 2817								 NL80211_BAND_ATTR_FREQS);
 2818				if (!nl_freqs)
 2819					goto nla_put_failure;
 2820
 2821				for (i = state->chan_start - 1;
 2822				     i < sband->n_channels;
 2823				     i++) {
 2824					nl_freq = nla_nest_start_noflag(msg,
 2825									i);
 2826					if (!nl_freq)
 2827						goto nla_put_failure;
 2828
 2829					chan = &sband->channels[i];
 2830
 2831					if (nl80211_msg_put_channel(
 2832							msg, &rdev->wiphy, chan,
 2833							state->split))
 2834						goto nla_put_failure;
 2835
 2836					nla_nest_end(msg, nl_freq);
 2837					if (state->split)
 2838						break;
 2839				}
 2840				if (i < sband->n_channels)
 2841					state->chan_start = i + 2;
 2842				else
 2843					state->chan_start = 0;
 2844				nla_nest_end(msg, nl_freqs);
 2845			}
 2846
 2847			nla_nest_end(msg, nl_band);
 2848
 2849			if (state->split) {
 2850				/* start again here */
 2851				if (state->chan_start)
 2852					band--;
 2853				break;
 2854			}
 2855		}
 2856		nla_nest_end(msg, nl_bands);
 2857
 2858		if (band < NUM_NL80211_BANDS)
 2859			state->band_start = band + 1;
 2860		else
 2861			state->band_start = 0;
 2862
 2863		/* if bands & channels are done, continue outside */
 2864		if (state->band_start == 0 && state->chan_start == 0)
 2865			state->split_start++;
 2866		if (state->split)
 2867			break;
 2868		fallthrough;
 2869	case 4:
 2870		nl_cmds = nla_nest_start_noflag(msg,
 2871						NL80211_ATTR_SUPPORTED_COMMANDS);
 2872		if (!nl_cmds)
 2873			goto nla_put_failure;
 2874
 2875		i = nl80211_add_commands_unsplit(rdev, msg);
 2876		if (i < 0)
 2877			goto nla_put_failure;
 2878		if (state->split) {
 2879			CMD(crit_proto_start, CRIT_PROTOCOL_START);
 2880			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
 2881			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
 2882				CMD(channel_switch, CHANNEL_SWITCH);
 2883			CMD(set_qos_map, SET_QOS_MAP);
 2884			if (rdev->wiphy.features &
 2885					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
 2886				CMD(add_tx_ts, ADD_TX_TS);
 2887			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
 2888			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
 2889			CMD(update_ft_ies, UPDATE_FT_IES);
 2890			if (rdev->wiphy.sar_capa)
 2891				CMD(set_sar_specs, SET_SAR_SPECS);
 2892			CMD(assoc_ml_reconf, ASSOC_MLO_RECONF);
 2893		}
 2894#undef CMD
 2895
 2896		nla_nest_end(msg, nl_cmds);
 2897		state->split_start++;
 2898		if (state->split)
 2899			break;
 2900		fallthrough;
 2901	case 5:
 2902		if (rdev->ops->remain_on_channel &&
 2903		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
 2904		    nla_put_u32(msg,
 2905				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
 2906				rdev->wiphy.max_remain_on_channel_duration))
 2907			goto nla_put_failure;
 2908
 2909		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
 2910		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
 2911			goto nla_put_failure;
 2912
 2913		state->split_start++;
 2914		if (state->split)
 2915			break;
 2916		fallthrough;
 2917	case 6:
 2918#ifdef CONFIG_PM
 2919		if (nl80211_send_wowlan(msg, rdev, state->split))
 2920			goto nla_put_failure;
 2921		state->split_start++;
 2922		if (state->split)
 2923			break;
 2924#else
 2925		state->split_start++;
 2926#endif
 2927		fallthrough;
 2928	case 7:
 2929		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
 2930					rdev->wiphy.software_iftypes))
 2931			goto nla_put_failure;
 2932
 2933		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
 2934						   NL80211_ATTR_INTERFACE_COMBINATIONS,
 2935						   rdev->wiphy.n_radio ? 0 : -1,
 2936						   state->split, 0))
 2937			goto nla_put_failure;
 2938
 2939		state->split_start++;
 2940		if (state->split)
 2941			break;
 2942		fallthrough;
 2943	case 8:
 2944		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
 2945		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
 2946				rdev->wiphy.ap_sme_capa))
 2947			goto nla_put_failure;
 2948
 2949		features = rdev->wiphy.features;
 2950		/*
 2951		 * We can only add the per-channel limit information if the
 2952		 * dump is split, otherwise it makes it too big. Therefore
 2953		 * only advertise it in that case.
 2954		 */
 2955		if (state->split)
 2956			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
 2957		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
 2958			goto nla_put_failure;
 2959
 2960		if (rdev->wiphy.ht_capa_mod_mask &&
 2961		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
 2962			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
 2963			    rdev->wiphy.ht_capa_mod_mask))
 2964			goto nla_put_failure;
 2965
 2966		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
 2967		    rdev->wiphy.max_acl_mac_addrs &&
 2968		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
 2969				rdev->wiphy.max_acl_mac_addrs))
 2970			goto nla_put_failure;
 2971
 2972		/*
 2973		 * Any information below this point is only available to
 2974		 * applications that can deal with it being split. This
 2975		 * helps ensure that newly added capabilities don't break
 2976		 * older tools by overrunning their buffers.
 2977		 *
 2978		 * We still increment split_start so that in the split
 2979		 * case we'll continue with more data in the next round,
 2980		 * but break unconditionally so unsplit data stops here.
 2981		 */
 2982		if (state->split)
 2983			state->split_start++;
 2984		else
 2985			state->split_start = 0;
 2986		break;
 2987	case 9:
 2988		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
 2989			goto nla_put_failure;
 2990
 2991		if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
 2992				rdev->wiphy.max_sched_scan_plans) ||
 2993		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
 2994				rdev->wiphy.max_sched_scan_plan_interval) ||
 2995		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
 2996				rdev->wiphy.max_sched_scan_plan_iterations))
 2997			goto nla_put_failure;
 2998
 2999		if (rdev->wiphy.extended_capabilities &&
 3000		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
 3001			     rdev->wiphy.extended_capabilities_len,
 3002			     rdev->wiphy.extended_capabilities) ||
 3003		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
 3004			     rdev->wiphy.extended_capabilities_len,
 3005			     rdev->wiphy.extended_capabilities_mask)))
 3006			goto nla_put_failure;
 3007
 3008		if (rdev->wiphy.vht_capa_mod_mask &&
 3009		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
 3010			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
 3011			    rdev->wiphy.vht_capa_mod_mask))
 3012			goto nla_put_failure;
 3013
 3014		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 3015			    rdev->wiphy.perm_addr))
 3016			goto nla_put_failure;
 3017
 3018		if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
 3019		    nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
 3020			    rdev->wiphy.addr_mask))
 3021			goto nla_put_failure;
 3022
 3023		if (rdev->wiphy.n_addresses > 1) {
 3024			void *attr;
 3025
 3026			attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
 3027			if (!attr)
 3028				goto nla_put_failure;
 3029
 3030			for (i = 0; i < rdev->wiphy.n_addresses; i++)
 3031				if (nla_put(msg, i + 1, ETH_ALEN,
 3032					    rdev->wiphy.addresses[i].addr))
 3033					goto nla_put_failure;
 3034
 3035			nla_nest_end(msg, attr);
 3036		}
 3037
 3038		state->split_start++;
 3039		break;
 3040	case 10:
 3041		if (nl80211_send_coalesce(msg, rdev))
 3042			goto nla_put_failure;
 3043
 3044		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
 3045		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
 3046		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
 3047			goto nla_put_failure;
 3048
 3049		if (rdev->wiphy.max_ap_assoc_sta &&
 3050		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
 3051				rdev->wiphy.max_ap_assoc_sta))
 3052			goto nla_put_failure;
 3053
 3054		state->split_start++;
 3055		break;
 3056	case 11:
 3057		if (rdev->wiphy.n_vendor_commands) {
 3058			const struct nl80211_vendor_cmd_info *info;
 3059			struct nlattr *nested;
 3060
 3061			nested = nla_nest_start_noflag(msg,
 3062						       NL80211_ATTR_VENDOR_DATA);
 3063			if (!nested)
 3064				goto nla_put_failure;
 3065
 3066			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
 3067				info = &rdev->wiphy.vendor_commands[i].info;
 3068				if (nla_put(msg, i + 1, sizeof(*info), info))
 3069					goto nla_put_failure;
 3070			}
 3071			nla_nest_end(msg, nested);
 3072		}
 3073
 3074		if (rdev->wiphy.n_vendor_events) {
 3075			const struct nl80211_vendor_cmd_info *info;
 3076			struct nlattr *nested;
 3077
 3078			nested = nla_nest_start_noflag(msg,
 3079						       NL80211_ATTR_VENDOR_EVENTS);
 3080			if (!nested)
 3081				goto nla_put_failure;
 3082
 3083			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
 3084				info = &rdev->wiphy.vendor_events[i];
 3085				if (nla_put(msg, i + 1, sizeof(*info), info))
 3086					goto nla_put_failure;
 3087			}
 3088			nla_nest_end(msg, nested);
 3089		}
 3090		state->split_start++;
 3091		break;
 3092	case 12:
 3093		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
 3094		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
 3095			       rdev->wiphy.max_num_csa_counters))
 3096			goto nla_put_failure;
 3097
 3098		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
 3099		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
 3100			goto nla_put_failure;
 3101
 3102		if (rdev->wiphy.max_sched_scan_reqs &&
 3103		    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
 3104				rdev->wiphy.max_sched_scan_reqs))
 3105			goto nla_put_failure;
 3106
 3107		if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
 3108			    sizeof(rdev->wiphy.ext_features),
 3109			    rdev->wiphy.ext_features))
 3110			goto nla_put_failure;
 3111
 3112		if (rdev->wiphy.bss_param_support) {
 3113			struct nlattr *nested;
 3114			u32 parsup = rdev->wiphy.bss_param_support;
 3115
 3116			nested = nla_nest_start(msg, NL80211_ATTR_BSS_PARAM);
 3117			if (!nested)
 3118				goto nla_put_failure;
 3119
 3120			if ((parsup & WIPHY_BSS_PARAM_CTS_PROT) &&
 3121			    nla_put_flag(msg, NL80211_ATTR_BSS_CTS_PROT))
 3122				goto nla_put_failure;
 3123			if ((parsup & WIPHY_BSS_PARAM_SHORT_PREAMBLE) &&
 3124			    nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE))
 3125				goto nla_put_failure;
 3126			if ((parsup & WIPHY_BSS_PARAM_SHORT_SLOT_TIME) &&
 3127			    nla_put_flag(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME))
 3128				goto nla_put_failure;
 3129			if ((parsup & WIPHY_BSS_PARAM_BASIC_RATES) &&
 3130			    nla_put_flag(msg, NL80211_ATTR_BSS_BASIC_RATES))
 3131				goto nla_put_failure;
 3132			if ((parsup & WIPHY_BSS_PARAM_AP_ISOLATE) &&
 3133			    nla_put_flag(msg, NL80211_ATTR_AP_ISOLATE))
 3134				goto nla_put_failure;
 3135			if ((parsup & WIPHY_BSS_PARAM_HT_OPMODE) &&
 3136			    nla_put_flag(msg, NL80211_ATTR_BSS_HT_OPMODE))
 3137				goto nla_put_failure;
 3138			if ((parsup & WIPHY_BSS_PARAM_P2P_CTWINDOW) &&
 3139			    nla_put_flag(msg, NL80211_ATTR_P2P_CTWINDOW))
 3140				goto nla_put_failure;
 3141			if ((parsup & WIPHY_BSS_PARAM_P2P_OPPPS) &&
 3142			    nla_put_flag(msg, NL80211_ATTR_P2P_OPPPS))
 3143				goto nla_put_failure;
 3144			nla_nest_end(msg, nested);
 3145		}
 3146		if (rdev->wiphy.bss_select_support) {
 3147			struct nlattr *nested;
 3148			u32 bss_select_support = rdev->wiphy.bss_select_support;
 3149
 3150			nested = nla_nest_start_noflag(msg,
 3151						       NL80211_ATTR_BSS_SELECT);
 3152			if (!nested)
 3153				goto nla_put_failure;
 3154
 3155			i = 0;
 3156			while (bss_select_support) {
 3157				if ((bss_select_support & 1) &&
 3158				    nla_put_flag(msg, i))
 3159					goto nla_put_failure;
 3160				i++;
 3161				bss_select_support >>= 1;
 3162			}
 3163			nla_nest_end(msg, nested);
 3164		}
 3165
 3166		state->split_start++;
 3167		break;
 3168	case 13:
 3169		if (rdev->wiphy.num_iftype_ext_capab &&
 3170		    rdev->wiphy.iftype_ext_capab) {
 3171			struct nlattr *nested_ext_capab, *nested;
 3172
 3173			nested = nla_nest_start_noflag(msg,
 3174						       NL80211_ATTR_IFTYPE_EXT_CAPA);
 3175			if (!nested)
 3176				goto nla_put_failure;
 3177
 3178			for (i = state->capa_start;
 3179			     i < rdev->wiphy.num_iftype_ext_capab; i++) {
 3180				const struct wiphy_iftype_ext_capab *capab;
 3181
 3182				capab = &rdev->wiphy.iftype_ext_capab[i];
 3183
 3184				nested_ext_capab = nla_nest_start_noflag(msg,
 3185									 i);
 3186				if (!nested_ext_capab ||
 3187				    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
 3188						capab->iftype) ||
 3189				    nla_put(msg, NL80211_ATTR_EXT_CAPA,
 3190					    capab->extended_capabilities_len,
 3191					    capab->extended_capabilities) ||
 3192				    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
 3193					    capab->extended_capabilities_len,
 3194					    capab->extended_capabilities_mask))
 3195					goto nla_put_failure;
 3196
 3197				if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
 3198				    (nla_put_u16(msg,
 3199						 NL80211_ATTR_EML_CAPABILITY,
 3200						 capab->eml_capabilities) ||
 3201				     nla_put_u16(msg,
 3202						 NL80211_ATTR_MLD_CAPA_AND_OPS,
 3203						 capab->mld_capa_and_ops)))
 3204					goto nla_put_failure;
 3205
 3206				nla_nest_end(msg, nested_ext_capab);
 3207				if (state->split)
 3208					break;
 3209			}
 3210			nla_nest_end(msg, nested);
 3211			if (i < rdev->wiphy.num_iftype_ext_capab) {
 3212				state->capa_start = i + 1;
 3213				break;
 3214			}
 3215		}
 3216
 3217		if (nla_put_u32(msg, NL80211_ATTR_BANDS,
 3218				rdev->wiphy.nan_supported_bands))
 3219			goto nla_put_failure;
 3220
 3221		if (wiphy_ext_feature_isset(&rdev->wiphy,
 3222					    NL80211_EXT_FEATURE_TXQS)) {
 3223			struct cfg80211_txq_stats txqstats = {};
 3224			int res;
 3225
 3226			res = rdev_get_txq_stats(rdev, NULL, &txqstats);
 3227			if (!res &&
 3228			    !nl80211_put_txq_stats(msg, &txqstats,
 3229						   NL80211_ATTR_TXQ_STATS))
 3230				goto nla_put_failure;
 3231
 3232			if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
 3233					rdev->wiphy.txq_limit))
 3234				goto nla_put_failure;
 3235			if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
 3236					rdev->wiphy.txq_memory_limit))
 3237				goto nla_put_failure;
 3238			if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
 3239					rdev->wiphy.txq_quantum))
 3240				goto nla_put_failure;
 3241		}
 3242
 3243		state->split_start++;
 3244		break;
 3245	case 14:
 3246		if (nl80211_send_pmsr_capa(rdev, msg))
 3247			goto nla_put_failure;
 3248
 3249		state->split_start++;
 3250		break;
 3251	case 15:
 3252		if (rdev->wiphy.akm_suites &&
 3253		    nla_put(msg, NL80211_ATTR_AKM_SUITES,
 3254			    sizeof(u32) * rdev->wiphy.n_akm_suites,
 3255			    rdev->wiphy.akm_suites))
 3256			goto nla_put_failure;
 3257
 3258		if (nl80211_put_iftype_akm_suites(rdev, msg))
 3259			goto nla_put_failure;
 3260
 3261		if (nl80211_put_tid_config_support(rdev, msg))
 3262			goto nla_put_failure;
 3263		state->split_start++;
 3264		break;
 3265	case 16:
 3266		if (nl80211_put_sar_specs(rdev, msg))
 3267			goto nla_put_failure;
 3268
 3269		if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
 3270			goto nla_put_failure;
 3271
 3272		if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
 3273				rdev->wiphy.max_num_akm_suites))
 3274			goto nla_put_failure;
 3275
 3276		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
 3277			nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
 3278
 3279		if (rdev->wiphy.hw_timestamp_max_peers &&
 3280		    nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
 3281				rdev->wiphy.hw_timestamp_max_peers))
 3282			goto nla_put_failure;
 3283
 3284		state->split_start++;
 3285		break;
 3286	case 17:
 3287		if (nl80211_put_radios(&rdev->wiphy, msg))
 3288			goto nla_put_failure;
 3289
 3290		state->split_start++;
 3291		break;
 3292	case 18:
 3293		if (nl80211_put_nan_capa(&rdev->wiphy, msg))
 3294			goto nla_put_failure;
 3295
 3296		/* done */
 3297		state->split_start = 0;
 3298		break;
 3299	}
 3300 finish:
 3301	genlmsg_end(msg, hdr);
 3302	return 0;
 3303
 3304 nla_put_failure:
 3305	genlmsg_cancel(msg, hdr);
 3306	return -EMSGSIZE;
 3307}
 3308
 3309static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
 3310				    struct netlink_callback *cb,
 3311				    struct nl80211_dump_wiphy_state *state)
 3312{
 3313	struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
 3314	int ret;
 3315
 3316	if (!tb)
 3317		return -ENOMEM;
 3318
 3319	ret = nlmsg_parse_deprecated(cb->nlh,
 3320				     GENL_HDRLEN + nl80211_fam.hdrsize,
 3321				     tb, nl80211_fam.maxattr,
 3322				     nl80211_policy, NULL);
 3323	/* ignore parse errors for backward compatibility */
 3324	if (ret) {
 3325		ret = 0;
 3326		goto out;
 3327	}
 3328
 3329	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
 3330	if (tb[NL80211_ATTR_WIPHY])
 3331		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
 3332	if (tb[NL80211_ATTR_WDEV])
 3333		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
 3334	if (tb[NL80211_ATTR_IFINDEX]) {
 3335		struct net_device *netdev;
 3336		struct cfg80211_registered_device *rdev;
 3337		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 3338
 3339		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
 3340		if (!netdev) {
 3341			ret = -ENODEV;
 3342			goto out;
 3343		}
 3344		if (netdev->ieee80211_ptr) {
 3345			rdev = wiphy_to_rdev(
 3346				netdev->ieee80211_ptr->wiphy);
 3347			state->filter_wiphy = rdev->wiphy_idx;
 3348		}
 3349	}
 3350
 3351	ret = 0;
 3352out:
 3353	kfree(tb);
 3354	return ret;
 3355}
 3356
 3357static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
 3358{
 3359	int idx = 0, ret;
 3360	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
 3361	struct cfg80211_registered_device *rdev;
 3362
 3363	rtnl_lock();
 3364	if (!state) {
 3365		state = kzalloc(sizeof(*state), GFP_KERNEL);
 3366		if (!state) {
 3367			rtnl_unlock();
 3368			return -ENOMEM;
 3369		}
 3370		state->filter_wiphy = -1;
 3371		ret = nl80211_dump_wiphy_parse(skb, cb, state);
 3372		if (ret) {
 3373			kfree(state);
 3374			rtnl_unlock();
 3375			return ret;
 3376		}
 3377		cb->args[0] = (long)state;
 3378	}
 3379
 3380	for_each_rdev(rdev) {
 3381		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 3382			continue;
 3383		if (++idx <= state->start)
 3384			continue;
 3385		if (state->filter_wiphy != -1 &&
 3386		    state->filter_wiphy != rdev->wiphy_idx)
 3387			continue;
 3388		wiphy_lock(&rdev->wiphy);
 3389		/* attempt to fit multiple wiphy data chunks into the skb */
 3390		do {
 3391			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
 3392						 skb,
 3393						 NETLINK_CB(cb->skb).portid,
 3394						 cb->nlh->nlmsg_seq,
 3395						 NLM_F_MULTI, state);
 3396			if (ret < 0) {
 3397				/*
 3398				 * If sending the wiphy data didn't fit (ENOBUFS
 3399				 * or EMSGSIZE returned), this SKB is still
 3400				 * empty (so it's not too big because another
 3401				 * wiphy dataset is already in the skb) and
 3402				 * we've not tried to adjust the dump allocation
 3403				 * yet ... then adjust the alloc size to be
 3404				 * bigger, and return 1 but with the empty skb.
 3405				 * This results in an empty message being RX'ed
 3406				 * in userspace, but that is ignored.
 3407				 *
 3408				 * We can then retry with the larger buffer.
 3409				 */
 3410				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
 3411				    !skb->len && !state->split &&
 3412				    cb->min_dump_alloc < 4096) {
 3413					cb->min_dump_alloc = 4096;
 3414					state->split_start = 0;
 3415					wiphy_unlock(&rdev->wiphy);
 3416					rtnl_unlock();
 3417					return 1;
 3418				}
 3419				idx--;
 3420				break;
 3421			}
 3422		} while (state->split_start > 0);
 3423		wiphy_unlock(&rdev->wiphy);
 3424		break;
 3425	}
 3426	rtnl_unlock();
 3427
 3428	state->start = idx;
 3429
 3430	return skb->len;
 3431}
 3432
 3433static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
 3434{
 3435	kfree((void *)cb->args[0]);
 3436	return 0;
 3437}
 3438
 3439static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
 3440{
 3441	struct sk_buff *msg;
 3442	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 3443	struct nl80211_dump_wiphy_state state = {};
 3444
 3445	msg = nlmsg_new(4096, GFP_KERNEL);
 3446	if (!msg)
 3447		return -ENOMEM;
 3448
 3449	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
 3450			       info->snd_portid, info->snd_seq, 0,
 3451			       &state) < 0) {
 3452		nlmsg_free(msg);
 3453		return -ENOBUFS;
 3454	}
 3455
 3456	return genlmsg_reply(msg, info);
 3457}
 3458
 3459static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
 3460	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
 3461	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
 3462	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
 3463	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
 3464	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
 3465};
 3466
 3467static int parse_txq_params(struct nlattr *tb[],
 3468			    struct ieee80211_txq_params *txq_params)
 3469{
 3470	u8 ac;
 3471
 3472	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
 3473	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
 3474	    !tb[NL80211_TXQ_ATTR_AIFS])
 3475		return -EINVAL;
 3476
 3477	ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
 3478	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
 3479	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
 3480	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
 3481	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
 3482
 3483	if (ac >= NL80211_NUM_ACS)
 3484		return -EINVAL;
 3485	txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
 3486	return 0;
 3487}
 3488
 3489static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
 3490{
 3491	/*
 3492	 * You can only set the channel explicitly for some interfaces,
 3493	 * most have their channel managed via their respective
 3494	 * "establish a connection" command (connect, join, ...)
 3495	 *
 3496	 * For AP/GO and mesh mode, the channel can be set with the
 3497	 * channel userspace API, but is only stored and passed to the
 3498	 * low-level driver when the AP starts or the mesh is joined.
 3499	 * This is for backward compatibility, userspace can also give
 3500	 * the channel in the start-ap or join-mesh commands instead.
 3501	 *
 3502	 * Monitors are special as they are normally slaved to
 3503	 * whatever else is going on, so they have their own special
 3504	 * operation to set the monitor channel if possible.
 3505	 */
 3506	return !wdev ||
 3507		wdev->iftype == NL80211_IFTYPE_AP ||
 3508		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
 3509		wdev->iftype == NL80211_IFTYPE_MONITOR ||
 3510		wdev->iftype == NL80211_IFTYPE_P2P_GO;
 3511}
 3512
 3513static int _nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
 3514				  struct genl_info *info, bool monitor,
 3515				  struct cfg80211_chan_def *chandef)
 3516{
 3517	struct netlink_ext_ack *extack = info->extack;
 3518	struct nlattr **attrs = info->attrs;
 3519	u32 control_freq;
 3520
 3521	if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
 3522		NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
 3523				    "Frequency is missing");
 3524		return -EINVAL;
 3525	}
 3526
 3527	control_freq = MHZ_TO_KHZ(
 3528			nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
 3529	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
 3530		control_freq +=
 3531		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
 3532
 3533	memset(chandef, 0, sizeof(*chandef));
 3534	chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
 3535	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
 3536	chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
 3537	chandef->freq1_offset = control_freq % 1000;
 3538	chandef->center_freq2 = 0;
 3539	chandef->s1g_primary_2mhz = false;
 3540
 3541	if (!chandef->chan) {
 3542		NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
 3543				    "Unknown channel");
 3544		return -EINVAL;
 3545	}
 3546
 3547	if (cfg80211_chandef_is_s1g(chandef))
 3548		chandef->width = NL80211_CHAN_WIDTH_1;
 3549
 3550	if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
 3551		enum nl80211_channel_type chantype;
 3552
 3553		chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
 3554
 3555		switch (chantype) {
 3556		case NL80211_CHAN_NO_HT:
 3557		case NL80211_CHAN_HT20:
 3558		case NL80211_CHAN_HT40PLUS:
 3559		case NL80211_CHAN_HT40MINUS:
 3560			cfg80211_chandef_create(chandef, chandef->chan,
 3561						chantype);
 3562			/* user input for center_freq is incorrect */
 3563			if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
 3564			    chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
 3565				NL_SET_ERR_MSG_ATTR(extack,
 3566						    attrs[NL80211_ATTR_CENTER_FREQ1],
 3567						    "bad center frequency 1");
 3568				return -EINVAL;
 3569			}
 3570			/* center_freq2 must be zero */
 3571			if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
 3572			    nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
 3573				NL_SET_ERR_MSG_ATTR(extack,
 3574						    attrs[NL80211_ATTR_CENTER_FREQ2],
 3575						    "center frequency 2 can't be used");
 3576				return -EINVAL;
 3577			}
 3578			break;
 3579		default:
 3580			NL_SET_ERR_MSG_ATTR(extack,
 3581					    attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
 3582					    "invalid channel type");
 3583			return -EINVAL;
 3584		}
 3585	} else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
 3586		chandef->width = nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
 3587		if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
 3588			chandef->center_freq1 =
 3589				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
 3590			chandef->freq1_offset = nla_get_u32_default(
 3591				attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET], 0);
 3592		}
 3593
 3594		if (attrs[NL80211_ATTR_CENTER_FREQ2])
 3595			chandef->center_freq2 =
 3596				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
 3597
 3598		chandef->s1g_primary_2mhz = nla_get_flag(
 3599			attrs[NL80211_ATTR_S1G_PRIMARY_2MHZ]);
 3600	}
 3601
 3602	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
 3603		chandef->edmg.channels =
 3604		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
 3605
 3606		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
 3607			chandef->edmg.bw_config =
 3608		     nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
 3609	} else {
 3610		chandef->edmg.bw_config = 0;
 3611		chandef->edmg.channels = 0;
 3612	}
 3613
 3614	if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
 3615		chandef->punctured =
 3616			nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
 3617
 3618		if (chandef->punctured &&
 3619		    !wiphy_ext_feature_isset(&rdev->wiphy,
 3620					     NL80211_EXT_FEATURE_PUNCT)) {
 3621			NL_SET_ERR_MSG(extack,
 3622				       "driver doesn't support puncturing");
 3623			return -EINVAL;
 3624		}
 3625	}
 3626
 3627	if (!cfg80211_chandef_valid(chandef)) {
 3628		NL_SET_ERR_MSG(extack, "invalid channel definition");
 3629		return -EINVAL;
 3630	}
 3631
 3632	if (!_cfg80211_chandef_usable(&rdev->wiphy, chandef,
 3633				      IEEE80211_CHAN_DISABLED,
 3634				      monitor ? IEEE80211_CHAN_CAN_MONITOR : 0)) {
 3635		NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
 3636		return -EINVAL;
 3637	}
 3638
 3639	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
 3640	     chandef->width == NL80211_CHAN_WIDTH_10) &&
 3641	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
 3642		NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
 3643		return -EINVAL;
 3644	}
 3645
 3646	return 0;
 3647}
 3648
 3649int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
 3650			  struct genl_info *info,
 3651			  struct cfg80211_chan_def *chandef)
 3652{
 3653	return _nl80211_parse_chandef(rdev, info, false, chandef);
 3654}
 3655
 3656static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
 3657				 struct net_device *dev,
 3658				 struct genl_info *info,
 3659				 int _link_id)
 3660{
 3661	struct cfg80211_chan_def chandef;
 3662	int result;
 3663	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
 3664	struct wireless_dev *wdev = NULL;
 3665	int link_id = _link_id;
 3666
 3667	if (dev)
 3668		wdev = dev->ieee80211_ptr;
 3669	if (!nl80211_can_set_dev_channel(wdev))
 3670		return -EOPNOTSUPP;
 3671	if (wdev)
 3672		iftype = wdev->iftype;
 3673
 3674	if (link_id < 0) {
 3675		if (wdev && wdev->valid_links)
 3676			return -EINVAL;
 3677		link_id = 0;
 3678	}
 3679
 3680	result = _nl80211_parse_chandef(rdev, info,
 3681					iftype == NL80211_IFTYPE_MONITOR,
 3682					&chandef);
 3683	if (result)
 3684		return result;
 3685
 3686	switch (iftype) {
 3687	case NL80211_IFTYPE_AP:
 3688	case NL80211_IFTYPE_P2P_GO:
 3689		if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
 3690						   iftype))
 3691			return -EINVAL;
 3692		if (wdev->links[link_id].ap.beacon_interval) {
 3693			struct ieee80211_channel *cur_chan;
 3694
 3695			if (!dev || !rdev->ops->set_ap_chanwidth ||
 3696			    !(rdev->wiphy.features &
 3697			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
 3698				return -EBUSY;
 3699
 3700			/* Only allow dynamic channel width changes */
 3701			cur_chan = wdev->links[link_id].ap.chandef.chan;
 3702			if (chandef.chan != cur_chan)
 3703				return -EBUSY;
 3704
 3705			/* only allow this for regular channel widths */
 3706			switch (wdev->links[link_id].ap.chandef.width) {
 3707			case NL80211_CHAN_WIDTH_20_NOHT:
 3708			case NL80211_CHAN_WIDTH_20:
 3709			case NL80211_CHAN_WIDTH_40:
 3710			case NL80211_CHAN_WIDTH_80:
 3711			case NL80211_CHAN_WIDTH_80P80:
 3712			case NL80211_CHAN_WIDTH_160:
 3713			case NL80211_CHAN_WIDTH_320:
 3714				break;
 3715			default:
 3716				return -EINVAL;
 3717			}
 3718
 3719			switch (chandef.width) {
 3720			case NL80211_CHAN_WIDTH_20_NOHT:
 3721			case NL80211_CHAN_WIDTH_20:
 3722			case NL80211_CHAN_WIDTH_40:
 3723			case NL80211_CHAN_WIDTH_80:
 3724			case NL80211_CHAN_WIDTH_80P80:
 3725			case NL80211_CHAN_WIDTH_160:
 3726			case NL80211_CHAN_WIDTH_320:
 3727				break;
 3728			default:
 3729				return -EINVAL;
 3730			}
 3731
 3732			result = rdev_set_ap_chanwidth(rdev, dev, link_id,
 3733						       &chandef);
 3734			if (result)
 3735				return result;
 3736			wdev->links[link_id].ap.chandef = chandef;
 3737		} else {
 3738			wdev->u.ap.preset_chandef = chandef;
 3739		}
 3740		return 0;
 3741	case NL80211_IFTYPE_MESH_POINT:
 3742		return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
 3743	case NL80211_IFTYPE_MONITOR:
 3744		return cfg80211_set_monitor_channel(rdev, dev, &chandef);
 3745	default:
 3746		break;
 3747	}
 3748
 3749	return -EINVAL;
 3750}
 3751
 3752static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
 3753{
 3754	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 3755	int link_id = nl80211_link_id_or_invalid(info->attrs);
 3756	struct net_device *netdev = info->user_ptr[1];
 3757
 3758	return __nl80211_set_channel(rdev, netdev, info, link_id);
 3759}
 3760
 3761static int nl80211_set_wiphy_radio(struct genl_info *info,
 3762				   struct cfg80211_registered_device *rdev,
 3763				   int radio_idx)
 3764{
 3765	u32 rts_threshold = 0, old_rts, changed = 0;
 3766	int result;
 3767
 3768	if (!rdev->ops->set_wiphy_params)
 3769		return -EOPNOTSUPP;
 3770
 3771	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 3772		rts_threshold = nla_get_u32(
 3773				info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 3774		changed |= WIPHY_PARAM_RTS_THRESHOLD;
 3775	}
 3776
 3777	old_rts = rdev->wiphy.radio_cfg[radio_idx].rts_threshold;
 3778
 3779	rdev->wiphy.radio_cfg[radio_idx].rts_threshold = rts_threshold;
 3780
 3781	result = rdev_set_wiphy_params(rdev, radio_idx, changed);
 3782	if (result)
 3783		rdev->wiphy.radio_cfg[radio_idx].rts_threshold = old_rts;
 3784
 3785	return 0;
 3786}
 3787
 3788static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
 3789{
 3790	struct cfg80211_registered_device *rdev = NULL;
 3791	struct net_device *netdev = NULL;
 3792	struct wireless_dev *wdev;
 3793	int result = 0, rem_txq_params = 0;
 3794	struct nlattr *nl_txq_params;
 3795	u32 changed;
 3796	u8 retry_short = 0, retry_long = 0;
 3797	u32 frag_threshold = 0, rts_threshold = 0;
 3798	u8 coverage_class = 0;
 3799	u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
 3800	int radio_idx = -1;
 3801
 3802	rtnl_lock();
 3803	/*
 3804	 * Try to find the wiphy and netdev. Normally this
 3805	 * function shouldn't need the netdev, but this is
 3806	 * done for backward compatibility -- previously
 3807	 * setting the channel was done per wiphy, but now
 3808	 * it is per netdev. Previous userland like hostapd
 3809	 * also passed a netdev to set_wiphy, so that it is
 3810	 * possible to let that go to the right netdev!
 3811	 */
 3812
 3813	if (info->attrs[NL80211_ATTR_IFINDEX]) {
 3814		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
 3815
 3816		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
 3817		if (netdev && netdev->ieee80211_ptr)
 3818			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
 3819		else
 3820			netdev = NULL;
 3821	}
 3822
 3823	if (!netdev) {
 3824		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
 3825						  info->attrs);
 3826		if (IS_ERR(rdev)) {
 3827			rtnl_unlock();
 3828			return PTR_ERR(rdev);
 3829		}
 3830		wdev = NULL;
 3831		netdev = NULL;
 3832		result = 0;
 3833	} else
 3834		wdev = netdev->ieee80211_ptr;
 3835
 3836	guard(wiphy)(&rdev->wiphy);
 3837
 3838	/*
 3839	 * end workaround code, by now the rdev is available
 3840	 * and locked, and wdev may or may not be NULL.
 3841	 */
 3842
 3843	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
 3844		result = cfg80211_dev_rename(
 3845			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
 3846	rtnl_unlock();
 3847
 3848	if (result)
 3849		return result;
 3850
 3851	if (info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]) {
 3852		/* Radio idx is not expected for non-multi radio wiphy */
 3853		if (rdev->wiphy.n_radio <= 0)
 3854			return -EINVAL;
 3855
 3856		radio_idx = nla_get_u8(
 3857				info->attrs[NL80211_ATTR_WIPHY_RADIO_INDEX]);
 3858		if (radio_idx >= rdev->wiphy.n_radio)
 3859			return -EINVAL;
 3860
 3861		return nl80211_set_wiphy_radio(info, rdev, radio_idx);
 3862	}
 3863
 3864	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
 3865		struct ieee80211_txq_params txq_params;
 3866		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
 3867
 3868		if (!rdev->ops->set_txq_params)
 3869			return -EOPNOTSUPP;
 3870
 3871		if (!netdev)
 3872			return -EINVAL;
 3873
 3874		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 3875		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 3876			return -EINVAL;
 3877
 3878		if (!netif_running(netdev))
 3879			return -ENETDOWN;
 3880
 3881		nla_for_each_nested(nl_txq_params,
 3882				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
 3883				    rem_txq_params) {
 3884			result = nla_parse_nested_deprecated(tb,
 3885							     NL80211_TXQ_ATTR_MAX,
 3886							     nl_txq_params,
 3887							     txq_params_policy,
 3888							     info->extack);
 3889			if (result)
 3890				return result;
 3891
 3892			result = parse_txq_params(tb, &txq_params);
 3893			if (result)
 3894				return result;
 3895
 3896			txq_params.link_id =
 3897				nl80211_link_id_or_invalid(info->attrs);
 3898
 3899			if (txq_params.link_id >= 0 &&
 3900			    !(netdev->ieee80211_ptr->valid_links &
 3901			      BIT(txq_params.link_id)))
 3902				result = -ENOLINK;
 3903			else if (txq_params.link_id >= 0 &&
 3904				 !netdev->ieee80211_ptr->valid_links)
 3905				result = -EINVAL;
 3906			else
 3907				result = rdev_set_txq_params(rdev, netdev,
 3908							     &txq_params);
 3909			if (result)
 3910				return result;
 3911		}
 3912	}
 3913
 3914	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 3915		int link_id = nl80211_link_id_or_invalid(info->attrs);
 3916
 3917		if (wdev) {
 3918			result = __nl80211_set_channel(
 3919				rdev,
 3920				nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
 3921				info, link_id);
 3922		} else {
 3923			result = __nl80211_set_channel(rdev, netdev, info, link_id);
 3924		}
 3925
 3926		if (result)
 3927			return result;
 3928	}
 3929
 3930	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
 3931		struct wireless_dev *txp_wdev = wdev;
 3932		enum nl80211_tx_power_setting type;
 3933		int idx, mbm = 0;
 3934
 3935		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
 3936			txp_wdev = NULL;
 3937
 3938		if (!rdev->ops->set_tx_power)
 3939			return -EOPNOTSUPP;
 3940
 3941		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
 3942		type = nla_get_u32(info->attrs[idx]);
 3943
 3944		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
 3945		    (type != NL80211_TX_POWER_AUTOMATIC))
 3946			return -EINVAL;
 3947
 3948		if (type != NL80211_TX_POWER_AUTOMATIC) {
 3949			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
 3950			mbm = nla_get_u32(info->attrs[idx]);
 3951		}
 3952
 3953		result = rdev_set_tx_power(rdev, txp_wdev, radio_idx, type,
 3954					   mbm);
 3955		if (result)
 3956			return result;
 3957	}
 3958
 3959	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
 3960	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
 3961		u32 tx_ant, rx_ant;
 3962
 3963		if ((!rdev->wiphy.available_antennas_tx &&
 3964		     !rdev->wiphy.available_antennas_rx) ||
 3965		    !rdev->ops->set_antenna)
 3966			return -EOPNOTSUPP;
 3967
 3968		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
 3969		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
 3970
 3971		/* reject antenna configurations which don't match the
 3972		 * available antenna masks, except for the "all" mask */
 3973		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
 3974		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
 3975			return -EINVAL;
 3976
 3977		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
 3978		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
 3979
 3980		result = rdev_set_antenna(rdev, radio_idx, tx_ant, rx_ant);
 3981		if (result)
 3982			return result;
 3983	}
 3984
 3985	changed = 0;
 3986
 3987	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
 3988		retry_short = nla_get_u8(
 3989			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
 3990
 3991		changed |= WIPHY_PARAM_RETRY_SHORT;
 3992	}
 3993
 3994	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
 3995		retry_long = nla_get_u8(
 3996			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
 3997
 3998		changed |= WIPHY_PARAM_RETRY_LONG;
 3999	}
 4000
 4001	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
 4002		frag_threshold = nla_get_u32(
 4003			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
 4004		if (frag_threshold < 256)
 4005			return -EINVAL;
 4006
 4007		if (frag_threshold != (u32) -1) {
 4008			/*
 4009			 * Fragments (apart from the last one) are required to
 4010			 * have even length. Make the fragmentation code
 4011			 * simpler by stripping LSB should someone try to use
 4012			 * odd threshold value.
 4013			 */
 4014			frag_threshold &= ~0x1;
 4015		}
 4016		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
 4017	}
 4018
 4019	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
 4020		rts_threshold = nla_get_u32(
 4021			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
 4022		changed |= WIPHY_PARAM_RTS_THRESHOLD;
 4023	}
 4024
 4025	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
 4026		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
 4027			return -EINVAL;
 4028
 4029		coverage_class = nla_get_u8(
 4030			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
 4031		changed |= WIPHY_PARAM_COVERAGE_CLASS;
 4032	}
 4033
 4034	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
 4035		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
 4036			return -EOPNOTSUPP;
 4037
 4038		changed |= WIPHY_PARAM_DYN_ACK;
 4039	}
 4040
 4041	if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
 4042		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 4043					     NL80211_EXT_FEATURE_TXQS))
 4044			return -EOPNOTSUPP;
 4045
 4046		txq_limit = nla_get_u32(
 4047			info->attrs[NL80211_ATTR_TXQ_LIMIT]);
 4048		changed |= WIPHY_PARAM_TXQ_LIMIT;
 4049	}
 4050
 4051	if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
 4052		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 4053					     NL80211_EXT_FEATURE_TXQS))
 4054			return -EOPNOTSUPP;
 4055
 4056		txq_memory_limit = nla_get_u32(
 4057			info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
 4058		changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
 4059	}
 4060
 4061	if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
 4062		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 4063					     NL80211_EXT_FEATURE_TXQS))
 4064			return -EOPNOTSUPP;
 4065
 4066		txq_quantum = nla_get_u32(
 4067			info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
 4068		changed |= WIPHY_PARAM_TXQ_QUANTUM;
 4069	}
 4070
 4071	if (changed) {
 4072		u8 old_retry_short, old_retry_long;
 4073		u32 old_frag_threshold, old_rts_threshold;
 4074		u8 old_coverage_class, i;
 4075		u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
 4076		u32 *old_radio_rts_threshold = NULL;
 4077
 4078		if (!rdev->ops->set_wiphy_params)
 4079			return -EOPNOTSUPP;
 4080
 4081		if (rdev->wiphy.n_radio) {
 4082			old_radio_rts_threshold = kcalloc(rdev->wiphy.n_radio,
 4083							  sizeof(u32),
 4084							  GFP_KERNEL);
 4085			if (!old_radio_rts_threshold)
 4086				return -ENOMEM;
 4087		}
 4088
 4089		old_retry_short = rdev->wiphy.retry_short;
 4090		old_retry_long = rdev->wiphy.retry_long;
 4091		old_frag_threshold = rdev->wiphy.frag_threshold;
 4092		old_rts_threshold = rdev->wiphy.rts_threshold;
 4093		if (old_radio_rts_threshold) {
 4094			for (i = 0 ; i < rdev->wiphy.n_radio; i++)
 4095				old_radio_rts_threshold[i] =
 4096					rdev->wiphy.radio_cfg[i].rts_threshold;
 4097		}
 4098		old_coverage_class = rdev->wiphy.coverage_class;
 4099		old_txq_limit = rdev->wiphy.txq_limit;
 4100		old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
 4101		old_txq_quantum = rdev->wiphy.txq_quantum;
 4102
 4103		if (changed & WIPHY_PARAM_RETRY_SHORT)
 4104			rdev->wiphy.retry_short = retry_short;
 4105		if (changed & WIPHY_PARAM_RETRY_LONG)
 4106			rdev->wiphy.retry_long = retry_long;
 4107		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
 4108			rdev->wiphy.frag_threshold = frag_threshold;
 4109		if ((changed & WIPHY_PARAM_RTS_THRESHOLD) &&
 4110		    old_radio_rts_threshold) {
 4111			rdev->wiphy.rts_threshold = rts_threshold;
 4112			for (i = 0 ; i < rdev->wiphy.n_radio; i++)
 4113				rdev->wiphy.radio_cfg[i].rts_threshold =
 4114					rdev->wiphy.rts_threshold;
 4115		}
 4116		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
 4117			rdev->wiphy.coverage_class = coverage_class;
 4118		if (changed & WIPHY_PARAM_TXQ_LIMIT)
 4119			rdev->wiphy.txq_limit = txq_limit;
 4120		if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
 4121			rdev->wiphy.txq_memory_limit = txq_memory_limit;
 4122		if (changed & WIPHY_PARAM_TXQ_QUANTUM)
 4123			rdev->wiphy.txq_quantum = txq_quantum;
 4124
 4125		result = rdev_set_wiphy_params(rdev, radio_idx, changed);
 4126		if (result) {
 4127			rdev->wiphy.retry_short = old_retry_short;
 4128			rdev->wiphy.retry_long = old_retry_long;
 4129			rdev->wiphy.frag_threshold = old_frag_threshold;
 4130			rdev->wiphy.rts_threshold = old_rts_threshold;
 4131			if (old_radio_rts_threshold) {
 4132				for (i = 0 ; i < rdev->wiphy.n_radio; i++)
 4133					rdev->wiphy.radio_cfg[i].rts_threshold =
 4134						old_radio_rts_threshold[i];
 4135			}
 4136			rdev->wiphy.coverage_class = old_coverage_class;
 4137			rdev->wiphy.txq_limit = old_txq_limit;
 4138			rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
 4139			rdev->wiphy.txq_quantum = old_txq_quantum;
 4140		}
 4141
 4142		kfree(old_radio_rts_threshold);
 4143		return result;
 4144	}
 4145
 4146	return 0;
 4147}
 4148
 4149int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
 4150{
 4151	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
 4152		return -EINVAL;
 4153
 4154	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
 4155			chandef->chan->center_freq))
 4156		return -ENOBUFS;
 4157	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
 4158			chandef->chan->freq_offset))
 4159		return -ENOBUFS;
 4160	switch (chandef->width) {
 4161	case NL80211_CHAN_WIDTH_20_NOHT:
 4162	case NL80211_CHAN_WIDTH_20:
 4163	case NL80211_CHAN_WIDTH_40:
 4164		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
 4165				cfg80211_get_chandef_type(chandef)))
 4166			return -ENOBUFS;
 4167		break;
 4168	default:
 4169		break;
 4170	}
 4171	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
 4172		return -ENOBUFS;
 4173	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
 4174		return -ENOBUFS;
 4175	if (chandef->center_freq2 &&
 4176	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
 4177		return -ENOBUFS;
 4178	if (chandef->punctured &&
 4179	    nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, chandef->punctured))
 4180		return -ENOBUFS;
 4181	if (chandef->s1g_primary_2mhz &&
 4182	    nla_put_flag(msg, NL80211_ATTR_S1G_PRIMARY_2MHZ))
 4183		return -ENOBUFS;
 4184
 4185	return 0;
 4186}
 4187EXPORT_SYMBOL(nl80211_send_chandef);
 4188
 4189static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
 4190			      struct cfg80211_registered_device *rdev,
 4191			      struct wireless_dev *wdev,
 4192			      enum nl80211_commands cmd)
 4193{
 4194	struct net_device *dev = wdev->netdev;
 4195	void *hdr;
 4196
 4197	lockdep_assert_wiphy(&rdev->wiphy);
 4198
 4199	WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
 4200		cmd != NL80211_CMD_DEL_INTERFACE &&
 4201		cmd != NL80211_CMD_SET_INTERFACE);
 4202
 4203	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
 4204	if (!hdr)
 4205		return -1;
 4206
 4207	if (dev &&
 4208	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 4209	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
 4210		goto nla_put_failure;
 4211
 4212	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 4213	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
 4214	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
 4215			      NL80211_ATTR_PAD) ||
 4216	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
 4217	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
 4218			rdev->devlist_generation ^
 4219			(cfg80211_rdev_list_generation << 2)) ||
 4220	    nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr) ||
 4221	    nla_put_u32(msg, NL80211_ATTR_VIF_RADIO_MASK, wdev->radio_mask))
 4222		goto nla_put_failure;
 4223
 4224	if (rdev->ops->get_channel && !wdev->valid_links) {
 4225		struct cfg80211_chan_def chandef = {};
 4226		int ret;
 4227
 4228		ret = rdev_get_channel(rdev, wdev, 0, &chandef);
 4229		if (ret == 0 && nl80211_send_chandef(msg, &chandef))
 4230			goto nla_put_failure;
 4231	}
 4232
 4233	if (rdev->ops->get_tx_power && !wdev->valid_links) {
 4234		int dbm, ret;
 4235
 4236		ret = rdev_get_tx_power(rdev, wdev, -1, 0, &dbm);
 4237		if (ret == 0 &&
 4238		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
 4239				DBM_TO_MBM(dbm)))
 4240			goto nla_put_failure;
 4241	}
 4242
 4243	switch (wdev->iftype) {
 4244	case NL80211_IFTYPE_AP:
 4245	case NL80211_IFTYPE_P2P_GO:
 4246		if (wdev->u.ap.ssid_len &&
 4247		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
 4248			    wdev->u.ap.ssid))
 4249			goto nla_put_failure;
 4250		break;
 4251	case NL80211_IFTYPE_STATION:
 4252	case NL80211_IFTYPE_P2P_CLIENT:
 4253		if (wdev->u.client.ssid_len &&
 4254		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
 4255			    wdev->u.client.ssid))
 4256			goto nla_put_failure;
 4257		break;
 4258	case NL80211_IFTYPE_ADHOC:
 4259		if (wdev->u.ibss.ssid_len &&
 4260		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
 4261			    wdev->u.ibss.ssid))
 4262			goto nla_put_failure;
 4263		break;
 4264	default:
 4265		/* nothing */
 4266		break;
 4267	}
 4268
 4269	if (rdev->ops->get_txq_stats) {
 4270		struct cfg80211_txq_stats txqstats = {};
 4271		int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
 4272
 4273		if (ret == 0 &&
 4274		    !nl80211_put_txq_stats(msg, &txqstats,
 4275					   NL80211_ATTR_TXQ_STATS))
 4276			goto nla_put_failure;
 4277	}
 4278
 4279	if (wdev->valid_links) {
 4280		unsigned int link_id;
 4281		struct nlattr *links = nla_nest_start(msg,
 4282						      NL80211_ATTR_MLO_LINKS);
 4283
 4284		if (!links)
 4285			goto nla_put_failure;
 4286
 4287		for_each_valid_link(wdev, link_id) {
 4288			struct nlattr *link = nla_nest_start(msg, link_id + 1);
 4289			struct cfg80211_chan_def chandef = {};
 4290			int ret;
 4291
 4292			if (!link)
 4293				goto nla_put_failure;
 4294
 4295			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
 4296				goto nla_put_failure;
 4297			if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 4298				    wdev->links[link_id].addr))
 4299				goto nla_put_failure;
 4300
 4301			ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
 4302			if (ret == 0 && nl80211_send_chandef(msg, &chandef))
 4303				goto nla_put_failure;
 4304
 4305			if (rdev->ops->get_tx_power) {
 4306				int dbm, ret;
 4307
 4308				ret = rdev_get_tx_power(rdev, wdev, -1, link_id, &dbm);
 4309				if (ret == 0 &&
 4310				    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
 4311						DBM_TO_MBM(dbm)))
 4312					goto nla_put_failure;
 4313			}
 4314			nla_nest_end(msg, link);
 4315		}
 4316
 4317		nla_nest_end(msg, links);
 4318	}
 4319
 4320	genlmsg_end(msg, hdr);
 4321	return 0;
 4322
 4323 nla_put_failure:
 4324	genlmsg_cancel(msg, hdr);
 4325	return -EMSGSIZE;
 4326}
 4327
 4328static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
 4329{
 4330	int wp_idx = 0;
 4331	int if_idx = 0;
 4332	int wp_start = cb->args[0];
 4333	int if_start = cb->args[1];
 4334	int filter_wiphy = -1;
 4335	struct cfg80211_registered_device *rdev;
 4336	struct wireless_dev *wdev;
 4337	int ret;
 4338
 4339	rtnl_lock();
 4340	if (!cb->args[2]) {
 4341		struct nl80211_dump_wiphy_state state = {
 4342			.filter_wiphy = -1,
 4343		};
 4344
 4345		ret = nl80211_dump_wiphy_parse(skb, cb, &state);
 4346		if (ret)
 4347			goto out_unlock;
 4348
 4349		filter_wiphy = state.filter_wiphy;
 4350
 4351		/*
 4352		 * if filtering, set cb->args[2] to +1 since 0 is the default
 4353		 * value needed to determine that parsing is necessary.
 4354		 */
 4355		if (filter_wiphy >= 0)
 4356			cb->args[2] = filter_wiphy + 1;
 4357		else
 4358			cb->args[2] = -1;
 4359	} else if (cb->args[2] > 0) {
 4360		filter_wiphy = cb->args[2] - 1;
 4361	}
 4362
 4363	for_each_rdev(rdev) {
 4364		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
 4365			continue;
 4366		if (wp_idx < wp_start) {
 4367			wp_idx++;
 4368			continue;
 4369		}
 4370
 4371		if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
 4372			continue;
 4373
 4374		if_idx = 0;
 4375
 4376		guard(wiphy)(&rdev->wiphy);
 4377
 4378		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 4379			if (if_idx < if_start) {
 4380				if_idx++;
 4381				continue;
 4382			}
 4383
 4384			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
 4385					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 4386					       rdev, wdev,
 4387					       NL80211_CMD_NEW_INTERFACE) < 0)
 4388				goto out;
 4389
 4390			if_idx++;
 4391		}
 4392
 4393		if_start = 0;
 4394		wp_idx++;
 4395	}
 4396 out:
 4397	cb->args[0] = wp_idx;
 4398	cb->args[1] = if_idx;
 4399
 4400	ret = skb->len;
 4401 out_unlock:
 4402	rtnl_unlock();
 4403
 4404	return ret;
 4405}
 4406
 4407static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
 4408{
 4409	struct sk_buff *msg;
 4410	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4411	struct wireless_dev *wdev = info->user_ptr[1];
 4412
 4413	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 4414	if (!msg)
 4415		return -ENOMEM;
 4416
 4417	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
 4418			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
 4419		nlmsg_free(msg);
 4420		return -ENOBUFS;
 4421	}
 4422
 4423	return genlmsg_reply(msg, info);
 4424}
 4425
 4426static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
 4427	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
 4428	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
 4429	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
 4430	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
 4431	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
 4432	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
 4433	[NL80211_MNTR_FLAG_SKIP_TX] = { .type = NLA_FLAG },
 4434};
 4435
 4436static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
 4437{
 4438	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
 4439	int flag;
 4440
 4441	*mntrflags = 0;
 4442
 4443	if (!nla)
 4444		return -EINVAL;
 4445
 4446	if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
 4447		return -EINVAL;
 4448
 4449	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
 4450		if (flags[flag])
 4451			*mntrflags |= (1<<flag);
 4452
 4453	/* cooked monitor mode is incompatible with other modes */
 4454	if (*mntrflags & MONITOR_FLAG_COOK_FRAMES &&
 4455	    *mntrflags != MONITOR_FLAG_COOK_FRAMES)
 4456		return -EOPNOTSUPP;
 4457
 4458	*mntrflags |= MONITOR_FLAG_CHANGED;
 4459
 4460	return 0;
 4461}
 4462
 4463static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
 4464				     enum nl80211_iftype type,
 4465				     struct genl_info *info,
 4466				     struct vif_params *params)
 4467{
 4468	bool change = false;
 4469	int err;
 4470
 4471	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
 4472		if (type != NL80211_IFTYPE_MONITOR)
 4473			return -EINVAL;
 4474
 4475		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
 4476					  &params->flags);
 4477		if (err)
 4478			return err;
 4479
 4480		change = true;
 4481	}
 4482
 4483	/* MONITOR_FLAG_COOK_FRAMES is deprecated, refuse cooperation */
 4484	if (params->flags & MONITOR_FLAG_COOK_FRAMES)
 4485		return -EOPNOTSUPP;
 4486
 4487	if (params->flags & MONITOR_FLAG_ACTIVE &&
 4488	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
 4489		return -EOPNOTSUPP;
 4490
 4491	if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
 4492		const u8 *mumimo_groups;
 4493		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
 4494
 4495		if (type != NL80211_IFTYPE_MONITOR)
 4496			return -EINVAL;
 4497
 4498		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
 4499			return -EOPNOTSUPP;
 4500
 4501		mumimo_groups =
 4502			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
 4503
 4504		/* bits 0 and 63 are reserved and must be zero */
 4505		if ((mumimo_groups[0] & BIT(0)) ||
 4506		    (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
 4507			return -EINVAL;
 4508
 4509		params->vht_mumimo_groups = mumimo_groups;
 4510		change = true;
 4511	}
 4512
 4513	if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
 4514		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
 4515
 4516		if (type != NL80211_IFTYPE_MONITOR)
 4517			return -EINVAL;
 4518
 4519		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
 4520			return -EOPNOTSUPP;
 4521
 4522		params->vht_mumimo_follow_addr =
 4523			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
 4524		change = true;
 4525	}
 4526
 4527	return change ? 1 : 0;
 4528}
 4529
 4530static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
 4531			       struct net_device *netdev, u8 use_4addr,
 4532			       enum nl80211_iftype iftype)
 4533{
 4534	if (!use_4addr) {
 4535		if (netdev && netif_is_bridge_port(netdev))
 4536			return -EBUSY;
 4537		return 0;
 4538	}
 4539
 4540	switch (iftype) {
 4541	case NL80211_IFTYPE_AP_VLAN:
 4542		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
 4543			return 0;
 4544		break;
 4545	case NL80211_IFTYPE_STATION:
 4546		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
 4547			return 0;
 4548		break;
 4549	default:
 4550		break;
 4551	}
 4552
 4553	return -EOPNOTSUPP;
 4554}
 4555
 4556static int nl80211_parse_vif_radio_mask(struct genl_info *info,
 4557					u32 *radio_mask)
 4558{
 4559	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4560	struct nlattr *attr = info->attrs[NL80211_ATTR_VIF_RADIO_MASK];
 4561	u32 mask, allowed;
 4562
 4563	if (!attr) {
 4564		*radio_mask = 0;
 4565		return 0;
 4566	}
 4567
 4568	allowed = BIT(rdev->wiphy.n_radio) - 1;
 4569	mask = nla_get_u32(attr);
 4570	if (mask & ~allowed)
 4571		return -EINVAL;
 4572	if (!mask)
 4573		mask = allowed;
 4574	*radio_mask = mask;
 4575
 4576	return 1;
 4577}
 4578
 4579static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
 4580{
 4581	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4582	struct vif_params params;
 4583	int err;
 4584	enum nl80211_iftype otype, ntype;
 4585	struct net_device *dev = info->user_ptr[1];
 4586	struct wireless_dev *wdev = dev->ieee80211_ptr;
 4587	u32 radio_mask = 0;
 4588	bool change = false;
 4589
 4590	memset(&params, 0, sizeof(params));
 4591
 4592	otype = ntype = dev->ieee80211_ptr->iftype;
 4593
 4594	if (info->attrs[NL80211_ATTR_IFTYPE]) {
 4595		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 4596		if (otype != ntype)
 4597			change = true;
 4598	}
 4599
 4600	if (info->attrs[NL80211_ATTR_MESH_ID]) {
 4601		if (ntype != NL80211_IFTYPE_MESH_POINT)
 4602			return -EINVAL;
 4603		if (otype != NL80211_IFTYPE_MESH_POINT)
 4604			return -EINVAL;
 4605		if (netif_running(dev))
 4606			return -EBUSY;
 4607
 4608		wdev->u.mesh.id_up_len =
 4609			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 4610		memcpy(wdev->u.mesh.id,
 4611		       nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
 4612		       wdev->u.mesh.id_up_len);
 4613	}
 4614
 4615	if (info->attrs[NL80211_ATTR_4ADDR]) {
 4616		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
 4617		change = true;
 4618		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
 4619		if (err)
 4620			return err;
 4621	} else {
 4622		params.use_4addr = -1;
 4623	}
 4624
 4625	err = nl80211_parse_mon_options(rdev, ntype, info, &params);
 4626	if (err < 0)
 4627		return err;
 4628	if (err > 0)
 4629		change = true;
 4630
 4631	err = nl80211_parse_vif_radio_mask(info, &radio_mask);
 4632	if (err < 0)
 4633		return err;
 4634	if (err && netif_running(dev))
 4635		return -EBUSY;
 4636
 4637	if (change)
 4638		err = cfg80211_change_iface(rdev, dev, ntype, &params);
 4639	else
 4640		err = 0;
 4641
 4642	if (!err && params.use_4addr != -1)
 4643		dev->ieee80211_ptr->use_4addr = params.use_4addr;
 4644
 4645	if (radio_mask)
 4646		wdev->radio_mask = radio_mask;
 4647
 4648	if (change && !err)
 4649		nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
 4650
 4651	return err;
 4652}
 4653
 4654static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 4655{
 4656	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4657	struct vif_params params;
 4658	struct wireless_dev *wdev;
 4659	struct sk_buff *msg;
 4660	u32 radio_mask;
 4661	int err;
 4662	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
 4663
 4664	memset(&params, 0, sizeof(params));
 4665
 4666	if (!info->attrs[NL80211_ATTR_IFNAME])
 4667		return -EINVAL;
 4668
 4669	if (info->attrs[NL80211_ATTR_IFTYPE])
 4670		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
 4671
 4672	if (!rdev->ops->add_virtual_intf)
 4673		return -EOPNOTSUPP;
 4674
 4675	if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
 4676	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
 4677	    info->attrs[NL80211_ATTR_MAC]) {
 4678		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
 4679			   ETH_ALEN);
 4680		if (!is_valid_ether_addr(params.macaddr))
 4681			return -EADDRNOTAVAIL;
 4682	}
 4683
 4684	if (info->attrs[NL80211_ATTR_4ADDR]) {
 4685		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
 4686		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
 4687		if (err)
 4688			return err;
 4689	}
 4690
 4691	if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
 4692		return -EOPNOTSUPP;
 4693
 4694	err = nl80211_parse_mon_options(rdev, type, info, &params);
 4695	if (err < 0)
 4696		return err;
 4697
 4698	err = nl80211_parse_vif_radio_mask(info, &radio_mask);
 4699	if (err < 0)
 4700		return err;
 4701
 4702	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 4703	if (!msg)
 4704		return -ENOMEM;
 4705
 4706	wdev = rdev_add_virtual_intf(rdev,
 4707				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
 4708				NET_NAME_USER, type, &params);
 4709	if (WARN_ON(!wdev)) {
 4710		nlmsg_free(msg);
 4711		return -EPROTO;
 4712	} else if (IS_ERR(wdev)) {
 4713		nlmsg_free(msg);
 4714		return PTR_ERR(wdev);
 4715	}
 4716
 4717	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
 4718		wdev->owner_nlportid = info->snd_portid;
 4719
 4720	switch (type) {
 4721	case NL80211_IFTYPE_MESH_POINT:
 4722		if (!info->attrs[NL80211_ATTR_MESH_ID])
 4723			break;
 4724		wdev->u.mesh.id_up_len =
 4725			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
 4726		memcpy(wdev->u.mesh.id,
 4727		       nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
 4728		       wdev->u.mesh.id_up_len);
 4729		break;
 4730	case NL80211_IFTYPE_NAN:
 4731	case NL80211_IFTYPE_P2P_DEVICE:
 4732		/*
 4733		 * P2P Device and NAN do not have a netdev, so don't go
 4734		 * through the netdev notifier and must be added here
 4735		 */
 4736		cfg80211_init_wdev(wdev);
 4737		cfg80211_register_wdev(rdev, wdev);
 4738		break;
 4739	default:
 4740		break;
 4741	}
 4742
 4743	if (radio_mask)
 4744		wdev->radio_mask = radio_mask;
 4745
 4746	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
 4747			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
 4748		nlmsg_free(msg);
 4749		return -ENOBUFS;
 4750	}
 4751
 4752	return genlmsg_reply(msg, info);
 4753}
 4754
 4755static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
 4756{
 4757	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4758
 4759	/* to avoid failing a new interface creation due to pending removal */
 4760	cfg80211_destroy_ifaces(rdev);
 4761
 4762	guard(wiphy)(&rdev->wiphy);
 4763
 4764	return _nl80211_new_interface(skb, info);
 4765}
 4766
 4767static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
 4768{
 4769	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4770	struct wireless_dev *wdev = info->user_ptr[1];
 4771
 4772	if (!rdev->ops->del_virtual_intf)
 4773		return -EOPNOTSUPP;
 4774
 4775	/*
 4776	 * We hold RTNL, so this is safe, without RTNL opencount cannot
 4777	 * reach 0, and thus the rdev cannot be deleted.
 4778	 *
 4779	 * We need to do it for the dev_close(), since that will call
 4780	 * the netdev notifiers, and we need to acquire the mutex there
 4781	 * but don't know if we get there from here or from some other
 4782	 * place (e.g. "ip link set ... down").
 4783	 */
 4784	mutex_unlock(&rdev->wiphy.mtx);
 4785
 4786	/*
 4787	 * If we remove a wireless device without a netdev then clear
 4788	 * user_ptr[1] so that nl80211_post_doit won't dereference it
 4789	 * to check if it needs to do dev_put(). Otherwise it crashes
 4790	 * since the wdev has been freed, unlike with a netdev where
 4791	 * we need the dev_put() for the netdev to really be freed.
 4792	 */
 4793	if (!wdev->netdev)
 4794		info->user_ptr[1] = NULL;
 4795	else
 4796		dev_close(wdev->netdev);
 4797
 4798	mutex_lock(&rdev->wiphy.mtx);
 4799
 4800	return cfg80211_remove_virtual_intf(rdev, wdev);
 4801}
 4802
 4803static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
 4804{
 4805	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4806	struct net_device *dev = info->user_ptr[1];
 4807	u16 noack_map;
 4808
 4809	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
 4810		return -EINVAL;
 4811
 4812	if (!rdev->ops->set_noack_map)
 4813		return -EOPNOTSUPP;
 4814
 4815	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
 4816
 4817	return rdev_set_noack_map(rdev, dev, noack_map);
 4818}
 4819
 4820static int nl80211_validate_key_link_id(struct genl_info *info,
 4821					struct wireless_dev *wdev,
 4822					int link_id, bool pairwise)
 4823{
 4824	if (pairwise) {
 4825		if (link_id != -1) {
 4826			GENL_SET_ERR_MSG(info,
 4827					 "link ID not allowed for pairwise key");
 4828			return -EINVAL;
 4829		}
 4830
 4831		return 0;
 4832	}
 4833
 4834	if (wdev->valid_links) {
 4835		if (link_id == -1) {
 4836			GENL_SET_ERR_MSG(info,
 4837					 "link ID must for MLO group key");
 4838			return -EINVAL;
 4839		}
 4840		if (!(wdev->valid_links & BIT(link_id))) {
 4841			GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
 4842			return -EINVAL;
 4843		}
 4844	} else if (link_id != -1) {
 4845		GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
 4846		return -EINVAL;
 4847	}
 4848
 4849	return 0;
 4850}
 4851
 4852struct get_key_cookie {
 4853	struct sk_buff *msg;
 4854	int error;
 4855	int idx;
 4856};
 4857
 4858static void get_key_callback(void *c, struct key_params *params)
 4859{
 4860	struct nlattr *key;
 4861	struct get_key_cookie *cookie = c;
 4862
 4863	if ((params->seq &&
 4864	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
 4865		     params->seq_len, params->seq)) ||
 4866	    (params->cipher &&
 4867	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
 4868			 params->cipher)))
 4869		goto nla_put_failure;
 4870
 4871	key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
 4872	if (!key)
 4873		goto nla_put_failure;
 4874
 4875	if ((params->seq &&
 4876	     nla_put(cookie->msg, NL80211_KEY_SEQ,
 4877		     params->seq_len, params->seq)) ||
 4878	    (params->cipher &&
 4879	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
 4880			 params->cipher)))
 4881		goto nla_put_failure;
 4882
 4883	if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
 4884		goto nla_put_failure;
 4885
 4886	nla_nest_end(cookie->msg, key);
 4887
 4888	return;
 4889 nla_put_failure:
 4890	cookie->error = 1;
 4891}
 4892
 4893static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
 4894{
 4895	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4896	int err;
 4897	struct net_device *dev = info->user_ptr[1];
 4898	u8 key_idx = 0;
 4899	const u8 *mac_addr = NULL;
 4900	bool pairwise;
 4901	struct get_key_cookie cookie = {
 4902		.error = 0,
 4903	};
 4904	void *hdr;
 4905	struct sk_buff *msg;
 4906	bool bigtk_support = false;
 4907	int link_id = nl80211_link_id_or_invalid(info->attrs);
 4908	struct wireless_dev *wdev = dev->ieee80211_ptr;
 4909
 4910	if (wiphy_ext_feature_isset(&rdev->wiphy,
 4911				    NL80211_EXT_FEATURE_BEACON_PROTECTION))
 4912		bigtk_support = true;
 4913
 4914	if ((wdev->iftype == NL80211_IFTYPE_STATION ||
 4915	     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
 4916	    wiphy_ext_feature_isset(&rdev->wiphy,
 4917				    NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
 4918		bigtk_support = true;
 4919
 4920	if (info->attrs[NL80211_ATTR_KEY_IDX]) {
 4921		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 4922
 4923		if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
 4924			GENL_SET_ERR_MSG(info, "BIGTK not supported");
 4925			return -EINVAL;
 4926		}
 4927	}
 4928
 4929	if (info->attrs[NL80211_ATTR_MAC])
 4930		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 4931
 4932	pairwise = !!mac_addr;
 4933	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 4934		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 4935
 4936		if (kt != NL80211_KEYTYPE_GROUP &&
 4937		    kt != NL80211_KEYTYPE_PAIRWISE)
 4938			return -EINVAL;
 4939		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
 4940	}
 4941
 4942	if (!rdev->ops->get_key)
 4943		return -EOPNOTSUPP;
 4944
 4945	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
 4946		return -ENOENT;
 4947
 4948	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 4949	if (!msg)
 4950		return -ENOMEM;
 4951
 4952	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
 4953			     NL80211_CMD_NEW_KEY);
 4954	if (!hdr)
 4955		goto nla_put_failure;
 4956
 4957	cookie.msg = msg;
 4958	cookie.idx = key_idx;
 4959
 4960	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 4961	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
 4962		goto nla_put_failure;
 4963	if (mac_addr &&
 4964	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
 4965		goto nla_put_failure;
 4966
 4967	err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
 4968	if (err)
 4969		goto free_msg;
 4970
 4971	err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
 4972			   &cookie, get_key_callback);
 4973
 4974	if (err)
 4975		goto free_msg;
 4976
 4977	if (cookie.error)
 4978		goto nla_put_failure;
 4979
 4980	genlmsg_end(msg, hdr);
 4981	return genlmsg_reply(msg, info);
 4982
 4983 nla_put_failure:
 4984	err = -ENOBUFS;
 4985 free_msg:
 4986	nlmsg_free(msg);
 4987	return err;
 4988}
 4989
 4990static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
 4991{
 4992	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 4993	struct key_parse key;
 4994	int err;
 4995	struct net_device *dev = info->user_ptr[1];
 4996	int link_id = nl80211_link_id_or_invalid(info->attrs);
 4997	struct wireless_dev *wdev = dev->ieee80211_ptr;
 4998
 4999	err = nl80211_parse_key(info, &key);
 5000	if (err)
 5001		return err;
 5002
 5003	if (key.idx < 0)
 5004		return -EINVAL;
 5005
 5006	/* Only support setting default key and
 5007	 * Extended Key ID action NL80211_KEY_SET_TX.
 5008	 */
 5009	if (!key.def && !key.defmgmt && !key.defbeacon &&
 5010	    !(key.p.mode == NL80211_KEY_SET_TX))
 5011		return -EINVAL;
 5012
 5013	if (key.def) {
 5014		if (!rdev->ops->set_default_key)
 5015			return -EOPNOTSUPP;
 5016
 5017		err = nl80211_key_allowed(wdev);
 5018		if (err)
 5019			return err;
 5020
 5021		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
 5022		if (err)
 5023			return err;
 5024
 5025		err = rdev_set_default_key(rdev, dev, link_id, key.idx,
 5026					   key.def_uni, key.def_multi);
 5027
 5028		if (err)
 5029			return err;
 5030
 5031#ifdef CONFIG_CFG80211_WEXT
 5032		wdev->wext.default_key = key.idx;
 5033#endif
 5034		return 0;
 5035	} else if (key.defmgmt) {
 5036		if (key.def_uni || !key.def_multi)
 5037			return -EINVAL;
 5038
 5039		if (!rdev->ops->set_default_mgmt_key)
 5040			return -EOPNOTSUPP;
 5041
 5042		err = nl80211_key_allowed(wdev);
 5043		if (err)
 5044			return err;
 5045
 5046		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
 5047		if (err)
 5048			return err;
 5049
 5050		err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
 5051		if (err)
 5052			return err;
 5053
 5054#ifdef CONFIG_CFG80211_WEXT
 5055		wdev->wext.default_mgmt_key = key.idx;
 5056#endif
 5057		return 0;
 5058	} else if (key.defbeacon) {
 5059		if (key.def_uni || !key.def_multi)
 5060			return -EINVAL;
 5061
 5062		if (!rdev->ops->set_default_beacon_key)
 5063			return -EOPNOTSUPP;
 5064
 5065		err = nl80211_key_allowed(wdev);
 5066		if (err)
 5067			return err;
 5068
 5069		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
 5070		if (err)
 5071			return err;
 5072
 5073		return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
 5074	} else if (key.p.mode == NL80211_KEY_SET_TX &&
 5075		   wiphy_ext_feature_isset(&rdev->wiphy,
 5076					   NL80211_EXT_FEATURE_EXT_KEY_ID)) {
 5077		u8 *mac_addr = NULL;
 5078
 5079		if (info->attrs[NL80211_ATTR_MAC])
 5080			mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 5081
 5082		if (!mac_addr || key.idx < 0 || key.idx > 1)
 5083			return -EINVAL;
 5084
 5085		err = nl80211_validate_key_link_id(info, wdev, link_id, true);
 5086		if (err)
 5087			return err;
 5088
 5089		return rdev_add_key(rdev, dev, link_id, key.idx,
 5090				    NL80211_KEYTYPE_PAIRWISE,
 5091				    mac_addr, &key.p);
 5092	}
 5093
 5094	return -EINVAL;
 5095}
 5096
 5097static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
 5098{
 5099	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 5100	int err;
 5101	struct net_device *dev = info->user_ptr[1];
 5102	struct key_parse key;
 5103	const u8 *mac_addr = NULL;
 5104	int link_id = nl80211_link_id_or_invalid(info->attrs);
 5105	struct wireless_dev *wdev = dev->ieee80211_ptr;
 5106
 5107	err = nl80211_parse_key(info, &key);
 5108	if (err)
 5109		return err;
 5110
 5111	if (!key.p.key) {
 5112		GENL_SET_ERR_MSG(info, "no key");
 5113		return -EINVAL;
 5114	}
 5115
 5116	if (info->attrs[NL80211_ATTR_MAC])
 5117		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 5118
 5119	if (key.type == -1) {
 5120		if (mac_addr)
 5121			key.type = NL80211_KEYTYPE_PAIRWISE;
 5122		else
 5123			key.type = NL80211_KEYTYPE_GROUP;
 5124	}
 5125
 5126	/* for now */
 5127	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
 5128	    key.type != NL80211_KEYTYPE_GROUP) {
 5129		GENL_SET_ERR_MSG(info, "key type not pairwise or group");
 5130		return -EINVAL;
 5131	}
 5132
 5133	if (key.type == NL80211_KEYTYPE_GROUP &&
 5134	    info->attrs[NL80211_ATTR_VLAN_ID])
 5135		key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
 5136
 5137	if (!rdev->ops->add_key)
 5138		return -EOPNOTSUPP;
 5139
 5140	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
 5141					   key.type == NL80211_KEYTYPE_PAIRWISE,
 5142					   mac_addr)) {
 5143		GENL_SET_ERR_MSG(info, "key setting validation failed");
 5144		return -EINVAL;
 5145	}
 5146
 5147	err = nl80211_key_allowed(wdev);
 5148	if (err)
 5149		GENL_SET_ERR_MSG(info, "key not allowed");
 5150
 5151	if (!err)
 5152		err = nl80211_validate_key_link_id(info, wdev, link_id,
 5153				key.type == NL80211_KEYTYPE_PAIRWISE);
 5154
 5155	if (!err) {
 5156		err = rdev_add_key(rdev, dev, link_id, key.idx,
 5157				   key.type == NL80211_KEYTYPE_PAIRWISE,
 5158				    mac_addr, &key.p);
 5159		if (err)
 5160			GENL_SET_ERR_MSG(info, "key addition failed");
 5161	}
 5162
 5163	return err;
 5164}
 5165
 5166static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
 5167{
 5168	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 5169	int err;
 5170	struct net_device *dev = info->user_ptr[1];
 5171	u8 *mac_addr = NULL;
 5172	struct key_parse key;
 5173	int link_id = nl80211_link_id_or_invalid(info->attrs);
 5174	struct wireless_dev *wdev = dev->ieee80211_ptr;
 5175
 5176	err = nl80211_parse_key(info, &key);
 5177	if (err)
 5178		return err;
 5179
 5180	if (info->attrs[NL80211_ATTR_MAC])
 5181		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 5182
 5183	if (key.type == -1) {
 5184		if (mac_addr)
 5185			key.type = NL80211_KEYTYPE_PAIRWISE;
 5186		else
 5187			key.type = NL80211_KEYTYPE_GROUP;
 5188	}
 5189
 5190	/* for now */
 5191	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
 5192	    key.type != NL80211_KEYTYPE_GROUP)
 5193		return -EINVAL;
 5194
 5195	if (!cfg80211_valid_key_idx(rdev, key.idx,
 5196				    key.type == NL80211_KEYTYPE_PAIRWISE))
 5197		return -EINVAL;
 5198
 5199	if (!rdev->ops->del_key)
 5200		return -EOPNOTSUPP;
 5201
 5202	err = nl80211_key_allowed(wdev);
 5203
 5204	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
 5205	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
 5206		err = -ENOENT;
 5207
 5208	if (!err)
 5209		err = nl80211_validate_key_link_id(info, wdev, link_id,
 5210				key.type == NL80211_KEYTYPE_PAIRWISE);
 5211
 5212	if (!err)
 5213		err = rdev_del_key(rdev, dev, link_id, key.idx,
 5214				   key.type == NL80211_KEYTYPE_PAIRWISE,
 5215				   mac_addr);
 5216
 5217#ifdef CONFIG_CFG80211_WEXT
 5218	if (!err) {
 5219		if (key.idx == wdev->wext.default_key)
 5220			wdev->wext.default_key = -1;
 5221		else if (key.idx == wdev->wext.default_mgmt_key)
 5222			wdev->wext.default_mgmt_key = -1;
 5223	}
 5224#endif
 5225
 5226	return err;
 5227}
 5228
 5229/* This function returns an error or the number of nested attributes */
 5230static int validate_acl_mac_addrs(struct nlattr *nl_attr)
 5231{
 5232	struct nlattr *attr;
 5233	int n_entries = 0, tmp;
 5234
 5235	nla_for_each_nested(attr, nl_attr, tmp) {
 5236		if (nla_len(attr) != ETH_ALEN)
 5237			return -EINVAL;
 5238
 5239		n_entries++;
 5240	}
 5241
 5242	return n_entries;
 5243}
 5244
 5245/*
 5246 * This function parses ACL information and allocates memory for ACL data.
 5247 * On successful return, the calling function is responsible to free the
 5248 * ACL buffer returned by this function.
 5249 */
 5250static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
 5251						struct genl_info *info)
 5252{
 5253	enum nl80211_acl_policy acl_policy;
 5254	struct nlattr *attr;
 5255	struct cfg80211_acl_data *acl;
 5256	int i = 0, n_entries, tmp;
 5257
 5258	if (!wiphy->max_acl_mac_addrs)
 5259		return ERR_PTR(-EOPNOTSUPP);
 5260
 5261	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
 5262		return ERR_PTR(-EINVAL);
 5263
 5264	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
 5265	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
 5266	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
 5267		return ERR_PTR(-EINVAL);
 5268
 5269	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
 5270		return ERR_PTR(-EINVAL);
 5271
 5272	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
 5273	if (n_entries < 0)
 5274		return ERR_PTR(n_entries);
 5275
 5276	if (n_entries > wiphy->max_acl_mac_addrs)
 5277		return ERR_PTR(-EOPNOTSUPP);
 5278
 5279	acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
 5280	if (!acl)
 5281		return ERR_PTR(-ENOMEM);
 5282	acl->n_acl_entries = n_entries;
 5283
 5284	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
 5285		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
 5286		i++;
 5287	}
 5288	acl->acl_policy = acl_policy;
 5289
 5290	return acl;
 5291}
 5292
 5293static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
 5294{
 5295	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 5296	struct net_device *dev = info->user_ptr[1];
 5297	struct cfg80211_acl_data *acl;
 5298	int err;
 5299
 5300	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 5301	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 5302		return -EOPNOTSUPP;
 5303
 5304	if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
 5305		return -EINVAL;
 5306
 5307	acl = parse_acl_data(&rdev->wiphy, info);
 5308	if (IS_ERR(acl))
 5309		return PTR_ERR(acl);
 5310
 5311	err = rdev_set_mac_acl(rdev, dev, acl);
 5312
 5313	kfree(acl);
 5314
 5315	return err;
 5316}
 5317
 5318static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
 5319			   u8 *rates, u8 rates_len)
 5320{
 5321	u8 i;
 5322	u32 mask = 0;
 5323
 5324	for (i = 0; i < rates_len; i++) {
 5325		int rate = (rates[i] & 0x7f) * 5;
 5326		int ridx;
 5327
 5328		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
 5329			struct ieee80211_rate *srate =
 5330				&sband->bitrates[ridx];
 5331			if (rate == srate->bitrate) {
 5332				mask |= 1 << ridx;
 5333				break;
 5334			}
 5335		}
 5336		if (ridx == sband->n_bitrates)
 5337			return 0; /* rate not found */
 5338	}
 5339
 5340	return mask;
 5341}
 5342
 5343static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
 5344			       u8 *rates, u8 rates_len,
 5345			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
 5346{
 5347	u8 i;
 5348
 5349	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
 5350
 5351	for (i = 0; i < rates_len; i++) {
 5352		int ridx, rbit;
 5353
 5354		ridx = rates[i] / 8;
 5355		rbit = BIT(rates[i] % 8);
 5356
 5357		/* check validity */
 5358		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
 5359			return false;
 5360
 5361		/* check availability */
 5362		ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
 5363		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
 5364			mcs[ridx] |= rbit;
 5365		else
 5366			return false;
 5367	}
 5368
 5369	return true;
 5370}
 5371
 5372static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
 5373{
 5374	u16 mcs_mask = 0;
 5375
 5376	switch (vht_mcs_map) {
 5377	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
 5378		break;
 5379	case IEEE80211_VHT_MCS_SUPPORT_0_7:
 5380		mcs_mask = 0x00FF;
 5381		break;
 5382	case IEEE80211_VHT_MCS_SUPPORT_0_8:
 5383		mcs_mask = 0x01FF;
 5384		break;
 5385	case IEEE80211_VHT_MCS_SUPPORT_0_9:
 5386		mcs_mask = 0x03FF;
 5387		break;
 5388	default:
 5389		break;
 5390	}
 5391
 5392	return mcs_mask;
 5393}
 5394
 5395static void vht_build_mcs_mask(u16 vht_mcs_map,
 5396			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
 5397{
 5398	u8 nss;
 5399
 5400	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
 5401		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
 5402		vht_mcs_map >>= 2;
 5403	}
 5404}
 5405
 5406static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
 5407			     struct nl80211_txrate_vht *txrate,
 5408			     u16 mcs[NL80211_VHT_NSS_MAX])
 5409{
 5410	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
 5411	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
 5412	u8 i;
 5413
 5414	if (!sband->vht_cap.vht_supported)
 5415		return false;
 5416
 5417	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
 5418
 5419	/* Build vht_mcs_mask from VHT capabilities */
 5420	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
 5421
 5422	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
 5423		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
 5424			mcs[i] = txrate->mcs[i];
 5425		else
 5426			return false;
 5427	}
 5428
 5429	return true;
 5430}
 5431
 5432static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
 5433{
 5434	switch (he_mcs_map) {
 5435	case IEEE80211_HE_MCS_NOT_SUPPORTED:
 5436		return 0;
 5437	case IEEE80211_HE_MCS_SUPPORT_0_7:
 5438		return 0x00FF;
 5439	case IEEE80211_HE_MCS_SUPPORT_0_9:
 5440		return 0x03FF;
 5441	case IEEE80211_HE_MCS_SUPPORT_0_11:
 5442		return 0xFFF;
 5443	default:
 5444		break;
 5445	}
 5446	return 0;
 5447}
 5448
 5449static void he_build_mcs_mask(u16 he_mcs_map,
 5450			      u16 he_mcs_mask[NL80211_HE_NSS_MAX])
 5451{
 5452	u8 nss;
 5453
 5454	for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
 5455		he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
 5456		he_mcs_map >>= 2;
 5457	}
 5458}
 5459
 5460static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
 5461			   const struct ieee80211_sta_he_cap *he_cap)
 5462{
 5463	struct net_device *dev = info->user_ptr[1];
 5464	struct wireless_dev *wdev = dev->ieee80211_ptr;
 5465	struct cfg80211_chan_def *chandef;
 5466	__le16 tx_mcs;
 5467
 5468	chandef = wdev_chandef(wdev, link_id);
 5469	if (!chandef) {
 5470		/*
 5471		 * This is probably broken, but we never maintained
 5472		 * a chandef in these cases, so it always was.
 5473		 */
 5474		return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
 5475	}
 5476
 5477	switch (chandef->width) {
 5478	case NL80211_CHAN_WIDTH_80P80:
 5479		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
 5480		break;
 5481	case NL80211_CHAN_WIDTH_160:
 5482		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
 5483		break;
 5484	default:
 5485		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
 5486		break;
 5487	}
 5488
 5489	return le16_to_cpu(tx_mcs);
 5490}
 5491
 5492static bool he_set_mcs_mask(struct genl_info *info,
 5493			    struct wireless_dev *wdev,
 5494			    struct ieee80211_supported_band *sband,
 5495			    struct nl80211_txrate_he *txrate,
 5496			    u16 mcs[NL80211_HE_NSS_MAX],
 5497			    unsigned int link_id)
 5498{
 5499	const struct ieee80211_sta_he_cap *he_cap;
 5500	u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
 5501	u16 tx_mcs_map = 0;
 5502	u8 i;
 5503
 5504	he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
 5505	if (!he_cap)
 5506		return false;
 5507
 5508	memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
 5509
 5510	tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
 5511
 5512	/* Build he_mcs_mask from HE capabilities */
 5513	he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
 5514
 5515	for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
 5516		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
 5517			mcs[i] = txrate->mcs[i];
 5518		else
 5519			return false;
 5520	}
 5521
 5522	return true;
 5523}
 5524
 5525static void eht_build_mcs_mask(struct genl_info *info,
 5526			       const struct ieee80211_sta_eht_cap *eht_cap,
 5527			       u8 mcs_nss_len, u16 *mcs_mask)
 5528{
 5529	struct net_device *dev = info->user_ptr[1];
 5530	struct wireless_dev *wdev = dev->ieee80211_ptr;
 5531	u8 nss, mcs_7 = 0, mcs_9 = 0, mcs_11 = 0, mcs_13 = 0;
 5532	unsigned int link_id = nl80211_link_id(info->attrs);
 5533
 5534	if (mcs_nss_len == 4) {
 5535		const struct ieee80211_eht_mcs_nss_supp_20mhz_only *mcs =
 5536					&eht_cap->eht_mcs_nss_supp.only_20mhz;
 5537
 5538		mcs_7 = u8_get_bits(mcs->rx_tx_mcs7_max_nss,
 5539				    IEEE80211_EHT_MCS_NSS_TX);
 5540		mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
 5541				    IEEE80211_EHT_MCS_NSS_TX);
 5542		mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
 5543				     IEEE80211_EHT_MCS_NSS_TX);
 5544		mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
 5545				     IEEE80211_EHT_MCS_NSS_TX);
 5546
 5547	} else {
 5548		const struct ieee80211_eht_mcs_nss_supp_bw *mcs;
 5549		enum nl80211_chan_width width;
 5550
 5551		switch (wdev->iftype) {
 5552		case NL80211_IFTYPE_ADHOC:
 5553			width = wdev->u.ibss.chandef.width;
 5554			break;
 5555		case NL80211_IFTYPE_MESH_POINT:
 5556			width = wdev->u.mesh.chandef.width;
 5557			break;
 5558		case NL80211_IFTYPE_OCB:
 5559			width = wdev->u.ocb.chandef.width;
 5560			break;
 5561		default:
 5562			if (wdev->valid_links)
 5563				width = wdev->links[link_id].ap.chandef.width;
 5564			else
 5565				width = wdev->u.ap.preset_chandef.width;
 5566			break;
 5567		}
 5568
 5569		switch (width) {
 5570		case NL80211_CHAN_WIDTH_320:
 5571			mcs = &eht_cap->eht_mcs_nss_supp.bw._320;
 5572			break;
 5573		case NL80211_CHAN_WIDTH_160:
 5574			mcs = &eht_cap->eht_mcs_nss_supp.bw._160;
 5575			break;
 5576		default:
 5577			mcs = &eht_cap->eht_mcs_nss_supp.bw._80;
 5578			break;
 5579		}
 5580
 5581		mcs_7 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
 5582				    IEEE80211_EHT_MCS_NSS_TX);
 5583		mcs_9 = u8_get_bits(mcs->rx_tx_mcs9_max_nss,
 5584				    IEEE80211_EHT_MCS_NSS_TX);
 5585		mcs_11 = u8_get_bits(mcs->rx_tx_mcs11_max_nss,
 5586				     IEEE80211_EHT_MCS_NSS_TX);
 5587		mcs_13 = u8_get_bits(mcs->rx_tx_mcs13_max_nss,
 5588				     IEEE80211_EHT_MCS_NSS_TX);
 5589	}
 5590
 5591	/* Enable MCS 14 for NSS 0 */
 5592	if (eht_cap->eht_cap_elem.phy_cap_info[6] &
 5593	    IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP)
 5594		mcs_mask[0] |= 0x4000;
 5595
 5596	/* Enable MCS 15 for NSS 0 */
 5597	mcs_mask[0] |= 0x8000;
 5598
 5599	for (nss = 0; nss < NL80211_EHT_NSS_MAX; nss++) {
 5600		if (!mcs_7)
 5601			continue;
 5602		mcs_mask[nss] |= 0x00FF;
 5603		mcs_7--;
 5604
 5605		if (!mcs_9)
 5606			continue;
 5607		mcs_mask[nss] |= 0x0300;
 5608		mcs_9--;
 5609
 5610		if (!mcs_11)
 5611			continue;
 5612		mcs_mask[nss] |= 0x0C00;
 5613		mcs_11--;
 5614
 5615		if (!mcs_13)
 5616			continue;
 5617		mcs_mask[nss] |= 0x3000;
 5618		mcs_13--;
 5619	}
 5620}
 5621
 5622static bool eht_set_mcs_mask(struct genl_info *info, struct wireless_dev *wdev,
 5623			     struct ieee80211_supported_band *sband,
 5624			     struct nl80211_txrate_eht *txrate,
 5625			     u16 mcs[NL80211_EHT_NSS_MAX])
 5626{
 5627	const struct ieee80211_sta_he_cap *he_cap;
 5628	const struct ieee80211_sta_eht_cap *eht_cap;
 5629	u16 tx_mcs_mask[NL80211_EHT_NSS_MAX] = { 0 };
 5630	u8 i, mcs_nss_len;
 5631
 5632	he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
 5633	if (!he_cap)
 5634		return false;
 5635
 5636	eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
 5637	if (!eht_cap)
 5638		return false;
 5639
 5640	/* Checks for MCS 14 */
 5641	if (txrate->mcs[0] & 0x4000) {
 5642		if (sband->band != NL80211_BAND_6GHZ)
 5643			return false;
 5644
 5645		if (!(eht_cap->eht_cap_elem.phy_cap_info[6] &
 5646		      IEEE80211_EHT_PHY_CAP6_EHT_DUP_6GHZ_SUPP))
 5647			return false;
 5648	}
 5649
 5650	mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 5651						 &eht_cap->eht_cap_elem,
 5652						 wdev->iftype ==
 5653							NL80211_IFTYPE_STATION);
 5654
 5655	if (mcs_nss_len == 3) {
 5656		/* Supported iftypes for setting non-20 MHZ only EHT MCS */
 5657		switch (wdev->iftype) {
 5658		case NL80211_IFTYPE_ADHOC:
 5659		case NL80211_IFTYPE_AP:
 5660		case NL80211_IFTYPE_P2P_GO:
 5661		case NL80211_IFTYPE_MESH_POINT:
 5662		case NL80211_IFTYPE_OCB:
 5663			break;
 5664		default:
 5665			return false;
 5666		}
 5667	}
 5668
 5669	/* Build eht_mcs_mask from EHT and HE capabilities */
 5670	eht_build_mcs_mask(info, eht_cap, mcs_nss_len, tx_mcs_mask);
 5671
 5672	memset(mcs, 0, sizeof(u16) * NL80211_EHT_NSS_MAX);
 5673	for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
 5674		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
 5675			mcs[i] = txrate->mcs[i];
 5676		else
 5677			return false;
 5678	}
 5679
 5680	return true;
 5681}
 5682
 5683static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
 5684					 struct nlattr *attrs[],
 5685					 enum nl80211_attrs attr,
 5686					 struct cfg80211_bitrate_mask *mask,
 5687					 struct net_device *dev,
 5688					 bool default_all_enabled,
 5689					 unsigned int link_id)
 5690{
 5691	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
 5692	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 5693	struct wireless_dev *wdev = dev->ieee80211_ptr;
 5694	int rem, i;
 5695	struct nlattr *tx_rates;
 5696	struct ieee80211_supported_band *sband;
 5697	u16 vht_tx_mcs_map, he_tx_mcs_map;
 5698
 5699	memset(mask, 0, sizeof(*mask));
 5700	/* Default to all rates enabled */
 5701	for (i = 0; i < NUM_NL80211_BANDS; i++) {
 5702		const struct ieee80211_sta_he_cap *he_cap;
 5703		const struct ieee80211_sta_eht_cap *eht_cap;
 5704		u8 mcs_nss_len;
 5705
 5706		if (!default_all_enabled)
 5707			break;
 5708
 5709		sband = rdev->wiphy.bands[i];
 5710
 5711		if (!sband)
 5712			continue;
 5713
 5714		mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
 5715		memcpy(mask->control[i].ht_mcs,
 5716		       sband->ht_cap.mcs.rx_mask,
 5717		       sizeof(mask->control[i].ht_mcs));
 5718
 5719		if (sband->vht_cap.vht_supported) {
 5720			vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
 5721			vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
 5722		}
 5723
 5724		he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
 5725		if (!he_cap)
 5726			continue;
 5727
 5728		he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
 5729		he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
 5730
 5731		mask->control[i].he_gi = 0xFF;
 5732		mask->control[i].he_ltf = 0xFF;
 5733
 5734		eht_cap = ieee80211_get_eht_iftype_cap(sband, wdev->iftype);
 5735		if (!eht_cap)
 5736			continue;
 5737
 5738		mcs_nss_len = ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
 5739							 &eht_cap->eht_cap_elem,
 5740							 wdev->iftype ==
 5741							 NL80211_IFTYPE_STATION);
 5742
 5743		eht_build_mcs_mask(info, eht_cap, mcs_nss_len,
 5744				   mask->control[i].eht_mcs);
 5745
 5746		mask->control[i].eht_gi = 0xFF;
 5747		mask->control[i].eht_ltf = 0xFF;
 5748	}
 5749
 5750	/* if no rates are given set it back to the defaults */
 5751	if (!attrs[attr])
 5752		goto out;
 5753
 5754	/* The nested attribute uses enum nl80211_band as the index. This maps
 5755	 * directly to the enum nl80211_band values used in cfg80211.
 5756	 */
 5757	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
 5758	nla_for_each_nested(tx_rates, attrs[attr], rem) {
 5759		enum nl80211_band band = nla_type(tx_rates);
 5760		int err;
 5761
 5762		if (band < 0 || band >= NUM_NL80211_BANDS)
 5763			return -EINVAL;
 5764		sband = rdev->wiphy.bands[band];
 5765		if (sband == NULL)
 5766			return -EINVAL;
 5767		err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
 5768						  tx_rates,
 5769						  nl80211_txattr_policy,
 5770						  info->extack);
 5771		if (err)
 5772			return err;
 5773		if (tb[NL80211_TXRATE_LEGACY]) {
 5774			mask->control[band].legacy = rateset_to_mask(
 5775				sband,
 5776				nla_data(tb[NL80211_TXRATE_LEGACY]),
 5777				nla_len(tb[NL80211_TXRATE_LEGACY]));
 5778			if ((mask->control[band].legacy == 0) &&
 5779			    nla_len(tb[NL80211_TXRATE_LEGACY]))
 5780				return -EINVAL;
 5781		}
 5782		if (tb[NL80211_TXRATE_HT]) {
 5783			if (!ht_rateset_to_mask(
 5784					sband,
 5785					nla_data(tb[NL80211_TXRATE_HT]),
 5786					nla_len(tb[NL80211_TXRATE_HT]),
 5787					mask->control[band].ht_mcs))
 5788				return -EINVAL;
 5789		}
 5790
 5791		if (tb[NL80211_TXRATE_VHT]) {
 5792			if (!vht_set_mcs_mask(
 5793					sband,
 5794					nla_data(tb[NL80211_TXRATE_VHT]),
 5795					mask->control[band].vht_mcs))
 5796				return -EINVAL;
 5797		}
 5798
 5799		if (tb[NL80211_TXRATE_GI]) {
 5800			mask->control[band].gi =
 5801				nla_get_u8(tb[NL80211_TXRATE_GI]);
 5802			if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
 5803				return -EINVAL;
 5804		}
 5805		if (tb[NL80211_TXRATE_HE] &&
 5806		    !he_set_mcs_mask(info, wdev, sband,
 5807				     nla_data(tb[NL80211_TXRATE_HE]),
 5808				     mask->control[band].he_mcs,
 5809				     link_id))
 5810			return -EINVAL;
 5811
 5812		if (tb[NL80211_TXRATE_HE_GI])
 5813			mask->control[band].he_gi =
 5814				nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
 5815		if (tb[NL80211_TXRATE_HE_LTF])
 5816			mask->control[band].he_ltf =
 5817				nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
 5818
 5819		if (tb[NL80211_TXRATE_EHT] &&
 5820		    !eht_set_mcs_mask(info, wdev, sband,
 5821				      nla_data(tb[NL80211_TXRATE_EHT]),
 5822				      mask->control[band].eht_mcs))
 5823			return -EINVAL;
 5824
 5825		if (tb[NL80211_TXRATE_EHT_GI])
 5826			mask->control[band].eht_gi =
 5827				nla_get_u8(tb[NL80211_TXRATE_EHT_GI]);
 5828		if (tb[NL80211_TXRATE_EHT_LTF])
 5829			mask->control[band].eht_ltf =
 5830				nla_get_u8(tb[NL80211_TXRATE_EHT_LTF]);
 5831
 5832		if (mask->control[band].legacy == 0) {
 5833			/* don't allow empty legacy rates if HT, VHT, HE or EHT
 5834			 * are not even supported.
 5835			 */
 5836			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
 5837			      rdev->wiphy.bands[band]->vht_cap.vht_supported ||
 5838			      ieee80211_get_he_iftype_cap(sband, wdev->iftype) ||
 5839			      ieee80211_get_eht_iftype_cap(sband, wdev->iftype)))
 5840				return -EINVAL;
 5841
 5842			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
 5843				if (mask->control[band].ht_mcs[i])
 5844					goto out;
 5845
 5846			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
 5847				if (mask->control[band].vht_mcs[i])
 5848					goto out;
 5849
 5850			for (i = 0; i < NL80211_HE_NSS_MAX; i++)
 5851				if (mask->control[band].he_mcs[i])
 5852					goto out;
 5853
 5854			for (i = 0; i < NL80211_EHT_NSS_MAX; i++)
 5855				if (mask->control[band].eht_mcs[i])
 5856					goto out;
 5857
 5858			/* legacy and mcs rates may not be both empty */
 5859			return -EINVAL;
 5860		}
 5861	}
 5862
 5863out:
 5864	return 0;
 5865}
 5866
 5867static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
 5868				   enum nl80211_band band,
 5869				   struct cfg80211_bitrate_mask *beacon_rate)
 5870{
 5871	u32 count_ht, count_vht, count_he, count_eht, i;
 5872	u32 rate = beacon_rate->control[band].legacy;
 5873
 5874	/* Allow only one rate */
 5875	if (hweight32(rate) > 1)
 5876		return -EINVAL;
 5877
 5878	count_ht = 0;
 5879	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
 5880		if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
 5881			return -EINVAL;
 5882		} else if (beacon_rate->control[band].ht_mcs[i]) {
 5883			count_ht++;
 5884			if (count_ht > 1)
 5885				return -EINVAL;
 5886		}
 5887		if (count_ht && rate)
 5888			return -EINVAL;
 5889	}
 5890
 5891	count_vht = 0;
 5892	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
 5893		if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
 5894			return -EINVAL;
 5895		} else if (beacon_rate->control[band].vht_mcs[i]) {
 5896			count_vht++;
 5897			if (count_vht > 1)
 5898				return -EINVAL;
 5899		}
 5900		if (count_vht && rate)
 5901			return -EINVAL;
 5902	}
 5903
 5904	count_he = 0;
 5905	for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
 5906		if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
 5907			return -EINVAL;
 5908		} else if (beacon_rate->control[band].he_mcs[i]) {
 5909			count_he++;
 5910			if (count_he > 1)
 5911				return -EINVAL;
 5912		}
 5913		if (count_he && rate)
 5914			return -EINVAL;
 5915	}
 5916
 5917	count_eht = 0;
 5918	for (i = 0; i < NL80211_EHT_NSS_MAX; i++) {
 5919		if (hweight16(beacon_rate->control[band].eht_mcs[i]) > 1) {
 5920			return -EINVAL;
 5921		} else if (beacon_rate->control[band].eht_mcs[i]) {
 5922			count_eht++;
 5923			if (count_eht > 1)
 5924				return -EINVAL;
 5925		}
 5926		if (count_eht && rate)
 5927			return -EINVAL;
 5928	}
 5929
 5930	if ((count_ht && count_vht && count_he && count_eht) ||
 5931	    (!rate && !count_ht && !count_vht && !count_he && !count_eht))
 5932		return -EINVAL;
 5933
 5934	if (rate &&
 5935	    !wiphy_ext_feature_isset(&rdev->wiphy,
 5936				     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
 5937		return -EINVAL;
 5938	if (count_ht &&
 5939	    !wiphy_ext_feature_isset(&rdev->wiphy,
 5940				     NL80211_EXT_FEATURE_BEACON_RATE_HT))
 5941		return -EINVAL;
 5942	if (count_vht &&
 5943	    !wiphy_ext_feature_isset(&rdev->wiphy,
 5944				     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
 5945		return -EINVAL;
 5946	if (count_he &&
 5947	    !wiphy_ext_feature_isset(&rdev->wiphy,
 5948				     NL80211_EXT_FEATURE_BEACON_RATE_HE))
 5949		return -EINVAL;
 5950
 5951	if (count_eht &&
 5952	    !wiphy_ext_feature_isset(&rdev->wiphy,
 5953				     NL80211_EXT_FEATURE_BEACON_RATE_EHT))
 5954		return -EINVAL;
 5955
 5956	return 0;
 5957}
 5958
 5959static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
 5960				       struct net_device *dev,
 5961				       unsigned int link_id,
 5962				       struct nlattr *attrs,
 5963				       struct cfg80211_mbssid_config *config,
 5964				       u8 num_elems)
 5965{
 5966	struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
 5967	int tx_link_id = -1;
 5968
 5969	if (!wiphy->mbssid_max_interfaces)
 5970		return -EOPNOTSUPP;
 5971
 5972	if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
 5973			     NULL) ||
 5974	    !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
 5975		return -EINVAL;
 5976
 5977	config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
 5978	if (config->ema) {
 5979		if (!wiphy->ema_max_profile_periodicity)
 5980			return -EOPNOTSUPP;
 5981
 5982		if (num_elems > wiphy->ema_max_profile_periodicity)
 5983			return -EINVAL;
 5984	}
 5985
 5986	config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
 5987	if (config->index >= wiphy->mbssid_max_interfaces ||
 5988	    (!config->index && !num_elems))
 5989		return -EINVAL;
 5990
 5991	if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID])
 5992		tx_link_id = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_TX_LINK_ID]);
 5993
 5994	if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
 5995		u32 tx_ifindex =
 5996			nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
 5997
 5998		if ((!config->index && tx_ifindex != dev->ifindex) ||
 5999		    (config->index && tx_ifindex == dev->ifindex))
 6000			return -EINVAL;
 6001
 6002		if (tx_ifindex != dev->ifindex) {
 6003			struct net_device *tx_netdev =
 6004				dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
 6005
 6006			if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
 6007			    tx_netdev->ieee80211_ptr->wiphy != wiphy ||
 6008			    tx_netdev->ieee80211_ptr->iftype !=
 6009							NL80211_IFTYPE_AP) {
 6010				dev_put(tx_netdev);
 6011				return -EINVAL;
 6012			}
 6013
 6014			config->tx_wdev = tx_netdev->ieee80211_ptr;
 6015			/* Caller should call dev_put(config->tx_wdev) from this point */
 6016
 6017			if (config->tx_wdev->valid_links) {
 6018				if (tx_link_id == -1 ||
 6019				    !(config->tx_wdev->valid_links & BIT(tx_link_id)))
 6020					return -ENOLINK;
 6021
 6022				config->tx_link_id = tx_link_id;
 6023			}
 6024		} else {
 6025			if (tx_link_id >= 0 && tx_link_id != link_id)
 6026				return -EINVAL;
 6027
 6028			config->tx_wdev = dev->ieee80211_ptr;
 6029		}
 6030	} else if (!config->index) {
 6031		if (tx_link_id >= 0 && tx_link_id != link_id)
 6032			return -EINVAL;
 6033
 6034		config->tx_wdev = dev->ieee80211_ptr;
 6035	} else {
 6036		return -EINVAL;
 6037	}
 6038
 6039	return 0;
 6040}
 6041
 6042static struct cfg80211_mbssid_elems *
 6043nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
 6044{
 6045	struct nlattr *nl_elems;
 6046	struct cfg80211_mbssid_elems *elems;
 6047	int rem_elems;
 6048	u8 i = 0, num_elems = 0;
 6049
 6050	if (!wiphy->mbssid_max_interfaces)
 6051		return ERR_PTR(-EINVAL);
 6052
 6053	nla_for_each_nested(nl_elems, attrs, rem_elems) {
 6054		if (num_elems >= 255)
 6055			return ERR_PTR(-EINVAL);
 6056		num_elems++;
 6057	}
 6058
 6059	elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
 6060	if (!elems)
 6061		return ERR_PTR(-ENOMEM);
 6062	elems->cnt = num_elems;
 6063
 6064	nla_for_each_nested(nl_elems, attrs, rem_elems) {
 6065		elems->elem[i].data = nla_data(nl_elems);
 6066		elems->elem[i].len = nla_len(nl_elems);
 6067		i++;
 6068	}
 6069	return elems;
 6070}
 6071
 6072static struct cfg80211_rnr_elems *
 6073nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
 6074			struct netlink_ext_ack *extack)
 6075{
 6076	struct nlattr *nl_elems;
 6077	struct cfg80211_rnr_elems *elems;
 6078	int rem_elems;
 6079	u8 i = 0, num_elems = 0;
 6080
 6081	nla_for_each_nested(nl_elems, attrs, rem_elems) {
 6082		int ret;
 6083
 6084		ret = validate_ie_attr(nl_elems, extack);
 6085		if (ret)
 6086			return ERR_PTR(ret);
 6087
 6088		num_elems++;
 6089	}
 6090
 6091	elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
 6092	if (!elems)
 6093		return ERR_PTR(-ENOMEM);
 6094	elems->cnt = num_elems;
 6095
 6096	nla_for_each_nested(nl_elems, attrs, rem_elems) {
 6097		elems->elem[i].data = nla_data(nl_elems);
 6098		elems->elem[i].len = nla_len(nl_elems);
 6099		i++;
 6100	}
 6101	return elems;
 6102}
 6103
 6104static int nl80211_parse_he_bss_color(struct nlattr *attrs,
 6105				      struct cfg80211_he_bss_color *he_bss_color)
 6106{
 6107	struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
 6108	int err;
 6109
 6110	err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
 6111			       he_bss_color_policy, NULL);
 6112	if (err)
 6113		return err;
 6114
 6115	if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
 6116		return -EINVAL;
 6117
 6118	he_bss_color->color =
 6119		nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
 6120	he_bss_color->enabled =
 6121		!nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
 6122	he_bss_color->partial =
 6123		nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
 6124
 6125	return 0;
 6126}
 6127
 6128static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
 6129				struct nlattr *attrs[],
 6130				struct cfg80211_beacon_data *bcn,
 6131				struct netlink_ext_ack *extack)
 6132{
 6133	bool haveinfo = false;
 6134	int err;
 6135
 6136	memset(bcn, 0, sizeof(*bcn));
 6137
 6138	bcn->link_id = nl80211_link_id(attrs);
 6139
 6140	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
 6141		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
 6142		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
 6143		if (!bcn->head_len)
 6144			return -EINVAL;
 6145		haveinfo = true;
 6146	}
 6147
 6148	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
 6149		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
 6150		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
 6151		haveinfo = true;
 6152	}
 6153
 6154	if (!haveinfo)
 6155		return -EINVAL;
 6156
 6157	if (attrs[NL80211_ATTR_IE]) {
 6158		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
 6159		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
 6160	}
 6161
 6162	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
 6163		bcn->proberesp_ies =
 6164			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
 6165		bcn->proberesp_ies_len =
 6166			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
 6167	}
 6168
 6169	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
 6170		bcn->assocresp_ies =
 6171			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
 6172		bcn->assocresp_ies_len =
 6173			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
 6174	}
 6175
 6176	if (attrs[NL80211_ATTR_PROBE_RESP]) {
 6177		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
 6178		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
 6179	}
 6180
 6181	if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
 6182		struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
 6183
 6184		err = nla_parse_nested_deprecated(tb,
 6185						  NL80211_FTM_RESP_ATTR_MAX,
 6186						  attrs[NL80211_ATTR_FTM_RESPONDER],
 6187						  NULL, NULL);
 6188		if (err)
 6189			return err;
 6190
 6191		if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
 6192		    wiphy_ext_feature_isset(&rdev->wiphy,
 6193					    NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
 6194			bcn->ftm_responder = 1;
 6195		else
 6196			return -EOPNOTSUPP;
 6197
 6198		if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
 6199			bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
 6200			bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
 6201		}
 6202
 6203		if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
 6204			bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
 6205			bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
 6206		}
 6207	} else {
 6208		bcn->ftm_responder = -1;
 6209	}
 6210
 6211	if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
 6212		err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
 6213						 &bcn->he_bss_color);
 6214		if (err)
 6215			return err;
 6216		bcn->he_bss_color_valid = true;
 6217	}
 6218
 6219	if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
 6220		struct cfg80211_mbssid_elems *mbssid =
 6221			nl80211_parse_mbssid_elems(&rdev->wiphy,
 6222						   attrs[NL80211_ATTR_MBSSID_ELEMS]);
 6223
 6224		if (IS_ERR(mbssid))
 6225			return PTR_ERR(mbssid);
 6226
 6227		bcn->mbssid_ies = mbssid;
 6228
 6229		if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
 6230			struct cfg80211_rnr_elems *rnr =
 6231				nl80211_parse_rnr_elems(&rdev->wiphy,
 6232							attrs[NL80211_ATTR_EMA_RNR_ELEMS],
 6233							extack);
 6234
 6235			if (IS_ERR(rnr))
 6236				return PTR_ERR(rnr);
 6237
 6238			if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
 6239				return -EINVAL;
 6240
 6241			bcn->rnr_ies = rnr;
 6242		}
 6243	}
 6244
 6245	return 0;
 6246}
 6247
 6248static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
 6249				    struct ieee80211_he_obss_pd *he_obss_pd)
 6250{
 6251	struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
 6252	int err;
 6253
 6254	err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
 6255			       he_obss_pd_policy, NULL);
 6256	if (err)
 6257		return err;
 6258
 6259	if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
 6260		return -EINVAL;
 6261
 6262	he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
 6263
 6264	if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
 6265		he_obss_pd->min_offset =
 6266			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
 6267	if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
 6268		he_obss_pd->max_offset =
 6269			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
 6270	if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
 6271		he_obss_pd->non_srg_max_offset =
 6272			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
 6273
 6274	if (he_obss_pd->min_offset > he_obss_pd->max_offset)
 6275		return -EINVAL;
 6276
 6277	if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
 6278		memcpy(he_obss_pd->bss_color_bitmap,
 6279		       nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
 6280		       sizeof(he_obss_pd->bss_color_bitmap));
 6281
 6282	if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
 6283		memcpy(he_obss_pd->partial_bssid_bitmap,
 6284		       nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
 6285		       sizeof(he_obss_pd->partial_bssid_bitmap));
 6286
 6287	he_obss_pd->enable = true;
 6288
 6289	return 0;
 6290}
 6291
 6292static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
 6293					struct nlattr *attrs,
 6294					struct cfg80211_fils_discovery *fd)
 6295{
 6296	struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
 6297	int ret;
 6298
 6299	if (!wiphy_ext_feature_isset(&rdev->wiphy,
 6300				     NL80211_EXT_FEATURE_FILS_DISCOVERY))
 6301		return -EINVAL;
 6302
 6303	ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
 6304			       NULL, NULL);
 6305	if (ret)
 6306		return ret;
 6307
 6308	if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
 6309	    !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
 6310	    !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
 6311		fd->update = true;
 6312		return 0;
 6313	}
 6314
 6315	if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
 6316	    !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
 6317	    !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
 6318		return -EINVAL;
 6319
 6320	fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
 6321	fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
 6322	fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
 6323	fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
 6324	fd->update = true;
 6325	return 0;
 6326}
 6327
 6328static int
 6329nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
 6330				     struct nlattr *attrs,
 6331				     struct cfg80211_unsol_bcast_probe_resp *presp)
 6332{
 6333	struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
 6334	int ret;
 6335
 6336	if (!wiphy_ext_feature_isset(&rdev->wiphy,
 6337				     NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
 6338		return -EINVAL;
 6339
 6340	ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
 6341			       attrs, NULL, NULL);
 6342	if (ret)
 6343		return ret;
 6344
 6345	if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
 6346	    !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
 6347		presp->update = true;
 6348		return 0;
 6349	}
 6350
 6351	if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
 6352	    !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
 6353		return -EINVAL;
 6354
 6355	presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
 6356	presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
 6357	presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
 6358	presp->update = true;
 6359	return 0;
 6360}
 6361
 6362static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
 6363					    const struct element *rates)
 6364{
 6365	int i;
 6366
 6367	if (!rates)
 6368		return;
 6369
 6370	for (i = 0; i < rates->datalen; i++) {
 6371		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
 6372			params->ht_required = true;
 6373		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
 6374			params->vht_required = true;
 6375		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
 6376			params->he_required = true;
 6377		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
 6378			params->sae_h2e_required = true;
 6379	}
 6380}
 6381
 6382/*
 6383 * Since the nl80211 API didn't include, from the beginning, attributes about
 6384 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
 6385 * benefit of drivers that rebuild IEs in the firmware.
 6386 */
 6387static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
 6388{
 6389	const struct cfg80211_beacon_data *bcn = &params->beacon;
 6390	size_t ies_len = bcn->tail_len;
 6391	const u8 *ies = bcn->tail;
 6392	const struct element *rates;
 6393	const struct element *cap;
 6394
 6395	rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
 6396	nl80211_check_ap_rate_selectors(params, rates);
 6397
 6398	rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
 6399	nl80211_check_ap_rate_selectors(params, rates);
 6400
 6401	cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
 6402	if (cap && cap->datalen >= sizeof(*params->ht_cap))
 6403		params->ht_cap = (void *)cap->data;
 6404	cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
 6405	if (cap && cap->datalen >= sizeof(*params->vht_cap))
 6406		params->vht_cap = (void *)cap->data;
 6407	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
 6408	if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
 6409		params->he_cap = (void *)(cap->data + 1);
 6410	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
 6411	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
 6412		params->he_oper = (void *)(cap->data + 1);
 6413	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
 6414	if (cap) {
 6415		if (!cap->datalen)
 6416			return -EINVAL;
 6417		params->eht_cap = (void *)(cap->data + 1);
 6418		if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
 6419						(const u8 *)params->eht_cap,
 6420						cap->datalen - 1, true))
 6421			return -EINVAL;
 6422	}
 6423	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
 6424	if (cap) {
 6425		if (!cap->datalen)
 6426			return -EINVAL;
 6427		params->eht_oper = (void *)(cap->data + 1);
 6428		if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
 6429						cap->datalen - 1))
 6430			return -EINVAL;
 6431	}
 6432	return 0;
 6433}
 6434
 6435static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
 6436				   struct cfg80211_ap_settings *params)
 6437{
 6438	struct wireless_dev *wdev;
 6439
 6440	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 6441		if (wdev->iftype != NL80211_IFTYPE_AP &&
 6442		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
 6443			continue;
 6444
 6445		if (!wdev->u.ap.preset_chandef.chan)
 6446			continue;
 6447
 6448		params->chandef = wdev->u.ap.preset_chandef;
 6449		return true;
 6450	}
 6451
 6452	return false;
 6453}
 6454
 6455static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
 6456				    enum nl80211_auth_type auth_type,
 6457				    enum nl80211_commands cmd)
 6458{
 6459	if (auth_type > NL80211_AUTHTYPE_MAX)
 6460		return false;
 6461
 6462	switch (cmd) {
 6463	case NL80211_CMD_AUTHENTICATE:
 6464		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
 6465		    auth_type == NL80211_AUTHTYPE_SAE)
 6466			return false;
 6467		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 6468					     NL80211_EXT_FEATURE_FILS_STA) &&
 6469		    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
 6470		     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
 6471		     auth_type == NL80211_AUTHTYPE_FILS_PK))
 6472			return false;
 6473		return true;
 6474	case NL80211_CMD_CONNECT:
 6475		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
 6476		    !wiphy_ext_feature_isset(&rdev->wiphy,
 6477					     NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
 6478		    auth_type == NL80211_AUTHTYPE_SAE)
 6479			return false;
 6480
 6481		/* FILS with SK PFS or PK not supported yet */
 6482		if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
 6483		    auth_type == NL80211_AUTHTYPE_FILS_PK)
 6484			return false;
 6485		if (!wiphy_ext_feature_isset(
 6486			    &rdev->wiphy,
 6487			    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
 6488		    auth_type == NL80211_AUTHTYPE_FILS_SK)
 6489			return false;
 6490		return true;
 6491	case NL80211_CMD_START_AP:
 6492		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 6493					     NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
 6494		    auth_type == NL80211_AUTHTYPE_SAE)
 6495			return false;
 6496		/* FILS not supported yet */
 6497		if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
 6498		    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
 6499		    auth_type == NL80211_AUTHTYPE_FILS_PK)
 6500			return false;
 6501		return true;
 6502	default:
 6503		return false;
 6504	}
 6505}
 6506
 6507static void nl80211_send_ap_started(struct wireless_dev *wdev,
 6508				    unsigned int link_id)
 6509{
 6510	struct wiphy *wiphy = wdev->wiphy;
 6511	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
 6512	struct sk_buff *msg;
 6513	void *hdr;
 6514
 6515	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 6516	if (!msg)
 6517		return;
 6518
 6519	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
 6520	if (!hdr)
 6521		goto out;
 6522
 6523	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
 6524	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
 6525	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
 6526			      NL80211_ATTR_PAD) ||
 6527	    (wdev->u.ap.ssid_len &&
 6528	     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
 6529		     wdev->u.ap.ssid)) ||
 6530	    (wdev->valid_links &&
 6531	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
 6532		goto out;
 6533
 6534	genlmsg_end(msg, hdr);
 6535
 6536	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
 6537				NL80211_MCGRP_MLME, GFP_KERNEL);
 6538	return;
 6539out:
 6540	nlmsg_free(msg);
 6541}
 6542
 6543static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
 6544{
 6545	struct ieee80211_channel *channel = params->chandef.chan;
 6546
 6547	if ((params->he_cap ||  params->he_oper) &&
 6548	    (channel->flags & IEEE80211_CHAN_NO_HE))
 6549		return -EOPNOTSUPP;
 6550
 6551	if ((params->eht_cap || params->eht_oper) &&
 6552	    (channel->flags & IEEE80211_CHAN_NO_EHT))
 6553		return -EOPNOTSUPP;
 6554
 6555	return 0;
 6556}
 6557
 6558static int
 6559nl80211_parse_s1g_short_beacon(struct cfg80211_registered_device *rdev,
 6560			       struct nlattr *attrs,
 6561			       struct cfg80211_s1g_short_beacon *sb)
 6562{
 6563	struct nlattr *tb[NL80211_S1G_SHORT_BEACON_ATTR_MAX + 1];
 6564	int ret;
 6565
 6566	if (!rdev->wiphy.bands[NL80211_BAND_S1GHZ])
 6567		return -EINVAL;
 6568
 6569	ret = nla_parse_nested(tb, NL80211_S1G_SHORT_BEACON_ATTR_MAX, attrs,
 6570			       NULL, NULL);
 6571	if (ret)
 6572		return ret;
 6573
 6574	/* Short beacon tail is optional (i.e might only include the TIM) */
 6575	if (!tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD])
 6576		return -EINVAL;
 6577
 6578	sb->short_head = nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
 6579	sb->short_head_len = nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_HEAD]);
 6580	sb->short_tail_len = 0;
 6581
 6582	if (tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]) {
 6583		sb->short_tail =
 6584			nla_data(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
 6585		sb->short_tail_len =
 6586			nla_len(tb[NL80211_S1G_SHORT_BEACON_ATTR_TAIL]);
 6587	}
 6588
 6589	sb->update = true;
 6590	return 0;
 6591}
 6592
 6593static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
 6594{
 6595	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 6596	struct cfg80211_beaconing_check_config beacon_check = {};
 6597	unsigned int link_id = nl80211_link_id(info->attrs);
 6598	struct net_device *dev = info->user_ptr[1];
 6599	struct wireless_dev *wdev = dev->ieee80211_ptr;
 6600	struct cfg80211_ap_settings *params;
 6601	int err;
 6602
 6603	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 6604	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 6605		return -EOPNOTSUPP;
 6606
 6607	if (!rdev->ops->start_ap)
 6608		return -EOPNOTSUPP;
 6609
 6610	if (wdev->links[link_id].cac_started)
 6611		return -EBUSY;
 6612
 6613	if (wdev->links[link_id].ap.beacon_interval)
 6614		return -EALREADY;
 6615
 6616	/* these are required for START_AP */
 6617	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
 6618	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
 6619	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
 6620		return -EINVAL;
 6621
 6622	if (info->attrs[NL80211_ATTR_SMPS_MODE] &&
 6623	    nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]) != NL80211_SMPS_OFF)
 6624		return -EOPNOTSUPP;
 6625
 6626	params = kzalloc(sizeof(*params), GFP_KERNEL);
 6627	if (!params)
 6628		return -ENOMEM;
 6629
 6630	err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
 6631				   info->extack);
 6632	if (err)
 6633		goto out;
 6634
 6635	params->beacon_interval =
 6636		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
 6637	params->dtim_period =
 6638		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
 6639
 6640	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
 6641					   params->beacon_interval);
 6642	if (err)
 6643		goto out;
 6644
 6645	/*
 6646	 * In theory, some of these attributes should be required here
 6647	 * but since they were not used when the command was originally
 6648	 * added, keep them optional for old user space programs to let
 6649	 * them continue to work with drivers that do not need the
 6650	 * additional information -- drivers must check!
 6651	 */
 6652	if (info->attrs[NL80211_ATTR_SSID]) {
 6653		params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
 6654		params->ssid_len =
 6655			nla_len(info->attrs[NL80211_ATTR_SSID]);
 6656		if (params->ssid_len == 0) {
 6657			err = -EINVAL;
 6658			goto out;
 6659		}
 6660
 6661		if (wdev->u.ap.ssid_len &&
 6662		    (wdev->u.ap.ssid_len != params->ssid_len ||
 6663		     memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
 6664			/* require identical SSID for MLO */
 6665			err = -EINVAL;
 6666			goto out;
 6667		}
 6668	} else if (wdev->valid_links) {
 6669		/* require SSID for MLO */
 6670		err = -EINVAL;
 6671		goto out;
 6672	}
 6673
 6674	if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
 6675		params->hidden_ssid = nla_get_u32(
 6676			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
 6677
 6678	params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
 6679
 6680	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
 6681		params->auth_type = nla_get_u32(
 6682			info->attrs[NL80211_ATTR_AUTH_TYPE]);
 6683		if (!nl80211_valid_auth_type(rdev, params->auth_type,
 6684					     NL80211_CMD_START_AP)) {
 6685			err = -EINVAL;
 6686			goto out;
 6687		}
 6688	} else
 6689		params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
 6690
 6691	err = nl80211_crypto_settings(rdev, info, &params->crypto,
 6692				      NL80211_MAX_NR_CIPHER_SUITES);
 6693	if (err)
 6694		goto out;
 6695
 6696	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
 6697		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
 6698			err = -EOPNOTSUPP;
 6699			goto out;
 6700		}
 6701		params->inactivity_timeout = nla_get_u16(
 6702			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
 6703	}
 6704
 6705	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
 6706		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
 6707			err = -EINVAL;
 6708			goto out;
 6709		}
 6710		params->p2p_ctwindow =
 6711			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
 6712		if (params->p2p_ctwindow != 0 &&
 6713		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
 6714			err = -EINVAL;
 6715			goto out;
 6716		}
 6717	}
 6718
 6719	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
 6720		u8 tmp;
 6721
 6722		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
 6723			err = -EINVAL;
 6724			goto out;
 6725		}
 6726		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
 6727		params->p2p_opp_ps = tmp;
 6728		if (params->p2p_opp_ps != 0 &&
 6729		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
 6730			err = -EINVAL;
 6731			goto out;
 6732		}
 6733	}
 6734
 6735	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
 6736		err = nl80211_parse_chandef(rdev, info, &params->chandef);
 6737		if (err)
 6738			goto out;
 6739	} else if (wdev->valid_links) {
 6740		/* with MLD need to specify the channel configuration */
 6741		err = -EINVAL;
 6742		goto out;
 6743	} else if (wdev->u.ap.preset_chandef.chan) {
 6744		params->chandef = wdev->u.ap.preset_chandef;
 6745	} else if (!nl80211_get_ap_channel(rdev, params)) {
 6746		err = -EINVAL;
 6747		goto out;
 6748	}
 6749
 6750	beacon_check.iftype = wdev->iftype;
 6751	beacon_check.relax = true;
 6752	beacon_check.reg_power =
 6753		cfg80211_get_6ghz_power_type(params->beacon.tail,
 6754					     params->beacon.tail_len, 0);
 6755	if (!cfg80211_reg_check_beaconing(&rdev->wiphy, &params->chandef,
 6756					  &beacon_check)) {
 6757		err = -EINVAL;
 6758		goto out;
 6759	}
 6760
 6761	if (info->attrs[NL80211_ATTR_TX_RATES]) {
 6762		err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
 6763						    NL80211_ATTR_TX_RATES,
 6764						    &params->beacon_rate,
 6765						    dev, false, link_id);
 6766		if (err)
 6767			goto out;
 6768
 6769		err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
 6770					      &params->beacon_rate);
 6771		if (err)
 6772			goto out;
 6773	}
 6774
 6775	params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
 6776	if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
 6777		err = -EOPNOTSUPP;
 6778		goto out;
 6779	}
 6780
 6781	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
 6782		params->acl = parse_acl_data(&rdev->wiphy, info);
 6783		if (IS_ERR(params->acl)) {
 6784			err = PTR_ERR(params->acl);
 6785			params->acl = NULL;
 6786			goto out;
 6787		}
 6788	}
 6789
 6790	params->twt_responder =
 6791		    nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
 6792
 6793	if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
 6794		err = nl80211_parse_he_obss_pd(
 6795					info->attrs[NL80211_ATTR_HE_OBSS_PD],
 6796					&params->he_obss_pd);
 6797		if (err)
 6798			goto out;
 6799	}
 6800
 6801	if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
 6802		err = nl80211_parse_fils_discovery(rdev,
 6803						   info->attrs[NL80211_ATTR_FILS_DISCOVERY],
 6804						   &params->fils_discovery);
 6805		if (err)
 6806			goto out;
 6807	}
 6808
 6809	if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
 6810		err = nl80211_parse_unsol_bcast_probe_resp(
 6811			rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
 6812			&params->unsol_bcast_probe_resp);
 6813		if (err)
 6814			goto out;
 6815	}
 6816
 6817	if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
 6818		err = nl80211_parse_mbssid_config(&rdev->wiphy, dev, link_id,
 6819						  info->attrs[NL80211_ATTR_MBSSID_CONFIG],
 6820						  &params->mbssid_config,
 6821						  params->beacon.mbssid_ies ?
 6822							params->beacon.mbssid_ies->cnt :
 6823							0);
 6824		if (err)
 6825			goto out;
 6826	}
 6827
 6828	if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
 6829		err = -EINVAL;
 6830		goto out;
 6831	}
 6832
 6833	if (info->attrs[NL80211_ATTR_S1G_SHORT_BEACON]) {
 6834		if (!info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]) {
 6835			err = -EINVAL;
 6836			goto out;
 6837		}
 6838
 6839		params->s1g_long_beacon_period = nla_get_u8(
 6840			info->attrs[NL80211_ATTR_S1G_LONG_BEACON_PERIOD]);
 6841
 6842		err = nl80211_parse_s1g_short_beacon(
 6843			rdev, info->attrs[NL80211_ATTR_S1G_SHORT_BEACON],
 6844			&params->s1g_short_beacon);
 6845		if (err)
 6846			goto out;
 6847	}
 6848
 6849	err = nl80211_calculate_ap_params(params);
 6850	if (err)
 6851		goto out;
 6852
 6853	err = nl80211_validate_ap_phy_operation(params);
 6854	if (err)
 6855		goto out;
 6856
 6857	if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
 6858		params->flags = nla_get_u32(
 6859			info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
 6860	else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
 6861		params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
 6862
 6863	if (wdev->conn_owner_nlportid &&
 6864	    info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
 6865	    wdev->conn_owner_nlportid != info->snd_portid) {
 6866		err = -EINVAL;
 6867		goto out;
 6868	}
 6869
 6870	/* FIXME: validate MLO/link-id against driver capabilities */
 6871
 6872	err = rdev_start_ap(rdev, dev, params);
 6873	if (!err) {
 6874		wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
 6875		wdev->links[link_id].ap.chandef = params->chandef;
 6876		wdev->u.ap.ssid_len = params->ssid_len;
 6877		memcpy(wdev->u.ap.ssid, params->ssid,
 6878		       params->ssid_len);
 6879
 6880		if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
 6881			wdev->conn_owner_nlportid = info->snd_portid;
 6882
 6883		nl80211_send_ap_started(wdev, link_id);
 6884	}
 6885out:
 6886	kfree(params->acl);
 6887	kfree(params->beacon.mbssid_ies);
 6888	if (params->mbssid_config.tx_wdev &&
 6889	    params->mbssid_config.tx_wdev->netdev &&
 6890	    params->mbssid_config.tx_wdev->netdev != dev)
 6891		dev_put(params->mbssid_config.tx_wdev->netdev);
 6892	kfree(params->beacon.rnr_ies);
 6893	kfree(params);
 6894
 6895	return err;
 6896}
 6897
 6898static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
 6899{
 6900	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 6901	struct cfg80211_beaconing_check_config beacon_check = {};
 6902	unsigned int link_id = nl80211_link_id(info->attrs);
 6903	struct net_device *dev = info->user_ptr[1];
 6904	struct wireless_dev *wdev = dev->ieee80211_ptr;
 6905	struct cfg80211_ap_update *params;
 6906	struct nlattr *attr;
 6907	int err;
 6908
 6909	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 6910	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 6911		return -EOPNOTSUPP;
 6912
 6913	if (!rdev->ops->change_beacon)
 6914		return -EOPNOTSUPP;
 6915
 6916	if (!wdev->links[link_id].ap.beacon_interval)
 6917		return -EINVAL;
 6918
 6919	params = kzalloc(sizeof(*params), GFP_KERNEL);
 6920	if (!params)
 6921		return -ENOMEM;
 6922
 6923	err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
 6924				   info->extack);
 6925	if (err)
 6926		goto out;
 6927
 6928	/* recheck beaconing is permitted with possibly changed power type */
 6929	beacon_check.iftype = wdev->iftype;
 6930	beacon_check.relax = true;
 6931	beacon_check.reg_power =
 6932		cfg80211_get_6ghz_power_type(params->beacon.tail,
 6933					     params->beacon.tail_len, 0);
 6934	if (!cfg80211_reg_check_beaconing(&rdev->wiphy,
 6935					  &wdev->links[link_id].ap.chandef,
 6936					  &beacon_check)) {
 6937		err = -EINVAL;
 6938		goto out;
 6939	}
 6940
 6941	attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
 6942	if (attr) {
 6943		err = nl80211_parse_fils_discovery(rdev, attr,
 6944						   &params->fils_discovery);
 6945		if (err)
 6946			goto out;
 6947	}
 6948
 6949	attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
 6950	if (attr) {
 6951		err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
 6952							   &params->unsol_bcast_probe_resp);
 6953		if (err)
 6954			goto out;
 6955	}
 6956
 6957	attr = info->attrs[NL80211_ATTR_S1G_SHORT_BEACON];
 6958	if (attr) {
 6959		err = nl80211_parse_s1g_short_beacon(rdev, attr,
 6960						     &params->s1g_short_beacon);
 6961		if (err)
 6962			goto out;
 6963	}
 6964
 6965	err = rdev_change_beacon(rdev, dev, params);
 6966
 6967out:
 6968	kfree(params->beacon.mbssid_ies);
 6969	kfree(params->beacon.rnr_ies);
 6970	kfree(params);
 6971	return err;
 6972}
 6973
 6974static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
 6975{
 6976	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 6977	unsigned int link_id = nl80211_link_id(info->attrs);
 6978	struct net_device *dev = info->user_ptr[1];
 6979
 6980	return cfg80211_stop_ap(rdev, dev, link_id, false);
 6981}
 6982
 6983static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
 6984	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
 6985	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
 6986	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
 6987	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
 6988	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
 6989	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
 6990};
 6991
 6992static int parse_station_flags(struct genl_info *info,
 6993			       enum nl80211_iftype iftype,
 6994			       struct station_parameters *params)
 6995{
 6996	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
 6997	struct nlattr *nla;
 6998	int flag;
 6999
 7000	/*
 7001	 * Try parsing the new attribute first so userspace
 7002	 * can specify both for older kernels.
 7003	 */
 7004	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
 7005	if (nla) {
 7006		struct nl80211_sta_flag_update *sta_flags;
 7007
 7008		sta_flags = nla_data(nla);
 7009		params->sta_flags_mask = sta_flags->mask;
 7010		params->sta_flags_set = sta_flags->set;
 7011		params->sta_flags_set &= params->sta_flags_mask;
 7012		if ((params->sta_flags_mask |
 7013		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
 7014			return -EINVAL;
 7015		return 0;
 7016	}
 7017
 7018	/* if present, parse the old attribute */
 7019
 7020	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
 7021	if (!nla)
 7022		return 0;
 7023
 7024	if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
 7025		return -EINVAL;
 7026
 7027	/*
 7028	 * Only allow certain flags for interface types so that
 7029	 * other attributes are silently ignored. Remember that
 7030	 * this is backward compatibility code with old userspace
 7031	 * and shouldn't be hit in other cases anyway.
 7032	 */
 7033	switch (iftype) {
 7034	case NL80211_IFTYPE_AP:
 7035	case NL80211_IFTYPE_AP_VLAN:
 7036	case NL80211_IFTYPE_P2P_GO:
 7037		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
 7038					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
 7039					 BIT(NL80211_STA_FLAG_WME) |
 7040					 BIT(NL80211_STA_FLAG_MFP);
 7041		break;
 7042	case NL80211_IFTYPE_P2P_CLIENT:
 7043	case NL80211_IFTYPE_STATION:
 7044		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
 7045					 BIT(NL80211_STA_FLAG_TDLS_PEER);
 7046		break;
 7047	case NL80211_IFTYPE_MESH_POINT:
 7048		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
 7049					 BIT(NL80211_STA_FLAG_MFP) |
 7050					 BIT(NL80211_STA_FLAG_AUTHORIZED);
 7051		break;
 7052	default:
 7053		return -EINVAL;
 7054	}
 7055
 7056	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
 7057		if (flags[flag]) {
 7058			params->sta_flags_set |= (1<<flag);
 7059
 7060			/* no longer support new API additions in old API */
 7061			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
 7062				return -EINVAL;
 7063		}
 7064	}
 7065
 7066	return 0;
 7067}
 7068
 7069bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
 7070{
 7071	struct nlattr *rate;
 7072	u32 bitrate;
 7073	u16 bitrate_compat;
 7074	enum nl80211_rate_info rate_flg;
 7075
 7076	rate = nla_nest_start_noflag(msg, attr);
 7077	if (!rate)
 7078		return false;
 7079
 7080	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
 7081	bitrate = cfg80211_calculate_bitrate(info);
 7082	/* report 16-bit bitrate only if we can */
 7083	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
 7084	if (bitrate > 0 &&
 7085	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
 7086		return false;
 7087	if (bitrate_compat > 0 &&
 7088	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
 7089		return false;
 7090
 7091	switch (info->bw) {
 7092	case RATE_INFO_BW_1:
 7093		rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
 7094		break;
 7095	case RATE_INFO_BW_2:
 7096		rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
 7097		break;
 7098	case RATE_INFO_BW_4:
 7099		rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
 7100		break;
 7101	case RATE_INFO_BW_5:
 7102		rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
 7103		break;
 7104	case RATE_INFO_BW_8:
 7105		rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
 7106		break;
 7107	case RATE_INFO_BW_10:
 7108		rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
 7109		break;
 7110	case RATE_INFO_BW_16:
 7111		rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
 7112		break;
 7113	default:
 7114		WARN_ON(1);
 7115		fallthrough;
 7116	case RATE_INFO_BW_20:
 7117		rate_flg = 0;
 7118		break;
 7119	case RATE_INFO_BW_40:
 7120		rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
 7121		break;
 7122	case RATE_INFO_BW_80:
 7123		rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
 7124		break;
 7125	case RATE_INFO_BW_160:
 7126		rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
 7127		break;
 7128	case RATE_INFO_BW_HE_RU:
 7129		rate_flg = 0;
 7130		WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
 7131		break;
 7132	case RATE_INFO_BW_320:
 7133		rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
 7134		break;
 7135	case RATE_INFO_BW_EHT_RU:
 7136		rate_flg = 0;
 7137		WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
 7138		break;
 7139	}
 7140
 7141	if (rate_flg && nla_put_flag(msg, rate_flg))
 7142		return false;
 7143
 7144	if (info->flags & RATE_INFO_FLAGS_MCS) {
 7145		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
 7146			return false;
 7147		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
 7148		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
 7149			return false;
 7150	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
 7151		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
 7152			return false;
 7153		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
 7154			return false;
 7155		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
 7156		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
 7157			return false;
 7158	} else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
 7159		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
 7160			return false;
 7161		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
 7162			return false;
 7163		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
 7164			return false;
 7165		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
 7166			return false;
 7167		if (info->bw == RATE_INFO_BW_HE_RU &&
 7168		    nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
 7169			       info->he_ru_alloc))
 7170			return false;
 7171	} else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
 7172		if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
 7173			return false;
 7174		if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
 7175			return false;
 7176		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
 7177		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
 7178			return false;
 7179	} else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
 7180		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
 7181			return false;
 7182		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
 7183			return false;
 7184		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
 7185			return false;
 7186		if (info->bw == RATE_INFO_BW_EHT_RU &&
 7187		    nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
 7188			       info->eht_ru_alloc))
 7189			return false;
 7190	}
 7191
 7192	nla_nest_end(msg, rate);
 7193	return true;
 7194}
 7195
 7196static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
 7197			       int id)
 7198{
 7199	void *attr;
 7200	int i = 0;
 7201
 7202	if (!mask)
 7203		return true;
 7204
 7205	attr = nla_nest_start_noflag(msg, id);
 7206	if (!attr)
 7207		return false;
 7208
 7209	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
 7210		if (!(mask & BIT(i)))
 7211			continue;
 7212
 7213		if (nla_put_u8(msg, i, signal[i]))
 7214			return false;
 7215	}
 7216
 7217	nla_nest_end(msg, attr);
 7218
 7219	return true;
 7220}
 7221
 7222static int nl80211_fill_link_station(struct sk_buff *msg,
 7223				     struct cfg80211_registered_device *rdev,
 7224				     struct link_station_info *link_sinfo)
 7225{
 7226	struct nlattr *bss_param, *link_sinfoattr;
 7227
 7228#define PUT_LINK_SINFO(attr, memb, type) do {				\
 7229	BUILD_BUG_ON(sizeof(type) == sizeof(u64));			\
 7230	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
 7231	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
 7232			     link_sinfo->memb))				\
 7233		goto nla_put_failure;					\
 7234	} while (0)
 7235#define PUT_LINK_SINFO_U64(attr, memb) do {				\
 7236	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
 7237	    nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,		\
 7238			      link_sinfo->memb, NL80211_STA_INFO_PAD))	\
 7239		goto nla_put_failure;					\
 7240	} while (0)
 7241
 7242	link_sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
 7243	if (!link_sinfoattr)
 7244		goto nla_put_failure;
 7245
 7246	PUT_LINK_SINFO(INACTIVE_TIME, inactive_time, u32);
 7247
 7248	if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
 7249			     BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
 7250	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
 7251			(u32)link_sinfo->rx_bytes))
 7252		goto nla_put_failure;
 7253
 7254	if (link_sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
 7255			     BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
 7256	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
 7257			(u32)link_sinfo->tx_bytes))
 7258		goto nla_put_failure;
 7259
 7260	PUT_LINK_SINFO_U64(RX_BYTES64, rx_bytes);
 7261	PUT_LINK_SINFO_U64(TX_BYTES64, tx_bytes);
 7262	PUT_LINK_SINFO_U64(RX_DURATION, rx_duration);
 7263	PUT_LINK_SINFO_U64(TX_DURATION, tx_duration);
 7264
 7265	if (wiphy_ext_feature_isset(&rdev->wiphy,
 7266				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
 7267		PUT_LINK_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
 7268
 7269	switch (rdev->wiphy.signal_type) {
 7270	case CFG80211_SIGNAL_TYPE_MBM:
 7271		PUT_LINK_SINFO(SIGNAL, signal, u8);
 7272		PUT_LINK_SINFO(SIGNAL_AVG, signal_avg, u8);
 7273		break;
 7274	default:
 7275		break;
 7276	}
 7277	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
 7278		if (!nl80211_put_signal(msg, link_sinfo->chains,
 7279					link_sinfo->chain_signal,
 7280					NL80211_STA_INFO_CHAIN_SIGNAL))
 7281			goto nla_put_failure;
 7282	}
 7283	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
 7284		if (!nl80211_put_signal(msg, link_sinfo->chains,
 7285					link_sinfo->chain_signal_avg,
 7286					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
 7287			goto nla_put_failure;
 7288	}
 7289	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
 7290		if (!nl80211_put_sta_rate(msg, &link_sinfo->txrate,
 7291					  NL80211_STA_INFO_TX_BITRATE))
 7292			goto nla_put_failure;
 7293	}
 7294	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
 7295		if (!nl80211_put_sta_rate(msg, &link_sinfo->rxrate,
 7296					  NL80211_STA_INFO_RX_BITRATE))
 7297			goto nla_put_failure;
 7298	}
 7299
 7300	PUT_LINK_SINFO(RX_PACKETS, rx_packets, u32);
 7301	PUT_LINK_SINFO(TX_PACKETS, tx_packets, u32);
 7302	PUT_LINK_SINFO(TX_RETRIES, tx_retries, u32);
 7303	PUT_LINK_SINFO(TX_FAILED, tx_failed, u32);
 7304	PUT_LINK_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
 7305	PUT_LINK_SINFO(BEACON_LOSS, beacon_loss_count, u32);
 7306
 7307	if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
 7308		bss_param = nla_nest_start_noflag(msg,
 7309						  NL80211_STA_INFO_BSS_PARAM);
 7310		if (!bss_param)
 7311			goto nla_put_failure;
 7312
 7313		if (((link_sinfo->bss_param.flags &
 7314		      BSS_PARAM_FLAGS_CTS_PROT) &&
 7315		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
 7316		    ((link_sinfo->bss_param.flags &
 7317		      BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
 7318		     nla_put_flag(msg,
 7319				  NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
 7320		    ((link_sinfo->bss_param.flags &
 7321		      BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
 7322		     nla_put_flag(msg,
 7323				  NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
 7324		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
 7325			       link_sinfo->bss_param.dtim_period) ||
 7326		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
 7327				link_sinfo->bss_param.beacon_interval))
 7328			goto nla_put_failure;
 7329
 7330		nla_nest_end(msg, bss_param);
 7331	}
 7332
 7333	PUT_LINK_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
 7334	PUT_LINK_SINFO_U64(BEACON_RX, rx_beacon);
 7335	PUT_LINK_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
 7336	PUT_LINK_SINFO(RX_MPDUS, rx_mpdu_count, u32);
 7337	PUT_LINK_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
 7338	if (wiphy_ext_feature_isset(&rdev->wiphy,
 7339				    NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
 7340		PUT_LINK_SINFO(ACK_SIGNAL, ack_signal, u8);
 7341		PUT_LINK_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
 7342	}
 7343
 7344#undef PUT_LINK_SINFO
 7345#undef PUT_LINK_SINFO_U64
 7346
 7347	if (link_sinfo->pertid) {
 7348		struct nlattr *tidsattr;
 7349		int tid;
 7350
 7351		tidsattr = nla_nest_start_noflag(msg,
 7352						 NL80211_STA_INFO_TID_STATS);
 7353		if (!tidsattr)
 7354			goto nla_put_failure;
 7355
 7356		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
 7357			struct cfg80211_tid_stats *tidstats;
 7358			struct nlattr *tidattr;
 7359
 7360			tidstats = &link_sinfo->pertid[tid];
 7361
 7362			if (!tidstats->filled)
 7363				continue;
 7364
 7365			tidattr = nla_nest_start_noflag(msg, tid + 1);
 7366			if (!tidattr)
 7367				goto nla_put_failure;
 7368
 7369#define PUT_TIDVAL_U64(attr, memb) do {					\
 7370	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
 7371	    nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,		\
 7372			      tidstats->memb, NL80211_TID_STATS_PAD))	\
 7373		goto nla_put_failure;					\
 7374	} while (0)
 7375
 7376			PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
 7377			PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
 7378			PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
 7379			PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
 7380
 7381#undef PUT_TIDVAL_U64
 7382			if ((tidstats->filled &
 7383			     BIT(NL80211_TID_STATS_TXQ_STATS)) &&
 7384			    !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
 7385						   NL80211_TID_STATS_TXQ_STATS))
 7386				goto nla_put_failure;
 7387
 7388			nla_nest_end(msg, tidattr);
 7389		}
 7390
 7391		nla_nest_end(msg, tidsattr);
 7392	}
 7393
 7394	nla_nest_end(msg, link_sinfoattr);
 7395	return 0;
 7396
 7397nla_put_failure:
 7398	return -EMSGSIZE;
 7399}
 7400
 7401static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
 7402				u32 seq, int flags,
 7403				struct cfg80211_registered_device *rdev,
 7404				struct net_device *dev,
 7405				const u8 *mac_addr, struct station_info *sinfo,
 7406				bool link_stats)
 7407{
 7408	void *hdr;
 7409	struct nlattr *sinfoattr, *bss_param;
 7410	struct link_station_info *link_sinfo;
 7411	struct nlattr *links, *link;
 7412	int link_id;
 7413
 7414	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
 7415	if (!hdr) {
 7416		cfg80211_sinfo_release_content(sinfo);
 7417		return -1;
 7418	}
 7419
 7420	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 7421	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
 7422	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
 7423		goto nla_put_failure;
 7424
 7425	sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
 7426	if (!sinfoattr)
 7427		goto nla_put_failure;
 7428
 7429#define PUT_SINFO(attr, memb, type) do {				\
 7430	BUILD_BUG_ON(sizeof(type) == sizeof(u64));			\
 7431	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
 7432	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
 7433			     sinfo->memb))				\
 7434		goto nla_put_failure;					\
 7435	} while (0)
 7436#define PUT_SINFO_U64(attr, memb) do {					\
 7437	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
 7438	    nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,		\
 7439			      sinfo->memb, NL80211_STA_INFO_PAD))	\
 7440		goto nla_put_failure;					\
 7441	} while (0)
 7442
 7443	PUT_SINFO(CONNECTED_TIME, connected_time, u32);
 7444	PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
 7445	PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
 7446
 7447	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
 7448			     BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
 7449	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
 7450			(u32)sinfo->rx_bytes))
 7451		goto nla_put_failure;
 7452
 7453	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
 7454			     BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
 7455	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
 7456			(u32)sinfo->tx_bytes))
 7457		goto nla_put_failure;
 7458
 7459	PUT_SINFO_U64(RX_BYTES64, rx_bytes);
 7460	PUT_SINFO_U64(TX_BYTES64, tx_bytes);
 7461	PUT_SINFO_U64(RX_DURATION, rx_duration);
 7462	PUT_SINFO_U64(TX_DURATION, tx_duration);
 7463
 7464	if (wiphy_ext_feature_isset(&rdev->wiphy,
 7465				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
 7466		PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
 7467
 7468	switch (rdev->wiphy.signal_type) {
 7469	case CFG80211_SIGNAL_TYPE_MBM:
 7470		PUT_SINFO(SIGNAL, signal, u8);
 7471		PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
 7472		break;
 7473	default:
 7474		break;
 7475	}
 7476	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
 7477		if (!nl80211_put_signal(msg, sinfo->chains,
 7478					sinfo->chain_signal,
 7479					NL80211_STA_INFO_CHAIN_SIGNAL))
 7480			goto nla_put_failure;
 7481	}
 7482	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
 7483		if (!nl80211_put_signal(msg, sinfo->chains,
 7484					sinfo->chain_signal_avg,
 7485					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
 7486			goto nla_put_failure;
 7487	}
 7488	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
 7489		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
 7490					  NL80211_STA_INFO_TX_BITRATE))
 7491			goto nla_put_failure;
 7492	}
 7493	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
 7494		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
 7495					  NL80211_STA_INFO_RX_BITRATE))
 7496			goto nla_put_failure;
 7497	}
 7498
 7499	PUT_SINFO(RX_PACKETS, rx_packets, u32);
 7500	PUT_SINFO(TX_PACKETS, tx_packets, u32);
 7501	PUT_SINFO(TX_RETRIES, tx_retries, u32);
 7502	PUT_SINFO(TX_FAILED, tx_failed, u32);
 7503	PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
 7504	PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
 7505
 7506	PUT_SINFO(LLID, llid, u16);
 7507	PUT_SINFO(PLID, plid, u16);
 7508	PUT_SINFO(PLINK_STATE, plink_state, u8);
 7509	PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
 7510	PUT_SINFO(LOCAL_PM, local_pm, u32);
 7511	PUT_SINFO(PEER_PM, peer_pm, u32);
 7512	PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
 7513	PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
 7514	PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
 7515	PUT_SINFO_U64(T_OFFSET, t_offset);
 7516
 7517	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
 7518		bss_param = nla_nest_start_noflag(msg,
 7519						  NL80211_STA_INFO_BSS_PARAM);
 7520		if (!bss_param)
 7521			goto nla_put_failure;
 7522
 7523		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
 7524		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
 7525		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
 7526		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
 7527		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
 7528		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
 7529		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
 7530			       sinfo->bss_param.dtim_period) ||
 7531		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
 7532				sinfo->bss_param.beacon_interval))
 7533			goto nla_put_failure;
 7534
 7535		nla_nest_end(msg, bss_param);
 7536	}
 7537	if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
 7538	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
 7539		    sizeof(struct nl80211_sta_flag_update),
 7540		    &sinfo->sta_flags))
 7541		goto nla_put_failure;
 7542
 7543	PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
 7544	PUT_SINFO_U64(BEACON_RX, rx_beacon);
 7545	PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
 7546	PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
 7547	PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
 7548	if (wiphy_ext_feature_isset(&rdev->wiphy,
 7549				    NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
 7550		PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
 7551		PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
 7552	}
 7553
 7554#undef PUT_SINFO
 7555#undef PUT_SINFO_U64
 7556
 7557	if (sinfo->pertid) {
 7558		struct nlattr *tidsattr;
 7559		int tid;
 7560
 7561		tidsattr = nla_nest_start_noflag(msg,
 7562						 NL80211_STA_INFO_TID_STATS);
 7563		if (!tidsattr)
 7564			goto nla_put_failure;
 7565
 7566		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
 7567			struct cfg80211_tid_stats *tidstats;
 7568			struct nlattr *tidattr;
 7569
 7570			tidstats = &sinfo->pertid[tid];
 7571
 7572			if (!tidstats->filled)
 7573				continue;
 7574
 7575			tidattr = nla_nest_start_noflag(msg, tid + 1);
 7576			if (!tidattr)
 7577				goto nla_put_failure;
 7578
 7579#define PUT_TIDVAL_U64(attr, memb) do {					\
 7580	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
 7581	    nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,		\
 7582			      tidstats->memb, NL80211_TID_STATS_PAD))	\
 7583		goto nla_put_failure;					\
 7584	} while (0)
 7585
 7586			PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
 7587			PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
 7588			PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
 7589			PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
 7590
 7591#undef PUT_TIDVAL_U64
 7592			if ((tidstats->filled &
 7593			     BIT(NL80211_TID_STATS_TXQ_STATS)) &&
 7594			    !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
 7595						   NL80211_TID_STATS_TXQ_STATS))
 7596				goto nla_put_failure;
 7597
 7598			nla_nest_end(msg, tidattr);
 7599		}
 7600
 7601		nla_nest_end(msg, tidsattr);
 7602	}
 7603
 7604	nla_nest_end(msg, sinfoattr);
 7605
 7606	if (sinfo->assoc_req_ies_len &&
 7607	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
 7608		    sinfo->assoc_req_ies))
 7609		goto nla_put_failure;
 7610
 7611	if (sinfo->assoc_resp_ies_len &&
 7612	    nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
 7613		    sinfo->assoc_resp_ies))
 7614		goto nla_put_failure;
 7615
 7616	if (sinfo->mlo_params_valid) {
 7617		if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
 7618			       sinfo->assoc_link_id))
 7619			goto nla_put_failure;
 7620
 7621		if (!is_zero_ether_addr(sinfo->mld_addr) &&
 7622		    nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
 7623			    sinfo->mld_addr))
 7624			goto nla_put_failure;
 7625	}
 7626
 7627	if (link_stats && sinfo->valid_links) {
 7628		links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
 7629		if (!links)
 7630			goto nla_put_failure;
 7631
 7632		for_each_valid_link(sinfo, link_id) {
 7633			link_sinfo = sinfo->links[link_id];
 7634
 7635			if (WARN_ON_ONCE(!link_sinfo))
 7636				continue;
 7637
 7638			if (!is_valid_ether_addr(link_sinfo->addr))
 7639				continue;
 7640
 7641			link = nla_nest_start(msg, link_id + 1);
 7642			if (!link)
 7643				goto nla_put_failure;
 7644
 7645			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
 7646				       link_id))
 7647				goto nla_put_failure;
 7648
 7649			if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
 7650				    link_sinfo->addr))
 7651				goto nla_put_failure;
 7652
 7653			if (nl80211_fill_link_station(msg, rdev, link_sinfo))
 7654				goto nla_put_failure;
 7655
 7656			nla_nest_end(msg, link);
 7657		}
 7658		nla_nest_end(msg, links);
 7659	}
 7660
 7661	cfg80211_sinfo_release_content(sinfo);
 7662	genlmsg_end(msg, hdr);
 7663	return 0;
 7664
 7665 nla_put_failure:
 7666	cfg80211_sinfo_release_content(sinfo);
 7667	genlmsg_cancel(msg, hdr);
 7668	return -EMSGSIZE;
 7669}
 7670
 7671static void cfg80211_sta_set_mld_sinfo(struct station_info *sinfo)
 7672{
 7673	struct link_station_info *link_sinfo;
 7674	int link_id, init = 0;
 7675	u32 link_inactive_time;
 7676
 7677	sinfo->signal = -99;
 7678
 7679	for_each_valid_link(sinfo, link_id) {
 7680		link_sinfo = sinfo->links[link_id];
 7681		if (!link_sinfo)
 7682			continue;
 7683
 7684		if ((link_sinfo->filled &
 7685		     BIT_ULL(NL80211_STA_INFO_TX_PACKETS))) {
 7686			sinfo->tx_packets += link_sinfo->tx_packets;
 7687			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_PACKETS);
 7688		}
 7689
 7690		if ((link_sinfo->filled &
 7691		     BIT_ULL(NL80211_STA_INFO_RX_PACKETS))) {
 7692			sinfo->rx_packets += link_sinfo->rx_packets;
 7693			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_PACKETS);
 7694		}
 7695
 7696		if (link_sinfo->filled &
 7697		    (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
 7698		     BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
 7699			sinfo->tx_bytes += link_sinfo->tx_bytes;
 7700			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BYTES);
 7701		}
 7702
 7703		if (link_sinfo->filled &
 7704		    (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
 7705		     BIT_ULL(NL80211_STA_INFO_TX_BYTES64))) {
 7706			sinfo->rx_bytes += link_sinfo->rx_bytes;
 7707			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BYTES);
 7708		}
 7709
 7710		if (link_sinfo->filled &
 7711		    BIT_ULL(NL80211_STA_INFO_TX_RETRIES)) {
 7712			sinfo->tx_retries += link_sinfo->tx_retries;
 7713			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_RETRIES);
 7714		}
 7715
 7716		if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_FAILED)) {
 7717			sinfo->tx_failed += link_sinfo->tx_failed;
 7718			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_FAILED);
 7719		}
 7720
 7721		if (link_sinfo->filled &
 7722		    BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC)) {
 7723			sinfo->rx_dropped_misc += link_sinfo->rx_dropped_misc;
 7724			sinfo->filled |=
 7725				BIT_ULL(NL80211_STA_INFO_RX_DROP_MISC);
 7726		}
 7727
 7728		if (link_sinfo->filled &
 7729		    BIT_ULL(NL80211_STA_INFO_BEACON_LOSS)) {
 7730			sinfo->beacon_loss_count +=
 7731				link_sinfo->beacon_loss_count;
 7732			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_LOSS);
 7733		}
 7734
 7735		if (link_sinfo->filled &
 7736		    BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT)) {
 7737			sinfo->expected_throughput +=
 7738				link_sinfo->expected_throughput;
 7739			sinfo->filled |=
 7740				BIT_ULL(NL80211_STA_INFO_EXPECTED_THROUGHPUT);
 7741		}
 7742
 7743		if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_MPDUS)) {
 7744			sinfo->rx_mpdu_count += link_sinfo->rx_mpdu_count;
 7745			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_MPDUS);
 7746		}
 7747
 7748		if (link_sinfo->filled &
 7749		    BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT)) {
 7750			sinfo->fcs_err_count += link_sinfo->fcs_err_count;
 7751			sinfo->filled |=
 7752				BIT_ULL(NL80211_STA_INFO_FCS_ERROR_COUNT);
 7753		}
 7754
 7755		if (link_sinfo->filled &
 7756		    BIT_ULL(NL80211_STA_INFO_BEACON_RX)) {
 7757			sinfo->rx_beacon += link_sinfo->rx_beacon;
 7758			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_BEACON_RX);
 7759		}
 7760
 7761		/* Update MLO signal, signal_avg as best among links */
 7762		if ((link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_SIGNAL)) &&
 7763		    link_sinfo->signal > sinfo->signal) {
 7764			sinfo->signal = link_sinfo->signal;
 7765			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL);
 7766		}
 7767
 7768		if ((link_sinfo->filled &
 7769			BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG)) &&
 7770		    link_sinfo->signal_avg > sinfo->signal_avg) {
 7771			sinfo->signal_avg = link_sinfo->signal_avg;
 7772			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_SIGNAL_AVG);
 7773		}
 7774
 7775		/* Update MLO inactive_time, bss_param based on least
 7776		 * value for corresponding field of link.
 7777		 */
 7778		if ((link_sinfo->filled &
 7779		     BIT_ULL(NL80211_STA_INFO_INACTIVE_TIME)) &&
 7780		    (!init ||
 7781		     link_inactive_time > link_sinfo->inactive_time)) {
 7782			link_inactive_time = link_sinfo->inactive_time;
 7783			sinfo->inactive_time = link_sinfo->inactive_time;
 7784			sinfo->filled |= NL80211_STA_INFO_INACTIVE_TIME;
 7785		}
 7786
 7787		if (link_sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM) &&
 7788		    (!init ||
 7789		     sinfo->bss_param.dtim_period >
 7790		      link_sinfo->bss_param.dtim_period)) {
 7791			sinfo->bss_param.dtim_period =
 7792				link_sinfo->bss_param.dtim_period;
 7793			sinfo->filled |= NL80211_STA_BSS_PARAM_DTIM_PERIOD;
 7794			sinfo->bss_param.beacon_interval =
 7795				link_sinfo->bss_param.beacon_interval;
 7796			sinfo->filled |= NL80211_STA_BSS_PARAM_BEACON_INTERVAL;
 7797		}
 7798
 7799		/* Update MLO rates as per last updated link rate */
 7800		if ((link_sinfo->filled &
 7801		     BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) &&
 7802		    (!init ||
 7803		     link_inactive_time > link_sinfo->inactive_time)) {
 7804			sinfo->txrate = link_sinfo->txrate;
 7805			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_TX_BITRATE);
 7806		}
 7807		if ((link_sinfo->filled &
 7808		     BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) &&
 7809		    (!init ||
 7810		     link_inactive_time > link_sinfo->inactive_time)) {
 7811			sinfo->rxrate = link_sinfo->rxrate;
 7812			sinfo->filled |= BIT_ULL(NL80211_STA_INFO_RX_BITRATE);
 7813		}
 7814
 7815		if (link_sinfo->filled &
 7816		    BIT_ULL(NL80211_STA_INFO_TX_DURATION) &&
 7817		    (!init ||
 7818		     link_inactive_time > link_sinfo->inactive_time)) {
 7819			sinfo->tx_duration += link_sinfo->tx_duration;
 7820			sinfo->filled |=
 7821				BIT_ULL(NL80211_STA_INFO_TX_DURATION);
 7822		}
 7823		if (link_sinfo->filled &
 7824		    BIT_ULL(NL80211_STA_INFO_RX_DURATION) &&
 7825		    (!init ||
 7826		     link_inactive_time > link_sinfo->inactive_time)) {
 7827			sinfo->rx_duration += link_sinfo->rx_duration;
 7828			sinfo->filled |=
 7829				BIT_ULL(NL80211_STA_INFO_RX_DURATION);
 7830		}
 7831		init++;
 7832
 7833		/* pertid stats accumulate for rx/tx fields */
 7834		if (sinfo->pertid) {
 7835			sinfo->pertid->rx_msdu +=
 7836				link_sinfo->pertid->rx_msdu;
 7837			sinfo->pertid->tx_msdu +=
 7838				link_sinfo->pertid->tx_msdu;
 7839			sinfo->pertid->tx_msdu_retries +=
 7840				link_sinfo->pertid->tx_msdu_retries;
 7841			sinfo->pertid->tx_msdu_failed +=
 7842				link_sinfo->pertid->tx_msdu_failed;
 7843
 7844			sinfo->pertid->filled |=
 7845				BIT(NL80211_TID_STATS_RX_MSDU) |
 7846				BIT(NL80211_TID_STATS_TX_MSDU) |
 7847				BIT(NL80211_TID_STATS_TX_MSDU_RETRIES) |
 7848				BIT(NL80211_TID_STATS_TX_MSDU_FAILED);
 7849		}
 7850	}
 7851
 7852	/* Reset sinfo->filled bits to exclude fields which don't make
 7853	 * much sense at the MLO level.
 7854	 */
 7855	sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL);
 7856	sinfo->filled &= ~BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG);
 7857}
 7858
 7859static int nl80211_dump_station(struct sk_buff *skb,
 7860				struct netlink_callback *cb)
 7861{
 7862	struct station_info sinfo;
 7863	struct cfg80211_registered_device *rdev;
 7864	struct wireless_dev *wdev;
 7865	u8 mac_addr[ETH_ALEN];
 7866	int sta_idx = cb->args[2];
 7867	bool sinfo_alloc = false;
 7868	int err, i;
 7869
 7870	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
 7871	if (err)
 7872		return err;
 7873	/* nl80211_prepare_wdev_dump acquired it in the successful case */
 7874	__acquire(&rdev->wiphy.mtx);
 7875
 7876	if (!wdev->netdev) {
 7877		err = -EINVAL;
 7878		goto out_err;
 7879	}
 7880
 7881	if (!rdev->ops->dump_station) {
 7882		err = -EOPNOTSUPP;
 7883		goto out_err;
 7884	}
 7885
 7886	while (1) {
 7887		memset(&sinfo, 0, sizeof(sinfo));
 7888
 7889		for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
 7890			sinfo.links[i] =
 7891				kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
 7892			if (!sinfo.links[i]) {
 7893				err = -ENOMEM;
 7894				goto out_err;
 7895			}
 7896			sinfo_alloc = true;
 7897		}
 7898
 7899		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
 7900					mac_addr, &sinfo);
 7901		if (err == -ENOENT)
 7902			break;
 7903		if (err)
 7904			goto out_err;
 7905
 7906		if (sinfo.valid_links)
 7907			cfg80211_sta_set_mld_sinfo(&sinfo);
 7908
 7909		/* reset the sinfo_alloc flag as nl80211_send_station()
 7910		 * always releases sinfo
 7911		 */
 7912		sinfo_alloc = false;
 7913
 7914		if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
 7915				NETLINK_CB(cb->skb).portid,
 7916				cb->nlh->nlmsg_seq, NLM_F_MULTI,
 7917				rdev, wdev->netdev, mac_addr,
 7918				&sinfo, false) < 0)
 7919			goto out;
 7920
 7921		sta_idx++;
 7922	}
 7923
 7924 out:
 7925	cb->args[2] = sta_idx;
 7926	err = skb->len;
 7927 out_err:
 7928	if (sinfo_alloc)
 7929		cfg80211_sinfo_release_content(&sinfo);
 7930	wiphy_unlock(&rdev->wiphy);
 7931
 7932	return err;
 7933}
 7934
 7935static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
 7936{
 7937	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 7938	struct net_device *dev = info->user_ptr[1];
 7939	struct station_info sinfo;
 7940	struct sk_buff *msg;
 7941	u8 *mac_addr = NULL;
 7942	int err, i;
 7943
 7944	memset(&sinfo, 0, sizeof(sinfo));
 7945
 7946	if (!info->attrs[NL80211_ATTR_MAC])
 7947		return -EINVAL;
 7948
 7949	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 7950
 7951	if (!rdev->ops->get_station)
 7952		return -EOPNOTSUPP;
 7953
 7954	for (i = 0; i < IEEE80211_MLD_MAX_NUM_LINKS; i++) {
 7955		sinfo.links[i] = kzalloc(sizeof(*sinfo.links[0]), GFP_KERNEL);
 7956		if (!sinfo.links[i]) {
 7957			cfg80211_sinfo_release_content(&sinfo);
 7958			return -ENOMEM;
 7959		}
 7960	}
 7961
 7962	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
 7963	if (err) {
 7964		cfg80211_sinfo_release_content(&sinfo);
 7965		return err;
 7966	}
 7967
 7968	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 7969	if (!msg) {
 7970		cfg80211_sinfo_release_content(&sinfo);
 7971		return -ENOMEM;
 7972	}
 7973
 7974	if (sinfo.valid_links)
 7975		cfg80211_sta_set_mld_sinfo(&sinfo);
 7976
 7977	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
 7978				 info->snd_portid, info->snd_seq, 0,
 7979				 rdev, dev, mac_addr, &sinfo, false) < 0) {
 7980		nlmsg_free(msg);
 7981		return -ENOBUFS;
 7982	}
 7983
 7984	return genlmsg_reply(msg, info);
 7985}
 7986
 7987int cfg80211_check_station_change(struct wiphy *wiphy,
 7988				  struct station_parameters *params,
 7989				  enum cfg80211_station_type statype)
 7990{
 7991	if (params->listen_interval != -1 &&
 7992	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
 7993		return -EINVAL;
 7994
 7995	if (params->support_p2p_ps != -1 &&
 7996	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
 7997		return -EINVAL;
 7998
 7999	if (params->aid &&
 8000	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
 8001	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
 8002		return -EINVAL;
 8003
 8004	/* When you run into this, adjust the code below for the new flag */
 8005	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
 8006
 8007	switch (statype) {
 8008	case CFG80211_STA_MESH_PEER_KERNEL:
 8009	case CFG80211_STA_MESH_PEER_USER:
 8010		/*
 8011		 * No ignoring the TDLS flag here -- the userspace mesh
 8012		 * code doesn't have the bug of including TDLS in the
 8013		 * mask everywhere.
 8014		 */
 8015		if (params->sta_flags_mask &
 8016				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
 8017				  BIT(NL80211_STA_FLAG_MFP) |
 8018				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
 8019			return -EINVAL;
 8020		break;
 8021	case CFG80211_STA_TDLS_PEER_SETUP:
 8022	case CFG80211_STA_TDLS_PEER_ACTIVE:
 8023		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
 8024			return -EINVAL;
 8025		/* ignore since it can't change */
 8026		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
 8027		break;
 8028	default:
 8029		/* disallow mesh-specific things */
 8030		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
 8031			return -EINVAL;
 8032		if (params->local_pm)
 8033			return -EINVAL;
 8034		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
 8035			return -EINVAL;
 8036	}
 8037
 8038	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
 8039	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
 8040		/* TDLS can't be set, ... */
 8041		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
 8042			return -EINVAL;
 8043		/*
 8044		 * ... but don't bother the driver with it. This works around
 8045		 * a hostapd/wpa_supplicant issue -- it always includes the
 8046		 * TLDS_PEER flag in the mask even for AP mode.
 8047		 */
 8048		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
 8049	}
 8050
 8051	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
 8052	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
 8053		/* reject other things that can't change */
 8054		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
 8055			return -EINVAL;
 8056		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
 8057			return -EINVAL;
 8058		if (params->link_sta_params.supported_rates)
 8059			return -EINVAL;
 8060		if (params->ext_capab || params->link_sta_params.ht_capa ||
 8061		    params->link_sta_params.vht_capa ||
 8062		    params->link_sta_params.he_capa ||
 8063		    params->link_sta_params.eht_capa)
 8064			return -EINVAL;
 8065		if (params->sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
 8066			return -EINVAL;
 8067	}
 8068
 8069	if (statype != CFG80211_STA_AP_CLIENT &&
 8070	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
 8071		if (params->vlan)
 8072			return -EINVAL;
 8073	}
 8074
 8075	/* Accept EMLSR capabilities only for AP client before association */
 8076	if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
 8077	    params->eml_cap_present)
 8078		return -EINVAL;
 8079
 8080	switch (statype) {
 8081	case CFG80211_STA_AP_MLME_CLIENT:
 8082		/* Use this only for authorizing/unauthorizing a station */
 8083		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
 8084			return -EOPNOTSUPP;
 8085		break;
 8086	case CFG80211_STA_AP_CLIENT:
 8087	case CFG80211_STA_AP_CLIENT_UNASSOC:
 8088		/* accept only the listed bits */
 8089		if (params->sta_flags_mask &
 8090				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
 8091				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
 8092				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
 8093				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
 8094				  BIT(NL80211_STA_FLAG_WME) |
 8095				  BIT(NL80211_STA_FLAG_MFP) |
 8096				  BIT(NL80211_STA_FLAG_SPP_AMSDU)))
 8097			return -EINVAL;
 8098
 8099		/* but authenticated/associated only if driver handles it */
 8100		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
 8101		    params->sta_flags_mask &
 8102				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
 8103				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
 8104			return -EINVAL;
 8105		break;
 8106	case CFG80211_STA_IBSS:
 8107	case CFG80211_STA_AP_STA:
 8108		/* reject any changes other than AUTHORIZED */
 8109		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
 8110			return -EINVAL;
 8111		break;
 8112	case CFG80211_STA_TDLS_PEER_SETUP:
 8113		/* reject any changes other than AUTHORIZED or WME */
 8114		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
 8115					       BIT(NL80211_STA_FLAG_WME)))
 8116			return -EINVAL;
 8117		/* force (at least) rates when authorizing */
 8118		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
 8119		    !params->link_sta_params.supported_rates)
 8120			return -EINVAL;
 8121		break;
 8122	case CFG80211_STA_TDLS_PEER_ACTIVE:
 8123		/* reject any changes */
 8124		return -EINVAL;
 8125	case CFG80211_STA_MESH_PEER_KERNEL:
 8126		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
 8127			return -EINVAL;
 8128		break;
 8129	case CFG80211_STA_MESH_PEER_USER:
 8130		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
 8131		    params->plink_action != NL80211_PLINK_ACTION_BLOCK)
 8132			return -EINVAL;
 8133		break;
 8134	}
 8135
 8136	/*
 8137	 * Older kernel versions ignored this attribute entirely, so don't
 8138	 * reject attempts to update it but mark it as unused instead so the
 8139	 * driver won't look at the data.
 8140	 */
 8141	if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
 8142	    statype != CFG80211_STA_TDLS_PEER_SETUP)
 8143		params->link_sta_params.opmode_notif_used = false;
 8144
 8145	return 0;
 8146}
 8147EXPORT_SYMBOL(cfg80211_check_station_change);
 8148
 8149/*
 8150 * Get vlan interface making sure it is running and on the right wiphy.
 8151 */
 8152static struct net_device *get_vlan(struct genl_info *info,
 8153				   struct cfg80211_registered_device *rdev)
 8154{
 8155	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
 8156	struct net_device *v;
 8157	int ret;
 8158
 8159	if (!vlanattr)
 8160		return NULL;
 8161
 8162	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
 8163	if (!v)
 8164		return ERR_PTR(-ENODEV);
 8165
 8166	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
 8167		ret = -EINVAL;
 8168		goto error;
 8169	}
 8170
 8171	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
 8172	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 8173	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
 8174		ret = -EINVAL;
 8175		goto error;
 8176	}
 8177
 8178	if (!netif_running(v)) {
 8179		ret = -ENETDOWN;
 8180		goto error;
 8181	}
 8182
 8183	return v;
 8184 error:
 8185	dev_put(v);
 8186	return ERR_PTR(ret);
 8187}
 8188
 8189static int nl80211_parse_sta_wme(struct genl_info *info,
 8190				 struct station_parameters *params)
 8191{
 8192	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
 8193	struct nlattr *nla;
 8194	int err;
 8195
 8196	/* parse WME attributes if present */
 8197	if (!info->attrs[NL80211_ATTR_STA_WME])
 8198		return 0;
 8199
 8200	nla = info->attrs[NL80211_ATTR_STA_WME];
 8201	err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
 8202					  nl80211_sta_wme_policy,
 8203					  info->extack);
 8204	if (err)
 8205		return err;
 8206
 8207	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
 8208		params->uapsd_queues = nla_get_u8(
 8209			tb[NL80211_STA_WME_UAPSD_QUEUES]);
 8210	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
 8211		return -EINVAL;
 8212
 8213	if (tb[NL80211_STA_WME_MAX_SP])
 8214		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
 8215
 8216	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
 8217		return -EINVAL;
 8218
 8219	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
 8220
 8221	return 0;
 8222}
 8223
 8224static int nl80211_parse_sta_channel_info(struct genl_info *info,
 8225				      struct station_parameters *params)
 8226{
 8227	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
 8228		params->supported_channels =
 8229		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
 8230		params->supported_channels_len =
 8231		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
 8232		/*
 8233		 * Need to include at least one (first channel, number of
 8234		 * channels) tuple for each subband (checked in policy),
 8235		 * and must have proper tuples for the rest of the data as well.
 8236		 */
 8237		if (params->supported_channels_len % 2)
 8238			return -EINVAL;
 8239	}
 8240
 8241	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
 8242		params->supported_oper_classes =
 8243		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
 8244		params->supported_oper_classes_len =
 8245		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
 8246	}
 8247	return 0;
 8248}
 8249
 8250static int nl80211_set_station_tdls(struct genl_info *info,
 8251				    struct station_parameters *params)
 8252{
 8253	int err;
 8254	/* Dummy STA entry gets updated once the peer capabilities are known */
 8255	if (info->attrs[NL80211_ATTR_PEER_AID])
 8256		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
 8257	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
 8258		params->link_sta_params.ht_capa =
 8259			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 8260	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
 8261		params->link_sta_params.vht_capa =
 8262			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
 8263	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
 8264		params->link_sta_params.he_capa =
 8265			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
 8266		params->link_sta_params.he_capa_len =
 8267			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
 8268
 8269		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
 8270			params->link_sta_params.eht_capa =
 8271				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
 8272			params->link_sta_params.eht_capa_len =
 8273				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
 8274
 8275			if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
 8276							(const u8 *)params->link_sta_params.eht_capa,
 8277							params->link_sta_params.eht_capa_len,
 8278							false))
 8279				return -EINVAL;
 8280		}
 8281	}
 8282
 8283	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
 8284		params->link_sta_params.s1g_capa =
 8285			nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
 8286
 8287	err = nl80211_parse_sta_channel_info(info, params);
 8288	if (err)
 8289		return err;
 8290
 8291	return nl80211_parse_sta_wme(info, params);
 8292}
 8293
 8294static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
 8295					     struct sta_txpwr *txpwr,
 8296					     bool *txpwr_set)
 8297{
 8298	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 8299	int idx;
 8300
 8301	if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
 8302		if (!rdev->ops->set_tx_power ||
 8303		    !wiphy_ext_feature_isset(&rdev->wiphy,
 8304					 NL80211_EXT_FEATURE_STA_TX_PWR))
 8305			return -EOPNOTSUPP;
 8306
 8307		idx = NL80211_ATTR_STA_TX_POWER_SETTING;
 8308		txpwr->type = nla_get_u8(info->attrs[idx]);
 8309
 8310		if (txpwr->type == NL80211_TX_POWER_LIMITED) {
 8311			idx = NL80211_ATTR_STA_TX_POWER;
 8312
 8313			if (info->attrs[idx])
 8314				txpwr->power = nla_get_s16(info->attrs[idx]);
 8315			else
 8316				return -EINVAL;
 8317		}
 8318
 8319		*txpwr_set = true;
 8320	} else {
 8321		*txpwr_set = false;
 8322	}
 8323
 8324	return 0;
 8325}
 8326
 8327static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
 8328{
 8329	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 8330	struct net_device *dev = info->user_ptr[1];
 8331	struct station_parameters params;
 8332	u8 *mac_addr;
 8333	int err;
 8334
 8335	memset(&params, 0, sizeof(params));
 8336
 8337	if (!rdev->ops->change_station)
 8338		return -EOPNOTSUPP;
 8339
 8340	/*
 8341	 * AID and listen_interval properties can be set only for unassociated
 8342	 * station. Include these parameters here and will check them in
 8343	 * cfg80211_check_station_change().
 8344	 */
 8345	if (info->attrs[NL80211_ATTR_STA_AID])
 8346		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
 8347
 8348	if (info->attrs[NL80211_ATTR_VLAN_ID])
 8349		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
 8350
 8351	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
 8352		params.listen_interval =
 8353		     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 8354	else
 8355		params.listen_interval = -1;
 8356
 8357	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
 8358		params.support_p2p_ps =
 8359			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
 8360	else
 8361		params.support_p2p_ps = -1;
 8362
 8363	if (!info->attrs[NL80211_ATTR_MAC])
 8364		return -EINVAL;
 8365
 8366	params.link_sta_params.link_id =
 8367		nl80211_link_id_or_invalid(info->attrs);
 8368
 8369	if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
 8370		/* If MLD_ADDR attribute is set then this is an MLD station
 8371		 * and the MLD_ADDR attribute holds the MLD address and the
 8372		 * MAC attribute holds for the LINK address.
 8373		 * In that case, the link_id is also expected to be valid.
 8374		 */
 8375		if (params.link_sta_params.link_id < 0)
 8376			return -EINVAL;
 8377
 8378		mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
 8379		params.link_sta_params.mld_mac = mac_addr;
 8380		params.link_sta_params.link_mac =
 8381			nla_data(info->attrs[NL80211_ATTR_MAC]);
 8382		if (!is_valid_ether_addr(params.link_sta_params.link_mac))
 8383			return -EINVAL;
 8384	} else {
 8385		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 8386	}
 8387
 8388
 8389	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
 8390		params.link_sta_params.supported_rates =
 8391			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 8392		params.link_sta_params.supported_rates_len =
 8393			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 8394	}
 8395
 8396	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
 8397		params.capability =
 8398			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
 8399		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
 8400	}
 8401
 8402	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
 8403		params.ext_capab =
 8404			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
 8405		params.ext_capab_len =
 8406			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
 8407	}
 8408
 8409	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
 8410		return -EINVAL;
 8411
 8412	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
 8413		params.plink_action =
 8414			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
 8415
 8416	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
 8417		params.plink_state =
 8418			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
 8419		if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
 8420			params.peer_aid = nla_get_u16(
 8421				info->attrs[NL80211_ATTR_MESH_PEER_AID]);
 8422		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
 8423	}
 8424
 8425	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
 8426		params.local_pm = nla_get_u32(
 8427			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
 8428
 8429	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
 8430		params.link_sta_params.opmode_notif_used = true;
 8431		params.link_sta_params.opmode_notif =
 8432			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
 8433	}
 8434
 8435	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
 8436		params.link_sta_params.he_6ghz_capa =
 8437			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
 8438
 8439	if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
 8440		params.eml_cap_present = true;
 8441		params.eml_cap =
 8442			nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
 8443	}
 8444
 8445	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
 8446		params.airtime_weight =
 8447			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
 8448
 8449	if (params.airtime_weight &&
 8450	    !wiphy_ext_feature_isset(&rdev->wiphy,
 8451				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
 8452		return -EOPNOTSUPP;
 8453
 8454	err = nl80211_parse_sta_txpower_setting(info,
 8455						&params.link_sta_params.txpwr,
 8456						&params.link_sta_params.txpwr_set);
 8457	if (err)
 8458		return err;
 8459
 8460	/* Include parameters for TDLS peer (will check later) */
 8461	err = nl80211_set_station_tdls(info, &params);
 8462	if (err)
 8463		return err;
 8464
 8465	params.vlan = get_vlan(info, rdev);
 8466	if (IS_ERR(params.vlan))
 8467		return PTR_ERR(params.vlan);
 8468
 8469	switch (dev->ieee80211_ptr->iftype) {
 8470	case NL80211_IFTYPE_AP:
 8471	case NL80211_IFTYPE_AP_VLAN:
 8472	case NL80211_IFTYPE_P2P_GO:
 8473	case NL80211_IFTYPE_P2P_CLIENT:
 8474	case NL80211_IFTYPE_STATION:
 8475	case NL80211_IFTYPE_ADHOC:
 8476	case NL80211_IFTYPE_MESH_POINT:
 8477		break;
 8478	default:
 8479		err = -EOPNOTSUPP;
 8480		goto out_put_vlan;
 8481	}
 8482
 8483	/* driver will call cfg80211_check_station_change() */
 8484	err = rdev_change_station(rdev, dev, mac_addr, &params);
 8485
 8486 out_put_vlan:
 8487	dev_put(params.vlan);
 8488
 8489	return err;
 8490}
 8491
 8492static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
 8493{
 8494	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 8495	int err;
 8496	struct net_device *dev = info->user_ptr[1];
 8497	struct wireless_dev *wdev = dev->ieee80211_ptr;
 8498	struct station_parameters params;
 8499	u8 *mac_addr = NULL;
 8500	u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
 8501			 BIT(NL80211_STA_FLAG_ASSOCIATED);
 8502
 8503	memset(&params, 0, sizeof(params));
 8504
 8505	if (!rdev->ops->add_station)
 8506		return -EOPNOTSUPP;
 8507
 8508	if (!info->attrs[NL80211_ATTR_MAC])
 8509		return -EINVAL;
 8510
 8511	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
 8512		return -EINVAL;
 8513
 8514	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
 8515		return -EINVAL;
 8516
 8517	if (!info->attrs[NL80211_ATTR_STA_AID] &&
 8518	    !info->attrs[NL80211_ATTR_PEER_AID])
 8519		return -EINVAL;
 8520
 8521	params.link_sta_params.link_id =
 8522		nl80211_link_id_or_invalid(info->attrs);
 8523
 8524	if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
 8525		mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
 8526		params.link_sta_params.mld_mac = mac_addr;
 8527		params.link_sta_params.link_mac =
 8528			nla_data(info->attrs[NL80211_ATTR_MAC]);
 8529		if (!is_valid_ether_addr(params.link_sta_params.link_mac))
 8530			return -EINVAL;
 8531	} else {
 8532		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
 8533	}
 8534
 8535	params.link_sta_params.supported_rates =
 8536		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 8537	params.link_sta_params.supported_rates_len =
 8538		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
 8539	params.listen_interval =
 8540		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
 8541
 8542	if (info->attrs[NL80211_ATTR_VLAN_ID])
 8543		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
 8544
 8545	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
 8546		params.support_p2p_ps =
 8547			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
 8548	} else {
 8549		/*
 8550		 * if not specified, assume it's supported for P2P GO interface,
 8551		 * and is NOT supported for AP interface
 8552		 */
 8553		params.support_p2p_ps =
 8554			dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
 8555	}
 8556
 8557	if (info->attrs[NL80211_ATTR_PEER_AID])
 8558		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
 8559	else
 8560		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
 8561
 8562	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
 8563		params.capability =
 8564			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
 8565		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
 8566	}
 8567
 8568	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
 8569		params.ext_capab =
 8570			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
 8571		params.ext_capab_len =
 8572			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
 8573	}
 8574
 8575	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
 8576		params.link_sta_params.ht_capa =
 8577			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
 8578
 8579	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
 8580		params.link_sta_params.vht_capa =
 8581			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
 8582
 8583	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
 8584		params.link_sta_params.he_capa =
 8585			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
 8586		params.link_sta_params.he_capa_len =
 8587			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
 8588
 8589		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
 8590			params.link_sta_params.eht_capa =
 8591				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
 8592			params.link_sta_params.eht_capa_len =
 8593				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
 8594
 8595			if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
 8596							(const u8 *)params.link_sta_params.eht_capa,
 8597							params.link_sta_params.eht_capa_len,
 8598							false))
 8599				return -EINVAL;
 8600		}
 8601	}
 8602
 8603	if (info->attrs[NL80211_ATTR_EML_CAPABILITY]) {
 8604		params.eml_cap_present = true;
 8605		params.eml_cap =
 8606			nla_get_u16(info->attrs[NL80211_ATTR_EML_CAPABILITY]);
 8607	}
 8608
 8609	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
 8610		params.link_sta_params.he_6ghz_capa =
 8611			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
 8612
 8613	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY])
 8614		params.link_sta_params.s1g_capa =
 8615			nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]);
 8616
 8617	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
 8618		params.link_sta_params.opmode_notif_used = true;
 8619		params.link_sta_params.opmode_notif =
 8620			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
 8621	}
 8622
 8623	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
 8624		params.plink_action =
 8625			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
 8626
 8627	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
 8628		params.airtime_weight =
 8629			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
 8630
 8631	if (params.airtime_weight &&
 8632	    !wiphy_ext_feature_isset(&rdev->wiphy,
 8633				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
 8634		return -EOPNOTSUPP;
 8635
 8636	err = nl80211_parse_sta_txpower_setting(info,
 8637						&params.link_sta_params.txpwr,
 8638						&params.link_sta_params.txpwr_set);
 8639	if (err)
 8640		return err;
 8641
 8642	err = nl80211_parse_sta_channel_info(info, &params);
 8643	if (err)
 8644		return err;
 8645
 8646	err = nl80211_parse_sta_wme(info, &params);
 8647	if (err)
 8648		return err;
 8649
 8650	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
 8651		return -EINVAL;
 8652
 8653	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
 8654	 * as userspace might just pass through the capabilities from the IEs
 8655	 * directly, rather than enforcing this restriction and returning an
 8656	 * error in this case.
 8657	 */
 8658	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
 8659		params.link_sta_params.ht_capa = NULL;
 8660		params.link_sta_params.vht_capa = NULL;
 8661
 8662		/* HE and EHT require WME */
 8663		if (params.link_sta_params.he_capa_len ||
 8664		    params.link_sta_params.he_6ghz_capa ||
 8665		    params.link_sta_params.eht_capa_len)
 8666			return -EINVAL;
 8667	}
 8668
 8669	/* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
 8670	if (params.link_sta_params.he_6ghz_capa &&
 8671	    (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
 8672		return -EINVAL;
 8673
 8674	/* When you run into this, adjust the code below for the new flag */
 8675	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 8);
 8676
 8677	switch (dev->ieee80211_ptr->iftype) {
 8678	case NL80211_IFTYPE_AP:
 8679	case NL80211_IFTYPE_AP_VLAN:
 8680	case NL80211_IFTYPE_P2P_GO:
 8681		/* ignore WME attributes if iface/sta is not capable */
 8682		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
 8683		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
 8684			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
 8685
 8686		/* TDLS peers cannot be added */
 8687		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
 8688		    info->attrs[NL80211_ATTR_PEER_AID])
 8689			return -EINVAL;
 8690		/* but don't bother the driver with it */
 8691		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
 8692
 8693		/* allow authenticated/associated only if driver handles it */
 8694		if (!(rdev->wiphy.features &
 8695				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
 8696		    params.sta_flags_mask & auth_assoc)
 8697			return -EINVAL;
 8698
 8699		if (!wiphy_ext_feature_isset(&rdev->wiphy,
 8700					     NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT) &&
 8701		    params.sta_flags_mask & BIT(NL80211_STA_FLAG_SPP_AMSDU))
 8702			return -EINVAL;
 8703
 8704		/* Older userspace, or userspace wanting to be compatible with
 8705		 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
 8706		 * and assoc flags in the mask, but assumes the station will be
 8707		 * added as associated anyway since this was the required driver
 8708		 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
 8709		 * introduced.
 8710		 * In order to not bother drivers with this quirk in the API
 8711		 * set the flags in both the mask and set for new stations in
 8712		 * this case.
 8713		 */
 8714		if (!(params.sta_flags_mask & auth_assoc)) {
 8715			params.sta_flags_mask |= auth_assoc;
 8716			params.sta_flags_set |= auth_assoc;
 8717		}
 8718
 8719		/* must be last in here for error handling */
 8720		params.vlan = get_vlan(info, rdev);
 8721		if (IS_ERR(params.vlan))
 8722			return PTR_ERR(params.vlan);
 8723		break;
 8724	case NL80211_IFTYPE_MESH_POINT:
 8725		/* ignore uAPSD data */
 8726		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
 8727
 8728		/* associated is disallowed */
 8729		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
 8730			return -EINVAL;
 8731		/* TDLS peers cannot be added */
 8732		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
 8733		    info->attrs[NL80211_ATTR_PEER_AID])
 8734			return -EINVAL;
 8735		break;
 8736	case NL80211_IFTYPE_STATION:
 8737	case NL80211_IFTYPE_P2P_CLIENT:
 8738		/* ignore uAPSD data */
 8739		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
 8740
 8741		/* these are disallowed */
 8742		if (params.sta_flags_mask &
 8743				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
 8744				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
 8745			return -EINVAL;
 8746		/* Only TDLS peers can be added */
 8747		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
 8748			return -EINVAL;
 8749		/* Can only add if TDLS ... */
 8750		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
 8751			return -EOPNOTSUPP;
 8752		/* ... with external setup is supported */
 8753		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
 8754			return -EOPNOTSUPP;
 8755		/*
 8756		 * Older wpa_supplicant versions always mark the TDLS peer
 8757		 * as authorized, but it shouldn't yet be.
 8758		 */
 8759		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
 8760		break;
 8761	default:
 8762		return -EOPNOTSUPP;
 8763	}
 8764
 8765	/* be aware of params.vlan when changing code here */
 8766
 8767	if (wdev->valid_links) {
 8768		if (params.link_sta_params.link_id < 0) {
 8769			err = -EINVAL;
 8770			goto out;
 8771		}
 8772		if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
 8773			err = -ENOLINK;
 8774			goto out;
 8775		}
 8776	} else {
 8777		if (params.link_sta_params.link_id >= 0) {
 8778			err = -EINVAL;
 8779			goto out;
 8780		}
 8781	}
 8782	err = rdev_add_station(rdev, dev, mac_addr, &params);
 8783out:
 8784	dev_put(params.vlan);
 8785	return err;
 8786}
 8787
 8788static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
 8789{
 8790	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 8791	struct net_device *dev = info->user_ptr[1];
 8792	struct wireless_dev *wdev = dev->ieee80211_ptr;
 8793	struct station_del_parameters params;
 8794	int link_id = nl80211_link_id_or_invalid(info->attrs);
 8795
 8796	memset(&params, 0, sizeof(params));
 8797
 8798	if (info->attrs[NL80211_ATTR_MAC])
 8799		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
 8800
 8801	switch (wdev->iftype) {
 8802	case NL80211_IFTYPE_AP:
 8803	case NL80211_IFTYPE_AP_VLAN:
 8804	case NL80211_IFTYPE_MESH_POINT:
 8805	case NL80211_IFTYPE_P2P_GO:
 8806		/* always accept these */
 8807		break;
 8808	case NL80211_IFTYPE_ADHOC:
 8809		/* conditionally accept */
 8810		if (wiphy_ext_feature_isset(&rdev->wiphy,
 8811					    NL80211_EXT_FEATURE_DEL_IBSS_STA))
 8812			break;
 8813		return -EINVAL;
 8814	default:
 8815		return -EINVAL;
 8816	}
 8817
 8818	if (!rdev->ops->del_station)
 8819		return -EOPNOTSUPP;
 8820
 8821	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
 8822		params.subtype =
 8823			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
 8824		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
 8825		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
 8826			return -EINVAL;
 8827	} else {
 8828		/* Default to Deauthentication frame */
 8829		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
 8830	}
 8831
 8832	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
 8833		params.reason_code =
 8834			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
 8835		if (params.reason_code == 0)
 8836			return -EINVAL; /* 0 is reserved */
 8837	} else {
 8838		/* Default to reason code 2 */
 8839		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
 8840	}
 8841
 8842	/* Link ID not expected in case of non-ML operation */
 8843	if (!wdev->valid_links && link_id != -1)
 8844		return -EINVAL;
 8845
 8846	/* If given, a valid link ID should be passed during MLO */
 8847	if (wdev->valid_links && link_id >= 0 &&
 8848	    !(wdev->valid_links & BIT(link_id)))
 8849		return -EINVAL;
 8850
 8851	params.link_id = link_id;
 8852
 8853	return rdev_del_station(rdev, dev, &params);
 8854}
 8855
 8856static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
 8857				int flags, struct net_device *dev,
 8858				u8 *dst, u8 *next_hop,
 8859				struct mpath_info *pinfo)
 8860{
 8861	void *hdr;
 8862	struct nlattr *pinfoattr;
 8863
 8864	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
 8865	if (!hdr)
 8866		return -1;
 8867
 8868	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 8869	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
 8870	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
 8871	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
 8872		goto nla_put_failure;
 8873
 8874	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
 8875	if (!pinfoattr)
 8876		goto nla_put_failure;
 8877	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
 8878	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
 8879			pinfo->frame_qlen))
 8880		goto nla_put_failure;
 8881	if (((pinfo->filled & MPATH_INFO_SN) &&
 8882	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
 8883	    ((pinfo->filled & MPATH_INFO_METRIC) &&
 8884	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
 8885			 pinfo->metric)) ||
 8886	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
 8887	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
 8888			 pinfo->exptime)) ||
 8889	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
 8890	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
 8891			pinfo->flags)) ||
 8892	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
 8893	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
 8894			 pinfo->discovery_timeout)) ||
 8895	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
 8896	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
 8897			pinfo->discovery_retries)) ||
 8898	    ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
 8899	     nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
 8900			pinfo->hop_count)) ||
 8901	    ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
 8902	     nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
 8903			 pinfo->path_change_count)))
 8904		goto nla_put_failure;
 8905
 8906	nla_nest_end(msg, pinfoattr);
 8907
 8908	genlmsg_end(msg, hdr);
 8909	return 0;
 8910
 8911 nla_put_failure:
 8912	genlmsg_cancel(msg, hdr);
 8913	return -EMSGSIZE;
 8914}
 8915
 8916static int nl80211_dump_mpath(struct sk_buff *skb,
 8917			      struct netlink_callback *cb)
 8918{
 8919	struct mpath_info pinfo;
 8920	struct cfg80211_registered_device *rdev;
 8921	struct wireless_dev *wdev;
 8922	u8 dst[ETH_ALEN];
 8923	u8 next_hop[ETH_ALEN];
 8924	int path_idx = cb->args[2];
 8925	int err;
 8926
 8927	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
 8928	if (err)
 8929		return err;
 8930	/* nl80211_prepare_wdev_dump acquired it in the successful case */
 8931	__acquire(&rdev->wiphy.mtx);
 8932
 8933	if (!rdev->ops->dump_mpath) {
 8934		err = -EOPNOTSUPP;
 8935		goto out_err;
 8936	}
 8937
 8938	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
 8939		err = -EOPNOTSUPP;
 8940		goto out_err;
 8941	}
 8942
 8943	while (1) {
 8944		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
 8945				      next_hop, &pinfo);
 8946		if (err == -ENOENT)
 8947			break;
 8948		if (err)
 8949			goto out_err;
 8950
 8951		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
 8952				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 8953				       wdev->netdev, dst, next_hop,
 8954				       &pinfo) < 0)
 8955			goto out;
 8956
 8957		path_idx++;
 8958	}
 8959
 8960 out:
 8961	cb->args[2] = path_idx;
 8962	err = skb->len;
 8963 out_err:
 8964	wiphy_unlock(&rdev->wiphy);
 8965	return err;
 8966}
 8967
 8968static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
 8969{
 8970	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 8971	int err;
 8972	struct net_device *dev = info->user_ptr[1];
 8973	struct mpath_info pinfo;
 8974	struct sk_buff *msg;
 8975	u8 *dst = NULL;
 8976	u8 next_hop[ETH_ALEN];
 8977
 8978	memset(&pinfo, 0, sizeof(pinfo));
 8979
 8980	if (!info->attrs[NL80211_ATTR_MAC])
 8981		return -EINVAL;
 8982
 8983	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 8984
 8985	if (!rdev->ops->get_mpath)
 8986		return -EOPNOTSUPP;
 8987
 8988	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
 8989		return -EOPNOTSUPP;
 8990
 8991	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
 8992	if (err)
 8993		return err;
 8994
 8995	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 8996	if (!msg)
 8997		return -ENOMEM;
 8998
 8999	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
 9000				 dev, dst, next_hop, &pinfo) < 0) {
 9001		nlmsg_free(msg);
 9002		return -ENOBUFS;
 9003	}
 9004
 9005	return genlmsg_reply(msg, info);
 9006}
 9007
 9008static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
 9009{
 9010	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9011	struct net_device *dev = info->user_ptr[1];
 9012	u8 *dst = NULL;
 9013	u8 *next_hop = NULL;
 9014
 9015	if (!info->attrs[NL80211_ATTR_MAC])
 9016		return -EINVAL;
 9017
 9018	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
 9019		return -EINVAL;
 9020
 9021	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 9022	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 9023
 9024	if (!rdev->ops->change_mpath)
 9025		return -EOPNOTSUPP;
 9026
 9027	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
 9028		return -EOPNOTSUPP;
 9029
 9030	return rdev_change_mpath(rdev, dev, dst, next_hop);
 9031}
 9032
 9033static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
 9034{
 9035	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9036	struct net_device *dev = info->user_ptr[1];
 9037	u8 *dst = NULL;
 9038	u8 *next_hop = NULL;
 9039
 9040	if (!info->attrs[NL80211_ATTR_MAC])
 9041		return -EINVAL;
 9042
 9043	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
 9044		return -EINVAL;
 9045
 9046	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 9047	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
 9048
 9049	if (!rdev->ops->add_mpath)
 9050		return -EOPNOTSUPP;
 9051
 9052	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
 9053		return -EOPNOTSUPP;
 9054
 9055	return rdev_add_mpath(rdev, dev, dst, next_hop);
 9056}
 9057
 9058static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
 9059{
 9060	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9061	struct net_device *dev = info->user_ptr[1];
 9062	u8 *dst = NULL;
 9063
 9064	if (info->attrs[NL80211_ATTR_MAC])
 9065		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 9066
 9067	if (!rdev->ops->del_mpath)
 9068		return -EOPNOTSUPP;
 9069
 9070	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
 9071		return -EOPNOTSUPP;
 9072
 9073	return rdev_del_mpath(rdev, dev, dst);
 9074}
 9075
 9076static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
 9077{
 9078	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9079	int err;
 9080	struct net_device *dev = info->user_ptr[1];
 9081	struct mpath_info pinfo;
 9082	struct sk_buff *msg;
 9083	u8 *dst = NULL;
 9084	u8 mpp[ETH_ALEN];
 9085
 9086	memset(&pinfo, 0, sizeof(pinfo));
 9087
 9088	if (!info->attrs[NL80211_ATTR_MAC])
 9089		return -EINVAL;
 9090
 9091	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
 9092
 9093	if (!rdev->ops->get_mpp)
 9094		return -EOPNOTSUPP;
 9095
 9096	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
 9097		return -EOPNOTSUPP;
 9098
 9099	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
 9100	if (err)
 9101		return err;
 9102
 9103	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 9104	if (!msg)
 9105		return -ENOMEM;
 9106
 9107	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
 9108			       dev, dst, mpp, &pinfo) < 0) {
 9109		nlmsg_free(msg);
 9110		return -ENOBUFS;
 9111	}
 9112
 9113	return genlmsg_reply(msg, info);
 9114}
 9115
 9116static int nl80211_dump_mpp(struct sk_buff *skb,
 9117			    struct netlink_callback *cb)
 9118{
 9119	struct mpath_info pinfo;
 9120	struct cfg80211_registered_device *rdev;
 9121	struct wireless_dev *wdev;
 9122	u8 dst[ETH_ALEN];
 9123	u8 mpp[ETH_ALEN];
 9124	int path_idx = cb->args[2];
 9125	int err;
 9126
 9127	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
 9128	if (err)
 9129		return err;
 9130	/* nl80211_prepare_wdev_dump acquired it in the successful case */
 9131	__acquire(&rdev->wiphy.mtx);
 9132
 9133	if (!rdev->ops->dump_mpp) {
 9134		err = -EOPNOTSUPP;
 9135		goto out_err;
 9136	}
 9137
 9138	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
 9139		err = -EOPNOTSUPP;
 9140		goto out_err;
 9141	}
 9142
 9143	while (1) {
 9144		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
 9145				    mpp, &pinfo);
 9146		if (err == -ENOENT)
 9147			break;
 9148		if (err)
 9149			goto out_err;
 9150
 9151		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
 9152				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
 9153				       wdev->netdev, dst, mpp,
 9154				       &pinfo) < 0)
 9155			goto out;
 9156
 9157		path_idx++;
 9158	}
 9159
 9160 out:
 9161	cb->args[2] = path_idx;
 9162	err = skb->len;
 9163 out_err:
 9164	wiphy_unlock(&rdev->wiphy);
 9165	return err;
 9166}
 9167
 9168static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
 9169{
 9170	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9171	struct net_device *dev = info->user_ptr[1];
 9172	struct bss_parameters params;
 9173	u32 bss_param_support = rdev->wiphy.bss_param_support;
 9174	u32 changed = 0;
 9175	bool strict;
 9176
 9177	memset(&params, 0, sizeof(params));
 9178	params.link_id = nl80211_link_id_or_invalid(info->attrs);
 9179	/* default to not changing parameters */
 9180	params.use_cts_prot = -1;
 9181	params.use_short_preamble = -1;
 9182	params.use_short_slot_time = -1;
 9183	params.ap_isolate = -1;
 9184	params.ht_opmode = -1;
 9185	params.p2p_ctwindow = -1;
 9186	params.p2p_opp_ps = -1;
 9187
 9188	strict = nla_get_flag(info->attrs[NL80211_ATTR_BSS_PARAM]);
 9189	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT]) {
 9190		if (strict && !(bss_param_support & WIPHY_BSS_PARAM_CTS_PROT))
 9191			return -EINVAL;
 9192		params.use_cts_prot =
 9193		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
 9194		changed |= WIPHY_BSS_PARAM_CTS_PROT;
 9195	}
 9196	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]) {
 9197		if (strict &&
 9198		    !(bss_param_support & WIPHY_BSS_PARAM_SHORT_PREAMBLE))
 9199			return -EINVAL;
 9200		params.use_short_preamble =
 9201		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
 9202		changed |= WIPHY_BSS_PARAM_SHORT_PREAMBLE;
 9203	}
 9204	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]) {
 9205		if (strict &&
 9206		    !(bss_param_support & WIPHY_BSS_PARAM_SHORT_SLOT_TIME))
 9207			return -EINVAL;
 9208		params.use_short_slot_time =
 9209		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
 9210		changed |= WIPHY_BSS_PARAM_SHORT_SLOT_TIME;
 9211	}
 9212	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
 9213		if (strict &&
 9214		    !(bss_param_support & WIPHY_BSS_PARAM_BASIC_RATES))
 9215			return -EINVAL;
 9216		params.basic_rates =
 9217			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
 9218		params.basic_rates_len =
 9219			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
 9220		changed |= WIPHY_BSS_PARAM_BASIC_RATES;
 9221	}
 9222	if (info->attrs[NL80211_ATTR_AP_ISOLATE]) {
 9223		if (strict && !(bss_param_support & WIPHY_BSS_PARAM_AP_ISOLATE))
 9224			return -EINVAL;
 9225		params.ap_isolate =
 9226			!!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
 9227		changed |= WIPHY_BSS_PARAM_AP_ISOLATE;
 9228	}
 9229	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE]) {
 9230		if (strict && !(bss_param_support & WIPHY_BSS_PARAM_HT_OPMODE))
 9231			return -EINVAL;
 9232		params.ht_opmode =
 9233			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
 9234		changed |= WIPHY_BSS_PARAM_HT_OPMODE;
 9235	}
 9236
 9237	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
 9238		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 9239			return -EINVAL;
 9240		params.p2p_ctwindow =
 9241			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
 9242		if (params.p2p_ctwindow != 0 &&
 9243		    !(bss_param_support & WIPHY_BSS_PARAM_P2P_CTWINDOW))
 9244			return -EINVAL;
 9245		changed |= WIPHY_BSS_PARAM_P2P_CTWINDOW;
 9246	}
 9247
 9248	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
 9249		u8 tmp;
 9250
 9251		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 9252			return -EINVAL;
 9253		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
 9254		if (tmp && !(bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
 9255			return -EINVAL;
 9256		params.p2p_opp_ps = tmp;
 9257		if (params.p2p_opp_ps &&
 9258		    !(rdev->wiphy.bss_param_support & WIPHY_BSS_PARAM_P2P_OPPPS))
 9259			return -EINVAL;
 9260	}
 9261
 9262	if (!rdev->ops->change_bss)
 9263		return -EOPNOTSUPP;
 9264
 9265	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
 9266	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
 9267		return -EOPNOTSUPP;
 9268
 9269	changed &= rdev->wiphy.bss_param_support;
 9270	if (!changed)
 9271		return 0;
 9272
 9273	return rdev_change_bss(rdev, dev, &params);
 9274}
 9275
 9276static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
 9277{
 9278	char *data = NULL;
 9279	bool is_indoor;
 9280	enum nl80211_user_reg_hint_type user_reg_hint_type;
 9281	u32 owner_nlportid;
 9282
 9283	/*
 9284	 * You should only get this when cfg80211 hasn't yet initialized
 9285	 * completely when built-in to the kernel right between the time
 9286	 * window between nl80211_init() and regulatory_init(), if that is
 9287	 * even possible.
 9288	 */
 9289	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
 9290		return -EINPROGRESS;
 9291
 9292	user_reg_hint_type =
 9293		nla_get_u32_default(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE],
 9294				    NL80211_USER_REG_HINT_USER);
 9295
 9296	switch (user_reg_hint_type) {
 9297	case NL80211_USER_REG_HINT_USER:
 9298	case NL80211_USER_REG_HINT_CELL_BASE:
 9299		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
 9300			return -EINVAL;
 9301
 9302		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
 9303		return regulatory_hint_user(data, user_reg_hint_type);
 9304	case NL80211_USER_REG_HINT_INDOOR:
 9305		if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
 9306			owner_nlportid = info->snd_portid;
 9307			is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
 9308		} else {
 9309			owner_nlportid = 0;
 9310			is_indoor = true;
 9311		}
 9312
 9313		regulatory_hint_indoor(is_indoor, owner_nlportid);
 9314		return 0;
 9315	default:
 9316		return -EINVAL;
 9317	}
 9318}
 9319
 9320static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
 9321{
 9322	return reg_reload_regdb();
 9323}
 9324
 9325static int nl80211_get_mesh_config(struct sk_buff *skb,
 9326				   struct genl_info *info)
 9327{
 9328	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9329	struct net_device *dev = info->user_ptr[1];
 9330	struct wireless_dev *wdev = dev->ieee80211_ptr;
 9331	struct mesh_config cur_params;
 9332	int err = 0;
 9333	void *hdr;
 9334	struct nlattr *pinfoattr;
 9335	struct sk_buff *msg;
 9336
 9337	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
 9338		return -EOPNOTSUPP;
 9339
 9340	if (!rdev->ops->get_mesh_config)
 9341		return -EOPNOTSUPP;
 9342
 9343	/* If not connected, get default parameters */
 9344	if (!wdev->u.mesh.id_len)
 9345		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
 9346	else
 9347		err = rdev_get_mesh_config(rdev, dev, &cur_params);
 9348
 9349	if (err)
 9350		return err;
 9351
 9352	/* Draw up a netlink message to send back */
 9353	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 9354	if (!msg)
 9355		return -ENOMEM;
 9356	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
 9357			     NL80211_CMD_GET_MESH_CONFIG);
 9358	if (!hdr)
 9359		goto out;
 9360	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
 9361	if (!pinfoattr)
 9362		goto nla_put_failure;
 9363	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
 9364	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
 9365			cur_params.dot11MeshRetryTimeout) ||
 9366	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
 9367			cur_params.dot11MeshConfirmTimeout) ||
 9368	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
 9369			cur_params.dot11MeshHoldingTimeout) ||
 9370	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
 9371			cur_params.dot11MeshMaxPeerLinks) ||
 9372	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
 9373		       cur_params.dot11MeshMaxRetries) ||
 9374	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
 9375		       cur_params.dot11MeshTTL) ||
 9376	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
 9377		       cur_params.element_ttl) ||
 9378	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 9379		       cur_params.auto_open_plinks) ||
 9380	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
 9381			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
 9382	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 9383		       cur_params.dot11MeshHWMPmaxPREQretries) ||
 9384	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
 9385			cur_params.path_refresh_time) ||
 9386	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 9387			cur_params.min_discovery_timeout) ||
 9388	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 9389			cur_params.dot11MeshHWMPactivePathTimeout) ||
 9390	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 9391			cur_params.dot11MeshHWMPpreqMinInterval) ||
 9392	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
 9393			cur_params.dot11MeshHWMPperrMinInterval) ||
 9394	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 9395			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
 9396	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
 9397		       cur_params.dot11MeshHWMPRootMode) ||
 9398	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
 9399			cur_params.dot11MeshHWMPRannInterval) ||
 9400	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
 9401		       cur_params.dot11MeshGateAnnouncementProtocol) ||
 9402	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
 9403		       cur_params.dot11MeshForwarding) ||
 9404	    nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
 9405			cur_params.rssi_threshold) ||
 9406	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
 9407			cur_params.ht_opmode) ||
 9408	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
 9409			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
 9410	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
 9411			cur_params.dot11MeshHWMProotInterval) ||
 9412	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
 9413			cur_params.dot11MeshHWMPconfirmationInterval) ||
 9414	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
 9415			cur_params.power_mode) ||
 9416	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
 9417			cur_params.dot11MeshAwakeWindowDuration) ||
 9418	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
 9419			cur_params.plink_timeout) ||
 9420	    nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
 9421		       cur_params.dot11MeshConnectedToMeshGate) ||
 9422	    nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
 9423		       cur_params.dot11MeshNolearn) ||
 9424	    nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
 9425		       cur_params.dot11MeshConnectedToAuthServer))
 9426		goto nla_put_failure;
 9427	nla_nest_end(msg, pinfoattr);
 9428	genlmsg_end(msg, hdr);
 9429	return genlmsg_reply(msg, info);
 9430
 9431 nla_put_failure:
 9432 out:
 9433	nlmsg_free(msg);
 9434	return -ENOBUFS;
 9435}
 9436
 9437static const struct nla_policy
 9438nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
 9439	[NL80211_MESHCONF_RETRY_TIMEOUT] =
 9440		NLA_POLICY_RANGE(NLA_U16, 1, 255),
 9441	[NL80211_MESHCONF_CONFIRM_TIMEOUT] =
 9442		NLA_POLICY_RANGE(NLA_U16, 1, 255),
 9443	[NL80211_MESHCONF_HOLDING_TIMEOUT] =
 9444		NLA_POLICY_RANGE(NLA_U16, 1, 255),
 9445	[NL80211_MESHCONF_MAX_PEER_LINKS] =
 9446		NLA_POLICY_RANGE(NLA_U16, 0, 255),
 9447	[NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
 9448	[NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
 9449	[NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
 9450	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
 9451	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
 9452		NLA_POLICY_RANGE(NLA_U32, 1, 255),
 9453	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
 9454	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
 9455	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
 9456	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
 9457	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
 9458		NLA_POLICY_MIN(NLA_U16, 1),
 9459	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
 9460		NLA_POLICY_MIN(NLA_U16, 1),
 9461	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
 9462		NLA_POLICY_MIN(NLA_U16, 1),
 9463	[NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
 9464	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
 9465		NLA_POLICY_MIN(NLA_U16, 1),
 9466	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
 9467	[NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
 9468	[NL80211_MESHCONF_RSSI_THRESHOLD] =
 9469		NLA_POLICY_RANGE(NLA_S32, -255, 0),
 9470	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
 9471	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
 9472	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
 9473		NLA_POLICY_MIN(NLA_U16, 1),
 9474	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
 9475		NLA_POLICY_MIN(NLA_U16, 1),
 9476	[NL80211_MESHCONF_POWER_MODE] =
 9477		NLA_POLICY_RANGE(NLA_U32,
 9478				 NL80211_MESH_POWER_ACTIVE,
 9479				 NL80211_MESH_POWER_MAX),
 9480	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
 9481	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
 9482	[NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
 9483	[NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
 9484	[NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
 9485};
 9486
 9487static const struct nla_policy
 9488	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
 9489	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
 9490	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
 9491	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
 9492	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
 9493	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
 9494	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
 9495	[NL80211_MESH_SETUP_IE] =
 9496		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 9497				       IEEE80211_MAX_DATA_LEN),
 9498	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
 9499};
 9500
 9501static int nl80211_parse_mesh_config(struct genl_info *info,
 9502				     struct mesh_config *cfg,
 9503				     u32 *mask_out)
 9504{
 9505	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
 9506	u32 mask = 0;
 9507	u16 ht_opmode;
 9508
 9509#define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)	\
 9510do {									\
 9511	if (tb[attr]) {							\
 9512		cfg->param = fn(tb[attr]);				\
 9513		mask |= BIT((attr) - 1);				\
 9514	}								\
 9515} while (0)
 9516
 9517	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
 9518		return -EINVAL;
 9519	if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
 9520		return -EINVAL;
 9521
 9522	/* This makes sure that there aren't more than 32 mesh config
 9523	 * parameters (otherwise our bitfield scheme would not work.) */
 9524	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
 9525
 9526	/* Fill in the params struct */
 9527	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
 9528				  NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
 9529	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
 9530				  NL80211_MESHCONF_CONFIRM_TIMEOUT,
 9531				  nla_get_u16);
 9532	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
 9533				  NL80211_MESHCONF_HOLDING_TIMEOUT,
 9534				  nla_get_u16);
 9535	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
 9536				  NL80211_MESHCONF_MAX_PEER_LINKS,
 9537				  nla_get_u16);
 9538	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
 9539				  NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
 9540	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
 9541				  NL80211_MESHCONF_TTL, nla_get_u8);
 9542	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
 9543				  NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
 9544	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
 9545				  NL80211_MESHCONF_AUTO_OPEN_PLINKS,
 9546				  nla_get_u8);
 9547	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
 9548				  mask,
 9549				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
 9550				  nla_get_u32);
 9551	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
 9552				  NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
 9553				  nla_get_u8);
 9554	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
 9555				  NL80211_MESHCONF_PATH_REFRESH_TIME,
 9556				  nla_get_u32);
 9557	if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
 9558	    (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
 9559		return -EINVAL;
 9560	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
 9561				  NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
 9562				  nla_get_u16);
 9563	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
 9564				  mask,
 9565				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
 9566				  nla_get_u32);
 9567	if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
 9568	    (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
 9569	     cfg->dot11MeshHWMPactivePathTimeout > 65535))
 9570		return -EINVAL;
 9571	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
 9572				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
 9573				  nla_get_u16);
 9574	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
 9575				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
 9576				  nla_get_u16);
 9577	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
 9578				  dot11MeshHWMPnetDiameterTraversalTime, mask,
 9579				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
 9580				  nla_get_u16);
 9581	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
 9582				  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
 9583	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
 9584				  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
 9585				  nla_get_u16);
 9586	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
 9587				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
 9588				  nla_get_u8);
 9589	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
 9590				  NL80211_MESHCONF_FORWARDING, nla_get_u8);
 9591	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
 9592				  NL80211_MESHCONF_RSSI_THRESHOLD,
 9593				  nla_get_s32);
 9594	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
 9595				  NL80211_MESHCONF_CONNECTED_TO_GATE,
 9596				  nla_get_u8);
 9597	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
 9598				  NL80211_MESHCONF_CONNECTED_TO_AS,
 9599				  nla_get_u8);
 9600	/*
 9601	 * Check HT operation mode based on
 9602	 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
 9603	 */
 9604	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
 9605		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
 9606
 9607		if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
 9608				  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
 9609				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
 9610			return -EINVAL;
 9611
 9612		/* NON_HT_STA bit is reserved, but some programs set it */
 9613		ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
 9614
 9615		cfg->ht_opmode = ht_opmode;
 9616		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
 9617	}
 9618	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
 9619				  dot11MeshHWMPactivePathToRootTimeout, mask,
 9620				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
 9621				  nla_get_u32);
 9622	if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
 9623	    (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
 9624	     cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
 9625		return -EINVAL;
 9626	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
 9627				  NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
 9628				  nla_get_u16);
 9629	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
 9630				  mask,
 9631				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
 9632				  nla_get_u16);
 9633	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
 9634				  NL80211_MESHCONF_POWER_MODE, nla_get_u32);
 9635	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
 9636				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
 9637	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
 9638				  NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
 9639	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
 9640				  NL80211_MESHCONF_NOLEARN, nla_get_u8);
 9641	if (mask_out)
 9642		*mask_out = mask;
 9643
 9644	return 0;
 9645
 9646#undef FILL_IN_MESH_PARAM_IF_SET
 9647}
 9648
 9649static int nl80211_parse_mesh_setup(struct genl_info *info,
 9650				     struct mesh_setup *setup)
 9651{
 9652	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9653	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
 9654
 9655	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
 9656		return -EINVAL;
 9657	if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
 9658		return -EINVAL;
 9659
 9660	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
 9661		setup->sync_method =
 9662		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
 9663		 IEEE80211_SYNC_METHOD_VENDOR :
 9664		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
 9665
 9666	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
 9667		setup->path_sel_proto =
 9668		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
 9669		 IEEE80211_PATH_PROTOCOL_VENDOR :
 9670		 IEEE80211_PATH_PROTOCOL_HWMP;
 9671
 9672	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
 9673		setup->path_metric =
 9674		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
 9675		 IEEE80211_PATH_METRIC_VENDOR :
 9676		 IEEE80211_PATH_METRIC_AIRTIME;
 9677
 9678	if (tb[NL80211_MESH_SETUP_IE]) {
 9679		struct nlattr *ieattr =
 9680			tb[NL80211_MESH_SETUP_IE];
 9681		setup->ie = nla_data(ieattr);
 9682		setup->ie_len = nla_len(ieattr);
 9683	}
 9684	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
 9685	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
 9686		return -EINVAL;
 9687	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
 9688	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
 9689	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
 9690	if (setup->is_secure)
 9691		setup->user_mpm = true;
 9692
 9693	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
 9694		if (!setup->user_mpm)
 9695			return -EINVAL;
 9696		setup->auth_id =
 9697			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
 9698	}
 9699
 9700	return 0;
 9701}
 9702
 9703static int nl80211_update_mesh_config(struct sk_buff *skb,
 9704				      struct genl_info *info)
 9705{
 9706	struct cfg80211_registered_device *rdev = info->user_ptr[0];
 9707	struct net_device *dev = info->user_ptr[1];
 9708	struct wireless_dev *wdev = dev->ieee80211_ptr;
 9709	struct mesh_config cfg = {};
 9710	u32 mask;
 9711	int err;
 9712
 9713	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
 9714		return -EOPNOTSUPP;
 9715
 9716	if (!rdev->ops->update_mesh_config)
 9717		return -EOPNOTSUPP;
 9718
 9719	err = nl80211_parse_mesh_config(info, &cfg, &mask);
 9720	if (err)
 9721		return err;
 9722
 9723	if (!wdev->u.mesh.id_len)
 9724		err = -ENOLINK;
 9725
 9726	if (!err)
 9727		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
 9728
 9729	return err;
 9730}
 9731
 9732static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
 9733			      struct sk_buff *msg)
 9734{
 9735	struct nlattr *nl_reg_rules;
 9736	unsigned int i;
 9737
 9738	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
 9739	    (regdom->dfs_region &&
 9740	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
 9741		goto nla_put_failure;
 9742
 9743	nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
 9744	if (!nl_reg_rules)
 9745		goto nla_put_failure;
 9746
 9747	for (i = 0; i < regdom->n_reg_rules; i++) {
 9748		struct nlattr *nl_reg_rule;
 9749		const struct ieee80211_reg_rule *reg_rule;
 9750		const struct ieee80211_freq_range *freq_range;
 9751		const struct ieee80211_power_rule *power_rule;
 9752		unsigned int max_bandwidth_khz;
 9753
 9754		reg_rule = &regdom->reg_rules[i];
 9755		freq_range = &reg_rule->freq_range;
 9756		power_rule = &reg_rule->power_rule;
 9757
 9758		nl_reg_rule = nla_nest_start_noflag(msg, i);
 9759		if (!nl_reg_rule)
 9760			goto nla_put_failure;
 9761
 9762		max_bandwidth_khz = freq_range->max_bandwidth_khz;
 9763		if (!max_bandwidth_khz)
 9764			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
 9765								  reg_rule);
 9766
 9767		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
 9768				reg_rule->flags) ||
 9769		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
 9770				freq_range->start_freq_khz) ||
 9771		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
 9772				freq_range->end_freq_khz) ||
 9773		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
 9774				max_bandwidth_khz) ||
 9775		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
 9776				power_rule->max_antenna_gain) ||
 9777		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
 9778				power_rule->max_eirp) ||
 9779		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
 9780				reg_rule->dfs_cac_ms))
 9781			goto nla_put_failure;
 9782
 9783		if ((reg_rule->flags & NL80211_RRF_PSD) &&
 9784		    nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
 9785			       reg_rule->psd))
 9786			goto nla_put_failure;
 9787
 9788		nla_nest_end(msg, nl_reg_rule);
 9789	}
 9790
 9791	nla_nest_end(msg, nl_reg_rules);
 9792	return 0;
 9793
 9794nla_put_failure:
 9795	return -EMSGSIZE;
 9796}
 9797
 9798static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
 9799{
 9800	const struct ieee80211_regdomain *regdom = NULL;
 9801	struct cfg80211_registered_device *rdev;
 9802	struct wiphy *wiphy = NULL;
 9803	struct sk_buff *msg;
 9804	int err = -EMSGSIZE;
 9805	void *hdr;
 9806
 9807	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
 9808	if (!msg)
 9809		return -ENOBUFS;
 9810
 9811	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
 9812			     NL80211_CMD_GET_REG);
 9813	if (!hdr)
 9814		goto put_failure;
 9815
 9816	rtnl_lock();
 9817
 9818	if (info->attrs[NL80211_ATTR_WIPHY]) {
 9819		bool self_managed;
 9820
 9821		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
 9822		if (IS_ERR(rdev)) {
 9823			err = PTR_ERR(rdev);
 9824			goto nla_put_failure;
 9825		}
 9826
 9827		wiphy = &rdev->wiphy;
 9828		self_managed = wiphy->regulatory_flags &
 9829			       REGULATORY_WIPHY_SELF_MANAGED;
 9830
 9831		rcu_read_lock();
 9832
 9833		regdom = get_wiphy_regdom(wiphy);
 9834
 9835		/* a self-managed-reg device must have a private regdom */
 9836		if (WARN_ON(!regdom && self_managed)) {
 9837			err = -EINVAL;
 9838			goto nla_put_failure_rcu;
 9839		}
 9840
 9841		if (regdom &&
 9842		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
 9843			goto nla_put_failure_rcu;
 9844	} else {
 9845		rcu_read_lock();
 9846	}
 9847
 9848	if (!wiphy && reg_last_request_cell_base() &&
 9849	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
 9850			NL80211_USER_REG_HINT_CELL_BASE))
 9851		goto nla_put_failure_rcu;
 9852
 9853	if (!regdom)
 9854		regdom = rcu_dereference(cfg80211_regdomain);
 9855
 9856	if (nl80211_put_regdom(regdom, msg))
 9857		goto nla_put_failure_rcu;
 9858
 9859	rcu_read_unlock();
 9860
 9861	genlmsg_end(msg, hdr);
 9862	rtnl_unlock();
 9863	return genlmsg_reply(msg, info);
 9864
 9865nla_put_failure_rcu:
 9866	rcu_read_unlock();
 9867nla_put_failure:
 9868	rtnl_unlock();
 9869put_failure:
 9870	nlmsg_free(msg);
 9871	return err;
 9872}
 9873
 9874static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
 9875			       u32 seq, int flags, struct wiphy *wiphy,
 9876			       const struct ieee80211_regdomain *regdom)
 9877{
 9878	void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
 9879				   NL80211_CMD_GET_REG);
 9880
 9881	if (!hdr)
 9882		return -1;
 9883
 9884	genl_dump_check_consistent(cb, hdr);
 9885
 9886	if (nl80211_put_regdom(regdom, msg))
 9887		goto nla_put_failure;
 9888
 9889	if (!wiphy && reg_last_request_cell_base() &&
 9890	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
 9891			NL80211_USER_REG_HINT_CELL_BASE))
 9892		goto nla_put_failure;
 9893
 9894	if (wiphy &&
 9895	    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
 9896		goto nla_put_failure;
 9897
 9898	if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
 9899	    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
 9900		goto nla_put_failure;
 9901
 9902	genlmsg_end(msg, hdr);
 9903	return 0;
 9904
 9905nla_put_failure:
 9906	genlmsg_cancel(msg, hdr);
 9907	return -EMSGSIZE;
 9908}
 9909
 9910static int nl80211_get_reg_dump(struct sk_buff *skb,
 9911				struct netlink_callback *cb)
 9912{
 9913	const struct ieee80211_regdomain *regdom = NULL;
 9914	struct cfg80211_registered_device *rdev;
 9915	int err, reg_idx, start = cb->args[2];
 9916
 9917	rcu_read_lock();
 9918
 9919	if (cfg80211_regdomain && start == 0) {
 9920		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
 9921					  NLM_F_MULTI, NULL,
 9922					  rcu_dereference(cfg80211_regdomain));
 9923		if (err < 0)
 9924			goto out_err;
 9925	}
 9926
 9927	/* the global regdom is idx 0 */
 9928	reg_idx = 1;
 9929	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
 9930		regdom = get_wiphy_regdom(&rdev->wiphy);
 9931		if (!regdom)
 9932			continue;
 9933
 9934		if (++reg_idx <= start)
 9935			continue;
 9936
 9937		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
 9938					  NLM_F_MULTI, &rdev->wiphy, regdom);
 9939		if (err < 0) {
 9940			reg_idx--;
 9941			break;
 9942		}
 9943	}
 9944
 9945	cb->args[2] = reg_idx;
 9946	err = skb->len;
 9947out_err:
 9948	rcu_read_unlock();
 9949	return err;
 9950}
 9951
 9952#ifdef CONFIG_CFG80211_CRDA_SUPPORT
 9953static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
 9954	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
 9955	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
 9956	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
 9957	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
 9958	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
 9959	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
 9960	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
 9961};
 9962
 9963static int parse_reg_rule(struct nlattr *tb[],
 9964	struct ieee80211_reg_rule *reg_rule)
 9965{
 9966	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
 9967	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
 9968
 9969	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
 9970		return -EINVAL;
 9971	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
 9972		return -EINVAL;
 9973	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
 9974		return -EINVAL;
 9975	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
 9976		return -EINVAL;
 9977	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
 9978		return -EINVAL;
 9979
 9980	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
 9981
 9982	freq_range->start_freq_khz =
 9983		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
 9984	freq_range->end_freq_khz =
 9985		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
 9986	freq_range->max_bandwidth_khz =
 9987		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
 9988
 9989	power_rule->max_eirp =
 9990		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
 9991
 9992	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
 9993		power_rule->max_antenna_gain =
 9994			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
 9995
 9996	if (tb[NL80211_ATTR_DFS_CAC_TIME])
 9997		reg_rule->dfs_cac_ms =
 9998			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
 9999
10000	return 0;
10001}
10002
10003static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
10004{
10005	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
10006	struct nlattr *nl_reg_rule;
10007	char *alpha2;
10008	int rem_reg_rules, r;
10009	u32 num_rules = 0, rule_idx = 0;
10010	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
10011	struct ieee80211_regdomain *rd;
10012
10013	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
10014		return -EINVAL;
10015
10016	if (!info->attrs[NL80211_ATTR_REG_RULES])
10017		return -EINVAL;
10018
10019	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
10020
10021	if (info->attrs[NL80211_ATTR_DFS_REGION])
10022		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
10023
10024	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10025			    rem_reg_rules) {
10026		num_rules++;
10027		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
10028			return -EINVAL;
10029	}
10030
10031	rtnl_lock();
10032	if (!reg_is_valid_request(alpha2)) {
10033		r = -EINVAL;
10034		goto out;
10035	}
10036
10037	rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
10038	if (!rd) {
10039		r = -ENOMEM;
10040		goto out;
10041	}
10042
10043	rd->n_reg_rules = num_rules;
10044	rd->alpha2[0] = alpha2[0];
10045	rd->alpha2[1] = alpha2[1];
10046
10047	/*
10048	 * Disable DFS master mode if the DFS region was
10049	 * not supported or known on this kernel.
10050	 */
10051	if (reg_supported_dfs_region(dfs_region))
10052		rd->dfs_region = dfs_region;
10053
10054	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
10055			    rem_reg_rules) {
10056		r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
10057						nl_reg_rule, reg_rule_policy,
10058						info->extack);
10059		if (r)
10060			goto bad_reg;
10061		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
10062		if (r)
10063			goto bad_reg;
10064
10065		rule_idx++;
10066
10067		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
10068			r = -EINVAL;
10069			goto bad_reg;
10070		}
10071	}
10072
10073	r = set_regdom(rd, REGD_SOURCE_CRDA);
10074	/* set_regdom takes ownership of rd */
10075	rd = NULL;
10076 bad_reg:
10077	kfree(rd);
10078 out:
10079	rtnl_unlock();
10080	return r;
10081}
10082#endif /* CONFIG_CFG80211_CRDA_SUPPORT */
10083
10084static int validate_scan_freqs(struct nlattr *freqs)
10085{
10086	struct nlattr *attr1, *attr2;
10087	int n_channels = 0, tmp1, tmp2;
10088
10089	nla_for_each_nested(attr1, freqs, tmp1)
10090		if (nla_len(attr1) != sizeof(u32))
10091			return 0;
10092
10093	nla_for_each_nested(attr1, freqs, tmp1) {
10094		n_channels++;
10095		/*
10096		 * Some hardware has a limited channel list for
10097		 * scanning, and it is pretty much nonsensical
10098		 * to scan for a channel twice, so disallow that
10099		 * and don't require drivers to check that the
10100		 * channel list they get isn't longer than what
10101		 * they can scan, as long as they can scan all
10102		 * the channels they registered at once.
10103		 */
10104		nla_for_each_nested(attr2, freqs, tmp2)
10105			if (attr1 != attr2 &&
10106			    nla_get_u32(attr1) == nla_get_u32(attr2))
10107				return 0;
10108	}
10109
10110	return n_channels;
10111}
10112
10113static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
10114{
10115	return b < NUM_NL80211_BANDS && wiphy->bands[b];
10116}
10117
10118static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
10119			    struct cfg80211_bss_selection *bss_select)
10120{
10121	struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
10122	struct nlattr *nest;
10123	int err;
10124	bool found = false;
10125	int i;
10126
10127	/* only process one nested attribute */
10128	nest = nla_data(nla);
10129	if (!nla_ok(nest, nla_len(nest)))
10130		return -EINVAL;
10131
10132	err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
10133					  nest, nl80211_bss_select_policy,
10134					  NULL);
10135	if (err)
10136		return err;
10137
10138	/* only one attribute may be given */
10139	for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
10140		if (attr[i]) {
10141			if (found)
10142				return -EINVAL;
10143			found = true;
10144		}
10145	}
10146
10147	bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
10148
10149	if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
10150		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
10151
10152	if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
10153		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
10154		bss_select->param.band_pref =
10155			nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
10156		if (!is_band_valid(wiphy, bss_select->param.band_pref))
10157			return -EINVAL;
10158	}
10159
10160	if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
10161		struct nl80211_bss_select_rssi_adjust *adj_param;
10162
10163		adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
10164		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
10165		bss_select->param.adjust.band = adj_param->band;
10166		bss_select->param.adjust.delta = adj_param->delta;
10167		if (!is_band_valid(wiphy, bss_select->param.adjust.band))
10168			return -EINVAL;
10169	}
10170
10171	/* user-space did not provide behaviour attribute */
10172	if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
10173		return -EINVAL;
10174
10175	if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
10176		return -EINVAL;
10177
10178	return 0;
10179}
10180
10181int nl80211_parse_random_mac(struct nlattr **attrs,
10182			     u8 *mac_addr, u8 *mac_addr_mask)
10183{
10184	int i;
10185
10186	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
10187		eth_zero_addr(mac_addr);
10188		eth_zero_addr(mac_addr_mask);
10189		mac_addr[0] = 0x2;
10190		mac_addr_mask[0] = 0x3;
10191
10192		return 0;
10193	}
10194
10195	/* need both or none */
10196	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
10197		return -EINVAL;
10198
10199	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
10200	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
10201
10202	/* don't allow or configure an mcast address */
10203	if (!is_multicast_ether_addr(mac_addr_mask) ||
10204	    is_multicast_ether_addr(mac_addr))
10205		return -EINVAL;
10206
10207	/*
10208	 * allow users to pass a MAC address that has bits set outside
10209	 * of the mask, but don't bother drivers with having to deal
10210	 * with such bits
10211	 */
10212	for (i = 0; i < ETH_ALEN; i++)
10213		mac_addr[i] &= mac_addr_mask[i];
10214
10215	return 0;
10216}
10217
10218static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
10219					      struct ieee80211_channel *chan)
10220{
10221	unsigned int link_id;
10222	bool all_ok = true;
10223	int radio_idx;
10224
10225	lockdep_assert_wiphy(wdev->wiphy);
10226
10227	if (!cfg80211_wdev_channel_allowed(wdev, chan))
10228		return false;
10229
10230	if (!cfg80211_beaconing_iface_active(wdev))
10231		return true;
10232
10233	radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy, chan);
10234
10235	/*
10236	 * FIXME: check if we have a free radio/link for chan
10237	 *
10238	 * This, as well as the FIXME below, requires knowing the link
10239	 * capabilities of the hardware.
10240	 */
10241
10242	/* we cannot leave radar channels */
10243	for_each_valid_link(wdev, link_id) {
10244		struct cfg80211_chan_def *chandef;
10245		int link_radio_idx;
10246
10247		chandef = wdev_chandef(wdev, link_id);
10248		if (!chandef || !chandef->chan)
10249			continue;
10250
10251		if (!(chandef->chan->flags & IEEE80211_CHAN_RADAR))
10252			continue;
10253
10254		/*
10255		 * chandef->chan is a radar channel. If the radio/link onto
10256		 * which this radar channel falls is the same radio/link onto
10257		 * which the input 'chan' falls, off-channel operation should
10258		 * not be allowed. Hence, set 'all_ok' to false.
10259		 */
10260
10261		link_radio_idx = cfg80211_get_radio_idx_by_chan(wdev->wiphy,
10262								chandef->chan);
10263		if (link_radio_idx == radio_idx) {
10264			all_ok = false;
10265			break;
10266		}
10267	}
10268
10269	if (all_ok)
10270		return true;
10271
10272	return regulatory_pre_cac_allowed(wdev->wiphy);
10273}
10274
10275static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
10276				    enum nl80211_ext_feature_index feat)
10277{
10278	if (!(flags & flag))
10279		return true;
10280	if (wiphy_ext_feature_isset(wiphy, feat))
10281		return true;
10282	return false;
10283}
10284
10285static int
10286nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
10287			 struct nlattr **attrs, u8 *mac_addr, u8 *mac_addr_mask,
10288			 u32 *flags, enum nl80211_feature_flags randomness_flag)
10289{
10290	if (!attrs[NL80211_ATTR_SCAN_FLAGS])
10291		return 0;
10292
10293	*flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
10294
10295	if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
10296	     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
10297	    !nl80211_check_scan_feat(wiphy, *flags,
10298				     NL80211_SCAN_FLAG_LOW_SPAN,
10299				     NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
10300	    !nl80211_check_scan_feat(wiphy, *flags,
10301				     NL80211_SCAN_FLAG_LOW_POWER,
10302				     NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
10303	    !nl80211_check_scan_feat(wiphy, *flags,
10304				     NL80211_SCAN_FLAG_HIGH_ACCURACY,
10305				     NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
10306	    !nl80211_check_scan_feat(wiphy, *flags,
10307				     NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
10308				     NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
10309	    !nl80211_check_scan_feat(wiphy, *flags,
10310				     NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
10311				     NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
10312	    !nl80211_check_scan_feat(wiphy, *flags,
10313				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
10314				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
10315	    !nl80211_check_scan_feat(wiphy, *flags,
10316				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
10317				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
10318	    !nl80211_check_scan_feat(wiphy, *flags,
10319				     NL80211_SCAN_FLAG_RANDOM_SN,
10320				     NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
10321	    !nl80211_check_scan_feat(wiphy, *flags,
10322				     NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
10323				     NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
10324		return -EOPNOTSUPP;
10325
10326	if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
10327		int err;
10328
10329		if (!(wiphy->features & randomness_flag) ||
10330		    (wdev && wdev->connected))
10331			return -EOPNOTSUPP;
10332
10333		err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
10334		if (err)
10335			return err;
10336	}
10337
10338	return 0;
10339}
10340
10341static int
10342nl80211_check_scan_flags_sched(struct wiphy *wiphy, struct wireless_dev *wdev,
10343			       struct nlattr **attrs,
10344			       struct cfg80211_sched_scan_request *req)
10345{
10346	return nl80211_check_scan_flags(wiphy, wdev, attrs,
10347					req->mac_addr, req->mac_addr_mask,
10348					&req->flags,
10349					wdev ? NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
10350					       NL80211_FEATURE_ND_RANDOM_MAC_ADDR);
10351}
10352
10353static int
10354nl80211_check_scan_flags_reg(struct wiphy *wiphy, struct wireless_dev *wdev,
10355			     struct nlattr **attrs,
10356			     struct cfg80211_scan_request_int *req)
10357{
10358	return nl80211_check_scan_flags(wiphy, wdev, attrs,
10359					req->req.mac_addr,
10360					req->req.mac_addr_mask,
10361					&req->req.flags,
10362					NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR);
10363}
10364
10365static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
10366{
10367	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10368	struct wireless_dev *wdev = info->user_ptr[1];
10369	struct cfg80211_scan_request_int *request;
10370	struct nlattr *scan_freqs = NULL;
10371	bool scan_freqs_khz = false;
10372	struct nlattr *attr;
10373	struct wiphy *wiphy;
10374	int err, tmp, n_ssids = 0, n_channels, i;
10375	size_t ie_len, size;
10376	size_t ssids_offset, ie_offset;
10377
10378	wiphy = &rdev->wiphy;
10379
10380	if (wdev->iftype == NL80211_IFTYPE_NAN)
10381		return -EOPNOTSUPP;
10382
10383	if (!rdev->ops->scan)
10384		return -EOPNOTSUPP;
10385
10386	if (rdev->scan_req || rdev->scan_msg)
10387		return -EBUSY;
10388
10389	if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
10390		if (!wiphy_ext_feature_isset(wiphy,
10391					     NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
10392			return -EOPNOTSUPP;
10393		scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
10394		scan_freqs_khz = true;
10395	} else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
10396		scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
10397
10398	if (scan_freqs) {
10399		n_channels = validate_scan_freqs(scan_freqs);
10400		if (!n_channels)
10401			return -EINVAL;
10402	} else {
10403		n_channels = ieee80211_get_num_supported_channels(wiphy);
10404	}
10405
10406	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
10407		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
10408			n_ssids++;
10409
10410	if (n_ssids > wiphy->max_scan_ssids)
10411		return -EINVAL;
10412
10413	if (info->attrs[NL80211_ATTR_IE])
10414		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10415	else
10416		ie_len = 0;
10417
10418	if (ie_len > wiphy->max_scan_ie_len)
10419		return -EINVAL;
10420
10421	size = struct_size(request, req.channels, n_channels);
10422	ssids_offset = size;
10423	size = size_add(size, array_size(sizeof(*request->req.ssids), n_ssids));
10424	ie_offset = size;
10425	size = size_add(size, ie_len);
10426	request = kzalloc(size, GFP_KERNEL);
10427	if (!request)
10428		return -ENOMEM;
10429
10430	if (n_ssids)
10431		request->req.ssids = (void *)request + ssids_offset;
10432	request->req.n_ssids = n_ssids;
10433	if (ie_len)
10434		request->req.ie = (void *)request + ie_offset;
10435
10436	i = 0;
10437	if (scan_freqs) {
10438		/* user specified, bail out if channel not found */
10439		nla_for_each_nested(attr, scan_freqs, tmp) {
10440			struct ieee80211_channel *chan;
10441			int freq = nla_get_u32(attr);
10442
10443			if (!scan_freqs_khz)
10444				freq = MHZ_TO_KHZ(freq);
10445
10446			chan = ieee80211_get_channel_khz(wiphy, freq);
10447			if (!chan) {
10448				err = -EINVAL;
10449				goto out_free;
10450			}
10451
10452			/* Ignore disabled / no primary channels */
10453			if (chan->flags & IEEE80211_CHAN_DISABLED ||
10454			    chan->flags & IEEE80211_CHAN_S1G_NO_PRIMARY ||
10455			    !cfg80211_wdev_channel_allowed(wdev, chan))
10456				continue;
10457
10458			request->req.channels[i] = chan;
10459			i++;
10460		}
10461	} else {
10462		enum nl80211_band band;
10463
10464		/* all channels */
10465		for (band = 0; band < NUM_NL80211_BANDS; band++) {
10466			int j;
10467
10468			if (!wiphy->bands[band])
10469				continue;
10470			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10471				struct ieee80211_channel *chan;
10472
10473				chan = &wiphy->bands[band]->channels[j];
10474
10475				if (chan->flags & IEEE80211_CHAN_DISABLED ||
10476				    chan->flags &
10477					    IEEE80211_CHAN_S1G_NO_PRIMARY ||
10478				    !cfg80211_wdev_channel_allowed(wdev, chan))
10479					continue;
10480
10481				request->req.channels[i] = chan;
10482				i++;
10483			}
10484		}
10485	}
10486
10487	if (!i) {
10488		err = -EINVAL;
10489		goto out_free;
10490	}
10491
10492	request->req.n_channels = i;
10493
10494	for (i = 0; i < request->req.n_channels; i++) {
10495		struct ieee80211_channel *chan = request->req.channels[i];
10496
10497		/* if we can go off-channel to the target channel we're good */
10498		if (cfg80211_off_channel_oper_allowed(wdev, chan))
10499			continue;
10500
10501		if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
10502			err = -EBUSY;
10503			goto out_free;
10504		}
10505	}
10506
10507	i = 0;
10508	if (n_ssids) {
10509		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
10510			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10511				err = -EINVAL;
10512				goto out_free;
10513			}
10514			request->req.ssids[i].ssid_len = nla_len(attr);
10515			memcpy(request->req.ssids[i].ssid,
10516			       nla_data(attr), nla_len(attr));
10517			i++;
10518		}
10519	}
10520
10521	if (info->attrs[NL80211_ATTR_IE]) {
10522		request->req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10523		memcpy((void *)request->req.ie,
10524		       nla_data(info->attrs[NL80211_ATTR_IE]),
10525		       request->req.ie_len);
10526	}
10527
10528	for (i = 0; i < NUM_NL80211_BANDS; i++)
10529		if (wiphy->bands[i])
10530			request->req.rates[i] =
10531				(1 << wiphy->bands[i]->n_bitrates) - 1;
10532
10533	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
10534		nla_for_each_nested(attr,
10535				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
10536				    tmp) {
10537			enum nl80211_band band = nla_type(attr);
10538
10539			if (band < 0 || band >= NUM_NL80211_BANDS) {
10540				err = -EINVAL;
10541				goto out_free;
10542			}
10543
10544			if (!wiphy->bands[band])
10545				continue;
10546
10547			err = ieee80211_get_ratemask(wiphy->bands[band],
10548						     nla_data(attr),
10549						     nla_len(attr),
10550						     &request->req.rates[band]);
10551			if (err)
10552				goto out_free;
10553		}
10554	}
10555
10556	if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
10557		request->req.duration =
10558			nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
10559		request->req.duration_mandatory =
10560			nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
10561	}
10562
10563	err = nl80211_check_scan_flags_reg(wiphy, wdev, info->attrs, request);
10564	if (err)
10565		goto out_free;
10566
10567	request->req.no_cck =
10568		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10569
10570	/* Initial implementation used NL80211_ATTR_MAC to set the specific
10571	 * BSSID to scan for. This was problematic because that same attribute
10572	 * was already used for another purpose (local random MAC address). The
10573	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
10574	 * compatibility with older userspace components, also use the
10575	 * NL80211_ATTR_MAC value here if it can be determined to be used for
10576	 * the specific BSSID use case instead of the random MAC address
10577	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
10578	 */
10579	if (info->attrs[NL80211_ATTR_BSSID])
10580		memcpy(request->req.bssid,
10581		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
10582	else if (!(request->req.flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
10583		 info->attrs[NL80211_ATTR_MAC])
10584		memcpy(request->req.bssid,
10585		       nla_data(info->attrs[NL80211_ATTR_MAC]),
10586		       ETH_ALEN);
10587	else
10588		eth_broadcast_addr(request->req.bssid);
10589
10590	request->req.tsf_report_link_id =
10591		nl80211_link_id_or_invalid(info->attrs);
10592	request->req.wdev = wdev;
10593	request->req.wiphy = &rdev->wiphy;
10594	request->req.scan_start = jiffies;
10595
10596	rdev->scan_req = request;
10597	err = cfg80211_scan(rdev);
10598
10599	if (err)
10600		goto out_free;
10601
10602	nl80211_send_scan_start(rdev, wdev);
10603	dev_hold(wdev->netdev);
10604
10605	return 0;
10606
10607 out_free:
10608	rdev->scan_req = NULL;
10609	kfree(request);
10610
10611	return err;
10612}
10613
10614static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
10615{
10616	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10617	struct wireless_dev *wdev = info->user_ptr[1];
10618
10619	if (!rdev->ops->abort_scan)
10620		return -EOPNOTSUPP;
10621
10622	if (rdev->scan_msg)
10623		return 0;
10624
10625	if (!rdev->scan_req)
10626		return -ENOENT;
10627
10628	rdev_abort_scan(rdev, wdev);
10629	return 0;
10630}
10631
10632static int
10633nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
10634			       struct cfg80211_sched_scan_request *request,
10635			       struct nlattr **attrs)
10636{
10637	int tmp, err, i = 0;
10638	struct nlattr *attr;
10639
10640	if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10641		u32 interval;
10642
10643		/*
10644		 * If scan plans are not specified,
10645		 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
10646		 * case one scan plan will be set with the specified scan
10647		 * interval and infinite number of iterations.
10648		 */
10649		interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
10650		if (!interval)
10651			return -EINVAL;
10652
10653		request->scan_plans[0].interval =
10654			DIV_ROUND_UP(interval, MSEC_PER_SEC);
10655		if (!request->scan_plans[0].interval)
10656			return -EINVAL;
10657
10658		if (request->scan_plans[0].interval >
10659		    wiphy->max_sched_scan_plan_interval)
10660			request->scan_plans[0].interval =
10661				wiphy->max_sched_scan_plan_interval;
10662
10663		return 0;
10664	}
10665
10666	nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
10667		struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
10668
10669		if (WARN_ON(i >= n_plans))
10670			return -EINVAL;
10671
10672		err = nla_parse_nested_deprecated(plan,
10673						  NL80211_SCHED_SCAN_PLAN_MAX,
10674						  attr, nl80211_plan_policy,
10675						  NULL);
10676		if (err)
10677			return err;
10678
10679		if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
10680			return -EINVAL;
10681
10682		request->scan_plans[i].interval =
10683			nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
10684		if (!request->scan_plans[i].interval ||
10685		    request->scan_plans[i].interval >
10686		    wiphy->max_sched_scan_plan_interval)
10687			return -EINVAL;
10688
10689		if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
10690			request->scan_plans[i].iterations =
10691				nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
10692			if (!request->scan_plans[i].iterations ||
10693			    (request->scan_plans[i].iterations >
10694			     wiphy->max_sched_scan_plan_iterations))
10695				return -EINVAL;
10696		} else if (i < n_plans - 1) {
10697			/*
10698			 * All scan plans but the last one must specify
10699			 * a finite number of iterations
10700			 */
10701			return -EINVAL;
10702		}
10703
10704		i++;
10705	}
10706
10707	/*
10708	 * The last scan plan must not specify the number of
10709	 * iterations, it is supposed to run infinitely
10710	 */
10711	if (request->scan_plans[n_plans - 1].iterations)
10712		return  -EINVAL;
10713
10714	return 0;
10715}
10716
10717static struct cfg80211_sched_scan_request *
10718nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
10719			 struct nlattr **attrs, int max_match_sets)
10720{
10721	struct cfg80211_sched_scan_request *request;
10722	struct nlattr *attr;
10723	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
10724	enum nl80211_band band;
10725	size_t ie_len, size;
10726	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
10727	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
10728
10729	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10730		n_channels = validate_scan_freqs(
10731				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
10732		if (!n_channels)
10733			return ERR_PTR(-EINVAL);
10734	} else {
10735		n_channels = ieee80211_get_num_supported_channels(wiphy);
10736	}
10737
10738	if (attrs[NL80211_ATTR_SCAN_SSIDS])
10739		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10740				    tmp)
10741			n_ssids++;
10742
10743	if (n_ssids > wiphy->max_sched_scan_ssids)
10744		return ERR_PTR(-EINVAL);
10745
10746	/*
10747	 * First, count the number of 'real' matchsets. Due to an issue with
10748	 * the old implementation, matchsets containing only the RSSI attribute
10749	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
10750	 * RSSI for all matchsets, rather than their own matchset for reporting
10751	 * all APs with a strong RSSI. This is needed to be compatible with
10752	 * older userspace that treated a matchset with only the RSSI as the
10753	 * global RSSI for all other matchsets - if there are other matchsets.
10754	 */
10755	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10756		nla_for_each_nested(attr,
10757				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10758				    tmp) {
10759			struct nlattr *rssi;
10760
10761			err = nla_parse_nested_deprecated(tb,
10762							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10763							  attr,
10764							  nl80211_match_policy,
10765							  NULL);
10766			if (err)
10767				return ERR_PTR(err);
10768
10769			/* SSID and BSSID are mutually exclusive */
10770			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
10771			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
10772				return ERR_PTR(-EINVAL);
10773
10774			/* add other standalone attributes here */
10775			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
10776			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
10777				n_match_sets++;
10778				continue;
10779			}
10780			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10781			if (rssi)
10782				default_match_rssi = nla_get_s32(rssi);
10783		}
10784	}
10785
10786	/* However, if there's no other matchset, add the RSSI one */
10787	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
10788		n_match_sets = 1;
10789
10790	if (n_match_sets > max_match_sets)
10791		return ERR_PTR(-EINVAL);
10792
10793	if (attrs[NL80211_ATTR_IE])
10794		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
10795	else
10796		ie_len = 0;
10797
10798	if (ie_len > wiphy->max_sched_scan_ie_len)
10799		return ERR_PTR(-EINVAL);
10800
10801	if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
10802		/*
10803		 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
10804		 * each scan plan already specifies its own interval
10805		 */
10806		if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10807			return ERR_PTR(-EINVAL);
10808
10809		nla_for_each_nested(attr,
10810				    attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
10811			n_plans++;
10812	} else {
10813		/*
10814		 * The scan interval attribute is kept for backward
10815		 * compatibility. If no scan plans are specified and sched scan
10816		 * interval is specified, one scan plan will be set with this
10817		 * scan interval and infinite number of iterations.
10818		 */
10819		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
10820			return ERR_PTR(-EINVAL);
10821
10822		n_plans = 1;
10823	}
10824
10825	if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
10826		return ERR_PTR(-EINVAL);
10827
10828	if (!wiphy_ext_feature_isset(
10829		    wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
10830	    (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
10831	     attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
10832		return ERR_PTR(-EINVAL);
10833
10834	size = struct_size(request, channels, n_channels);
10835	size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
10836	size = size_add(size, array_size(sizeof(*request->match_sets),
10837					 n_match_sets));
10838	size = size_add(size, array_size(sizeof(*request->scan_plans),
10839					 n_plans));
10840	size = size_add(size, ie_len);
10841	request = kzalloc(size, GFP_KERNEL);
10842	if (!request)
10843		return ERR_PTR(-ENOMEM);
10844	request->n_channels = n_channels;
10845
10846	if (n_ssids)
10847		request->ssids = (void *)request +
10848			struct_size(request, channels, n_channels);
10849	request->n_ssids = n_ssids;
10850	if (ie_len) {
10851		if (n_ssids)
10852			request->ie = (void *)(request->ssids + n_ssids);
10853		else
10854			request->ie = (void *)(request->channels + n_channels);
10855	}
10856
10857	if (n_match_sets) {
10858		if (request->ie)
10859			request->match_sets = (void *)(request->ie + ie_len);
10860		else if (n_ssids)
10861			request->match_sets =
10862				(void *)(request->ssids + n_ssids);
10863		else
10864			request->match_sets =
10865				(void *)(request->channels + n_channels);
10866	}
10867	request->n_match_sets = n_match_sets;
10868
10869	if (n_match_sets)
10870		request->scan_plans = (void *)(request->match_sets +
10871					       n_match_sets);
10872	else if (request->ie)
10873		request->scan_plans = (void *)(request->ie + ie_len);
10874	else if (n_ssids)
10875		request->scan_plans = (void *)(request->ssids + n_ssids);
10876	else
10877		request->scan_plans = (void *)(request->channels + n_channels);
10878
10879	request->n_scan_plans = n_plans;
10880
10881	i = 0;
10882	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
10883		/* user specified, bail out if channel not found */
10884		nla_for_each_nested(attr,
10885				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
10886				    tmp) {
10887			struct ieee80211_channel *chan;
10888
10889			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
10890
10891			if (!chan) {
10892				err = -EINVAL;
10893				goto out_free;
10894			}
10895
10896			/* ignore disabled channels */
10897			if (chan->flags & IEEE80211_CHAN_DISABLED)
10898				continue;
10899
10900			request->channels[i] = chan;
10901			i++;
10902		}
10903	} else {
10904		/* all channels */
10905		for (band = 0; band < NUM_NL80211_BANDS; band++) {
10906			int j;
10907
10908			if (!wiphy->bands[band])
10909				continue;
10910			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
10911				struct ieee80211_channel *chan;
10912
10913				chan = &wiphy->bands[band]->channels[j];
10914
10915				if (chan->flags & IEEE80211_CHAN_DISABLED)
10916					continue;
10917
10918				request->channels[i] = chan;
10919				i++;
10920			}
10921		}
10922	}
10923
10924	if (!i) {
10925		err = -EINVAL;
10926		goto out_free;
10927	}
10928
10929	request->n_channels = i;
10930
10931	i = 0;
10932	if (n_ssids) {
10933		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
10934				    tmp) {
10935			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
10936				err = -EINVAL;
10937				goto out_free;
10938			}
10939			request->ssids[i].ssid_len = nla_len(attr);
10940			memcpy(request->ssids[i].ssid, nla_data(attr),
10941			       nla_len(attr));
10942			i++;
10943		}
10944	}
10945
10946	i = 0;
10947	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
10948		nla_for_each_nested(attr,
10949				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
10950				    tmp) {
10951			struct nlattr *ssid, *bssid, *rssi;
10952
10953			err = nla_parse_nested_deprecated(tb,
10954							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
10955							  attr,
10956							  nl80211_match_policy,
10957							  NULL);
10958			if (err)
10959				goto out_free;
10960			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
10961			bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
10962
10963			if (!ssid && !bssid) {
10964				i++;
10965				continue;
10966			}
10967
10968			if (WARN_ON(i >= n_match_sets)) {
10969				/* this indicates a programming error,
10970				 * the loop above should have verified
10971				 * things properly
10972				 */
10973				err = -EINVAL;
10974				goto out_free;
10975			}
10976
10977			if (ssid) {
10978				memcpy(request->match_sets[i].ssid.ssid,
10979				       nla_data(ssid), nla_len(ssid));
10980				request->match_sets[i].ssid.ssid_len =
10981					nla_len(ssid);
10982			}
10983			if (bssid)
10984				memcpy(request->match_sets[i].bssid,
10985				       nla_data(bssid), ETH_ALEN);
10986
10987			/* special attribute - old implementation w/a */
10988			request->match_sets[i].rssi_thold = default_match_rssi;
10989			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
10990			if (rssi)
10991				request->match_sets[i].rssi_thold =
10992					nla_get_s32(rssi);
10993			i++;
10994		}
10995
10996		/* there was no other matchset, so the RSSI one is alone */
10997		if (i == 0 && n_match_sets)
10998			request->match_sets[0].rssi_thold = default_match_rssi;
10999
11000		request->min_rssi_thold = INT_MAX;
11001		for (i = 0; i < n_match_sets; i++)
11002			request->min_rssi_thold =
11003				min(request->match_sets[i].rssi_thold,
11004				    request->min_rssi_thold);
11005	} else {
11006		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
11007	}
11008
11009	if (ie_len) {
11010		request->ie_len = ie_len;
11011		memcpy((void *)request->ie,
11012		       nla_data(attrs[NL80211_ATTR_IE]),
11013		       request->ie_len);
11014	}
11015
11016	err = nl80211_check_scan_flags_sched(wiphy, wdev, attrs, request);
11017	if (err)
11018		goto out_free;
11019
11020	if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
11021		request->delay =
11022			nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
11023
11024	if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
11025		request->relative_rssi = nla_get_s8(
11026			attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
11027		request->relative_rssi_set = true;
11028	}
11029
11030	if (request->relative_rssi_set &&
11031	    attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
11032		struct nl80211_bss_select_rssi_adjust *rssi_adjust;
11033
11034		rssi_adjust = nla_data(
11035			attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
11036		request->rssi_adjust.band = rssi_adjust->band;
11037		request->rssi_adjust.delta = rssi_adjust->delta;
11038		if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
11039			err = -EINVAL;
11040			goto out_free;
11041		}
11042	}
11043
11044	err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
11045	if (err)
11046		goto out_free;
11047
11048	request->scan_start = jiffies;
11049
11050	return request;
11051
11052out_free:
11053	kfree(request);
11054	return ERR_PTR(err);
11055}
11056
11057static int nl80211_start_sched_scan(struct sk_buff *skb,
11058				    struct genl_info *info)
11059{
11060	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11061	struct net_device *dev = info->user_ptr[1];
11062	struct wireless_dev *wdev = dev->ieee80211_ptr;
11063	struct cfg80211_sched_scan_request *sched_scan_req;
11064	bool want_multi;
11065	int err;
11066
11067	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
11068		return -EOPNOTSUPP;
11069
11070	want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
11071	err = cfg80211_sched_scan_req_possible(rdev, want_multi);
11072	if (err)
11073		return err;
11074
11075	sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
11076						  info->attrs,
11077						  rdev->wiphy.max_match_sets);
11078
11079	err = PTR_ERR_OR_ZERO(sched_scan_req);
11080	if (err)
11081		goto out_err;
11082
11083	/* leave request id zero for legacy request
11084	 * or if driver does not support multi-scheduled scan
11085	 */
11086	if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
11087		sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
11088
11089	err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
11090	if (err)
11091		goto out_free;
11092
11093	sched_scan_req->dev = dev;
11094	sched_scan_req->wiphy = &rdev->wiphy;
11095
11096	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11097		sched_scan_req->owner_nlportid = info->snd_portid;
11098
11099	cfg80211_add_sched_scan_req(rdev, sched_scan_req);
11100
11101	nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
11102	return 0;
11103
11104out_free:
11105	kfree(sched_scan_req);
11106out_err:
11107	return err;
11108}
11109
11110static int nl80211_stop_sched_scan(struct sk_buff *skb,
11111				   struct genl_info *info)
11112{
11113	struct cfg80211_sched_scan_request *req;
11114	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11115	u64 cookie;
11116
11117	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
11118		return -EOPNOTSUPP;
11119
11120	if (info->attrs[NL80211_ATTR_COOKIE]) {
11121		cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11122		return __cfg80211_stop_sched_scan(rdev, cookie, false);
11123	}
11124
11125	req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
11126				     struct cfg80211_sched_scan_request,
11127				     list);
11128	if (!req || req->reqid ||
11129	    (req->owner_nlportid &&
11130	     req->owner_nlportid != info->snd_portid))
11131		return -ENOENT;
11132
11133	return cfg80211_stop_sched_scan_req(rdev, req, false);
11134}
11135
11136static int nl80211_start_radar_detection(struct sk_buff *skb,
11137					 struct genl_info *info)
11138{
11139	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11140	struct net_device *dev = info->user_ptr[1];
11141	struct wireless_dev *wdev = dev->ieee80211_ptr;
11142	int link_id = nl80211_link_id(info->attrs);
11143	struct wiphy *wiphy = wdev->wiphy;
11144	struct cfg80211_chan_def chandef;
11145	enum nl80211_dfs_regions dfs_region;
11146	unsigned int cac_time_ms;
11147	int err;
11148
11149	flush_delayed_work(&rdev->dfs_update_channels_wk);
11150
11151	switch (wdev->iftype) {
11152	case NL80211_IFTYPE_AP:
11153	case NL80211_IFTYPE_P2P_GO:
11154	case NL80211_IFTYPE_MESH_POINT:
11155	case NL80211_IFTYPE_ADHOC:
11156		break;
11157	default:
11158		/* caution - see cfg80211_beaconing_iface_active() below */
11159		return -EINVAL;
11160	}
11161
11162	guard(wiphy)(wiphy);
11163
11164	dfs_region = reg_get_dfs_region(wiphy);
11165	if (dfs_region == NL80211_DFS_UNSET)
11166		return -EINVAL;
11167
11168	err = nl80211_parse_chandef(rdev, info, &chandef);
11169	if (err)
11170		return err;
11171
11172	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11173	if (err < 0)
11174		return err;
11175
11176	if (err == 0)
11177		return -EINVAL;
11178
11179	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
11180		return -EINVAL;
11181
11182	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND]))
11183		return cfg80211_start_background_radar_detection(rdev, wdev,
11184								 &chandef);
11185
11186	if (cfg80211_beaconing_iface_active(wdev)) {
11187		/* During MLO other link(s) can beacon, only the current link
11188		 * can not already beacon
11189		 */
11190		if (wdev->valid_links &&
11191		    !wdev->links[link_id].ap.beacon_interval) {
11192			/* nothing */
11193		} else {
11194			return -EBUSY;
11195		}
11196	}
11197
11198	if (wdev->links[link_id].cac_started)
11199		return -EBUSY;
11200
11201	/* CAC start is offloaded to HW and can't be started manually */
11202	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
11203		return -EOPNOTSUPP;
11204
11205	if (!rdev->ops->start_radar_detection)
11206		return -EOPNOTSUPP;
11207
11208	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
11209	if (WARN_ON(!cac_time_ms))
11210		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
11211
11212	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms,
11213					 link_id);
11214	if (err)
11215		return err;
11216
11217	switch (wdev->iftype) {
11218	case NL80211_IFTYPE_AP:
11219	case NL80211_IFTYPE_P2P_GO:
11220		wdev->links[link_id].ap.chandef = chandef;
11221		break;
11222	case NL80211_IFTYPE_ADHOC:
11223		wdev->u.ibss.chandef = chandef;
11224		break;
11225	case NL80211_IFTYPE_MESH_POINT:
11226		wdev->u.mesh.chandef = chandef;
11227		break;
11228	default:
11229		break;
11230	}
11231	wdev->links[link_id].cac_started = true;
11232	wdev->links[link_id].cac_start_time = jiffies;
11233	wdev->links[link_id].cac_time_ms = cac_time_ms;
11234
11235	return 0;
11236}
11237
11238static int nl80211_notify_radar_detection(struct sk_buff *skb,
11239					  struct genl_info *info)
11240{
11241	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11242	struct net_device *dev = info->user_ptr[1];
11243	struct wireless_dev *wdev = dev->ieee80211_ptr;
11244	struct wiphy *wiphy = wdev->wiphy;
11245	struct cfg80211_chan_def chandef;
11246	enum nl80211_dfs_regions dfs_region;
11247	int err;
11248
11249	dfs_region = reg_get_dfs_region(wiphy);
11250	if (dfs_region == NL80211_DFS_UNSET) {
11251		GENL_SET_ERR_MSG(info,
11252				 "DFS Region is not set. Unexpected Radar indication");
11253		return -EINVAL;
11254	}
11255
11256	err = nl80211_parse_chandef(rdev, info, &chandef);
11257	if (err) {
11258		GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
11259		return err;
11260	}
11261
11262	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
11263	if (err < 0) {
11264		GENL_SET_ERR_MSG(info, "chandef is invalid");
11265		return err;
11266	}
11267
11268	if (err == 0) {
11269		GENL_SET_ERR_MSG(info,
11270				 "Unexpected Radar indication for chandef/iftype");
11271		return -EINVAL;
11272	}
11273
11274	/* Do not process this notification if radar is already detected
11275	 * by kernel on this channel, and return success.
11276	 */
11277	if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
11278		return 0;
11279
11280	cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
11281
11282	cfg80211_sched_dfs_chan_update(rdev);
11283
11284	rdev->radar_chandef = chandef;
11285
11286	/* Propagate this notification to other radios as well */
11287	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
11288
11289	return 0;
11290}
11291
11292static int nl80211_parse_counter_offsets(struct cfg80211_registered_device *rdev,
11293					 const u8 *data, size_t datalen,
11294					 int first_count, struct nlattr *attr,
11295					 const u16 **offsets, unsigned int *n_offsets)
11296{
11297	int i;
11298
11299	*n_offsets = 0;
11300
11301	if (!attr)
11302		return 0;
11303
11304	if (!nla_len(attr) || (nla_len(attr) % sizeof(u16)))
11305		return -EINVAL;
11306
11307	*n_offsets = nla_len(attr) / sizeof(u16);
11308	if (rdev->wiphy.max_num_csa_counters &&
11309	    (*n_offsets > rdev->wiphy.max_num_csa_counters))
11310		return -EINVAL;
11311
11312	*offsets = nla_data(attr);
11313
11314	/* sanity checks - counters should fit and be the same */
11315	for (i = 0; i < *n_offsets; i++) {
11316		u16 offset = (*offsets)[i];
11317
11318		if (offset >= datalen)
11319			return -EINVAL;
11320
11321		if (first_count != -1 && data[offset] != first_count)
11322			return -EINVAL;
11323	}
11324
11325	return 0;
11326}
11327
11328static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
11329{
11330	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11331	unsigned int link_id = nl80211_link_id(info->attrs);
11332	struct net_device *dev = info->user_ptr[1];
11333	struct wireless_dev *wdev = dev->ieee80211_ptr;
11334	struct cfg80211_csa_settings params;
11335	struct nlattr **csa_attrs = NULL;
11336	int err;
11337	bool need_new_beacon = false;
11338	bool need_handle_dfs_flag = true;
11339	u32 cs_count;
11340
11341	if (!rdev->ops->channel_switch ||
11342	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
11343		return -EOPNOTSUPP;
11344
11345	switch (dev->ieee80211_ptr->iftype) {
11346	case NL80211_IFTYPE_AP:
11347	case NL80211_IFTYPE_P2P_GO:
11348		need_new_beacon = true;
11349		/* For all modes except AP the handle_dfs flag needs to be
11350		 * supplied to tell the kernel that userspace will handle radar
11351		 * events when they happen. Otherwise a switch to a channel
11352		 * requiring DFS will be rejected.
11353		 */
11354		need_handle_dfs_flag = false;
11355
11356		/* useless if AP is not running */
11357		if (!wdev->links[link_id].ap.beacon_interval)
11358			return -ENOTCONN;
11359		break;
11360	case NL80211_IFTYPE_ADHOC:
11361		if (!wdev->u.ibss.ssid_len)
11362			return -ENOTCONN;
11363		break;
11364	case NL80211_IFTYPE_MESH_POINT:
11365		if (!wdev->u.mesh.id_len)
11366			return -ENOTCONN;
11367		break;
11368	default:
11369		return -EOPNOTSUPP;
11370	}
11371
11372	memset(&params, 0, sizeof(params));
11373	params.beacon_csa.ftm_responder = -1;
11374
11375	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11376	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
11377		return -EINVAL;
11378
11379	/* only important for AP, IBSS and mesh create IEs internally */
11380	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
11381		return -EINVAL;
11382
11383	/* Even though the attribute is u32, the specification says
11384	 * u8, so let's make sure we don't overflow.
11385	 */
11386	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
11387	if (cs_count > 255)
11388		return -EINVAL;
11389
11390	params.count = cs_count;
11391
11392	if (!need_new_beacon)
11393		goto skip_beacons;
11394
11395	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
11396				   info->extack);
11397	if (err)
11398		goto free;
11399
11400	csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
11401			    GFP_KERNEL);
11402	if (!csa_attrs) {
11403		err = -ENOMEM;
11404		goto free;
11405	}
11406
11407	err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
11408					  info->attrs[NL80211_ATTR_CSA_IES],
11409					  nl80211_policy, info->extack);
11410	if (err)
11411		goto free;
11412
11413	err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
11414				   info->extack);
11415	if (err)
11416		goto free;
11417
11418	if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
11419		err = -EINVAL;
11420		goto free;
11421	}
11422
11423	err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.tail,
11424					    params.beacon_csa.tail_len,
11425					    params.count,
11426					    csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON],
11427					    &params.counter_offsets_beacon,
11428					    &params.n_counter_offsets_beacon);
11429	if (err)
11430		goto free;
11431
11432	err = nl80211_parse_counter_offsets(rdev, params.beacon_csa.probe_resp,
11433					    params.beacon_csa.probe_resp_len,
11434					    params.count,
11435					    csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP],
11436					    &params.counter_offsets_presp,
11437					    &params.n_counter_offsets_presp);
11438	if (err)
11439		goto free;
11440
11441skip_beacons:
11442	err = nl80211_parse_chandef(rdev, info, &params.chandef);
11443	if (err)
11444		goto free;
11445
11446	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
11447					   wdev->iftype)) {
11448		err = -EINVAL;
11449		goto free;
11450	}
11451
11452	err = cfg80211_chandef_dfs_required(wdev->wiphy,
11453					    &params.chandef,
11454					    wdev->iftype);
11455	if (err < 0)
11456		goto free;
11457
11458	if (err > 0) {
11459		params.radar_required = true;
11460		if (need_handle_dfs_flag &&
11461		    !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
11462			err = -EINVAL;
11463			goto free;
11464		}
11465	}
11466
11467	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
11468		params.block_tx = true;
11469
11470	if ((wdev->iftype == NL80211_IFTYPE_AP ||
11471	     wdev->iftype == NL80211_IFTYPE_P2P_GO) &&
11472	    info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
11473		err = nl80211_parse_unsol_bcast_probe_resp(
11474			rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
11475			&params.unsol_bcast_probe_resp);
11476		if (err)
11477			goto free;
11478	}
11479
11480	params.link_id = link_id;
11481	err = rdev_channel_switch(rdev, dev, &params);
11482
11483free:
11484	kfree(params.beacon_after.mbssid_ies);
11485	kfree(params.beacon_csa.mbssid_ies);
11486	kfree(params.beacon_after.rnr_ies);
11487	kfree(params.beacon_csa.rnr_ies);
11488	kfree(csa_attrs);
11489	return err;
11490}
11491
11492static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
11493			    u32 seq, int flags,
11494			    struct cfg80211_registered_device *rdev,
11495			    struct wireless_dev *wdev,
11496			    struct cfg80211_internal_bss *intbss)
11497{
11498	struct cfg80211_bss *res = &intbss->pub;
11499	const struct cfg80211_bss_ies *ies;
11500	unsigned int link_id;
11501	void *hdr;
11502	struct nlattr *bss;
11503
11504	lockdep_assert_wiphy(wdev->wiphy);
11505
11506	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
11507			     NL80211_CMD_NEW_SCAN_RESULTS);
11508	if (!hdr)
11509		return -1;
11510
11511	genl_dump_check_consistent(cb, hdr);
11512
11513	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
11514		goto nla_put_failure;
11515	if (wdev->netdev &&
11516	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
11517		goto nla_put_failure;
11518	if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11519			      NL80211_ATTR_PAD))
11520		goto nla_put_failure;
11521
11522	bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
11523	if (!bss)
11524		goto nla_put_failure;
11525	if ((!is_zero_ether_addr(res->bssid) &&
11526	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
11527		goto nla_put_failure;
11528
11529	rcu_read_lock();
11530	/* indicate whether we have probe response data or not */
11531	if (rcu_access_pointer(res->proberesp_ies) &&
11532	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
11533		goto fail_unlock_rcu;
11534
11535	/* this pointer prefers to be pointed to probe response data
11536	 * but is always valid
11537	 */
11538	ies = rcu_dereference(res->ies);
11539	if (ies) {
11540		if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
11541				      NL80211_BSS_PAD))
11542			goto fail_unlock_rcu;
11543		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
11544					ies->len, ies->data))
11545			goto fail_unlock_rcu;
11546	}
11547
11548	/* and this pointer is always (unless driver didn't know) beacon data */
11549	ies = rcu_dereference(res->beacon_ies);
11550	if (ies && ies->from_beacon) {
11551		if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
11552				      NL80211_BSS_PAD))
11553			goto fail_unlock_rcu;
11554		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
11555					ies->len, ies->data))
11556			goto fail_unlock_rcu;
11557	}
11558	rcu_read_unlock();
11559
11560	if (res->beacon_interval &&
11561	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
11562		goto nla_put_failure;
11563	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
11564	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
11565	    nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
11566			res->channel->freq_offset) ||
11567	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
11568			jiffies_to_msecs(jiffies - intbss->ts)))
11569		goto nla_put_failure;
11570
11571	if (intbss->parent_tsf &&
11572	    (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
11573			       intbss->parent_tsf, NL80211_BSS_PAD) ||
11574	     nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
11575		     intbss->parent_bssid)))
11576		goto nla_put_failure;
11577
11578	if (res->ts_boottime &&
11579	    nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
11580			      res->ts_boottime, NL80211_BSS_PAD))
11581		goto nla_put_failure;
11582
11583	if (!nl80211_put_signal(msg, intbss->pub.chains,
11584				intbss->pub.chain_signal,
11585				NL80211_BSS_CHAIN_SIGNAL))
11586		goto nla_put_failure;
11587
11588	if (intbss->bss_source != BSS_SOURCE_STA_PROFILE) {
11589		switch (rdev->wiphy.signal_type) {
11590		case CFG80211_SIGNAL_TYPE_MBM:
11591			if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM,
11592					res->signal))
11593				goto nla_put_failure;
11594			break;
11595		case CFG80211_SIGNAL_TYPE_UNSPEC:
11596			if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC,
11597				       res->signal))
11598				goto nla_put_failure;
11599			break;
11600		default:
11601			break;
11602		}
11603	}
11604
11605	switch (wdev->iftype) {
11606	case NL80211_IFTYPE_P2P_CLIENT:
11607	case NL80211_IFTYPE_STATION:
11608		for_each_valid_link(wdev, link_id) {
11609			if (intbss == wdev->links[link_id].client.current_bss &&
11610			    (nla_put_u32(msg, NL80211_BSS_STATUS,
11611					 NL80211_BSS_STATUS_ASSOCIATED) ||
11612			     (wdev->valid_links &&
11613			      (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
11614					  link_id) ||
11615			       nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
11616				       wdev->u.client.connected_addr)))))
11617				goto nla_put_failure;
11618		}
11619		break;
11620	case NL80211_IFTYPE_ADHOC:
11621		if (intbss == wdev->u.ibss.current_bss &&
11622		    nla_put_u32(msg, NL80211_BSS_STATUS,
11623				NL80211_BSS_STATUS_IBSS_JOINED))
11624			goto nla_put_failure;
11625		break;
11626	default:
11627		break;
11628	}
11629
11630	if (nla_put_u32(msg, NL80211_BSS_USE_FOR, res->use_for))
11631		goto nla_put_failure;
11632
11633	if (res->cannot_use_reasons &&
11634	    nla_put_u64_64bit(msg, NL80211_BSS_CANNOT_USE_REASONS,
11635			      res->cannot_use_reasons,
11636			      NL80211_BSS_PAD))
11637		goto nla_put_failure;
11638
11639	nla_nest_end(msg, bss);
11640
11641	genlmsg_end(msg, hdr);
11642	return 0;
11643
11644 fail_unlock_rcu:
11645	rcu_read_unlock();
11646 nla_put_failure:
11647	genlmsg_cancel(msg, hdr);
11648	return -EMSGSIZE;
11649}
11650
11651static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
11652{
11653	struct cfg80211_registered_device *rdev;
11654	struct cfg80211_internal_bss *scan;
11655	struct wireless_dev *wdev;
11656	struct nlattr **attrbuf;
11657	int start = cb->args[2], idx = 0;
11658	bool dump_include_use_data;
11659	int err;
11660
11661	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11662	if (!attrbuf)
11663		return -ENOMEM;
11664
11665	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11666	if (err) {
11667		kfree(attrbuf);
11668		return err;
11669	}
11670	/* nl80211_prepare_wdev_dump acquired it in the successful case */
11671	__acquire(&rdev->wiphy.mtx);
11672
11673	dump_include_use_data =
11674		attrbuf[NL80211_ATTR_BSS_DUMP_INCLUDE_USE_DATA];
11675	kfree(attrbuf);
11676
11677	spin_lock_bh(&rdev->bss_lock);
11678
11679	/*
11680	 * dump_scan will be called multiple times to break up the scan results
11681	 * into multiple messages.  It is unlikely that any more bss-es will be
11682	 * expired after the first call, so only call only call this on the
11683	 * first dump_scan invocation.
11684	 */
11685	if (start == 0)
11686		cfg80211_bss_expire(rdev);
11687
11688	cb->seq = rdev->bss_generation;
11689
11690	list_for_each_entry(scan, &rdev->bss_list, list) {
11691		if (++idx <= start)
11692			continue;
11693		if (!dump_include_use_data &&
11694		    !(scan->pub.use_for & NL80211_BSS_USE_FOR_NORMAL))
11695			continue;
11696		if (nl80211_send_bss(skb, cb,
11697				cb->nlh->nlmsg_seq, NLM_F_MULTI,
11698				rdev, wdev, scan) < 0) {
11699			idx--;
11700			break;
11701		}
11702	}
11703
11704	spin_unlock_bh(&rdev->bss_lock);
11705
11706	cb->args[2] = idx;
11707	wiphy_unlock(&rdev->wiphy);
11708
11709	return skb->len;
11710}
11711
11712static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
11713			       int flags, struct net_device *dev,
11714			       bool allow_radio_stats,
11715			       struct survey_info *survey)
11716{
11717	void *hdr;
11718	struct nlattr *infoattr;
11719
11720	/* skip radio stats if userspace didn't request them */
11721	if (!survey->channel && !allow_radio_stats)
11722		return 0;
11723
11724	hdr = nl80211hdr_put(msg, portid, seq, flags,
11725			     NL80211_CMD_NEW_SURVEY_RESULTS);
11726	if (!hdr)
11727		return -ENOMEM;
11728
11729	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11730		goto nla_put_failure;
11731
11732	infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
11733	if (!infoattr)
11734		goto nla_put_failure;
11735
11736	if (survey->channel &&
11737	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
11738			survey->channel->center_freq))
11739		goto nla_put_failure;
11740
11741	if (survey->channel && survey->channel->freq_offset &&
11742	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
11743			survey->channel->freq_offset))
11744		goto nla_put_failure;
11745
11746	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
11747	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
11748		goto nla_put_failure;
11749	if ((survey->filled & SURVEY_INFO_IN_USE) &&
11750	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
11751		goto nla_put_failure;
11752	if ((survey->filled & SURVEY_INFO_TIME) &&
11753	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
11754			survey->time, NL80211_SURVEY_INFO_PAD))
11755		goto nla_put_failure;
11756	if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
11757	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
11758			      survey->time_busy, NL80211_SURVEY_INFO_PAD))
11759		goto nla_put_failure;
11760	if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
11761	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
11762			      survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
11763		goto nla_put_failure;
11764	if ((survey->filled & SURVEY_INFO_TIME_RX) &&
11765	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
11766			      survey->time_rx, NL80211_SURVEY_INFO_PAD))
11767		goto nla_put_failure;
11768	if ((survey->filled & SURVEY_INFO_TIME_TX) &&
11769	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
11770			      survey->time_tx, NL80211_SURVEY_INFO_PAD))
11771		goto nla_put_failure;
11772	if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
11773	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
11774			      survey->time_scan, NL80211_SURVEY_INFO_PAD))
11775		goto nla_put_failure;
11776	if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
11777	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
11778			      survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
11779		goto nla_put_failure;
11780
11781	nla_nest_end(msg, infoattr);
11782
11783	genlmsg_end(msg, hdr);
11784	return 0;
11785
11786 nla_put_failure:
11787	genlmsg_cancel(msg, hdr);
11788	return -EMSGSIZE;
11789}
11790
11791static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
11792{
11793	struct nlattr **attrbuf;
11794	struct survey_info survey;
11795	struct cfg80211_registered_device *rdev;
11796	struct wireless_dev *wdev;
11797	int survey_idx = cb->args[2];
11798	int res;
11799	bool radio_stats;
11800
11801	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
11802	if (!attrbuf)
11803		return -ENOMEM;
11804
11805	res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
11806	if (res) {
11807		kfree(attrbuf);
11808		return res;
11809	}
11810	/* nl80211_prepare_wdev_dump acquired it in the successful case */
11811	__acquire(&rdev->wiphy.mtx);
11812
11813	/* prepare_wdev_dump parsed the attributes */
11814	radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
11815
11816	if (!wdev->netdev) {
11817		res = -EINVAL;
11818		goto out_err;
11819	}
11820
11821	if (!rdev->ops->dump_survey) {
11822		res = -EOPNOTSUPP;
11823		goto out_err;
11824	}
11825
11826	while (1) {
11827		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
11828		if (res == -ENOENT)
11829			break;
11830		if (res)
11831			goto out_err;
11832
11833		/* don't send disabled channels, but do send non-channel data */
11834		if (survey.channel &&
11835		    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
11836			survey_idx++;
11837			continue;
11838		}
11839
11840		if (nl80211_send_survey(skb,
11841				NETLINK_CB(cb->skb).portid,
11842				cb->nlh->nlmsg_seq, NLM_F_MULTI,
11843				wdev->netdev, radio_stats, &survey) < 0)
11844			goto out;
11845		survey_idx++;
11846	}
11847
11848 out:
11849	cb->args[2] = survey_idx;
11850	res = skb->len;
11851 out_err:
11852	kfree(attrbuf);
11853	wiphy_unlock(&rdev->wiphy);
11854	return res;
11855}
11856
11857static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
11858{
11859	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11860	struct net_device *dev = info->user_ptr[1];
11861	struct ieee80211_channel *chan;
11862	const u8 *bssid, *ssid;
11863	int err, ssid_len;
11864	enum nl80211_auth_type auth_type;
11865	struct key_parse key;
11866	bool local_state_change;
11867	struct cfg80211_auth_request req = {};
11868	u32 freq;
11869
11870	if (!info->attrs[NL80211_ATTR_MAC])
11871		return -EINVAL;
11872
11873	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
11874		return -EINVAL;
11875
11876	if (!info->attrs[NL80211_ATTR_SSID])
11877		return -EINVAL;
11878
11879	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11880		return -EINVAL;
11881
11882	err = nl80211_parse_key(info, &key);
11883	if (err)
11884		return err;
11885
11886	if (key.idx >= 0) {
11887		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
11888			return -EINVAL;
11889		if (!key.p.key || !key.p.key_len)
11890			return -EINVAL;
11891		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
11892		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
11893		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
11894		     key.p.key_len != WLAN_KEY_LEN_WEP104))
11895			return -EINVAL;
11896		if (key.idx > 3)
11897			return -EINVAL;
11898	} else {
11899		key.p.key_len = 0;
11900		key.p.key = NULL;
11901	}
11902
11903	if (key.idx >= 0) {
11904		int i;
11905		bool ok = false;
11906
11907		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
11908			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
11909				ok = true;
11910				break;
11911			}
11912		}
11913		if (!ok)
11914			return -EINVAL;
11915	}
11916
11917	if (!rdev->ops->auth)
11918		return -EOPNOTSUPP;
11919
11920	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11921	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11922		return -EOPNOTSUPP;
11923
11924	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11925	freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11926	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11927		freq +=
11928		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11929
11930	chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
11931	if (!chan)
11932		return -EINVAL;
11933
11934	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11935	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11936
11937	if (info->attrs[NL80211_ATTR_IE]) {
11938		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11939		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11940	}
11941
11942	if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
11943		req.supported_selectors =
11944			nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11945		req.supported_selectors_len =
11946			nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
11947	}
11948
11949	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11950	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
11951		return -EINVAL;
11952
11953	if ((auth_type == NL80211_AUTHTYPE_SAE ||
11954	     auth_type == NL80211_AUTHTYPE_FILS_SK ||
11955	     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
11956	     auth_type == NL80211_AUTHTYPE_FILS_PK) &&
11957	    !info->attrs[NL80211_ATTR_AUTH_DATA])
11958		return -EINVAL;
11959
11960	if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
11961		if (auth_type != NL80211_AUTHTYPE_SAE &&
11962		    auth_type != NL80211_AUTHTYPE_FILS_SK &&
11963		    auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
11964		    auth_type != NL80211_AUTHTYPE_FILS_PK)
11965			return -EINVAL;
11966		req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
11967		req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
11968	}
11969
11970	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11971
11972	/*
11973	 * Since we no longer track auth state, ignore
11974	 * requests to only change local state.
11975	 */
11976	if (local_state_change)
11977		return 0;
11978
11979	req.auth_type = auth_type;
11980	req.key = key.p.key;
11981	req.key_len = key.p.key_len;
11982	req.key_idx = key.idx;
11983	req.link_id = nl80211_link_id_or_invalid(info->attrs);
11984	if (req.link_id >= 0) {
11985		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11986			return -EINVAL;
11987		if (!info->attrs[NL80211_ATTR_MLD_ADDR])
11988			return -EINVAL;
11989		req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11990		if (!is_valid_ether_addr(req.ap_mld_addr))
11991			return -EINVAL;
11992	}
11993
11994	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
11995				   IEEE80211_BSS_TYPE_ESS,
11996				   IEEE80211_PRIVACY_ANY);
11997	if (!req.bss)
11998		return -ENOENT;
11999
12000	err = cfg80211_mlme_auth(rdev, dev, &req);
12001
12002	cfg80211_put_bss(&rdev->wiphy, req.bss);
12003
12004	return err;
12005}
12006
12007static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
12008				     struct genl_info *info)
12009{
12010	if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12011		GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
12012		return -EINVAL;
12013	}
12014
12015	if (!rdev->ops->tx_control_port ||
12016	    !wiphy_ext_feature_isset(&rdev->wiphy,
12017				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12018		return -EOPNOTSUPP;
12019
12020	return 0;
12021}
12022
12023static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
12024				   struct genl_info *info,
12025				   struct cfg80211_crypto_settings *settings,
12026				   int cipher_limit)
12027{
12028	memset(settings, 0, sizeof(*settings));
12029
12030	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
12031
12032	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12033		u16 proto;
12034
12035		proto = nla_get_u16(
12036			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12037		settings->control_port_ethertype = cpu_to_be16(proto);
12038		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
12039		    proto != ETH_P_PAE)
12040			return -EINVAL;
12041		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
12042			settings->control_port_no_encrypt = true;
12043	} else
12044		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
12045
12046	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12047		int r = validate_pae_over_nl80211(rdev, info);
12048
12049		if (r < 0)
12050			return r;
12051
12052		settings->control_port_over_nl80211 = true;
12053
12054		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
12055			settings->control_port_no_preauth = true;
12056	}
12057
12058	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
12059		void *data;
12060		int len, i;
12061
12062		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12063		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
12064		settings->n_ciphers_pairwise = len / sizeof(u32);
12065
12066		if (len % sizeof(u32))
12067			return -EINVAL;
12068
12069		if (settings->n_ciphers_pairwise > cipher_limit)
12070			return -EINVAL;
12071
12072		memcpy(settings->ciphers_pairwise, data, len);
12073
12074		for (i = 0; i < settings->n_ciphers_pairwise; i++)
12075			if (!cfg80211_supported_cipher_suite(
12076					&rdev->wiphy,
12077					settings->ciphers_pairwise[i]))
12078				return -EINVAL;
12079	}
12080
12081	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
12082		settings->cipher_group =
12083			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
12084		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
12085						     settings->cipher_group))
12086			return -EINVAL;
12087	}
12088
12089	if (info->attrs[NL80211_ATTR_WPA_VERSIONS])
12090		settings->wpa_versions =
12091			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
12092
12093	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
12094		void *data;
12095		int len;
12096
12097		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
12098		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
12099		settings->n_akm_suites = len / sizeof(u32);
12100
12101		if (len % sizeof(u32))
12102			return -EINVAL;
12103
12104		if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
12105			return -EINVAL;
12106
12107		memcpy(settings->akm_suites, data, len);
12108	}
12109
12110	if (info->attrs[NL80211_ATTR_PMK]) {
12111		if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
12112			return -EINVAL;
12113		if (!wiphy_ext_feature_isset(&rdev->wiphy,
12114					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
12115		    !wiphy_ext_feature_isset(&rdev->wiphy,
12116					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
12117			return -EINVAL;
12118		settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12119	}
12120
12121	if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
12122		if (!wiphy_ext_feature_isset(&rdev->wiphy,
12123					     NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
12124		    !wiphy_ext_feature_isset(&rdev->wiphy,
12125					     NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
12126			return -EINVAL;
12127		settings->sae_pwd =
12128			nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12129		settings->sae_pwd_len =
12130			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
12131	}
12132
12133	settings->sae_pwe =
12134		nla_get_u8_default(info->attrs[NL80211_ATTR_SAE_PWE],
12135				   NL80211_SAE_PWE_UNSPECIFIED);
12136
12137	return 0;
12138}
12139
12140static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
12141					      const u8 *ssid, int ssid_len,
12142					      struct nlattr **attrs,
12143					      int assoc_link_id, int link_id)
12144{
12145	struct ieee80211_channel *chan;
12146	struct cfg80211_bss *bss;
12147	const u8 *bssid;
12148	u32 freq, use_for = 0;
12149
12150	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
12151		return ERR_PTR(-EINVAL);
12152
12153	bssid = nla_data(attrs[NL80211_ATTR_MAC]);
12154
12155	freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
12156	if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
12157		freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
12158
12159	chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
12160	if (!chan)
12161		return ERR_PTR(-EINVAL);
12162
12163	if (assoc_link_id >= 0)
12164		use_for = NL80211_BSS_USE_FOR_MLD_LINK;
12165	if (assoc_link_id == link_id)
12166		use_for |= NL80211_BSS_USE_FOR_NORMAL;
12167
12168	bss = __cfg80211_get_bss(&rdev->wiphy, chan, bssid,
12169				 ssid, ssid_len,
12170				 IEEE80211_BSS_TYPE_ESS,
12171				 IEEE80211_PRIVACY_ANY,
12172				 use_for);
12173	if (!bss)
12174		return ERR_PTR(-ENOENT);
12175
12176	return bss;
12177}
12178
12179static int nl80211_process_links(struct cfg80211_registered_device *rdev,
12180				 struct cfg80211_assoc_link *links,
12181				 int assoc_link_id,
12182				 const u8 *ssid, int ssid_len,
12183				 struct genl_info *info)
12184{
12185	unsigned int attrsize = NUM_NL80211_ATTR * sizeof(struct nlattr *);
12186	struct nlattr **attrs __free(kfree) = kzalloc(attrsize, GFP_KERNEL);
12187	struct nlattr *link;
12188	unsigned int link_id;
12189	int rem, err;
12190
12191	if (!attrs)
12192		return -ENOMEM;
12193
12194	nla_for_each_nested(link, info->attrs[NL80211_ATTR_MLO_LINKS], rem) {
12195		memset(attrs, 0, attrsize);
12196
12197		nla_parse_nested(attrs, NL80211_ATTR_MAX, link, NULL, NULL);
12198
12199		if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
12200			NL_SET_BAD_ATTR(info->extack, link);
12201			return -EINVAL;
12202		}
12203
12204		link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
12205		/* cannot use the same link ID again */
12206		if (links[link_id].bss) {
12207			NL_SET_BAD_ATTR(info->extack, link);
12208			return -EINVAL;
12209		}
12210		links[link_id].bss =
12211			nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
12212					  assoc_link_id, link_id);
12213		if (IS_ERR(links[link_id].bss)) {
12214			err = PTR_ERR(links[link_id].bss);
12215			links[link_id].bss = NULL;
12216			NL_SET_ERR_MSG_ATTR(info->extack, link,
12217					    "Error fetching BSS for link");
12218			return err;
12219		}
12220
12221		if (attrs[NL80211_ATTR_IE]) {
12222			links[link_id].elems = nla_data(attrs[NL80211_ATTR_IE]);
12223			links[link_id].elems_len =
12224				nla_len(attrs[NL80211_ATTR_IE]);
12225
12226			if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
12227					       links[link_id].elems,
12228					       links[link_id].elems_len)) {
12229				NL_SET_ERR_MSG_ATTR(info->extack,
12230						    attrs[NL80211_ATTR_IE],
12231						    "cannot deal with fragmentation");
12232				return -EINVAL;
12233			}
12234
12235			if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12236						   links[link_id].elems,
12237						   links[link_id].elems_len)) {
12238				NL_SET_ERR_MSG_ATTR(info->extack,
12239						    attrs[NL80211_ATTR_IE],
12240						    "cannot deal with non-inheritance");
12241				return -EINVAL;
12242			}
12243		}
12244	}
12245
12246	return 0;
12247}
12248
12249static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
12250{
12251	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12252	struct net_device *dev = info->user_ptr[1];
12253	struct cfg80211_assoc_request req = {};
12254	const u8 *ap_addr, *ssid;
12255	unsigned int link_id;
12256	int err, ssid_len;
12257
12258	if (dev->ieee80211_ptr->conn_owner_nlportid &&
12259	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12260		return -EPERM;
12261
12262	if (!info->attrs[NL80211_ATTR_SSID])
12263		return -EINVAL;
12264
12265	if (!rdev->ops->assoc)
12266		return -EOPNOTSUPP;
12267
12268	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12269	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12270		return -EOPNOTSUPP;
12271
12272	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12273	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12274
12275	if (info->attrs[NL80211_ATTR_IE]) {
12276		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12277		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12278
12279		if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
12280					   req.ie, req.ie_len)) {
12281			NL_SET_ERR_MSG_ATTR(info->extack,
12282					    info->attrs[NL80211_ATTR_IE],
12283					    "non-inheritance makes no sense");
12284			return -EINVAL;
12285		}
12286	}
12287
12288	if (info->attrs[NL80211_ATTR_USE_MFP]) {
12289		enum nl80211_mfp mfp =
12290			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
12291		if (mfp == NL80211_MFP_REQUIRED)
12292			req.use_mfp = true;
12293		else if (mfp != NL80211_MFP_NO)
12294			return -EINVAL;
12295	}
12296
12297	if (info->attrs[NL80211_ATTR_PREV_BSSID])
12298		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
12299
12300	if (info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]) {
12301		req.supported_selectors =
12302			nla_data(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12303		req.supported_selectors_len =
12304			nla_len(info->attrs[NL80211_ATTR_SUPPORTED_SELECTORS]);
12305	}
12306
12307	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
12308		req.flags |= ASSOC_REQ_DISABLE_HT;
12309
12310	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12311		memcpy(&req.ht_capa_mask,
12312		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12313		       sizeof(req.ht_capa_mask));
12314
12315	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12316		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12317			return -EINVAL;
12318		memcpy(&req.ht_capa,
12319		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12320		       sizeof(req.ht_capa));
12321	}
12322
12323	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
12324		req.flags |= ASSOC_REQ_DISABLE_VHT;
12325
12326	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
12327		req.flags |= ASSOC_REQ_DISABLE_HE;
12328
12329	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
12330		req.flags |= ASSOC_REQ_DISABLE_EHT;
12331
12332	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12333		memcpy(&req.vht_capa_mask,
12334		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
12335		       sizeof(req.vht_capa_mask));
12336
12337	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
12338		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
12339			return -EINVAL;
12340		memcpy(&req.vht_capa,
12341		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
12342		       sizeof(req.vht_capa));
12343	}
12344
12345	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
12346		if (!((rdev->wiphy.features &
12347			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
12348		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
12349		    !wiphy_ext_feature_isset(&rdev->wiphy,
12350					     NL80211_EXT_FEATURE_RRM))
12351			return -EINVAL;
12352		req.flags |= ASSOC_REQ_USE_RRM;
12353	}
12354
12355	if (info->attrs[NL80211_ATTR_FILS_KEK]) {
12356		req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
12357		req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
12358		if (!info->attrs[NL80211_ATTR_FILS_NONCES])
12359			return -EINVAL;
12360		req.fils_nonces =
12361			nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
12362	}
12363
12364	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
12365		if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
12366			return -EINVAL;
12367		memcpy(&req.s1g_capa_mask,
12368		       nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
12369		       sizeof(req.s1g_capa_mask));
12370	}
12371
12372	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
12373		if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
12374			return -EINVAL;
12375		memcpy(&req.s1g_capa,
12376		       nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
12377		       sizeof(req.s1g_capa));
12378	}
12379
12380	if (nla_get_flag(info->attrs[NL80211_ATTR_ASSOC_SPP_AMSDU])) {
12381		if (!wiphy_ext_feature_isset(&rdev->wiphy,
12382					     NL80211_EXT_FEATURE_SPP_AMSDU_SUPPORT)) {
12383			GENL_SET_ERR_MSG(info, "SPP A-MSDUs not supported");
12384			return -EINVAL;
12385		}
12386		req.flags |= ASSOC_REQ_SPP_AMSDU;
12387	}
12388
12389	req.link_id = nl80211_link_id_or_invalid(info->attrs);
12390
12391	if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12392		if (req.link_id < 0)
12393			return -EINVAL;
12394
12395		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
12396			return -EINVAL;
12397
12398		if (info->attrs[NL80211_ATTR_MAC] ||
12399		    info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12400		    !info->attrs[NL80211_ATTR_MLD_ADDR])
12401			return -EINVAL;
12402
12403		req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
12404		ap_addr = req.ap_mld_addr;
12405
12406		err = nl80211_process_links(rdev, req.links, req.link_id,
12407					    ssid, ssid_len, info);
12408		if (err)
12409			goto free;
12410
12411		if (!req.links[req.link_id].bss) {
12412			err = -EINVAL;
12413			goto free;
12414		}
12415
12416		if (req.links[req.link_id].elems_len) {
12417			GENL_SET_ERR_MSG(info,
12418					 "cannot have per-link elems on assoc link");
12419			err = -EINVAL;
12420			goto free;
12421		}
12422
12423		if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12424			req.ext_mld_capa_ops =
12425				nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
12426	} else {
12427		if (req.link_id >= 0)
12428			return -EINVAL;
12429
12430		req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
12431					    -1, -1);
12432		if (IS_ERR(req.bss))
12433			return PTR_ERR(req.bss);
12434		ap_addr = req.bss->bssid;
12435
12436		if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
12437			return -EINVAL;
12438	}
12439
12440	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
12441	if (!err) {
12442		struct nlattr *link;
12443		int rem = 0;
12444
12445		err = cfg80211_mlme_assoc(rdev, dev, &req,
12446					  info->extack);
12447
12448		if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12449			dev->ieee80211_ptr->conn_owner_nlportid =
12450				info->snd_portid;
12451			memcpy(dev->ieee80211_ptr->disconnect_bssid,
12452			       ap_addr, ETH_ALEN);
12453		}
12454
12455		/* Report error from first problematic link */
12456		if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
12457			nla_for_each_nested(link,
12458					    info->attrs[NL80211_ATTR_MLO_LINKS],
12459					    rem) {
12460				struct nlattr *link_id_attr =
12461					nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
12462
12463				if (!link_id_attr)
12464					continue;
12465
12466				link_id = nla_get_u8(link_id_attr);
12467
12468				if (link_id == req.link_id)
12469					continue;
12470
12471				if (!req.links[link_id].error ||
12472				    WARN_ON(req.links[link_id].error > 0))
12473					continue;
12474
12475				WARN_ON(err >= 0);
12476
12477				NL_SET_BAD_ATTR(info->extack, link);
12478				err = req.links[link_id].error;
12479				break;
12480			}
12481		}
12482	}
12483
12484free:
12485	for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
12486		cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
12487	cfg80211_put_bss(&rdev->wiphy, req.bss);
12488
12489	return err;
12490}
12491
12492static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
12493{
12494	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12495	struct net_device *dev = info->user_ptr[1];
12496	const u8 *ie = NULL, *bssid;
12497	int ie_len = 0;
12498	u16 reason_code;
12499	bool local_state_change;
12500
12501	if (dev->ieee80211_ptr->conn_owner_nlportid &&
12502	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12503		return -EPERM;
12504
12505	if (!info->attrs[NL80211_ATTR_MAC])
12506		return -EINVAL;
12507
12508	if (!info->attrs[NL80211_ATTR_REASON_CODE])
12509		return -EINVAL;
12510
12511	if (!rdev->ops->deauth)
12512		return -EOPNOTSUPP;
12513
12514	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12515	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12516		return -EOPNOTSUPP;
12517
12518	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12519
12520	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12521	if (reason_code == 0) {
12522		/* Reason Code 0 is reserved */
12523		return -EINVAL;
12524	}
12525
12526	if (info->attrs[NL80211_ATTR_IE]) {
12527		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12528		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12529	}
12530
12531	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12532
12533	return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
12534				    local_state_change);
12535}
12536
12537static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
12538{
12539	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12540	struct net_device *dev = info->user_ptr[1];
12541	const u8 *ie = NULL, *bssid;
12542	int ie_len = 0;
12543	u16 reason_code;
12544	bool local_state_change;
12545
12546	if (dev->ieee80211_ptr->conn_owner_nlportid &&
12547	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12548		return -EPERM;
12549
12550	if (!info->attrs[NL80211_ATTR_MAC])
12551		return -EINVAL;
12552
12553	if (!info->attrs[NL80211_ATTR_REASON_CODE])
12554		return -EINVAL;
12555
12556	if (!rdev->ops->disassoc)
12557		return -EOPNOTSUPP;
12558
12559	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12560	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12561		return -EOPNOTSUPP;
12562
12563	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12564
12565	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12566	if (reason_code == 0) {
12567		/* Reason Code 0 is reserved */
12568		return -EINVAL;
12569	}
12570
12571	if (info->attrs[NL80211_ATTR_IE]) {
12572		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12573		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12574	}
12575
12576	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
12577
12578	return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
12579				      local_state_change);
12580}
12581
12582static bool
12583nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
12584			 int mcast_rate[NUM_NL80211_BANDS],
12585			 int rateval)
12586{
12587	struct wiphy *wiphy = &rdev->wiphy;
12588	bool found = false;
12589	int band, i;
12590
12591	for (band = 0; band < NUM_NL80211_BANDS; band++) {
12592		struct ieee80211_supported_band *sband;
12593
12594		sband = wiphy->bands[band];
12595		if (!sband)
12596			continue;
12597
12598		for (i = 0; i < sband->n_bitrates; i++) {
12599			if (sband->bitrates[i].bitrate == rateval) {
12600				mcast_rate[band] = i + 1;
12601				found = true;
12602				break;
12603			}
12604		}
12605	}
12606
12607	return found;
12608}
12609
12610static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
12611{
12612	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12613	struct net_device *dev = info->user_ptr[1];
12614	struct cfg80211_ibss_params ibss;
12615	struct wiphy *wiphy;
12616	struct cfg80211_cached_keys *connkeys = NULL;
12617	int err;
12618
12619	memset(&ibss, 0, sizeof(ibss));
12620
12621	if (!info->attrs[NL80211_ATTR_SSID] ||
12622	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
12623		return -EINVAL;
12624
12625	ibss.beacon_interval = 100;
12626
12627	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
12628		ibss.beacon_interval =
12629			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12630
12631	err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
12632					   ibss.beacon_interval);
12633	if (err)
12634		return err;
12635
12636	if (!rdev->ops->join_ibss)
12637		return -EOPNOTSUPP;
12638
12639	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12640		return -EOPNOTSUPP;
12641
12642	wiphy = &rdev->wiphy;
12643
12644	if (info->attrs[NL80211_ATTR_MAC]) {
12645		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12646
12647		if (!is_valid_ether_addr(ibss.bssid))
12648			return -EINVAL;
12649	}
12650	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12651	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12652
12653	if (info->attrs[NL80211_ATTR_IE]) {
12654		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12655		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12656	}
12657
12658	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
12659	if (err)
12660		return err;
12661
12662	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
12663				     NL80211_IFTYPE_ADHOC))
12664		return -EINVAL;
12665
12666	switch (ibss.chandef.width) {
12667	case NL80211_CHAN_WIDTH_5:
12668	case NL80211_CHAN_WIDTH_10:
12669	case NL80211_CHAN_WIDTH_20_NOHT:
12670		break;
12671	case NL80211_CHAN_WIDTH_20:
12672	case NL80211_CHAN_WIDTH_40:
12673		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12674			return -EINVAL;
12675		break;
12676	case NL80211_CHAN_WIDTH_80:
12677	case NL80211_CHAN_WIDTH_80P80:
12678	case NL80211_CHAN_WIDTH_160:
12679		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
12680			return -EINVAL;
12681		if (!wiphy_ext_feature_isset(&rdev->wiphy,
12682					     NL80211_EXT_FEATURE_VHT_IBSS))
12683			return -EINVAL;
12684		break;
12685	case NL80211_CHAN_WIDTH_320:
12686		return -EINVAL;
12687	default:
12688		return -EINVAL;
12689	}
12690
12691	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
12692	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
12693
12694	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12695		u8 *rates =
12696			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12697		int n_rates =
12698			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12699		struct ieee80211_supported_band *sband =
12700			wiphy->bands[ibss.chandef.chan->band];
12701
12702		err = ieee80211_get_ratemask(sband, rates, n_rates,
12703					     &ibss.basic_rates);
12704		if (err)
12705			return err;
12706	}
12707
12708	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12709		memcpy(&ibss.ht_capa_mask,
12710		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
12711		       sizeof(ibss.ht_capa_mask));
12712
12713	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
12714		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
12715			return -EINVAL;
12716		memcpy(&ibss.ht_capa,
12717		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
12718		       sizeof(ibss.ht_capa));
12719	}
12720
12721	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12722	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
12723			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12724		return -EINVAL;
12725
12726	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
12727		bool no_ht = false;
12728
12729		connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
12730		if (IS_ERR(connkeys))
12731			return PTR_ERR(connkeys);
12732
12733		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
12734		    no_ht) {
12735			kfree_sensitive(connkeys);
12736			return -EINVAL;
12737		}
12738	}
12739
12740	ibss.control_port =
12741		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
12742
12743	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12744		int r = validate_pae_over_nl80211(rdev, info);
12745
12746		if (r < 0) {
12747			kfree_sensitive(connkeys);
12748			return r;
12749		}
12750
12751		ibss.control_port_over_nl80211 = true;
12752	}
12753
12754	ibss.userspace_handles_dfs =
12755		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12756
12757	err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
12758	if (err)
12759		kfree_sensitive(connkeys);
12760	else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
12761		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12762
12763	return err;
12764}
12765
12766static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
12767{
12768	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12769	struct net_device *dev = info->user_ptr[1];
12770
12771	if (!rdev->ops->leave_ibss)
12772		return -EOPNOTSUPP;
12773
12774	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
12775		return -EOPNOTSUPP;
12776
12777	return cfg80211_leave_ibss(rdev, dev, false);
12778}
12779
12780static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
12781{
12782	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12783	struct net_device *dev = info->user_ptr[1];
12784	int mcast_rate[NUM_NL80211_BANDS];
12785	u32 nla_rate;
12786
12787	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
12788	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
12789	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
12790		return -EOPNOTSUPP;
12791
12792	if (!rdev->ops->set_mcast_rate)
12793		return -EOPNOTSUPP;
12794
12795	memset(mcast_rate, 0, sizeof(mcast_rate));
12796
12797	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
12798		return -EINVAL;
12799
12800	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
12801	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
12802		return -EINVAL;
12803
12804	return rdev_set_mcast_rate(rdev, dev, mcast_rate);
12805}
12806
12807static struct sk_buff *
12808__cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
12809			    struct wireless_dev *wdev, int approxlen,
12810			    u32 portid, u32 seq, enum nl80211_commands cmd,
12811			    enum nl80211_attrs attr,
12812			    const struct nl80211_vendor_cmd_info *info,
12813			    gfp_t gfp)
12814{
12815	struct sk_buff *skb;
12816	void *hdr;
12817	struct nlattr *data;
12818
12819	skb = nlmsg_new(approxlen + 100, gfp);
12820	if (!skb)
12821		return NULL;
12822
12823	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
12824	if (!hdr) {
12825		kfree_skb(skb);
12826		return NULL;
12827	}
12828
12829	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
12830		goto nla_put_failure;
12831
12832	if (info) {
12833		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
12834				info->vendor_id))
12835			goto nla_put_failure;
12836		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
12837				info->subcmd))
12838			goto nla_put_failure;
12839	}
12840
12841	if (wdev) {
12842		if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12843				      wdev_id(wdev), NL80211_ATTR_PAD))
12844			goto nla_put_failure;
12845		if (wdev->netdev &&
12846		    nla_put_u32(skb, NL80211_ATTR_IFINDEX,
12847				wdev->netdev->ifindex))
12848			goto nla_put_failure;
12849	}
12850
12851	data = nla_nest_start_noflag(skb, attr);
12852	if (!data)
12853		goto nla_put_failure;
12854
12855	((void **)skb->cb)[0] = rdev;
12856	((void **)skb->cb)[1] = hdr;
12857	((void **)skb->cb)[2] = data;
12858
12859	return skb;
12860
12861 nla_put_failure:
12862	kfree_skb(skb);
12863	return NULL;
12864}
12865
12866struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
12867					   struct wireless_dev *wdev,
12868					   enum nl80211_commands cmd,
12869					   enum nl80211_attrs attr,
12870					   unsigned int portid,
12871					   int vendor_event_idx,
12872					   int approxlen, gfp_t gfp)
12873{
12874	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12875	const struct nl80211_vendor_cmd_info *info;
12876
12877	switch (cmd) {
12878	case NL80211_CMD_TESTMODE:
12879		if (WARN_ON(vendor_event_idx != -1))
12880			return NULL;
12881		info = NULL;
12882		break;
12883	case NL80211_CMD_VENDOR:
12884		if (WARN_ON(vendor_event_idx < 0 ||
12885			    vendor_event_idx >= wiphy->n_vendor_events))
12886			return NULL;
12887		info = &wiphy->vendor_events[vendor_event_idx];
12888		break;
12889	default:
12890		WARN_ON(1);
12891		return NULL;
12892	}
12893
12894	return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
12895					   cmd, attr, info, gfp);
12896}
12897EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
12898
12899void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
12900{
12901	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12902	void *hdr = ((void **)skb->cb)[1];
12903	struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
12904	struct nlattr *data = ((void **)skb->cb)[2];
12905	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
12906
12907	/* clear CB data for netlink core to own from now on */
12908	memset(skb->cb, 0, sizeof(skb->cb));
12909
12910	nla_nest_end(skb, data);
12911	genlmsg_end(skb, hdr);
12912
12913	if (nlhdr->nlmsg_pid) {
12914		genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
12915				nlhdr->nlmsg_pid);
12916	} else {
12917		if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
12918			mcgrp = NL80211_MCGRP_VENDOR;
12919
12920		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12921					skb, 0, mcgrp, gfp);
12922	}
12923}
12924EXPORT_SYMBOL(__cfg80211_send_event_skb);
12925
12926#ifdef CONFIG_NL80211_TESTMODE
12927static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
12928{
12929	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12930	struct wireless_dev *wdev;
12931	int err;
12932
12933	lockdep_assert_held(&rdev->wiphy.mtx);
12934
12935	wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
12936					  info->attrs);
12937
12938	if (!rdev->ops->testmode_cmd)
12939		return -EOPNOTSUPP;
12940
12941	if (IS_ERR(wdev)) {
12942		err = PTR_ERR(wdev);
12943		if (err != -EINVAL)
12944			return err;
12945		wdev = NULL;
12946	} else if (wdev->wiphy != &rdev->wiphy) {
12947		return -EINVAL;
12948	}
12949
12950	if (!info->attrs[NL80211_ATTR_TESTDATA])
12951		return -EINVAL;
12952
12953	rdev->cur_cmd_info = info;
12954	err = rdev_testmode_cmd(rdev, wdev,
12955				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
12956				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
12957	rdev->cur_cmd_info = NULL;
12958
12959	return err;
12960}
12961
12962static int nl80211_testmode_dump(struct sk_buff *skb,
12963				 struct netlink_callback *cb)
12964{
12965	struct cfg80211_registered_device *rdev;
12966	struct nlattr **attrbuf = NULL;
12967	int err;
12968	long phy_idx;
12969	void *data = NULL;
12970	int data_len = 0;
12971
12972	rtnl_lock();
12973
12974	if (cb->args[0]) {
12975		/*
12976		 * 0 is a valid index, but not valid for args[0],
12977		 * so we need to offset by 1.
12978		 */
12979		phy_idx = cb->args[0] - 1;
12980
12981		rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
12982		if (!rdev) {
12983			err = -ENOENT;
12984			goto out_err;
12985		}
12986	} else {
12987		attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
12988				  GFP_KERNEL);
12989		if (!attrbuf) {
12990			err = -ENOMEM;
12991			goto out_err;
12992		}
12993
12994		err = nlmsg_parse_deprecated(cb->nlh,
12995					     GENL_HDRLEN + nl80211_fam.hdrsize,
12996					     attrbuf, nl80211_fam.maxattr,
12997					     nl80211_policy, NULL);
12998		if (err)
12999			goto out_err;
13000
13001		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13002		if (IS_ERR(rdev)) {
13003			err = PTR_ERR(rdev);
13004			goto out_err;
13005		}
13006		phy_idx = rdev->wiphy_idx;
13007
13008		if (attrbuf[NL80211_ATTR_TESTDATA])
13009			cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
13010	}
13011
13012	if (cb->args[1]) {
13013		data = nla_data((void *)cb->args[1]);
13014		data_len = nla_len((void *)cb->args[1]);
13015	}
13016
13017	if (!rdev->ops->testmode_dump) {
13018		err = -EOPNOTSUPP;
13019		goto out_err;
13020	}
13021
13022	while (1) {
13023		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13024					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
13025					   NL80211_CMD_TESTMODE);
13026		struct nlattr *tmdata;
13027
13028		if (!hdr)
13029			break;
13030
13031		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
13032			genlmsg_cancel(skb, hdr);
13033			break;
13034		}
13035
13036		tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
13037		if (!tmdata) {
13038			genlmsg_cancel(skb, hdr);
13039			break;
13040		}
13041		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
13042		nla_nest_end(skb, tmdata);
13043
13044		if (err == -ENOBUFS || err == -ENOENT) {
13045			genlmsg_cancel(skb, hdr);
13046			break;
13047		} else if (err) {
13048			genlmsg_cancel(skb, hdr);
13049			goto out_err;
13050		}
13051
13052		genlmsg_end(skb, hdr);
13053	}
13054
13055	err = skb->len;
13056	/* see above */
13057	cb->args[0] = phy_idx + 1;
13058 out_err:
13059	kfree(attrbuf);
13060	rtnl_unlock();
13061	return err;
13062}
13063#endif
13064
13065static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
13066{
13067	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13068	struct net_device *dev = info->user_ptr[1];
13069	struct cfg80211_connect_params connect;
13070	struct wiphy *wiphy;
13071	struct cfg80211_cached_keys *connkeys = NULL;
13072	u32 freq = 0;
13073	int err;
13074
13075	memset(&connect, 0, sizeof(connect));
13076
13077	if (!info->attrs[NL80211_ATTR_SSID] ||
13078	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
13079		return -EINVAL;
13080
13081	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13082		connect.auth_type =
13083			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13084		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
13085					     NL80211_CMD_CONNECT))
13086			return -EINVAL;
13087	} else
13088		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
13089
13090	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
13091
13092	if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
13093	    !wiphy_ext_feature_isset(&rdev->wiphy,
13094				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13095		return -EINVAL;
13096	connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
13097
13098	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
13099				      NL80211_MAX_NR_CIPHER_SUITES);
13100	if (err)
13101		return err;
13102
13103	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13104	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13105		return -EOPNOTSUPP;
13106
13107	wiphy = &rdev->wiphy;
13108
13109	connect.bg_scan_period = -1;
13110	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
13111		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
13112		connect.bg_scan_period =
13113			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
13114	}
13115
13116	if (info->attrs[NL80211_ATTR_MAC])
13117		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13118	else if (info->attrs[NL80211_ATTR_MAC_HINT])
13119		connect.bssid_hint =
13120			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
13121	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13122	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13123
13124	if (info->attrs[NL80211_ATTR_IE]) {
13125		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13126		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13127	}
13128
13129	if (info->attrs[NL80211_ATTR_USE_MFP]) {
13130		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
13131		if (connect.mfp == NL80211_MFP_OPTIONAL &&
13132		    !wiphy_ext_feature_isset(&rdev->wiphy,
13133					     NL80211_EXT_FEATURE_MFP_OPTIONAL))
13134			return -EOPNOTSUPP;
13135	} else {
13136		connect.mfp = NL80211_MFP_NO;
13137	}
13138
13139	if (info->attrs[NL80211_ATTR_PREV_BSSID])
13140		connect.prev_bssid =
13141			nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
13142
13143	if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
13144		freq = MHZ_TO_KHZ(nla_get_u32(
13145					info->attrs[NL80211_ATTR_WIPHY_FREQ]));
13146	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
13147		freq +=
13148		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
13149
13150	if (freq) {
13151		connect.channel = nl80211_get_valid_chan(wiphy, freq);
13152		if (!connect.channel)
13153			return -EINVAL;
13154	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
13155		freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
13156		freq = MHZ_TO_KHZ(freq);
13157		connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
13158		if (!connect.channel_hint)
13159			return -EINVAL;
13160	}
13161
13162	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
13163		connect.edmg.channels =
13164		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
13165
13166		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
13167			connect.edmg.bw_config =
13168				nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
13169	}
13170
13171	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
13172		connkeys = nl80211_parse_connkeys(rdev, info, NULL);
13173		if (IS_ERR(connkeys))
13174			return PTR_ERR(connkeys);
13175	}
13176
13177	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
13178		connect.flags |= ASSOC_REQ_DISABLE_HT;
13179
13180	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
13181		memcpy(&connect.ht_capa_mask,
13182		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
13183		       sizeof(connect.ht_capa_mask));
13184
13185	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
13186		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
13187			kfree_sensitive(connkeys);
13188			return -EINVAL;
13189		}
13190		memcpy(&connect.ht_capa,
13191		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
13192		       sizeof(connect.ht_capa));
13193	}
13194
13195	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
13196		connect.flags |= ASSOC_REQ_DISABLE_VHT;
13197
13198	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
13199		connect.flags |= ASSOC_REQ_DISABLE_HE;
13200
13201	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
13202		connect.flags |= ASSOC_REQ_DISABLE_EHT;
13203
13204	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
13205		memcpy(&connect.vht_capa_mask,
13206		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
13207		       sizeof(connect.vht_capa_mask));
13208
13209	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
13210		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
13211			kfree_sensitive(connkeys);
13212			return -EINVAL;
13213		}
13214		memcpy(&connect.vht_capa,
13215		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
13216		       sizeof(connect.vht_capa));
13217	}
13218
13219	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
13220		if (!((rdev->wiphy.features &
13221			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
13222		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
13223		    !wiphy_ext_feature_isset(&rdev->wiphy,
13224					     NL80211_EXT_FEATURE_RRM)) {
13225			kfree_sensitive(connkeys);
13226			return -EINVAL;
13227		}
13228		connect.flags |= ASSOC_REQ_USE_RRM;
13229	}
13230
13231	connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
13232	if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
13233		kfree_sensitive(connkeys);
13234		return -EOPNOTSUPP;
13235	}
13236
13237	if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
13238		/* bss selection makes no sense if bssid is set */
13239		if (connect.bssid) {
13240			kfree_sensitive(connkeys);
13241			return -EINVAL;
13242		}
13243
13244		err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
13245				       wiphy, &connect.bss_select);
13246		if (err) {
13247			kfree_sensitive(connkeys);
13248			return err;
13249		}
13250	}
13251
13252	if (wiphy_ext_feature_isset(&rdev->wiphy,
13253				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
13254	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13255	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13256	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13257	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13258		connect.fils_erp_username =
13259			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13260		connect.fils_erp_username_len =
13261			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13262		connect.fils_erp_realm =
13263			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13264		connect.fils_erp_realm_len =
13265			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13266		connect.fils_erp_next_seq_num =
13267			nla_get_u16(
13268			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13269		connect.fils_erp_rrk =
13270			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13271		connect.fils_erp_rrk_len =
13272			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13273	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13274		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13275		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13276		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13277		kfree_sensitive(connkeys);
13278		return -EINVAL;
13279	}
13280
13281	if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
13282		if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13283			kfree_sensitive(connkeys);
13284			GENL_SET_ERR_MSG(info,
13285					 "external auth requires connection ownership");
13286			return -EINVAL;
13287		}
13288		connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
13289	}
13290
13291	if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
13292		connect.flags |= CONNECT_REQ_MLO_SUPPORT;
13293
13294	err = cfg80211_connect(rdev, dev, &connect, connkeys,
13295			       connect.prev_bssid);
13296	if (err)
13297		kfree_sensitive(connkeys);
13298
13299	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
13300		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13301		if (connect.bssid)
13302			memcpy(dev->ieee80211_ptr->disconnect_bssid,
13303			       connect.bssid, ETH_ALEN);
13304		else
13305			eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
13306	}
13307
13308	return err;
13309}
13310
13311static int nl80211_update_connect_params(struct sk_buff *skb,
13312					 struct genl_info *info)
13313{
13314	struct cfg80211_connect_params connect = {};
13315	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13316	struct net_device *dev = info->user_ptr[1];
13317	struct wireless_dev *wdev = dev->ieee80211_ptr;
13318	bool fils_sk_offload;
13319	u32 auth_type;
13320	u32 changed = 0;
13321
13322	if (!rdev->ops->update_connect_params)
13323		return -EOPNOTSUPP;
13324
13325	if (info->attrs[NL80211_ATTR_IE]) {
13326		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13327		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13328		changed |= UPDATE_ASSOC_IES;
13329	}
13330
13331	fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
13332						  NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
13333
13334	/*
13335	 * when driver supports fils-sk offload all attributes must be
13336	 * provided. So the else covers "fils-sk-not-all" and
13337	 * "no-fils-sk-any".
13338	 */
13339	if (fils_sk_offload &&
13340	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
13341	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
13342	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
13343	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13344		connect.fils_erp_username =
13345			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13346		connect.fils_erp_username_len =
13347			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
13348		connect.fils_erp_realm =
13349			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13350		connect.fils_erp_realm_len =
13351			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
13352		connect.fils_erp_next_seq_num =
13353			nla_get_u16(
13354			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
13355		connect.fils_erp_rrk =
13356			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13357		connect.fils_erp_rrk_len =
13358			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
13359		changed |= UPDATE_FILS_ERP_INFO;
13360	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
13361		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
13362		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
13363		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
13364		return -EINVAL;
13365	}
13366
13367	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
13368		auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
13369		if (!nl80211_valid_auth_type(rdev, auth_type,
13370					     NL80211_CMD_CONNECT))
13371			return -EINVAL;
13372
13373		if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
13374		    fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
13375			return -EINVAL;
13376
13377		connect.auth_type = auth_type;
13378		changed |= UPDATE_AUTH_TYPE;
13379	}
13380
13381	if (!wdev->connected)
13382		return -ENOLINK;
13383
13384	return rdev_update_connect_params(rdev, dev, &connect, changed);
13385}
13386
13387static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
13388{
13389	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13390	struct net_device *dev = info->user_ptr[1];
13391	u16 reason;
13392
13393	if (dev->ieee80211_ptr->conn_owner_nlportid &&
13394	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
13395		return -EPERM;
13396
13397	reason = nla_get_u16_default(info->attrs[NL80211_ATTR_REASON_CODE],
13398				     WLAN_REASON_DEAUTH_LEAVING);
13399
13400	if (reason == 0)
13401		return -EINVAL;
13402
13403	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13404	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13405		return -EOPNOTSUPP;
13406
13407	return cfg80211_disconnect(rdev, dev, reason, true);
13408}
13409
13410static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
13411{
13412	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13413	struct net *net;
13414	int err;
13415
13416	if (info->attrs[NL80211_ATTR_PID]) {
13417		u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
13418
13419		net = get_net_ns_by_pid(pid);
13420	} else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
13421		u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
13422
13423		net = get_net_ns_by_fd(fd);
13424	} else {
13425		return -EINVAL;
13426	}
13427
13428	if (IS_ERR(net))
13429		return PTR_ERR(net);
13430
13431	err = 0;
13432
13433	/* check if anything to do */
13434	if (!net_eq(wiphy_net(&rdev->wiphy), net))
13435		err = cfg80211_switch_netns(rdev, net);
13436
13437	put_net(net);
13438	return err;
13439}
13440
13441static int nl80211_set_pmksa(struct sk_buff *skb, struct genl_info *info)
13442{
13443	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13444	struct net_device *dev = info->user_ptr[1];
13445	struct cfg80211_pmksa pmksa;
13446	bool ap_pmksa_caching_support = false;
13447
13448	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13449
13450	ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13451		NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13452
13453	if (!info->attrs[NL80211_ATTR_PMKID])
13454		return -EINVAL;
13455
13456	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13457
13458	if (info->attrs[NL80211_ATTR_MAC]) {
13459		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13460	} else if (info->attrs[NL80211_ATTR_SSID] &&
13461	           info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13462	           info->attrs[NL80211_ATTR_PMK]) {
13463		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13464		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13465		pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13466	} else {
13467		return -EINVAL;
13468	}
13469
13470	if (info->attrs[NL80211_ATTR_PMK]) {
13471		pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13472		pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13473	}
13474
13475	if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
13476		pmksa.pmk_lifetime =
13477			nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
13478
13479	if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
13480		pmksa.pmk_reauth_threshold =
13481			nla_get_u8(info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
13482
13483	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13484	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13485	    !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13486	       dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13487	       ap_pmksa_caching_support))
13488		return -EOPNOTSUPP;
13489
13490	if (!rdev->ops->set_pmksa)
13491		return -EOPNOTSUPP;
13492
13493	return rdev_set_pmksa(rdev, dev, &pmksa);
13494}
13495
13496static int nl80211_del_pmksa(struct sk_buff *skb, struct genl_info *info)
13497{
13498	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13499	struct net_device *dev = info->user_ptr[1];
13500	struct cfg80211_pmksa pmksa;
13501	bool sae_offload_support = false;
13502	bool owe_offload_support = false;
13503	bool ap_pmksa_caching_support = false;
13504
13505	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
13506
13507	sae_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13508		NL80211_EXT_FEATURE_SAE_OFFLOAD);
13509	owe_offload_support = wiphy_ext_feature_isset(&rdev->wiphy,
13510		NL80211_EXT_FEATURE_OWE_OFFLOAD);
13511	ap_pmksa_caching_support = wiphy_ext_feature_isset(&rdev->wiphy,
13512		NL80211_EXT_FEATURE_AP_PMKSA_CACHING);
13513
13514	if (info->attrs[NL80211_ATTR_PMKID])
13515		pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13516
13517	if (info->attrs[NL80211_ATTR_MAC]) {
13518		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
13519	} else if (info->attrs[NL80211_ATTR_SSID]) {
13520		/* SSID based pmksa flush supported only for FILS,
13521		 * OWE/SAE OFFLOAD cases
13522		 */
13523		if (info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
13524		    info->attrs[NL80211_ATTR_PMK]) {
13525			pmksa.cache_id = nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
13526		} else if (!sae_offload_support && !owe_offload_support) {
13527			return -EINVAL;
13528		}
13529		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
13530		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13531	} else {
13532		return -EINVAL;
13533	}
13534
13535	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13536	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
13537	    !((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
13538	       dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO) &&
13539	       ap_pmksa_caching_support))
13540		return -EOPNOTSUPP;
13541
13542	if (!rdev->ops->del_pmksa)
13543		return -EOPNOTSUPP;
13544
13545	return rdev_del_pmksa(rdev, dev, &pmksa);
13546}
13547
13548static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
13549{
13550	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13551	struct net_device *dev = info->user_ptr[1];
13552
13553	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
13554	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
13555		return -EOPNOTSUPP;
13556
13557	if (!rdev->ops->flush_pmksa)
13558		return -EOPNOTSUPP;
13559
13560	return rdev_flush_pmksa(rdev, dev);
13561}
13562
13563static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
13564{
13565	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13566	struct net_device *dev = info->user_ptr[1];
13567	u8 action_code, dialog_token;
13568	u32 peer_capability = 0;
13569	u16 status_code;
13570	u8 *peer;
13571	int link_id;
13572	bool initiator;
13573
13574	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13575	    !rdev->ops->tdls_mgmt)
13576		return -EOPNOTSUPP;
13577
13578	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
13579	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
13580	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
13581	    !info->attrs[NL80211_ATTR_IE] ||
13582	    !info->attrs[NL80211_ATTR_MAC])
13583		return -EINVAL;
13584
13585	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13586	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
13587	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13588	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
13589	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
13590	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
13591		peer_capability =
13592			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
13593	link_id = nl80211_link_id_or_invalid(info->attrs);
13594
13595	return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
13596			      dialog_token, status_code, peer_capability,
13597			      initiator,
13598			      nla_data(info->attrs[NL80211_ATTR_IE]),
13599			      nla_len(info->attrs[NL80211_ATTR_IE]));
13600}
13601
13602static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
13603{
13604	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13605	struct net_device *dev = info->user_ptr[1];
13606	enum nl80211_tdls_operation operation;
13607	u8 *peer;
13608
13609	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
13610	    !rdev->ops->tdls_oper)
13611		return -EOPNOTSUPP;
13612
13613	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
13614	    !info->attrs[NL80211_ATTR_MAC])
13615		return -EINVAL;
13616
13617	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
13618	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13619
13620	return rdev_tdls_oper(rdev, dev, peer, operation);
13621}
13622
13623static int nl80211_remain_on_channel(struct sk_buff *skb,
13624				     struct genl_info *info)
13625{
13626	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13627	unsigned int link_id = nl80211_link_id(info->attrs);
13628	struct wireless_dev *wdev = info->user_ptr[1];
13629	struct cfg80211_chan_def chandef;
13630	struct sk_buff *msg;
13631	void *hdr;
13632	u64 cookie;
13633	u32 duration;
13634	int err;
13635
13636	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
13637	    !info->attrs[NL80211_ATTR_DURATION])
13638		return -EINVAL;
13639
13640	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13641
13642	if (!rdev->ops->remain_on_channel ||
13643	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
13644		return -EOPNOTSUPP;
13645
13646	/*
13647	 * We should be on that channel for at least a minimum amount of
13648	 * time (10ms) but no longer than the driver supports.
13649	 */
13650	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13651	    duration > rdev->wiphy.max_remain_on_channel_duration)
13652		return -EINVAL;
13653
13654	err = nl80211_parse_chandef(rdev, info, &chandef);
13655	if (err)
13656		return err;
13657
13658	if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
13659		const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
13660
13661		oper_chandef = wdev_chandef(wdev, link_id);
13662
13663		if (WARN_ON(!oper_chandef)) {
13664			/* cannot happen since we must beacon to get here */
13665			WARN_ON(1);
13666			return -EBUSY;
13667		}
13668
13669		/* note: returns first one if identical chandefs */
13670		compat_chandef = cfg80211_chandef_compatible(&chandef,
13671							     oper_chandef);
13672
13673		if (compat_chandef != &chandef)
13674			return -EBUSY;
13675	}
13676
13677	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13678	if (!msg)
13679		return -ENOMEM;
13680
13681	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13682			     NL80211_CMD_REMAIN_ON_CHANNEL);
13683	if (!hdr) {
13684		err = -ENOBUFS;
13685		goto free_msg;
13686	}
13687
13688	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
13689				     duration, &cookie);
13690
13691	if (err)
13692		goto free_msg;
13693
13694	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13695			      NL80211_ATTR_PAD))
13696		goto nla_put_failure;
13697
13698	genlmsg_end(msg, hdr);
13699
13700	return genlmsg_reply(msg, info);
13701
13702 nla_put_failure:
13703	err = -ENOBUFS;
13704 free_msg:
13705	nlmsg_free(msg);
13706	return err;
13707}
13708
13709static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
13710					    struct genl_info *info)
13711{
13712	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13713	struct wireless_dev *wdev = info->user_ptr[1];
13714	u64 cookie;
13715
13716	if (!info->attrs[NL80211_ATTR_COOKIE])
13717		return -EINVAL;
13718
13719	if (!rdev->ops->cancel_remain_on_channel)
13720		return -EOPNOTSUPP;
13721
13722	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13723
13724	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
13725}
13726
13727static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
13728				       struct genl_info *info)
13729{
13730	struct cfg80211_bitrate_mask mask;
13731	unsigned int link_id = nl80211_link_id(info->attrs);
13732	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13733	struct net_device *dev = info->user_ptr[1];
13734	int err;
13735
13736	if (!rdev->ops->set_bitrate_mask)
13737		return -EOPNOTSUPP;
13738
13739	err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13740					    NL80211_ATTR_TX_RATES, &mask,
13741					    dev, true, link_id);
13742	if (err)
13743		return err;
13744
13745	return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
13746}
13747
13748static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
13749{
13750	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13751	struct wireless_dev *wdev = info->user_ptr[1];
13752	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
13753
13754	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
13755		return -EINVAL;
13756
13757	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
13758		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
13759
13760	switch (wdev->iftype) {
13761	case NL80211_IFTYPE_STATION:
13762	case NL80211_IFTYPE_ADHOC:
13763	case NL80211_IFTYPE_P2P_CLIENT:
13764	case NL80211_IFTYPE_AP:
13765	case NL80211_IFTYPE_AP_VLAN:
13766	case NL80211_IFTYPE_MESH_POINT:
13767	case NL80211_IFTYPE_P2P_GO:
13768	case NL80211_IFTYPE_P2P_DEVICE:
13769		break;
13770	case NL80211_IFTYPE_NAN:
13771		if (!wiphy_ext_feature_isset(wdev->wiphy,
13772					     NL80211_EXT_FEATURE_SECURE_NAN) &&
13773		    !(wdev->wiphy->nan_capa.flags &
13774		      WIPHY_NAN_FLAGS_USERSPACE_DE))
13775			return -EOPNOTSUPP;
13776		break;
13777	default:
13778		return -EOPNOTSUPP;
13779	}
13780
13781	/* not much point in registering if we can't reply */
13782	if (!rdev->ops->mgmt_tx)
13783		return -EOPNOTSUPP;
13784
13785	if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
13786	    !wiphy_ext_feature_isset(&rdev->wiphy,
13787				     NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
13788		GENL_SET_ERR_MSG(info,
13789				 "multicast RX registrations are not supported");
13790		return -EOPNOTSUPP;
13791	}
13792
13793	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
13794					   nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13795					   nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
13796					   info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
13797					   info->extack);
13798}
13799
13800static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
13801{
13802	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13803	struct wireless_dev *wdev = info->user_ptr[1];
13804	struct cfg80211_chan_def chandef;
13805	int err;
13806	void *hdr = NULL;
13807	u64 cookie;
13808	struct sk_buff *msg = NULL;
13809	struct cfg80211_mgmt_tx_params params = {
13810		.dont_wait_for_ack =
13811			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
13812	};
13813
13814	if (!info->attrs[NL80211_ATTR_FRAME])
13815		return -EINVAL;
13816
13817	if (!rdev->ops->mgmt_tx)
13818		return -EOPNOTSUPP;
13819
13820	switch (wdev->iftype) {
13821	case NL80211_IFTYPE_P2P_DEVICE:
13822		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
13823			return -EINVAL;
13824		break;
13825	case NL80211_IFTYPE_STATION:
13826	case NL80211_IFTYPE_ADHOC:
13827	case NL80211_IFTYPE_P2P_CLIENT:
13828	case NL80211_IFTYPE_AP:
13829	case NL80211_IFTYPE_AP_VLAN:
13830	case NL80211_IFTYPE_MESH_POINT:
13831	case NL80211_IFTYPE_P2P_GO:
13832		break;
13833	case NL80211_IFTYPE_NAN:
13834		if (!wiphy_ext_feature_isset(wdev->wiphy,
13835					     NL80211_EXT_FEATURE_SECURE_NAN) &&
13836		    !(wdev->wiphy->nan_capa.flags &
13837		      WIPHY_NAN_FLAGS_USERSPACE_DE))
13838			return -EOPNOTSUPP;
13839		break;
13840	default:
13841		return -EOPNOTSUPP;
13842	}
13843
13844	if (info->attrs[NL80211_ATTR_DURATION]) {
13845		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13846			return -EINVAL;
13847		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
13848
13849		/*
13850		 * We should wait on the channel for at least a minimum amount
13851		 * of time (10ms) but no longer than the driver supports.
13852		 */
13853		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
13854		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
13855			return -EINVAL;
13856	}
13857
13858	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
13859
13860	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
13861		return -EINVAL;
13862
13863	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
13864
13865	/* get the channel if any has been specified, otherwise pass NULL to
13866	 * the driver. The latter will use the current one
13867	 */
13868	chandef.chan = NULL;
13869	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13870		err = nl80211_parse_chandef(rdev, info, &chandef);
13871		if (err)
13872			return err;
13873	}
13874
13875	if (!chandef.chan && params.offchan)
13876		return -EINVAL;
13877
13878	if (params.offchan &&
13879	    !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
13880		return -EBUSY;
13881
13882	params.link_id = nl80211_link_id_or_invalid(info->attrs);
13883	/*
13884	 * This now races due to the unlock, but we cannot check
13885	 * the valid links for the _station_ anyway, so that's up
13886	 * to the driver.
13887	 */
13888	if (params.link_id >= 0 &&
13889	    !(wdev->valid_links & BIT(params.link_id)))
13890		return -EINVAL;
13891
13892	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13893	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13894
13895	err = nl80211_parse_counter_offsets(rdev, NULL, params.len, -1,
13896					    info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX],
13897					    &params.csa_offsets,
13898					    &params.n_csa_offsets);
13899	if (err)
13900		return err;
13901
13902	if (!params.dont_wait_for_ack) {
13903		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13904		if (!msg)
13905			return -ENOMEM;
13906
13907		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13908				     NL80211_CMD_FRAME);
13909		if (!hdr) {
13910			err = -ENOBUFS;
13911			goto free_msg;
13912		}
13913	}
13914
13915	params.chan = chandef.chan;
13916	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
13917	if (err)
13918		goto free_msg;
13919
13920	if (msg) {
13921		if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13922				      NL80211_ATTR_PAD))
13923			goto nla_put_failure;
13924
13925		genlmsg_end(msg, hdr);
13926		return genlmsg_reply(msg, info);
13927	}
13928
13929	return 0;
13930
13931 nla_put_failure:
13932	err = -ENOBUFS;
13933 free_msg:
13934	nlmsg_free(msg);
13935	return err;
13936}
13937
13938static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
13939{
13940	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13941	struct wireless_dev *wdev = info->user_ptr[1];
13942	u64 cookie;
13943
13944	if (!info->attrs[NL80211_ATTR_COOKIE])
13945		return -EINVAL;
13946
13947	if (!rdev->ops->mgmt_tx_cancel_wait)
13948		return -EOPNOTSUPP;
13949
13950	switch (wdev->iftype) {
13951	case NL80211_IFTYPE_STATION:
13952	case NL80211_IFTYPE_ADHOC:
13953	case NL80211_IFTYPE_P2P_CLIENT:
13954	case NL80211_IFTYPE_AP:
13955	case NL80211_IFTYPE_AP_VLAN:
13956	case NL80211_IFTYPE_P2P_GO:
13957	case NL80211_IFTYPE_P2P_DEVICE:
13958		break;
13959	case NL80211_IFTYPE_NAN:
13960		if (!wiphy_ext_feature_isset(wdev->wiphy,
13961					     NL80211_EXT_FEATURE_SECURE_NAN))
13962			return -EOPNOTSUPP;
13963		break;
13964	default:
13965		return -EOPNOTSUPP;
13966	}
13967
13968	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13969
13970	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
13971}
13972
13973static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
13974{
13975	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13976	struct wireless_dev *wdev;
13977	struct net_device *dev = info->user_ptr[1];
13978	u8 ps_state;
13979	bool state;
13980	int err;
13981
13982	if (!info->attrs[NL80211_ATTR_PS_STATE])
13983		return -EINVAL;
13984
13985	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
13986
13987	wdev = dev->ieee80211_ptr;
13988
13989	if (!rdev->ops->set_power_mgmt)
13990		return -EOPNOTSUPP;
13991
13992	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
13993
13994	if (state == wdev->ps)
13995		return 0;
13996
13997	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
13998	if (!err)
13999		wdev->ps = state;
14000	return err;
14001}
14002
14003static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
14004{
14005	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14006	enum nl80211_ps_state ps_state;
14007	struct wireless_dev *wdev;
14008	struct net_device *dev = info->user_ptr[1];
14009	struct sk_buff *msg;
14010	void *hdr;
14011	int err;
14012
14013	wdev = dev->ieee80211_ptr;
14014
14015	if (!rdev->ops->set_power_mgmt)
14016		return -EOPNOTSUPP;
14017
14018	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14019	if (!msg)
14020		return -ENOMEM;
14021
14022	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14023			     NL80211_CMD_GET_POWER_SAVE);
14024	if (!hdr) {
14025		err = -ENOBUFS;
14026		goto free_msg;
14027	}
14028
14029	if (wdev->ps)
14030		ps_state = NL80211_PS_ENABLED;
14031	else
14032		ps_state = NL80211_PS_DISABLED;
14033
14034	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
14035		goto nla_put_failure;
14036
14037	genlmsg_end(msg, hdr);
14038	return genlmsg_reply(msg, info);
14039
14040 nla_put_failure:
14041	err = -ENOBUFS;
14042 free_msg:
14043	nlmsg_free(msg);
14044	return err;
14045}
14046
14047static const struct nla_policy
14048nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
14049	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
14050	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
14051	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
14052	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
14053	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
14054	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
14055	[NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
14056};
14057
14058static int nl80211_set_cqm_txe(struct genl_info *info,
14059			       u32 rate, u32 pkts, u32 intvl)
14060{
14061	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14062	struct net_device *dev = info->user_ptr[1];
14063	struct wireless_dev *wdev = dev->ieee80211_ptr;
14064
14065	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
14066		return -EINVAL;
14067
14068	if (!rdev->ops->set_cqm_txe_config)
14069		return -EOPNOTSUPP;
14070
14071	if (wdev->iftype != NL80211_IFTYPE_STATION &&
14072	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14073		return -EOPNOTSUPP;
14074
14075	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
14076}
14077
14078static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
14079				    struct net_device *dev,
14080				    struct cfg80211_cqm_config *cqm_config)
14081{
14082	struct wireless_dev *wdev = dev->ieee80211_ptr;
14083	s32 last, low, high;
14084	u32 hyst;
14085	int i, n, low_index;
14086	int err;
14087
14088	/*
14089	 * Obtain current RSSI value if possible, if not and no RSSI threshold
14090	 * event has been received yet, we should receive an event after a
14091	 * connection is established and enough beacons received to calculate
14092	 * the average.
14093	 */
14094	if (!cqm_config->last_rssi_event_value &&
14095	    wdev->links[0].client.current_bss &&
14096	    rdev->ops->get_station) {
14097		struct station_info sinfo = {};
14098		u8 *mac_addr;
14099
14100		mac_addr = wdev->links[0].client.current_bss->pub.bssid;
14101
14102		err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
14103		if (err)
14104			return err;
14105
14106		cfg80211_sinfo_release_content(&sinfo);
14107		if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
14108			cqm_config->last_rssi_event_value =
14109				(s8) sinfo.rx_beacon_signal_avg;
14110	}
14111
14112	last = cqm_config->last_rssi_event_value;
14113	hyst = cqm_config->rssi_hyst;
14114	n = cqm_config->n_rssi_thresholds;
14115
14116	for (i = 0; i < n; i++) {
14117		i = array_index_nospec(i, n);
14118		if (last < cqm_config->rssi_thresholds[i])
14119			break;
14120	}
14121
14122	low_index = i - 1;
14123	if (low_index >= 0) {
14124		low_index = array_index_nospec(low_index, n);
14125		low = cqm_config->rssi_thresholds[low_index] - hyst;
14126	} else {
14127		low = S32_MIN;
14128	}
14129	if (i < n) {
14130		i = array_index_nospec(i, n);
14131		high = cqm_config->rssi_thresholds[i] + hyst - 1;
14132	} else {
14133		high = S32_MAX;
14134	}
14135
14136	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
14137}
14138
14139static int nl80211_set_cqm_rssi(struct genl_info *info,
14140				const s32 *thresholds, int n_thresholds,
14141				u32 hysteresis)
14142{
14143	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14144	struct cfg80211_cqm_config *cqm_config = NULL, *old;
14145	struct net_device *dev = info->user_ptr[1];
14146	struct wireless_dev *wdev = dev->ieee80211_ptr;
14147	s32 prev = S32_MIN;
14148	int i, err;
14149
14150	/* Check all values negative and sorted */
14151	for (i = 0; i < n_thresholds; i++) {
14152		if (thresholds[i] > 0 || thresholds[i] <= prev)
14153			return -EINVAL;
14154
14155		prev = thresholds[i];
14156	}
14157
14158	if (wdev->iftype != NL80211_IFTYPE_STATION &&
14159	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14160		return -EOPNOTSUPP;
14161
14162	if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
14163		n_thresholds = 0;
14164
14165	old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
14166
14167	/* if already disabled just succeed */
14168	if (!n_thresholds && !old)
14169		return 0;
14170
14171	if (n_thresholds > 1) {
14172		if (!wiphy_ext_feature_isset(&rdev->wiphy,
14173					     NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
14174		    !rdev->ops->set_cqm_rssi_range_config)
14175			return -EOPNOTSUPP;
14176	} else {
14177		if (!rdev->ops->set_cqm_rssi_config)
14178			return -EOPNOTSUPP;
14179	}
14180
14181	if (n_thresholds) {
14182		cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
14183						 n_thresholds),
14184				     GFP_KERNEL);
14185		if (!cqm_config)
14186			return -ENOMEM;
14187
14188		cqm_config->rssi_hyst = hysteresis;
14189		cqm_config->n_rssi_thresholds = n_thresholds;
14190		memcpy(cqm_config->rssi_thresholds, thresholds,
14191		       flex_array_size(cqm_config, rssi_thresholds,
14192				       n_thresholds));
14193		cqm_config->use_range_api = n_thresholds > 1 ||
14194					    !rdev->ops->set_cqm_rssi_config;
14195
14196		rcu_assign_pointer(wdev->cqm_config, cqm_config);
14197
14198		if (cqm_config->use_range_api)
14199			err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
14200		else
14201			err = rdev_set_cqm_rssi_config(rdev, dev,
14202						       thresholds[0],
14203						       hysteresis);
14204	} else {
14205		RCU_INIT_POINTER(wdev->cqm_config, NULL);
14206		/* if enabled as range also disable via range */
14207		if (old->use_range_api)
14208			err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
14209		else
14210			err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
14211	}
14212
14213	if (err) {
14214		rcu_assign_pointer(wdev->cqm_config, old);
14215		kfree_rcu(cqm_config, rcu_head);
14216	} else {
14217		kfree_rcu(old, rcu_head);
14218	}
14219
14220	return err;
14221}
14222
14223static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
14224{
14225	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
14226	struct nlattr *cqm;
14227	int err;
14228
14229	cqm = info->attrs[NL80211_ATTR_CQM];
14230	if (!cqm)
14231		return -EINVAL;
14232
14233	err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
14234					  nl80211_attr_cqm_policy,
14235					  info->extack);
14236	if (err)
14237		return err;
14238
14239	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
14240	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
14241		const s32 *thresholds =
14242			nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14243		int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
14244		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
14245
14246		if (len % 4)
14247			return -EINVAL;
14248
14249		return nl80211_set_cqm_rssi(info, thresholds, len / 4,
14250					    hysteresis);
14251	}
14252
14253	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
14254	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
14255	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
14256		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
14257		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
14258		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
14259
14260		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
14261	}
14262
14263	return -EINVAL;
14264}
14265
14266static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
14267{
14268	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14269	struct net_device *dev = info->user_ptr[1];
14270	struct ocb_setup setup = {};
14271	int err;
14272
14273	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14274	if (err)
14275		return err;
14276
14277	return cfg80211_join_ocb(rdev, dev, &setup);
14278}
14279
14280static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
14281{
14282	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14283	struct net_device *dev = info->user_ptr[1];
14284
14285	return cfg80211_leave_ocb(rdev, dev);
14286}
14287
14288static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
14289{
14290	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14291	struct net_device *dev = info->user_ptr[1];
14292	struct mesh_config cfg;
14293	struct mesh_setup setup;
14294	int err;
14295
14296	/* start with default */
14297	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
14298	memcpy(&setup, &default_mesh_setup, sizeof(setup));
14299
14300	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
14301		/* and parse parameters if given */
14302		err = nl80211_parse_mesh_config(info, &cfg, NULL);
14303		if (err)
14304			return err;
14305	}
14306
14307	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
14308	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
14309		return -EINVAL;
14310
14311	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
14312	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
14313
14314	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
14315	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
14316			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
14317			return -EINVAL;
14318
14319	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
14320		setup.beacon_interval =
14321			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
14322
14323		err = cfg80211_validate_beacon_int(rdev,
14324						   NL80211_IFTYPE_MESH_POINT,
14325						   setup.beacon_interval);
14326		if (err)
14327			return err;
14328	}
14329
14330	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
14331		setup.dtim_period =
14332			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
14333		if (setup.dtim_period < 1 || setup.dtim_period > 100)
14334			return -EINVAL;
14335	}
14336
14337	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
14338		/* parse additional setup parameters if given */
14339		err = nl80211_parse_mesh_setup(info, &setup);
14340		if (err)
14341			return err;
14342	}
14343
14344	if (setup.user_mpm)
14345		cfg.auto_open_plinks = false;
14346
14347	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
14348		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
14349		if (err)
14350			return err;
14351	} else {
14352		/* __cfg80211_join_mesh() will sort it out */
14353		setup.chandef.chan = NULL;
14354	}
14355
14356	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
14357		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14358		int n_rates =
14359			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
14360		struct ieee80211_supported_band *sband;
14361
14362		if (!setup.chandef.chan)
14363			return -EINVAL;
14364
14365		sband = rdev->wiphy.bands[setup.chandef.chan->band];
14366
14367		err = ieee80211_get_ratemask(sband, rates, n_rates,
14368					     &setup.basic_rates);
14369		if (err)
14370			return err;
14371	}
14372
14373	if (info->attrs[NL80211_ATTR_TX_RATES]) {
14374		err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
14375						    NL80211_ATTR_TX_RATES,
14376						    &setup.beacon_rate,
14377						    dev, false, 0);
14378		if (err)
14379			return err;
14380
14381		if (!setup.chandef.chan)
14382			return -EINVAL;
14383
14384		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
14385					      &setup.beacon_rate);
14386		if (err)
14387			return err;
14388	}
14389
14390	setup.userspace_handles_dfs =
14391		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
14392
14393	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
14394		int r = validate_pae_over_nl80211(rdev, info);
14395
14396		if (r < 0)
14397			return r;
14398
14399		setup.control_port_over_nl80211 = true;
14400	}
14401
14402	err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
14403	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
14404		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
14405
14406	return err;
14407}
14408
14409static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
14410{
14411	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14412	struct net_device *dev = info->user_ptr[1];
14413
14414	return cfg80211_leave_mesh(rdev, dev);
14415}
14416
14417#ifdef CONFIG_PM
14418static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
14419					struct cfg80211_registered_device *rdev)
14420{
14421	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
14422	struct nlattr *nl_pats, *nl_pat;
14423	int i, pat_len;
14424
14425	if (!wowlan->n_patterns)
14426		return 0;
14427
14428	nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
14429	if (!nl_pats)
14430		return -ENOBUFS;
14431
14432	for (i = 0; i < wowlan->n_patterns; i++) {
14433		nl_pat = nla_nest_start_noflag(msg, i + 1);
14434		if (!nl_pat)
14435			return -ENOBUFS;
14436		pat_len = wowlan->patterns[i].pattern_len;
14437		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
14438			    wowlan->patterns[i].mask) ||
14439		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
14440			    wowlan->patterns[i].pattern) ||
14441		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
14442				wowlan->patterns[i].pkt_offset))
14443			return -ENOBUFS;
14444		nla_nest_end(msg, nl_pat);
14445	}
14446	nla_nest_end(msg, nl_pats);
14447
14448	return 0;
14449}
14450
14451static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
14452				   struct cfg80211_wowlan_tcp *tcp)
14453{
14454	struct nlattr *nl_tcp;
14455
14456	if (!tcp)
14457		return 0;
14458
14459	nl_tcp = nla_nest_start_noflag(msg,
14460				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
14461	if (!nl_tcp)
14462		return -ENOBUFS;
14463
14464	if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
14465	    nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
14466	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
14467	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
14468	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
14469	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
14470		    tcp->payload_len, tcp->payload) ||
14471	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
14472			tcp->data_interval) ||
14473	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
14474		    tcp->wake_len, tcp->wake_data) ||
14475	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
14476		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
14477		return -ENOBUFS;
14478
14479	if (tcp->payload_seq.len &&
14480	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
14481		    sizeof(tcp->payload_seq), &tcp->payload_seq))
14482		return -ENOBUFS;
14483
14484	if (tcp->payload_tok.len &&
14485	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
14486		    sizeof(tcp->payload_tok) + tcp->tokens_size,
14487		    &tcp->payload_tok))
14488		return -ENOBUFS;
14489
14490	nla_nest_end(msg, nl_tcp);
14491
14492	return 0;
14493}
14494
14495static int nl80211_send_wowlan_nd(struct sk_buff *msg,
14496				  struct cfg80211_sched_scan_request *req)
14497{
14498	struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
14499	int i;
14500
14501	if (!req)
14502		return 0;
14503
14504	nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
14505	if (!nd)
14506		return -ENOBUFS;
14507
14508	if (req->n_scan_plans == 1 &&
14509	    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
14510			req->scan_plans[0].interval * 1000))
14511		return -ENOBUFS;
14512
14513	if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
14514		return -ENOBUFS;
14515
14516	if (req->relative_rssi_set) {
14517		struct nl80211_bss_select_rssi_adjust rssi_adjust;
14518
14519		if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
14520			       req->relative_rssi))
14521			return -ENOBUFS;
14522
14523		rssi_adjust.band = req->rssi_adjust.band;
14524		rssi_adjust.delta = req->rssi_adjust.delta;
14525		if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
14526			    sizeof(rssi_adjust), &rssi_adjust))
14527			return -ENOBUFS;
14528	}
14529
14530	freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14531	if (!freqs)
14532		return -ENOBUFS;
14533
14534	for (i = 0; i < req->n_channels; i++) {
14535		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14536			return -ENOBUFS;
14537	}
14538
14539	nla_nest_end(msg, freqs);
14540
14541	if (req->n_match_sets) {
14542		matches = nla_nest_start_noflag(msg,
14543						NL80211_ATTR_SCHED_SCAN_MATCH);
14544		if (!matches)
14545			return -ENOBUFS;
14546
14547		for (i = 0; i < req->n_match_sets; i++) {
14548			match = nla_nest_start_noflag(msg, i);
14549			if (!match)
14550				return -ENOBUFS;
14551
14552			if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
14553				    req->match_sets[i].ssid.ssid_len,
14554				    req->match_sets[i].ssid.ssid))
14555				return -ENOBUFS;
14556			nla_nest_end(msg, match);
14557		}
14558		nla_nest_end(msg, matches);
14559	}
14560
14561	scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
14562	if (!scan_plans)
14563		return -ENOBUFS;
14564
14565	for (i = 0; i < req->n_scan_plans; i++) {
14566		scan_plan = nla_nest_start_noflag(msg, i + 1);
14567		if (!scan_plan)
14568			return -ENOBUFS;
14569
14570		if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
14571				req->scan_plans[i].interval) ||
14572		    (req->scan_plans[i].iterations &&
14573		     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
14574				 req->scan_plans[i].iterations)))
14575			return -ENOBUFS;
14576		nla_nest_end(msg, scan_plan);
14577	}
14578	nla_nest_end(msg, scan_plans);
14579
14580	nla_nest_end(msg, nd);
14581
14582	return 0;
14583}
14584
14585static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
14586{
14587	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14588	struct sk_buff *msg;
14589	void *hdr;
14590	u32 size = NLMSG_DEFAULT_SIZE;
14591
14592	if (!rdev->wiphy.wowlan)
14593		return -EOPNOTSUPP;
14594
14595	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
14596		/* adjust size to have room for all the data */
14597		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
14598			rdev->wiphy.wowlan_config->tcp->payload_len +
14599			rdev->wiphy.wowlan_config->tcp->wake_len +
14600			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
14601	}
14602
14603	msg = nlmsg_new(size, GFP_KERNEL);
14604	if (!msg)
14605		return -ENOMEM;
14606
14607	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14608			     NL80211_CMD_GET_WOWLAN);
14609	if (!hdr)
14610		goto nla_put_failure;
14611
14612	if (rdev->wiphy.wowlan_config) {
14613		struct nlattr *nl_wowlan;
14614
14615		nl_wowlan = nla_nest_start_noflag(msg,
14616						  NL80211_ATTR_WOWLAN_TRIGGERS);
14617		if (!nl_wowlan)
14618			goto nla_put_failure;
14619
14620		if ((rdev->wiphy.wowlan_config->any &&
14621		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
14622		    (rdev->wiphy.wowlan_config->disconnect &&
14623		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
14624		    (rdev->wiphy.wowlan_config->magic_pkt &&
14625		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
14626		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
14627		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
14628		    (rdev->wiphy.wowlan_config->eap_identity_req &&
14629		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
14630		    (rdev->wiphy.wowlan_config->four_way_handshake &&
14631		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
14632		    (rdev->wiphy.wowlan_config->rfkill_release &&
14633		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
14634			goto nla_put_failure;
14635
14636		if (nl80211_send_wowlan_patterns(msg, rdev))
14637			goto nla_put_failure;
14638
14639		if (nl80211_send_wowlan_tcp(msg,
14640					    rdev->wiphy.wowlan_config->tcp))
14641			goto nla_put_failure;
14642
14643		if (nl80211_send_wowlan_nd(
14644			    msg,
14645			    rdev->wiphy.wowlan_config->nd_config))
14646			goto nla_put_failure;
14647
14648		nla_nest_end(msg, nl_wowlan);
14649	}
14650
14651	genlmsg_end(msg, hdr);
14652	return genlmsg_reply(msg, info);
14653
14654nla_put_failure:
14655	nlmsg_free(msg);
14656	return -ENOBUFS;
14657}
14658
14659static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
14660				    struct nlattr *attr,
14661				    struct cfg80211_wowlan *trig)
14662{
14663	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
14664	struct cfg80211_wowlan_tcp *cfg;
14665	struct nl80211_wowlan_tcp_data_token *tok = NULL;
14666	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
14667	u32 size;
14668	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
14669	int err, port;
14670
14671	if (!rdev->wiphy.wowlan->tcp)
14672		return -EINVAL;
14673
14674	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
14675					  nl80211_wowlan_tcp_policy, NULL);
14676	if (err)
14677		return err;
14678
14679	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
14680	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
14681	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
14682	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
14683	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
14684	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
14685	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
14686	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
14687		return -EINVAL;
14688
14689	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
14690	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
14691		return -EINVAL;
14692
14693	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
14694			rdev->wiphy.wowlan->tcp->data_interval_max ||
14695	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
14696		return -EINVAL;
14697
14698	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
14699	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
14700		return -EINVAL;
14701
14702	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
14703	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
14704		return -EINVAL;
14705
14706	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
14707		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14708
14709		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
14710		tokens_size = tokln - sizeof(*tok);
14711
14712		if (!tok->len || tokens_size % tok->len)
14713			return -EINVAL;
14714		if (!rdev->wiphy.wowlan->tcp->tok)
14715			return -EINVAL;
14716		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
14717			return -EINVAL;
14718		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
14719			return -EINVAL;
14720		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
14721			return -EINVAL;
14722		if (tok->offset + tok->len > data_size)
14723			return -EINVAL;
14724	}
14725
14726	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
14727		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
14728		if (!rdev->wiphy.wowlan->tcp->seq)
14729			return -EINVAL;
14730		if (seq->len == 0 || seq->len > 4)
14731			return -EINVAL;
14732		if (seq->len + seq->offset > data_size)
14733			return -EINVAL;
14734	}
14735
14736	size = sizeof(*cfg);
14737	size += data_size;
14738	size += wake_size + wake_mask_size;
14739	size += tokens_size;
14740
14741	cfg = kzalloc(size, GFP_KERNEL);
14742	if (!cfg)
14743		return -ENOMEM;
14744	cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
14745	cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
14746	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
14747	       ETH_ALEN);
14748	port = nla_get_u16_default(tb[NL80211_WOWLAN_TCP_SRC_PORT], 0);
14749#ifdef CONFIG_INET
14750	/* allocate a socket and port for it and use it */
14751	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
14752			    IPPROTO_TCP, &cfg->sock, 1);
14753	if (err) {
14754		kfree(cfg);
14755		return err;
14756	}
14757	if (inet_csk_get_port(cfg->sock->sk, port)) {
14758		sock_release(cfg->sock);
14759		kfree(cfg);
14760		return -EADDRINUSE;
14761	}
14762	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
14763#else
14764	if (!port) {
14765		kfree(cfg);
14766		return -EINVAL;
14767	}
14768	cfg->src_port = port;
14769#endif
14770
14771	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
14772	cfg->payload_len = data_size;
14773	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
14774	memcpy((void *)cfg->payload,
14775	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
14776	       data_size);
14777	if (seq)
14778		cfg->payload_seq = *seq;
14779	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
14780	cfg->wake_len = wake_size;
14781	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
14782	memcpy((void *)cfg->wake_data,
14783	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
14784	       wake_size);
14785	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
14786			 data_size + wake_size;
14787	memcpy((void *)cfg->wake_mask,
14788	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
14789	       wake_mask_size);
14790	if (tok) {
14791		cfg->tokens_size = tokens_size;
14792		cfg->payload_tok = *tok;
14793		memcpy(cfg->payload_tok.token_stream, tok->token_stream,
14794		       tokens_size);
14795	}
14796
14797	trig->tcp = cfg;
14798
14799	return 0;
14800}
14801
14802static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
14803				   const struct wiphy_wowlan_support *wowlan,
14804				   struct nlattr *attr,
14805				   struct cfg80211_wowlan *trig)
14806{
14807	struct nlattr **tb;
14808	int err;
14809
14810	tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
14811	if (!tb)
14812		return -ENOMEM;
14813
14814	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
14815		err = -EOPNOTSUPP;
14816		goto out;
14817	}
14818
14819	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
14820					  nl80211_policy, NULL);
14821	if (err)
14822		goto out;
14823
14824	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
14825						   wowlan->max_nd_match_sets);
14826	err = PTR_ERR_OR_ZERO(trig->nd_config);
14827	if (err)
14828		trig->nd_config = NULL;
14829
14830out:
14831	kfree(tb);
14832	return err;
14833}
14834
14835static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
14836{
14837	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14838	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
14839	struct cfg80211_wowlan new_triggers = {};
14840	struct cfg80211_wowlan *ntrig;
14841	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
14842	int err, i;
14843	bool prev_enabled = rdev->wiphy.wowlan_config;
14844	bool regular = false;
14845
14846	if (!wowlan)
14847		return -EOPNOTSUPP;
14848
14849	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
14850		cfg80211_rdev_free_wowlan(rdev);
14851		rdev->wiphy.wowlan_config = NULL;
14852		goto set_wakeup;
14853	}
14854
14855	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
14856					  info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
14857					  nl80211_wowlan_policy, info->extack);
14858	if (err)
14859		return err;
14860
14861	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
14862		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
14863			return -EINVAL;
14864		new_triggers.any = true;
14865	}
14866
14867	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
14868		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
14869			return -EINVAL;
14870		new_triggers.disconnect = true;
14871		regular = true;
14872	}
14873
14874	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
14875		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
14876			return -EINVAL;
14877		new_triggers.magic_pkt = true;
14878		regular = true;
14879	}
14880
14881	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
14882		return -EINVAL;
14883
14884	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
14885		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
14886			return -EINVAL;
14887		new_triggers.gtk_rekey_failure = true;
14888		regular = true;
14889	}
14890
14891	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
14892		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
14893			return -EINVAL;
14894		new_triggers.eap_identity_req = true;
14895		regular = true;
14896	}
14897
14898	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
14899		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
14900			return -EINVAL;
14901		new_triggers.four_way_handshake = true;
14902		regular = true;
14903	}
14904
14905	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
14906		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
14907			return -EINVAL;
14908		new_triggers.rfkill_release = true;
14909		regular = true;
14910	}
14911
14912	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
14913		struct nlattr *pat;
14914		int n_patterns = 0;
14915		int rem, pat_len, mask_len, pkt_offset;
14916		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
14917
14918		regular = true;
14919
14920		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14921				    rem)
14922			n_patterns++;
14923		if (n_patterns > wowlan->n_patterns)
14924			return -EINVAL;
14925
14926		new_triggers.patterns = kcalloc(n_patterns,
14927						sizeof(new_triggers.patterns[0]),
14928						GFP_KERNEL);
14929		if (!new_triggers.patterns)
14930			return -ENOMEM;
14931
14932		new_triggers.n_patterns = n_patterns;
14933		i = 0;
14934
14935		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
14936				    rem) {
14937			u8 *mask_pat;
14938
14939			err = nla_parse_nested_deprecated(pat_tb,
14940							  MAX_NL80211_PKTPAT,
14941							  pat,
14942							  nl80211_packet_pattern_policy,
14943							  info->extack);
14944			if (err)
14945				goto error;
14946
14947			err = -EINVAL;
14948			if (!pat_tb[NL80211_PKTPAT_MASK] ||
14949			    !pat_tb[NL80211_PKTPAT_PATTERN])
14950				goto error;
14951			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
14952			mask_len = DIV_ROUND_UP(pat_len, 8);
14953			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
14954				goto error;
14955			if (pat_len > wowlan->pattern_max_len ||
14956			    pat_len < wowlan->pattern_min_len)
14957				goto error;
14958
14959			pkt_offset =
14960				nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
14961						    0);
14962			if (pkt_offset > wowlan->max_pkt_offset)
14963				goto error;
14964			new_triggers.patterns[i].pkt_offset = pkt_offset;
14965
14966			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
14967			if (!mask_pat) {
14968				err = -ENOMEM;
14969				goto error;
14970			}
14971			new_triggers.patterns[i].mask = mask_pat;
14972			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
14973			       mask_len);
14974			mask_pat += mask_len;
14975			new_triggers.patterns[i].pattern = mask_pat;
14976			new_triggers.patterns[i].pattern_len = pat_len;
14977			memcpy(mask_pat,
14978			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
14979			       pat_len);
14980			i++;
14981		}
14982	}
14983
14984	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
14985		regular = true;
14986		err = nl80211_parse_wowlan_tcp(
14987			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
14988			&new_triggers);
14989		if (err)
14990			goto error;
14991	}
14992
14993	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
14994		regular = true;
14995		err = nl80211_parse_wowlan_nd(
14996			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
14997			&new_triggers);
14998		if (err)
14999			goto error;
15000	}
15001
15002	/* The 'any' trigger means the device continues operating more or less
15003	 * as in its normal operation mode and wakes up the host on most of the
15004	 * normal interrupts (like packet RX, ...)
15005	 * It therefore makes little sense to combine with the more constrained
15006	 * wakeup trigger modes.
15007	 */
15008	if (new_triggers.any && regular) {
15009		err = -EINVAL;
15010		goto error;
15011	}
15012
15013	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
15014	if (!ntrig) {
15015		err = -ENOMEM;
15016		goto error;
15017	}
15018	cfg80211_rdev_free_wowlan(rdev);
15019	rdev->wiphy.wowlan_config = ntrig;
15020
15021 set_wakeup:
15022	if (rdev->ops->set_wakeup &&
15023	    prev_enabled != !!rdev->wiphy.wowlan_config)
15024		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
15025
15026	return 0;
15027 error:
15028	for (i = 0; i < new_triggers.n_patterns; i++)
15029		kfree(new_triggers.patterns[i].mask);
15030	kfree(new_triggers.patterns);
15031	if (new_triggers.tcp && new_triggers.tcp->sock)
15032		sock_release(new_triggers.tcp->sock);
15033	kfree(new_triggers.tcp);
15034	kfree(new_triggers.nd_config);
15035	return err;
15036}
15037#endif
15038
15039static int nl80211_send_coalesce_rules(struct sk_buff *msg,
15040				       struct cfg80211_registered_device *rdev)
15041{
15042	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
15043	int i, j, pat_len;
15044	struct cfg80211_coalesce_rules *rule;
15045
15046	if (!rdev->coalesce->n_rules)
15047		return 0;
15048
15049	nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
15050	if (!nl_rules)
15051		return -ENOBUFS;
15052
15053	for (i = 0; i < rdev->coalesce->n_rules; i++) {
15054		nl_rule = nla_nest_start_noflag(msg, i + 1);
15055		if (!nl_rule)
15056			return -ENOBUFS;
15057
15058		rule = &rdev->coalesce->rules[i];
15059		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
15060				rule->delay))
15061			return -ENOBUFS;
15062
15063		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
15064				rule->condition))
15065			return -ENOBUFS;
15066
15067		nl_pats = nla_nest_start_noflag(msg,
15068						NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
15069		if (!nl_pats)
15070			return -ENOBUFS;
15071
15072		for (j = 0; j < rule->n_patterns; j++) {
15073			nl_pat = nla_nest_start_noflag(msg, j + 1);
15074			if (!nl_pat)
15075				return -ENOBUFS;
15076			pat_len = rule->patterns[j].pattern_len;
15077			if (nla_put(msg, NL80211_PKTPAT_MASK,
15078				    DIV_ROUND_UP(pat_len, 8),
15079				    rule->patterns[j].mask) ||
15080			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
15081				    rule->patterns[j].pattern) ||
15082			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
15083					rule->patterns[j].pkt_offset))
15084				return -ENOBUFS;
15085			nla_nest_end(msg, nl_pat);
15086		}
15087		nla_nest_end(msg, nl_pats);
15088		nla_nest_end(msg, nl_rule);
15089	}
15090	nla_nest_end(msg, nl_rules);
15091
15092	return 0;
15093}
15094
15095static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
15096{
15097	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15098	struct sk_buff *msg;
15099	void *hdr;
15100
15101	if (!rdev->wiphy.coalesce)
15102		return -EOPNOTSUPP;
15103
15104	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15105	if (!msg)
15106		return -ENOMEM;
15107
15108	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15109			     NL80211_CMD_GET_COALESCE);
15110	if (!hdr)
15111		goto nla_put_failure;
15112
15113	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
15114		goto nla_put_failure;
15115
15116	genlmsg_end(msg, hdr);
15117	return genlmsg_reply(msg, info);
15118
15119nla_put_failure:
15120	nlmsg_free(msg);
15121	return -ENOBUFS;
15122}
15123
15124void cfg80211_free_coalesce(struct cfg80211_coalesce *coalesce)
15125{
15126	int i, j;
15127	struct cfg80211_coalesce_rules *rule;
15128
15129	if (!coalesce)
15130		return;
15131
15132	for (i = 0; i < coalesce->n_rules; i++) {
15133		rule = &coalesce->rules[i];
15134		for (j = 0; j < rule->n_patterns; j++)
15135			kfree(rule->patterns[j].mask);
15136		kfree(rule->patterns);
15137	}
15138	kfree(coalesce);
15139}
15140
15141static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
15142				       struct nlattr *rule,
15143				       struct cfg80211_coalesce_rules *new_rule)
15144{
15145	int err, i;
15146	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15147	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
15148	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
15149	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
15150
15151	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
15152					  rule, nl80211_coalesce_policy, NULL);
15153	if (err)
15154		return err;
15155
15156	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
15157		new_rule->delay =
15158			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
15159	if (new_rule->delay > coalesce->max_delay)
15160		return -EINVAL;
15161
15162	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
15163		new_rule->condition =
15164			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
15165
15166	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
15167		return -EINVAL;
15168
15169	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15170			    rem)
15171		n_patterns++;
15172	if (n_patterns > coalesce->n_patterns)
15173		return -EINVAL;
15174
15175	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
15176				     GFP_KERNEL);
15177	if (!new_rule->patterns)
15178		return -ENOMEM;
15179
15180	new_rule->n_patterns = n_patterns;
15181	i = 0;
15182
15183	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
15184			    rem) {
15185		u8 *mask_pat;
15186
15187		err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
15188						  pat,
15189						  nl80211_packet_pattern_policy,
15190						  NULL);
15191		if (err)
15192			return err;
15193
15194		if (!pat_tb[NL80211_PKTPAT_MASK] ||
15195		    !pat_tb[NL80211_PKTPAT_PATTERN])
15196			return -EINVAL;
15197		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
15198		mask_len = DIV_ROUND_UP(pat_len, 8);
15199		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
15200			return -EINVAL;
15201		if (pat_len > coalesce->pattern_max_len ||
15202		    pat_len < coalesce->pattern_min_len)
15203			return -EINVAL;
15204
15205		pkt_offset = nla_get_u32_default(pat_tb[NL80211_PKTPAT_OFFSET],
15206						 0);
15207		if (pkt_offset > coalesce->max_pkt_offset)
15208			return -EINVAL;
15209		new_rule->patterns[i].pkt_offset = pkt_offset;
15210
15211		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
15212		if (!mask_pat)
15213			return -ENOMEM;
15214
15215		new_rule->patterns[i].mask = mask_pat;
15216		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
15217		       mask_len);
15218
15219		mask_pat += mask_len;
15220		new_rule->patterns[i].pattern = mask_pat;
15221		new_rule->patterns[i].pattern_len = pat_len;
15222		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
15223		       pat_len);
15224		i++;
15225	}
15226
15227	return 0;
15228}
15229
15230static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
15231{
15232	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15233	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
15234	struct cfg80211_coalesce *new_coalesce;
15235	int err, rem_rule, n_rules = 0, i;
15236	struct nlattr *rule;
15237
15238	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
15239		return -EOPNOTSUPP;
15240
15241	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
15242		cfg80211_free_coalesce(rdev->coalesce);
15243		rdev->coalesce = NULL;
15244		rdev_set_coalesce(rdev, NULL);
15245		return 0;
15246	}
15247
15248	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15249			    rem_rule)
15250		n_rules++;
15251	if (n_rules > coalesce->n_rules)
15252		return -EINVAL;
15253
15254	new_coalesce = kzalloc(struct_size(new_coalesce, rules, n_rules),
15255			       GFP_KERNEL);
15256	if (!new_coalesce)
15257		return -ENOMEM;
15258
15259	new_coalesce->n_rules = n_rules;
15260	i = 0;
15261
15262	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
15263			    rem_rule) {
15264		err = nl80211_parse_coalesce_rule(rdev, rule,
15265						  &new_coalesce->rules[i]);
15266		if (err)
15267			goto error;
15268
15269		i++;
15270	}
15271
15272	err = rdev_set_coalesce(rdev, new_coalesce);
15273	if (err)
15274		goto error;
15275
15276	cfg80211_free_coalesce(rdev->coalesce);
15277	rdev->coalesce = new_coalesce;
15278
15279	return 0;
15280error:
15281	cfg80211_free_coalesce(new_coalesce);
15282
15283	return err;
15284}
15285
15286static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
15287{
15288	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15289	struct net_device *dev = info->user_ptr[1];
15290	struct wireless_dev *wdev = dev->ieee80211_ptr;
15291	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
15292	struct cfg80211_gtk_rekey_data rekey_data = {};
15293	int err;
15294
15295	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
15296		return -EINVAL;
15297
15298	err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
15299					  info->attrs[NL80211_ATTR_REKEY_DATA],
15300					  nl80211_rekey_policy, info->extack);
15301	if (err)
15302		return err;
15303
15304	if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
15305	    !tb[NL80211_REKEY_DATA_KCK])
15306		return -EINVAL;
15307	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
15308	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15309	      nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
15310		return -ERANGE;
15311	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
15312	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
15313	      nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
15314	     !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
15315	       nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
15316		return -ERANGE;
15317
15318	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
15319	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
15320	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
15321	rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
15322	rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
15323	if (tb[NL80211_REKEY_DATA_AKM])
15324		rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
15325
15326	if (!wdev->connected)
15327		return -ENOTCONN;
15328
15329	if (!rdev->ops->set_rekey_data)
15330		return -EOPNOTSUPP;
15331
15332	return rdev_set_rekey_data(rdev, dev, &rekey_data);
15333}
15334
15335static int nl80211_register_unexpected_frame(struct sk_buff *skb,
15336					     struct genl_info *info)
15337{
15338	struct net_device *dev = info->user_ptr[1];
15339	struct wireless_dev *wdev = dev->ieee80211_ptr;
15340
15341	if (wdev->iftype != NL80211_IFTYPE_AP &&
15342	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
15343		return -EINVAL;
15344
15345	if (wdev->ap_unexpected_nlportid)
15346		return -EBUSY;
15347
15348	wdev->ap_unexpected_nlportid = info->snd_portid;
15349	return 0;
15350}
15351
15352static int nl80211_probe_client(struct sk_buff *skb,
15353				struct genl_info *info)
15354{
15355	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15356	struct net_device *dev = info->user_ptr[1];
15357	struct wireless_dev *wdev = dev->ieee80211_ptr;
15358	struct sk_buff *msg;
15359	void *hdr;
15360	const u8 *addr;
15361	u64 cookie;
15362	int err;
15363
15364	if (wdev->iftype != NL80211_IFTYPE_AP &&
15365	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
15366		return -EOPNOTSUPP;
15367
15368	if (!info->attrs[NL80211_ATTR_MAC])
15369		return -EINVAL;
15370
15371	if (!rdev->ops->probe_client)
15372		return -EOPNOTSUPP;
15373
15374	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15375	if (!msg)
15376		return -ENOMEM;
15377
15378	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15379			     NL80211_CMD_PROBE_CLIENT);
15380	if (!hdr) {
15381		err = -ENOBUFS;
15382		goto free_msg;
15383	}
15384
15385	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15386
15387	err = rdev_probe_client(rdev, dev, addr, &cookie);
15388	if (err)
15389		goto free_msg;
15390
15391	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15392			      NL80211_ATTR_PAD))
15393		goto nla_put_failure;
15394
15395	genlmsg_end(msg, hdr);
15396
15397	return genlmsg_reply(msg, info);
15398
15399 nla_put_failure:
15400	err = -ENOBUFS;
15401 free_msg:
15402	nlmsg_free(msg);
15403	return err;
15404}
15405
15406static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
15407{
15408	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15409	struct cfg80211_beacon_registration *reg, *nreg;
15410	int rv;
15411
15412	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
15413		return -EOPNOTSUPP;
15414
15415	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
15416	if (!nreg)
15417		return -ENOMEM;
15418
15419	/* First, check if already registered. */
15420	spin_lock_bh(&rdev->beacon_registrations_lock);
15421	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15422		if (reg->nlportid == info->snd_portid) {
15423			rv = -EALREADY;
15424			goto out_err;
15425		}
15426	}
15427	/* Add it to the list */
15428	nreg->nlportid = info->snd_portid;
15429	list_add(&nreg->list, &rdev->beacon_registrations);
15430
15431	spin_unlock_bh(&rdev->beacon_registrations_lock);
15432
15433	return 0;
15434out_err:
15435	spin_unlock_bh(&rdev->beacon_registrations_lock);
15436	kfree(nreg);
15437	return rv;
15438}
15439
15440static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
15441{
15442	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15443	struct wireless_dev *wdev = info->user_ptr[1];
15444	int err;
15445
15446	if (!rdev->ops->start_p2p_device)
15447		return -EOPNOTSUPP;
15448
15449	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15450		return -EOPNOTSUPP;
15451
15452	if (wdev_running(wdev))
15453		return 0;
15454
15455	if (rfkill_blocked(rdev->wiphy.rfkill))
15456		return -ERFKILL;
15457
15458	err = rdev_start_p2p_device(rdev, wdev);
15459	if (err)
15460		return err;
15461
15462	wdev->is_running = true;
15463	rdev->opencount++;
15464
15465	return 0;
15466}
15467
15468static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
15469{
15470	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15471	struct wireless_dev *wdev = info->user_ptr[1];
15472
15473	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
15474		return -EOPNOTSUPP;
15475
15476	if (!rdev->ops->stop_p2p_device)
15477		return -EOPNOTSUPP;
15478
15479	cfg80211_stop_p2p_device(rdev, wdev);
15480
15481	return 0;
15482}
15483
15484static struct ieee80211_channel *nl80211_get_nan_channel(struct wiphy *wiphy,
15485							 int freq)
15486{
15487	struct ieee80211_channel *chan;
15488	struct cfg80211_chan_def def;
15489
15490	/* Check if the frequency is valid for NAN */
15491	if (freq != 5220 && freq != 5745 && freq != 2437)
15492		return NULL;
15493
15494	chan = ieee80211_get_channel(wiphy, freq);
15495	if (!chan)
15496		return NULL;
15497
15498	cfg80211_chandef_create(&def, chan, NL80211_CHAN_NO_HT);
15499
15500	/* Check if the channel is allowed */
15501	if (cfg80211_reg_can_beacon(wiphy, &def, NL80211_IFTYPE_NAN))
15502		return chan;
15503
15504	return NULL;
15505}
15506
15507static int nl80211_parse_nan_band_config(struct wiphy *wiphy,
15508					 struct nlattr **tb,
15509					 struct cfg80211_nan_band_config *cfg,
15510					 enum nl80211_band band)
15511{
15512	if (BIT(band) & ~(u32)wiphy->nan_supported_bands)
15513		return -EINVAL;
15514
15515	if (tb[NL80211_NAN_BAND_CONF_FREQ]) {
15516		u16 freq = nla_get_u16(tb[NL80211_NAN_BAND_CONF_FREQ]);
15517
15518		if (band != NL80211_BAND_5GHZ)
15519			return -EINVAL;
15520
15521		cfg->chan = nl80211_get_nan_channel(wiphy, freq);
15522		if (!cfg->chan)
15523			return -EINVAL;
15524	}
15525
15526	if (tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]) {
15527		cfg->rssi_close =
15528			nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_CLOSE]);
15529		if (!tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE])
15530			return -EINVAL;
15531	}
15532
15533	if (tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]) {
15534		cfg->rssi_middle =
15535			nla_get_s8(tb[NL80211_NAN_BAND_CONF_RSSI_MIDDLE]);
15536		if (!cfg->rssi_close || cfg->rssi_middle >= cfg->rssi_close)
15537			return -EINVAL;
15538	}
15539
15540	if (tb[NL80211_NAN_BAND_CONF_WAKE_DW]) {
15541		cfg->awake_dw_interval =
15542			nla_get_u8(tb[NL80211_NAN_BAND_CONF_WAKE_DW]);
15543
15544		if (band == NL80211_BAND_2GHZ && cfg->awake_dw_interval == 0)
15545			return -EINVAL;
15546	}
15547
15548	cfg->disable_scan =
15549		nla_get_flag(tb[NL80211_NAN_BAND_CONF_DISABLE_SCAN]);
15550	return 0;
15551}
15552
15553static int nl80211_parse_nan_conf(struct wiphy *wiphy,
15554				  struct genl_info *info,
15555				  struct cfg80211_nan_conf *conf,
15556				  u32 *changed_flags)
15557{
15558	struct nlattr *attrs[NL80211_NAN_CONF_ATTR_MAX + 1];
15559	int err, rem;
15560	u32 changed = 0;
15561	struct nlattr *band_config;
15562
15563	if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
15564		conf->master_pref =
15565			nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
15566
15567		changed |= CFG80211_NAN_CONF_CHANGED_PREF;
15568	}
15569
15570	if (info->attrs[NL80211_ATTR_BANDS]) {
15571		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
15572
15573		if (bands & ~(u32)wiphy->nan_supported_bands)
15574			return -EOPNOTSUPP;
15575
15576		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
15577			return -EINVAL;
15578
15579		conf->bands = bands;
15580		changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
15581	}
15582
15583	conf->band_cfgs[NL80211_BAND_2GHZ].awake_dw_interval = 1;
15584	if (conf->bands & BIT(NL80211_BAND_5GHZ) || !conf->bands)
15585		conf->band_cfgs[NL80211_BAND_5GHZ].awake_dw_interval = 1;
15586
15587	/* On 2.4 GHz band use channel 6 */
15588	conf->band_cfgs[NL80211_BAND_2GHZ].chan =
15589		nl80211_get_nan_channel(wiphy, 2437);
15590	if (!conf->band_cfgs[NL80211_BAND_2GHZ].chan)
15591		return -EINVAL;
15592
15593	if (!info->attrs[NL80211_ATTR_NAN_CONFIG])
15594		goto out;
15595
15596	err = nla_parse_nested(attrs, NL80211_NAN_CONF_ATTR_MAX,
15597			       info->attrs[NL80211_ATTR_NAN_CONFIG], NULL,
15598			       info->extack);
15599	if (err)
15600		return err;
15601
15602	changed |= CFG80211_NAN_CONF_CHANGED_CONFIG;
15603	if (attrs[NL80211_NAN_CONF_CLUSTER_ID])
15604		conf->cluster_id =
15605			nla_data(attrs[NL80211_NAN_CONF_CLUSTER_ID]);
15606
15607	if (attrs[NL80211_NAN_CONF_EXTRA_ATTRS]) {
15608		conf->extra_nan_attrs =
15609			nla_data(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15610		conf->extra_nan_attrs_len =
15611			nla_len(attrs[NL80211_NAN_CONF_EXTRA_ATTRS]);
15612	}
15613
15614	if (attrs[NL80211_NAN_CONF_VENDOR_ELEMS]) {
15615		conf->vendor_elems =
15616			nla_data(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15617		conf->vendor_elems_len =
15618			nla_len(attrs[NL80211_NAN_CONF_VENDOR_ELEMS]);
15619	}
15620
15621	if (attrs[NL80211_NAN_CONF_BAND_CONFIGS]) {
15622		nla_for_each_nested(band_config,
15623				    attrs[NL80211_NAN_CONF_BAND_CONFIGS],
15624				    rem) {
15625			enum nl80211_band band;
15626			struct cfg80211_nan_band_config *cfg;
15627			struct nlattr *tb[NL80211_NAN_BAND_CONF_ATTR_MAX + 1];
15628
15629			err = nla_parse_nested(tb,
15630					       NL80211_NAN_BAND_CONF_ATTR_MAX,
15631					       band_config, NULL,
15632					       info->extack);
15633			if (err)
15634				return err;
15635
15636			if (!tb[NL80211_NAN_BAND_CONF_BAND])
15637				return -EINVAL;
15638
15639			band = nla_get_u8(tb[NL80211_NAN_BAND_CONF_BAND]);
15640			if (conf->bands && !(conf->bands & BIT(band)))
15641				return -EINVAL;
15642
15643			cfg = &conf->band_cfgs[band];
15644
15645			err = nl80211_parse_nan_band_config(wiphy, tb, cfg,
15646							    band);
15647			if (err)
15648				return err;
15649		}
15650	}
15651
15652	if (attrs[NL80211_NAN_CONF_SCAN_PERIOD])
15653		conf->scan_period =
15654			nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_PERIOD]);
15655
15656	if (attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME])
15657		conf->scan_dwell_time =
15658			nla_get_u16(attrs[NL80211_NAN_CONF_SCAN_DWELL_TIME]);
15659
15660	if (attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL])
15661		conf->discovery_beacon_interval =
15662			nla_get_u8(attrs[NL80211_NAN_CONF_DISCOVERY_BEACON_INTERVAL]);
15663
15664	if (attrs[NL80211_NAN_CONF_NOTIFY_DW])
15665		conf->enable_dw_notification =
15666			nla_get_flag(attrs[NL80211_NAN_CONF_NOTIFY_DW]);
15667
15668out:
15669	if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15670	    (!conf->bands || conf->bands & BIT(NL80211_BAND_5GHZ))) {
15671		/* If no 5GHz channel is specified use default, if possible */
15672		conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15673				nl80211_get_nan_channel(wiphy, 5745);
15674		if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan)
15675			conf->band_cfgs[NL80211_BAND_5GHZ].chan =
15676					nl80211_get_nan_channel(wiphy, 5220);
15677
15678		/* Return error if user space asked explicitly for 5 GHz */
15679		if (!conf->band_cfgs[NL80211_BAND_5GHZ].chan &&
15680		    conf->bands & BIT(NL80211_BAND_5GHZ)) {
15681			NL_SET_ERR_MSG_ATTR(info->extack,
15682					    info->attrs[NL80211_ATTR_BANDS],
15683					    "5 GHz band operation is not allowed");
15684			return -EINVAL;
15685		}
15686	}
15687
15688	if (changed_flags)
15689		*changed_flags = changed;
15690
15691	return 0;
15692}
15693
15694static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
15695{
15696	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15697	struct wireless_dev *wdev = info->user_ptr[1];
15698	struct cfg80211_nan_conf conf = {};
15699	int err;
15700
15701	if (wdev->iftype != NL80211_IFTYPE_NAN)
15702		return -EOPNOTSUPP;
15703
15704	if (wdev_running(wdev))
15705		return -EEXIST;
15706
15707	if (rfkill_blocked(rdev->wiphy.rfkill))
15708		return -ERFKILL;
15709
15710	/* Master preference is mandatory for START_NAN */
15711	if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
15712		return -EINVAL;
15713
15714	err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, NULL);
15715	if (err)
15716		return err;
15717
15718	err = rdev_start_nan(rdev, wdev, &conf);
15719	if (err)
15720		return err;
15721
15722	wdev->is_running = true;
15723	rdev->opencount++;
15724
15725	return 0;
15726}
15727
15728static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
15729{
15730	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15731	struct wireless_dev *wdev = info->user_ptr[1];
15732
15733	if (wdev->iftype != NL80211_IFTYPE_NAN)
15734		return -EOPNOTSUPP;
15735
15736	cfg80211_stop_nan(rdev, wdev);
15737
15738	return 0;
15739}
15740
15741static int validate_nan_filter(struct nlattr *filter_attr)
15742{
15743	struct nlattr *attr;
15744	int len = 0, n_entries = 0, rem;
15745
15746	nla_for_each_nested(attr, filter_attr, rem) {
15747		len += nla_len(attr);
15748		n_entries++;
15749	}
15750
15751	if (len >= U8_MAX)
15752		return -EINVAL;
15753
15754	return n_entries;
15755}
15756
15757static int handle_nan_filter(struct nlattr *attr_filter,
15758			     struct cfg80211_nan_func *func,
15759			     bool tx)
15760{
15761	struct nlattr *attr;
15762	int n_entries, rem, i;
15763	struct cfg80211_nan_func_filter *filter;
15764
15765	n_entries = validate_nan_filter(attr_filter);
15766	if (n_entries < 0)
15767		return n_entries;
15768
15769	BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
15770
15771	filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
15772	if (!filter)
15773		return -ENOMEM;
15774
15775	i = 0;
15776	nla_for_each_nested(attr, attr_filter, rem) {
15777		filter[i].filter = nla_memdup(attr, GFP_KERNEL);
15778		if (!filter[i].filter)
15779			goto err;
15780
15781		filter[i].len = nla_len(attr);
15782		i++;
15783	}
15784	if (tx) {
15785		func->num_tx_filters = n_entries;
15786		func->tx_filters = filter;
15787	} else {
15788		func->num_rx_filters = n_entries;
15789		func->rx_filters = filter;
15790	}
15791
15792	return 0;
15793
15794err:
15795	i = 0;
15796	nla_for_each_nested(attr, attr_filter, rem) {
15797		kfree(filter[i].filter);
15798		i++;
15799	}
15800	kfree(filter);
15801	return -ENOMEM;
15802}
15803
15804static int nl80211_nan_add_func(struct sk_buff *skb,
15805				struct genl_info *info)
15806{
15807	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15808	struct wireless_dev *wdev = info->user_ptr[1];
15809	struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
15810	struct cfg80211_nan_func *func;
15811	struct sk_buff *msg = NULL;
15812	void *hdr = NULL;
15813	int err = 0;
15814
15815	if (wdev->iftype != NL80211_IFTYPE_NAN)
15816		return -EOPNOTSUPP;
15817
15818	if (!wdev_running(wdev))
15819		return -ENOTCONN;
15820
15821	if (!info->attrs[NL80211_ATTR_NAN_FUNC])
15822		return -EINVAL;
15823
15824	err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
15825					  info->attrs[NL80211_ATTR_NAN_FUNC],
15826					  nl80211_nan_func_policy,
15827					  info->extack);
15828	if (err)
15829		return err;
15830
15831	func = kzalloc(sizeof(*func), GFP_KERNEL);
15832	if (!func)
15833		return -ENOMEM;
15834
15835	func->cookie = cfg80211_assign_cookie(rdev);
15836
15837	if (!tb[NL80211_NAN_FUNC_TYPE]) {
15838		err = -EINVAL;
15839		goto out;
15840	}
15841
15842
15843	func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
15844
15845	if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
15846		err = -EINVAL;
15847		goto out;
15848	}
15849
15850	memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
15851	       sizeof(func->service_id));
15852
15853	func->close_range =
15854		nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
15855
15856	if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
15857		func->serv_spec_info_len =
15858			nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
15859		func->serv_spec_info =
15860			kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
15861				func->serv_spec_info_len,
15862				GFP_KERNEL);
15863		if (!func->serv_spec_info) {
15864			err = -ENOMEM;
15865			goto out;
15866		}
15867	}
15868
15869	if (tb[NL80211_NAN_FUNC_TTL])
15870		func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
15871
15872	switch (func->type) {
15873	case NL80211_NAN_FUNC_PUBLISH:
15874		if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
15875			err = -EINVAL;
15876			goto out;
15877		}
15878
15879		func->publish_type =
15880			nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
15881		func->publish_bcast =
15882			nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
15883
15884		if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
15885			func->publish_bcast) {
15886			err = -EINVAL;
15887			goto out;
15888		}
15889		break;
15890	case NL80211_NAN_FUNC_SUBSCRIBE:
15891		func->subscribe_active =
15892			nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
15893		break;
15894	case NL80211_NAN_FUNC_FOLLOW_UP:
15895		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
15896		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
15897		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
15898			err = -EINVAL;
15899			goto out;
15900		}
15901
15902		func->followup_id =
15903			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
15904		func->followup_reqid =
15905			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
15906		memcpy(func->followup_dest.addr,
15907		       nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
15908		       sizeof(func->followup_dest.addr));
15909		if (func->ttl) {
15910			err = -EINVAL;
15911			goto out;
15912		}
15913		break;
15914	default:
15915		err = -EINVAL;
15916		goto out;
15917	}
15918
15919	if (tb[NL80211_NAN_FUNC_SRF]) {
15920		struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
15921
15922		err = nla_parse_nested_deprecated(srf_tb,
15923						  NL80211_NAN_SRF_ATTR_MAX,
15924						  tb[NL80211_NAN_FUNC_SRF],
15925						  nl80211_nan_srf_policy,
15926						  info->extack);
15927		if (err)
15928			goto out;
15929
15930		func->srf_include =
15931			nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
15932
15933		if (srf_tb[NL80211_NAN_SRF_BF]) {
15934			if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
15935			    !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
15936				err = -EINVAL;
15937				goto out;
15938			}
15939
15940			func->srf_bf_len =
15941				nla_len(srf_tb[NL80211_NAN_SRF_BF]);
15942			func->srf_bf =
15943				kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
15944					func->srf_bf_len, GFP_KERNEL);
15945			if (!func->srf_bf) {
15946				err = -ENOMEM;
15947				goto out;
15948			}
15949
15950			func->srf_bf_idx =
15951				nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
15952		} else {
15953			struct nlattr *attr, *mac_attr =
15954				srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
15955			int n_entries, rem, i = 0;
15956
15957			if (!mac_attr) {
15958				err = -EINVAL;
15959				goto out;
15960			}
15961
15962			n_entries = validate_acl_mac_addrs(mac_attr);
15963			if (n_entries <= 0) {
15964				err = -EINVAL;
15965				goto out;
15966			}
15967
15968			func->srf_num_macs = n_entries;
15969			func->srf_macs =
15970				kcalloc(n_entries, sizeof(*func->srf_macs),
15971					GFP_KERNEL);
15972			if (!func->srf_macs) {
15973				err = -ENOMEM;
15974				goto out;
15975			}
15976
15977			nla_for_each_nested(attr, mac_attr, rem)
15978				memcpy(func->srf_macs[i++].addr, nla_data(attr),
15979				       sizeof(*func->srf_macs));
15980		}
15981	}
15982
15983	if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
15984		err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
15985					func, true);
15986		if (err)
15987			goto out;
15988	}
15989
15990	if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
15991		err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
15992					func, false);
15993		if (err)
15994			goto out;
15995	}
15996
15997	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15998	if (!msg) {
15999		err = -ENOMEM;
16000		goto out;
16001	}
16002
16003	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16004			     NL80211_CMD_ADD_NAN_FUNCTION);
16005	/* This can't really happen - we just allocated 4KB */
16006	if (WARN_ON(!hdr)) {
16007		err = -ENOMEM;
16008		goto out;
16009	}
16010
16011	err = rdev_add_nan_func(rdev, wdev, func);
16012out:
16013	if (err < 0) {
16014		cfg80211_free_nan_func(func);
16015		nlmsg_free(msg);
16016		return err;
16017	}
16018
16019	/* propagate the instance id and cookie to userspace  */
16020	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
16021			      NL80211_ATTR_PAD))
16022		goto nla_put_failure;
16023
16024	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16025	if (!func_attr)
16026		goto nla_put_failure;
16027
16028	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
16029		       func->instance_id))
16030		goto nla_put_failure;
16031
16032	nla_nest_end(msg, func_attr);
16033
16034	genlmsg_end(msg, hdr);
16035	return genlmsg_reply(msg, info);
16036
16037nla_put_failure:
16038	nlmsg_free(msg);
16039	return -ENOBUFS;
16040}
16041
16042static int nl80211_nan_del_func(struct sk_buff *skb,
16043			       struct genl_info *info)
16044{
16045	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16046	struct wireless_dev *wdev = info->user_ptr[1];
16047	u64 cookie;
16048
16049	if (wdev->iftype != NL80211_IFTYPE_NAN)
16050		return -EOPNOTSUPP;
16051
16052	if (!wdev_running(wdev))
16053		return -ENOTCONN;
16054
16055	if (!info->attrs[NL80211_ATTR_COOKIE])
16056		return -EINVAL;
16057
16058	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
16059
16060	rdev_del_nan_func(rdev, wdev, cookie);
16061
16062	return 0;
16063}
16064
16065static int nl80211_nan_change_config(struct sk_buff *skb,
16066				     struct genl_info *info)
16067{
16068	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16069	struct wireless_dev *wdev = info->user_ptr[1];
16070	struct cfg80211_nan_conf conf = {};
16071	u32 changed = 0;
16072	int err;
16073
16074	if (wdev->iftype != NL80211_IFTYPE_NAN)
16075		return -EOPNOTSUPP;
16076
16077	if (!wdev_running(wdev))
16078		return -ENOTCONN;
16079
16080	err = nl80211_parse_nan_conf(&rdev->wiphy, info, &conf, &changed);
16081	if (err)
16082		return err;
16083
16084	if (!changed)
16085		return -EINVAL;
16086
16087	return rdev_nan_change_conf(rdev, wdev, &conf, changed);
16088}
16089
16090void cfg80211_nan_match(struct wireless_dev *wdev,
16091			struct cfg80211_nan_match_params *match, gfp_t gfp)
16092{
16093	struct wiphy *wiphy = wdev->wiphy;
16094	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16095	struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
16096	struct sk_buff *msg;
16097	void *hdr;
16098
16099	if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
16100		return;
16101
16102	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16103	if (!msg)
16104		return;
16105
16106	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
16107	if (!hdr) {
16108		nlmsg_free(msg);
16109		return;
16110	}
16111
16112	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16113	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16114					 wdev->netdev->ifindex)) ||
16115	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16116			      NL80211_ATTR_PAD))
16117		goto nla_put_failure;
16118
16119	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
16120			      NL80211_ATTR_PAD) ||
16121	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
16122		goto nla_put_failure;
16123
16124	match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
16125	if (!match_attr)
16126		goto nla_put_failure;
16127
16128	local_func_attr = nla_nest_start_noflag(msg,
16129						NL80211_NAN_MATCH_FUNC_LOCAL);
16130	if (!local_func_attr)
16131		goto nla_put_failure;
16132
16133	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
16134		goto nla_put_failure;
16135
16136	nla_nest_end(msg, local_func_attr);
16137
16138	peer_func_attr = nla_nest_start_noflag(msg,
16139					       NL80211_NAN_MATCH_FUNC_PEER);
16140	if (!peer_func_attr)
16141		goto nla_put_failure;
16142
16143	if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
16144	    nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
16145		goto nla_put_failure;
16146
16147	if (match->info && match->info_len &&
16148	    nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
16149		    match->info))
16150		goto nla_put_failure;
16151
16152	nla_nest_end(msg, peer_func_attr);
16153	nla_nest_end(msg, match_attr);
16154	genlmsg_end(msg, hdr);
16155
16156	if (!wdev->owner_nlportid)
16157		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16158					msg, 0, NL80211_MCGRP_NAN, gfp);
16159	else
16160		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16161				wdev->owner_nlportid);
16162
16163	return;
16164
16165nla_put_failure:
16166	nlmsg_free(msg);
16167}
16168EXPORT_SYMBOL(cfg80211_nan_match);
16169
16170void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
16171				  u8 inst_id,
16172				  enum nl80211_nan_func_term_reason reason,
16173				  u64 cookie, gfp_t gfp)
16174{
16175	struct wiphy *wiphy = wdev->wiphy;
16176	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16177	struct sk_buff *msg;
16178	struct nlattr *func_attr;
16179	void *hdr;
16180
16181	if (WARN_ON(!inst_id))
16182		return;
16183
16184	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16185	if (!msg)
16186		return;
16187
16188	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
16189	if (!hdr) {
16190		nlmsg_free(msg);
16191		return;
16192	}
16193
16194	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16195	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16196					 wdev->netdev->ifindex)) ||
16197	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16198			      NL80211_ATTR_PAD))
16199		goto nla_put_failure;
16200
16201	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16202			      NL80211_ATTR_PAD))
16203		goto nla_put_failure;
16204
16205	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
16206	if (!func_attr)
16207		goto nla_put_failure;
16208
16209	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
16210	    nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
16211		goto nla_put_failure;
16212
16213	nla_nest_end(msg, func_attr);
16214	genlmsg_end(msg, hdr);
16215
16216	if (!wdev->owner_nlportid)
16217		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
16218					msg, 0, NL80211_MCGRP_NAN, gfp);
16219	else
16220		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16221				wdev->owner_nlportid);
16222
16223	return;
16224
16225nla_put_failure:
16226	nlmsg_free(msg);
16227}
16228EXPORT_SYMBOL(cfg80211_nan_func_terminated);
16229
16230static int nl80211_get_protocol_features(struct sk_buff *skb,
16231					 struct genl_info *info)
16232{
16233	void *hdr;
16234	struct sk_buff *msg;
16235
16236	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16237	if (!msg)
16238		return -ENOMEM;
16239
16240	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
16241			     NL80211_CMD_GET_PROTOCOL_FEATURES);
16242	if (!hdr)
16243		goto nla_put_failure;
16244
16245	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
16246			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
16247		goto nla_put_failure;
16248
16249	genlmsg_end(msg, hdr);
16250	return genlmsg_reply(msg, info);
16251
16252 nla_put_failure:
16253	kfree_skb(msg);
16254	return -ENOBUFS;
16255}
16256
16257static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
16258{
16259	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16260	struct cfg80211_update_ft_ies_params ft_params;
16261	struct net_device *dev = info->user_ptr[1];
16262
16263	if (!rdev->ops->update_ft_ies)
16264		return -EOPNOTSUPP;
16265
16266	if (!info->attrs[NL80211_ATTR_MDID] ||
16267	    !info->attrs[NL80211_ATTR_IE])
16268		return -EINVAL;
16269
16270	memset(&ft_params, 0, sizeof(ft_params));
16271	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
16272	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
16273	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
16274
16275	return rdev_update_ft_ies(rdev, dev, &ft_params);
16276}
16277
16278static int nl80211_crit_protocol_start(struct sk_buff *skb,
16279				       struct genl_info *info)
16280{
16281	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16282	struct wireless_dev *wdev = info->user_ptr[1];
16283	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
16284	u16 duration;
16285	int ret;
16286
16287	if (!rdev->ops->crit_proto_start)
16288		return -EOPNOTSUPP;
16289
16290	if (WARN_ON(!rdev->ops->crit_proto_stop))
16291		return -EINVAL;
16292
16293	if (rdev->crit_proto_nlportid)
16294		return -EBUSY;
16295
16296	/* determine protocol if provided */
16297	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
16298		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
16299
16300	if (proto >= NUM_NL80211_CRIT_PROTO)
16301		return -EINVAL;
16302
16303	/* timeout must be provided */
16304	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
16305		return -EINVAL;
16306
16307	duration =
16308		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
16309
16310	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
16311	if (!ret)
16312		rdev->crit_proto_nlportid = info->snd_portid;
16313
16314	return ret;
16315}
16316
16317static int nl80211_crit_protocol_stop(struct sk_buff *skb,
16318				      struct genl_info *info)
16319{
16320	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16321	struct wireless_dev *wdev = info->user_ptr[1];
16322
16323	if (!rdev->ops->crit_proto_stop)
16324		return -EOPNOTSUPP;
16325
16326	if (rdev->crit_proto_nlportid) {
16327		rdev->crit_proto_nlportid = 0;
16328		rdev_crit_proto_stop(rdev, wdev);
16329	}
16330	return 0;
16331}
16332
16333static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
16334				       struct nlattr *attr,
16335				       struct netlink_ext_ack *extack)
16336{
16337	if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
16338		if (attr->nla_type & NLA_F_NESTED) {
16339			NL_SET_ERR_MSG_ATTR(extack, attr,
16340					    "unexpected nested data");
16341			return -EINVAL;
16342		}
16343
16344		return 0;
16345	}
16346
16347	if (!(attr->nla_type & NLA_F_NESTED)) {
16348		NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
16349		return -EINVAL;
16350	}
16351
16352	return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
16353}
16354
16355static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
16356{
16357	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16358	struct wireless_dev *wdev =
16359		__cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
16360					   info->attrs);
16361	int i, err;
16362	u32 vid, subcmd;
16363
16364	if (!rdev->wiphy.vendor_commands)
16365		return -EOPNOTSUPP;
16366
16367	if (IS_ERR(wdev)) {
16368		err = PTR_ERR(wdev);
16369		if (err != -EINVAL)
16370			return err;
16371		wdev = NULL;
16372	} else if (wdev->wiphy != &rdev->wiphy) {
16373		return -EINVAL;
16374	}
16375
16376	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
16377	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
16378		return -EINVAL;
16379
16380	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
16381	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
16382	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
16383		const struct wiphy_vendor_command *vcmd;
16384		void *data = NULL;
16385		int len = 0;
16386
16387		vcmd = &rdev->wiphy.vendor_commands[i];
16388
16389		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16390			continue;
16391
16392		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16393				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16394			if (!wdev)
16395				return -EINVAL;
16396			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16397			    !wdev->netdev)
16398				return -EINVAL;
16399
16400			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16401				if (!wdev_running(wdev))
16402					return -ENETDOWN;
16403			}
16404		} else {
16405			wdev = NULL;
16406		}
16407
16408		if (!vcmd->doit)
16409			return -EOPNOTSUPP;
16410
16411		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
16412			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16413			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
16414
16415			err = nl80211_vendor_check_policy(vcmd,
16416					info->attrs[NL80211_ATTR_VENDOR_DATA],
16417					info->extack);
16418			if (err)
16419				return err;
16420		}
16421
16422		rdev->cur_cmd_info = info;
16423		err = vcmd->doit(&rdev->wiphy, wdev, data, len);
16424		rdev->cur_cmd_info = NULL;
16425		return err;
16426	}
16427
16428	return -EOPNOTSUPP;
16429}
16430
16431static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
16432				       struct netlink_callback *cb,
16433				       struct cfg80211_registered_device **rdev,
16434				       struct wireless_dev **wdev)
16435{
16436	struct nlattr **attrbuf;
16437	u32 vid, subcmd;
16438	unsigned int i;
16439	int vcmd_idx = -1;
16440	int err;
16441	void *data = NULL;
16442	unsigned int data_len = 0;
16443
16444	if (cb->args[0]) {
16445		/* subtract the 1 again here */
16446		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
16447		struct wireless_dev *tmp;
16448
16449		if (!wiphy)
16450			return -ENODEV;
16451		*rdev = wiphy_to_rdev(wiphy);
16452		*wdev = NULL;
16453
16454		if (cb->args[1]) {
16455			list_for_each_entry(tmp, &wiphy->wdev_list, list) {
16456				if (tmp->identifier == cb->args[1] - 1) {
16457					*wdev = tmp;
16458					break;
16459				}
16460			}
16461		}
16462
16463		/* keep rtnl locked in successful case */
16464		return 0;
16465	}
16466
16467	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
16468	if (!attrbuf)
16469		return -ENOMEM;
16470
16471	err = nlmsg_parse_deprecated(cb->nlh,
16472				     GENL_HDRLEN + nl80211_fam.hdrsize,
16473				     attrbuf, nl80211_fam.maxattr,
16474				     nl80211_policy, NULL);
16475	if (err)
16476		goto out;
16477
16478	if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
16479	    !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
16480		err = -EINVAL;
16481		goto out;
16482	}
16483
16484	*wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
16485	if (IS_ERR(*wdev))
16486		*wdev = NULL;
16487
16488	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
16489	if (IS_ERR(*rdev)) {
16490		err = PTR_ERR(*rdev);
16491		goto out;
16492	}
16493
16494	vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
16495	subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
16496
16497	for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
16498		const struct wiphy_vendor_command *vcmd;
16499
16500		vcmd = &(*rdev)->wiphy.vendor_commands[i];
16501
16502		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
16503			continue;
16504
16505		if (!vcmd->dumpit) {
16506			err = -EOPNOTSUPP;
16507			goto out;
16508		}
16509
16510		vcmd_idx = i;
16511		break;
16512	}
16513
16514	if (vcmd_idx < 0) {
16515		err = -EOPNOTSUPP;
16516		goto out;
16517	}
16518
16519	if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
16520		data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16521		data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
16522
16523		err = nl80211_vendor_check_policy(
16524				&(*rdev)->wiphy.vendor_commands[vcmd_idx],
16525				attrbuf[NL80211_ATTR_VENDOR_DATA],
16526				cb->extack);
16527		if (err)
16528			goto out;
16529	}
16530
16531	/* 0 is the first index - add 1 to parse only once */
16532	cb->args[0] = (*rdev)->wiphy_idx + 1;
16533	/* add 1 to know if it was NULL */
16534	cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
16535	cb->args[2] = vcmd_idx;
16536	cb->args[3] = (unsigned long)data;
16537	cb->args[4] = data_len;
16538
16539	/* keep rtnl locked in successful case */
16540	err = 0;
16541out:
16542	kfree(attrbuf);
16543	return err;
16544}
16545
16546static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
16547				   struct netlink_callback *cb)
16548{
16549	struct cfg80211_registered_device *rdev;
16550	struct wireless_dev *wdev;
16551	unsigned int vcmd_idx;
16552	const struct wiphy_vendor_command *vcmd;
16553	void *data;
16554	int data_len;
16555	int err;
16556	struct nlattr *vendor_data;
16557
16558	rtnl_lock();
16559	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
16560	if (err)
16561		goto out;
16562
16563	vcmd_idx = cb->args[2];
16564	data = (void *)cb->args[3];
16565	data_len = cb->args[4];
16566	vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
16567
16568	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
16569			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
16570		if (!wdev) {
16571			err = -EINVAL;
16572			goto out;
16573		}
16574		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
16575		    !wdev->netdev) {
16576			err = -EINVAL;
16577			goto out;
16578		}
16579
16580		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
16581			if (!wdev_running(wdev)) {
16582				err = -ENETDOWN;
16583				goto out;
16584			}
16585		}
16586	}
16587
16588	while (1) {
16589		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
16590					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
16591					   NL80211_CMD_VENDOR);
16592		if (!hdr)
16593			break;
16594
16595		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16596		    (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
16597					       wdev_id(wdev),
16598					       NL80211_ATTR_PAD))) {
16599			genlmsg_cancel(skb, hdr);
16600			break;
16601		}
16602
16603		vendor_data = nla_nest_start_noflag(skb,
16604						    NL80211_ATTR_VENDOR_DATA);
16605		if (!vendor_data) {
16606			genlmsg_cancel(skb, hdr);
16607			break;
16608		}
16609
16610		err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
16611				   (unsigned long *)&cb->args[5]);
16612		nla_nest_end(skb, vendor_data);
16613
16614		if (err == -ENOBUFS || err == -ENOENT) {
16615			genlmsg_cancel(skb, hdr);
16616			break;
16617		} else if (err <= 0) {
16618			genlmsg_cancel(skb, hdr);
16619			goto out;
16620		}
16621
16622		genlmsg_end(skb, hdr);
16623	}
16624
16625	err = skb->len;
16626 out:
16627	rtnl_unlock();
16628	return err;
16629}
16630
16631struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
16632					   enum nl80211_commands cmd,
16633					   enum nl80211_attrs attr,
16634					   int approxlen)
16635{
16636	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16637
16638	if (WARN_ON(!rdev->cur_cmd_info))
16639		return NULL;
16640
16641	return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
16642					   rdev->cur_cmd_info->snd_portid,
16643					   rdev->cur_cmd_info->snd_seq,
16644					   cmd, attr, NULL, GFP_KERNEL);
16645}
16646EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
16647
16648int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
16649{
16650	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
16651	void *hdr = ((void **)skb->cb)[1];
16652	struct nlattr *data = ((void **)skb->cb)[2];
16653
16654	/* clear CB data for netlink core to own from now on */
16655	memset(skb->cb, 0, sizeof(skb->cb));
16656
16657	if (WARN_ON(!rdev->cur_cmd_info)) {
16658		kfree_skb(skb);
16659		return -EINVAL;
16660	}
16661
16662	nla_nest_end(skb, data);
16663	genlmsg_end(skb, hdr);
16664	return genlmsg_reply(skb, rdev->cur_cmd_info);
16665}
16666EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
16667
16668unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
16669{
16670	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16671
16672	if (WARN_ON(!rdev->cur_cmd_info))
16673		return 0;
16674
16675	return rdev->cur_cmd_info->snd_portid;
16676}
16677EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
16678
16679static int nl80211_set_qos_map(struct sk_buff *skb,
16680			       struct genl_info *info)
16681{
16682	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16683	struct cfg80211_qos_map *qos_map = NULL;
16684	struct net_device *dev = info->user_ptr[1];
16685	u8 *pos, len, num_des, des_len, des;
16686	int ret;
16687
16688	if (!rdev->ops->set_qos_map)
16689		return -EOPNOTSUPP;
16690
16691	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
16692		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
16693		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
16694
16695		if (len % 2)
16696			return -EINVAL;
16697
16698		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
16699		if (!qos_map)
16700			return -ENOMEM;
16701
16702		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
16703		if (num_des) {
16704			des_len = num_des *
16705				sizeof(struct cfg80211_dscp_exception);
16706			memcpy(qos_map->dscp_exception, pos, des_len);
16707			qos_map->num_des = num_des;
16708			for (des = 0; des < num_des; des++) {
16709				if (qos_map->dscp_exception[des].up > 7) {
16710					kfree(qos_map);
16711					return -EINVAL;
16712				}
16713			}
16714			pos += des_len;
16715		}
16716		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
16717	}
16718
16719	ret = nl80211_key_allowed(dev->ieee80211_ptr);
16720	if (!ret)
16721		ret = rdev_set_qos_map(rdev, dev, qos_map);
16722
16723	kfree(qos_map);
16724	return ret;
16725}
16726
16727static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
16728{
16729	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16730	struct net_device *dev = info->user_ptr[1];
16731	struct wireless_dev *wdev = dev->ieee80211_ptr;
16732	const u8 *peer;
16733	u8 tsid, up;
16734	u16 admitted_time = 0;
16735
16736	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
16737		return -EOPNOTSUPP;
16738
16739	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
16740	    !info->attrs[NL80211_ATTR_USER_PRIO])
16741		return -EINVAL;
16742
16743	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16744	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
16745
16746	/* WMM uses TIDs 0-7 even for TSPEC */
16747	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
16748		/* TODO: handle 802.11 TSPEC/admission control
16749		 * need more attributes for that (e.g. BA session requirement);
16750		 * change the WMM admission test above to allow both then
16751		 */
16752		return -EINVAL;
16753	}
16754
16755	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16756
16757	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
16758		admitted_time =
16759			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
16760		if (!admitted_time)
16761			return -EINVAL;
16762	}
16763
16764	switch (wdev->iftype) {
16765	case NL80211_IFTYPE_STATION:
16766	case NL80211_IFTYPE_P2P_CLIENT:
16767		if (wdev->connected)
16768			break;
16769		return -ENOTCONN;
16770	default:
16771		return -EOPNOTSUPP;
16772	}
16773
16774	return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
16775}
16776
16777static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
16778{
16779	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16780	struct net_device *dev = info->user_ptr[1];
16781	const u8 *peer;
16782	u8 tsid;
16783
16784	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
16785		return -EINVAL;
16786
16787	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
16788	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
16789
16790	return rdev_del_tx_ts(rdev, dev, tsid, peer);
16791}
16792
16793static int nl80211_tdls_channel_switch(struct sk_buff *skb,
16794				       struct genl_info *info)
16795{
16796	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16797	struct net_device *dev = info->user_ptr[1];
16798	struct wireless_dev *wdev = dev->ieee80211_ptr;
16799	struct cfg80211_chan_def chandef = {};
16800	const u8 *addr;
16801	u8 oper_class;
16802	int err;
16803
16804	if (!rdev->ops->tdls_channel_switch ||
16805	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16806		return -EOPNOTSUPP;
16807
16808	switch (dev->ieee80211_ptr->iftype) {
16809	case NL80211_IFTYPE_STATION:
16810	case NL80211_IFTYPE_P2P_CLIENT:
16811		break;
16812	default:
16813		return -EOPNOTSUPP;
16814	}
16815
16816	if (!info->attrs[NL80211_ATTR_MAC] ||
16817	    !info->attrs[NL80211_ATTR_OPER_CLASS])
16818		return -EINVAL;
16819
16820	err = nl80211_parse_chandef(rdev, info, &chandef);
16821	if (err)
16822		return err;
16823
16824	/*
16825	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
16826	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
16827	 * specification is not defined for them.
16828	 */
16829	if (chandef.chan->band == NL80211_BAND_2GHZ &&
16830	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
16831	    chandef.width != NL80211_CHAN_WIDTH_20)
16832		return -EINVAL;
16833
16834	/* we will be active on the TDLS link */
16835	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
16836					   wdev->iftype))
16837		return -EINVAL;
16838
16839	/* don't allow switching to DFS channels */
16840	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
16841		return -EINVAL;
16842
16843	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16844	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
16845
16846	return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
16847}
16848
16849static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
16850					      struct genl_info *info)
16851{
16852	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16853	struct net_device *dev = info->user_ptr[1];
16854	const u8 *addr;
16855
16856	if (!rdev->ops->tdls_channel_switch ||
16857	    !rdev->ops->tdls_cancel_channel_switch ||
16858	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
16859		return -EOPNOTSUPP;
16860
16861	switch (dev->ieee80211_ptr->iftype) {
16862	case NL80211_IFTYPE_STATION:
16863	case NL80211_IFTYPE_P2P_CLIENT:
16864		break;
16865	default:
16866		return -EOPNOTSUPP;
16867	}
16868
16869	if (!info->attrs[NL80211_ATTR_MAC])
16870		return -EINVAL;
16871
16872	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16873
16874	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
16875
16876	return 0;
16877}
16878
16879static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
16880					    struct genl_info *info)
16881{
16882	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16883	struct net_device *dev = info->user_ptr[1];
16884	struct wireless_dev *wdev = dev->ieee80211_ptr;
16885	const struct nlattr *nla;
16886	bool enabled;
16887
16888	if (!rdev->ops->set_multicast_to_unicast)
16889		return -EOPNOTSUPP;
16890
16891	if (wdev->iftype != NL80211_IFTYPE_AP &&
16892	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
16893		return -EOPNOTSUPP;
16894
16895	nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
16896	enabled = nla_get_flag(nla);
16897
16898	return rdev_set_multicast_to_unicast(rdev, dev, enabled);
16899}
16900
16901static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
16902{
16903	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16904	struct net_device *dev = info->user_ptr[1];
16905	struct wireless_dev *wdev = dev->ieee80211_ptr;
16906	struct cfg80211_pmk_conf pmk_conf = {};
16907
16908	if (wdev->iftype != NL80211_IFTYPE_STATION &&
16909	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16910		return -EOPNOTSUPP;
16911
16912	if (!wiphy_ext_feature_isset(&rdev->wiphy,
16913				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16914		return -EOPNOTSUPP;
16915
16916	if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
16917		return -EINVAL;
16918
16919	if (!wdev->connected)
16920		return -ENOTCONN;
16921
16922	pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16923	if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
16924		return -EINVAL;
16925
16926	pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
16927	pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
16928	if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
16929	    pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
16930		return -EINVAL;
16931
16932	if (info->attrs[NL80211_ATTR_PMKR0_NAME])
16933		pmk_conf.pmk_r0_name =
16934			nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
16935
16936	return rdev_set_pmk(rdev, dev, &pmk_conf);
16937}
16938
16939static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
16940{
16941	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16942	struct net_device *dev = info->user_ptr[1];
16943	struct wireless_dev *wdev = dev->ieee80211_ptr;
16944	const u8 *aa;
16945
16946	if (wdev->iftype != NL80211_IFTYPE_STATION &&
16947	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
16948		return -EOPNOTSUPP;
16949
16950	if (!wiphy_ext_feature_isset(&rdev->wiphy,
16951				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
16952		return -EOPNOTSUPP;
16953
16954	if (!info->attrs[NL80211_ATTR_MAC])
16955		return -EINVAL;
16956
16957	aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
16958	return rdev_del_pmk(rdev, dev, aa);
16959}
16960
16961static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
16962{
16963	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16964	struct net_device *dev = info->user_ptr[1];
16965	struct cfg80211_external_auth_params params;
16966
16967	if (!rdev->ops->external_auth)
16968		return -EOPNOTSUPP;
16969
16970	if (!info->attrs[NL80211_ATTR_SSID] &&
16971	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
16972	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
16973		return -EINVAL;
16974
16975	if (!info->attrs[NL80211_ATTR_BSSID])
16976		return -EINVAL;
16977
16978	if (!info->attrs[NL80211_ATTR_STATUS_CODE])
16979		return -EINVAL;
16980
16981	memset(&params, 0, sizeof(params));
16982
16983	if (info->attrs[NL80211_ATTR_SSID]) {
16984		params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
16985		if (params.ssid.ssid_len == 0)
16986			return -EINVAL;
16987		memcpy(params.ssid.ssid,
16988		       nla_data(info->attrs[NL80211_ATTR_SSID]),
16989		       params.ssid.ssid_len);
16990	}
16991
16992	memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
16993	       ETH_ALEN);
16994
16995	params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
16996
16997	if (info->attrs[NL80211_ATTR_PMKID])
16998		params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
16999
17000	return rdev_external_auth(rdev, dev, &params);
17001}
17002
17003static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
17004{
17005	bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
17006	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17007	struct net_device *dev = info->user_ptr[1];
17008	struct wireless_dev *wdev = dev->ieee80211_ptr;
17009	const u8 *buf;
17010	size_t len;
17011	u8 *dest;
17012	u16 proto;
17013	bool noencrypt;
17014	u64 cookie = 0;
17015	int link_id;
17016	int err;
17017
17018	if (!wiphy_ext_feature_isset(&rdev->wiphy,
17019				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
17020		return -EOPNOTSUPP;
17021
17022	if (!rdev->ops->tx_control_port)
17023		return -EOPNOTSUPP;
17024
17025	if (!info->attrs[NL80211_ATTR_FRAME] ||
17026	    !info->attrs[NL80211_ATTR_MAC] ||
17027	    !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
17028		GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
17029		return -EINVAL;
17030	}
17031
17032	switch (wdev->iftype) {
17033	case NL80211_IFTYPE_AP:
17034	case NL80211_IFTYPE_P2P_GO:
17035	case NL80211_IFTYPE_MESH_POINT:
17036		break;
17037	case NL80211_IFTYPE_ADHOC:
17038		if (wdev->u.ibss.current_bss)
17039			break;
17040		return -ENOTCONN;
17041	case NL80211_IFTYPE_STATION:
17042	case NL80211_IFTYPE_P2P_CLIENT:
17043		if (wdev->connected)
17044			break;
17045		return -ENOTCONN;
17046	default:
17047		return -EOPNOTSUPP;
17048	}
17049
17050	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17051	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17052	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17053	proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
17054	noencrypt =
17055		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
17056
17057	link_id = nl80211_link_id_or_invalid(info->attrs);
17058
17059	err = rdev_tx_control_port(rdev, dev, buf, len,
17060				   dest, cpu_to_be16(proto), noencrypt, link_id,
17061				   dont_wait_for_ack ? NULL : &cookie);
17062	if (!err && !dont_wait_for_ack)
17063		nl_set_extack_cookie_u64(info->extack, cookie);
17064	return err;
17065}
17066
17067static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
17068					   struct genl_info *info)
17069{
17070	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17071	struct net_device *dev = info->user_ptr[1];
17072	struct wireless_dev *wdev = dev->ieee80211_ptr;
17073	struct cfg80211_ftm_responder_stats ftm_stats = {};
17074	unsigned int link_id = nl80211_link_id(info->attrs);
17075	struct sk_buff *msg;
17076	void *hdr;
17077	struct nlattr *ftm_stats_attr;
17078	int err;
17079
17080	if (wdev->iftype != NL80211_IFTYPE_AP ||
17081	    !wdev->links[link_id].ap.beacon_interval)
17082		return -EOPNOTSUPP;
17083
17084	err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
17085	if (err)
17086		return err;
17087
17088	if (!ftm_stats.filled)
17089		return -ENODATA;
17090
17091	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17092	if (!msg)
17093		return -ENOMEM;
17094
17095	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
17096			     NL80211_CMD_GET_FTM_RESPONDER_STATS);
17097	if (!hdr)
17098		goto nla_put_failure;
17099
17100	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17101		goto nla_put_failure;
17102
17103	ftm_stats_attr = nla_nest_start_noflag(msg,
17104					       NL80211_ATTR_FTM_RESPONDER_STATS);
17105	if (!ftm_stats_attr)
17106		goto nla_put_failure;
17107
17108#define SET_FTM(field, name, type)					 \
17109	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17110	    nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,		 \
17111			     ftm_stats.field))				 \
17112		goto nla_put_failure; } while (0)
17113#define SET_FTM_U64(field, name)					 \
17114	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
17115	    nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,		 \
17116			      ftm_stats.field, NL80211_FTM_STATS_PAD))	 \
17117		goto nla_put_failure; } while (0)
17118
17119	SET_FTM(success_num, SUCCESS_NUM, u32);
17120	SET_FTM(partial_num, PARTIAL_NUM, u32);
17121	SET_FTM(failed_num, FAILED_NUM, u32);
17122	SET_FTM(asap_num, ASAP_NUM, u32);
17123	SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
17124	SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
17125	SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
17126	SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
17127	SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
17128#undef SET_FTM
17129
17130	nla_nest_end(msg, ftm_stats_attr);
17131
17132	genlmsg_end(msg, hdr);
17133	return genlmsg_reply(msg, info);
17134
17135nla_put_failure:
17136	nlmsg_free(msg);
17137	return -ENOBUFS;
17138}
17139
17140static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
17141{
17142	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17143	struct cfg80211_update_owe_info owe_info;
17144	struct net_device *dev = info->user_ptr[1];
17145
17146	if (!rdev->ops->update_owe_info)
17147		return -EOPNOTSUPP;
17148
17149	if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
17150	    !info->attrs[NL80211_ATTR_MAC])
17151		return -EINVAL;
17152
17153	memset(&owe_info, 0, sizeof(owe_info));
17154	owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
17155	nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
17156
17157	if (info->attrs[NL80211_ATTR_IE]) {
17158		owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
17159		owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
17160	}
17161
17162	return rdev_update_owe_info(rdev, dev, &owe_info);
17163}
17164
17165static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
17166{
17167	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17168	struct net_device *dev = info->user_ptr[1];
17169	struct wireless_dev *wdev = dev->ieee80211_ptr;
17170	struct station_info sinfo = {};
17171	const u8 *buf;
17172	size_t len;
17173	u8 *dest;
17174	int err;
17175
17176	if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
17177		return -EOPNOTSUPP;
17178
17179	if (!info->attrs[NL80211_ATTR_MAC] ||
17180	    !info->attrs[NL80211_ATTR_FRAME]) {
17181		GENL_SET_ERR_MSG(info, "Frame or MAC missing");
17182		return -EINVAL;
17183	}
17184
17185	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
17186		return -EOPNOTSUPP;
17187
17188	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
17189	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
17190	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
17191
17192	if (len < sizeof(struct ethhdr))
17193		return -EINVAL;
17194
17195	if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
17196	    !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
17197		return -EINVAL;
17198
17199	err = rdev_get_station(rdev, dev, dest, &sinfo);
17200	if (err)
17201		return err;
17202
17203	cfg80211_sinfo_release_content(&sinfo);
17204
17205	return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
17206}
17207
17208static int parse_tid_conf(struct cfg80211_registered_device *rdev,
17209			  struct nlattr *attrs[], struct net_device *dev,
17210			  struct cfg80211_tid_cfg *tid_conf,
17211			  struct genl_info *info, const u8 *peer,
17212			  unsigned int link_id)
17213{
17214	struct netlink_ext_ack *extack = info->extack;
17215	u64 mask;
17216	int err;
17217
17218	if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
17219		return -EINVAL;
17220
17221	tid_conf->config_override =
17222			nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
17223	tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
17224
17225	if (tid_conf->config_override) {
17226		if (rdev->ops->reset_tid_config) {
17227			err = rdev_reset_tid_config(rdev, dev, peer,
17228						    tid_conf->tids);
17229			if (err)
17230				return err;
17231		} else {
17232			return -EINVAL;
17233		}
17234	}
17235
17236	if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
17237		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
17238		tid_conf->noack =
17239			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
17240	}
17241
17242	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
17243		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
17244		tid_conf->retry_short =
17245			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
17246
17247		if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
17248			return -EINVAL;
17249	}
17250
17251	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
17252		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
17253		tid_conf->retry_long =
17254			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
17255
17256		if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
17257			return -EINVAL;
17258	}
17259
17260	if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
17261		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
17262		tid_conf->ampdu =
17263			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
17264	}
17265
17266	if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
17267		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
17268		tid_conf->rtscts =
17269			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
17270	}
17271
17272	if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
17273		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
17274		tid_conf->amsdu =
17275			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
17276	}
17277
17278	if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
17279		u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
17280
17281		tid_conf->txrate_type = nla_get_u8(attrs[idx]);
17282
17283		if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
17284			attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
17285			err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
17286						    &tid_conf->txrate_mask, dev,
17287						    true, link_id);
17288			if (err)
17289				return err;
17290
17291			tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
17292		}
17293		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
17294	}
17295
17296	if (peer)
17297		mask = rdev->wiphy.tid_config_support.peer;
17298	else
17299		mask = rdev->wiphy.tid_config_support.vif;
17300
17301	if (tid_conf->mask & ~mask) {
17302		NL_SET_ERR_MSG(extack, "unsupported TID configuration");
17303		return -EOPNOTSUPP;
17304	}
17305
17306	return 0;
17307}
17308
17309static int nl80211_set_tid_config(struct sk_buff *skb,
17310				  struct genl_info *info)
17311{
17312	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17313	struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
17314	unsigned int link_id = nl80211_link_id(info->attrs);
17315	struct net_device *dev = info->user_ptr[1];
17316	struct cfg80211_tid_config *tid_config;
17317	struct nlattr *tid;
17318	int conf_idx = 0, rem_conf;
17319	int ret = -EINVAL;
17320	u32 num_conf = 0;
17321
17322	if (!info->attrs[NL80211_ATTR_TID_CONFIG])
17323		return -EINVAL;
17324
17325	if (!rdev->ops->set_tid_config)
17326		return -EOPNOTSUPP;
17327
17328	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17329			    rem_conf)
17330		num_conf++;
17331
17332	tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
17333			     GFP_KERNEL);
17334	if (!tid_config)
17335		return -ENOMEM;
17336
17337	tid_config->n_tid_conf = num_conf;
17338
17339	if (info->attrs[NL80211_ATTR_MAC])
17340		tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
17341
17342	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
17343			    rem_conf) {
17344		ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
17345				       tid, NULL, NULL);
17346
17347		if (ret)
17348			goto bad_tid_conf;
17349
17350		ret = parse_tid_conf(rdev, attrs, dev,
17351				     &tid_config->tid_conf[conf_idx],
17352				     info, tid_config->peer, link_id);
17353		if (ret)
17354			goto bad_tid_conf;
17355
17356		conf_idx++;
17357	}
17358
17359	ret = rdev_set_tid_config(rdev, dev, tid_config);
17360
17361bad_tid_conf:
17362	kfree(tid_config);
17363	return ret;
17364}
17365
17366static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
17367{
17368	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17369	struct cfg80211_color_change_settings params = {};
17370	struct net_device *dev = info->user_ptr[1];
17371	struct wireless_dev *wdev = dev->ieee80211_ptr;
17372	struct nlattr **tb;
17373	u16 offset;
17374	int err;
17375
17376	if (!rdev->ops->color_change)
17377		return -EOPNOTSUPP;
17378
17379	if (!wiphy_ext_feature_isset(&rdev->wiphy,
17380				     NL80211_EXT_FEATURE_BSS_COLOR))
17381		return -EOPNOTSUPP;
17382
17383	if (wdev->iftype != NL80211_IFTYPE_AP)
17384		return -EOPNOTSUPP;
17385
17386	if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
17387	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
17388	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
17389		return -EINVAL;
17390
17391	params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
17392	params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
17393
17394	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
17395				   info->extack);
17396	if (err)
17397		return err;
17398
17399	tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
17400	if (!tb)
17401		return -ENOMEM;
17402
17403	err = nla_parse_nested(tb, NL80211_ATTR_MAX,
17404			       info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
17405			       nl80211_policy, info->extack);
17406	if (err)
17407		goto out;
17408
17409	err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
17410				   info->extack);
17411	if (err)
17412		goto out;
17413
17414	if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
17415		err = -EINVAL;
17416		goto out;
17417	}
17418
17419	if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
17420		err = -EINVAL;
17421		goto out;
17422	}
17423
17424	offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
17425	if (offset >= params.beacon_color_change.tail_len) {
17426		err = -EINVAL;
17427		goto out;
17428	}
17429
17430	if (params.beacon_color_change.tail[offset] != params.count) {
17431		err = -EINVAL;
17432		goto out;
17433	}
17434
17435	params.counter_offset_beacon = offset;
17436
17437	if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
17438		if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
17439		    sizeof(u16)) {
17440			err = -EINVAL;
17441			goto out;
17442		}
17443
17444		offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
17445		if (offset >= params.beacon_color_change.probe_resp_len) {
17446			err = -EINVAL;
17447			goto out;
17448		}
17449
17450		if (params.beacon_color_change.probe_resp[offset] !=
17451		    params.count) {
17452			err = -EINVAL;
17453			goto out;
17454		}
17455
17456		params.counter_offset_presp = offset;
17457	}
17458
17459	if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
17460		err = nl80211_parse_unsol_bcast_probe_resp(
17461			rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
17462			&params.unsol_bcast_probe_resp);
17463		if (err)
17464			goto out;
17465	}
17466
17467	params.link_id = nl80211_link_id(info->attrs);
17468	err = rdev_color_change(rdev, dev, &params);
17469
17470out:
17471	kfree(params.beacon_next.mbssid_ies);
17472	kfree(params.beacon_color_change.mbssid_ies);
17473	kfree(params.beacon_next.rnr_ies);
17474	kfree(params.beacon_color_change.rnr_ies);
17475	kfree(tb);
17476	return err;
17477}
17478
17479static int nl80211_set_fils_aad(struct sk_buff *skb,
17480				struct genl_info *info)
17481{
17482	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17483	struct net_device *dev = info->user_ptr[1];
17484	struct cfg80211_fils_aad fils_aad = {};
17485	u8 *nonces;
17486
17487	if (!info->attrs[NL80211_ATTR_MAC] ||
17488	    !info->attrs[NL80211_ATTR_FILS_KEK] ||
17489	    !info->attrs[NL80211_ATTR_FILS_NONCES])
17490		return -EINVAL;
17491
17492	fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17493	fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
17494	fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
17495	nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
17496	fils_aad.snonce = nonces;
17497	fils_aad.anonce = nonces + FILS_NONCE_LEN;
17498
17499	return rdev_set_fils_aad(rdev, dev, &fils_aad);
17500}
17501
17502static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
17503{
17504	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17505	unsigned int link_id = nl80211_link_id(info->attrs);
17506	struct net_device *dev = info->user_ptr[1];
17507	struct wireless_dev *wdev = dev->ieee80211_ptr;
17508	int ret;
17509
17510	if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
17511		return -EINVAL;
17512
17513	switch (wdev->iftype) {
17514	case NL80211_IFTYPE_AP:
17515		break;
17516	default:
17517		return -EINVAL;
17518	}
17519
17520	if (!info->attrs[NL80211_ATTR_MAC] ||
17521	    !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
17522		return -EINVAL;
17523
17524	wdev->valid_links |= BIT(link_id);
17525	ether_addr_copy(wdev->links[link_id].addr,
17526			nla_data(info->attrs[NL80211_ATTR_MAC]));
17527
17528	ret = rdev_add_intf_link(rdev, wdev, link_id);
17529	if (ret) {
17530		wdev->valid_links &= ~BIT(link_id);
17531		eth_zero_addr(wdev->links[link_id].addr);
17532	}
17533
17534	return ret;
17535}
17536
17537static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
17538{
17539	unsigned int link_id = nl80211_link_id(info->attrs);
17540	struct net_device *dev = info->user_ptr[1];
17541	struct wireless_dev *wdev = dev->ieee80211_ptr;
17542
17543	/* cannot remove if there's no link */
17544	if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17545		return -EINVAL;
17546
17547	switch (wdev->iftype) {
17548	case NL80211_IFTYPE_AP:
17549		break;
17550	default:
17551		return -EINVAL;
17552	}
17553
17554	cfg80211_remove_link(wdev, link_id);
17555
17556	return 0;
17557}
17558
17559static int
17560nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
17561			     bool add)
17562{
17563	struct link_station_parameters params = {};
17564	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17565	struct net_device *dev = info->user_ptr[1];
17566	int err;
17567
17568	if ((add && !rdev->ops->add_link_station) ||
17569	    (!add && !rdev->ops->mod_link_station))
17570		return -EOPNOTSUPP;
17571
17572	if (add && !info->attrs[NL80211_ATTR_MAC])
17573		return -EINVAL;
17574
17575	if (!info->attrs[NL80211_ATTR_MLD_ADDR])
17576		return -EINVAL;
17577
17578	if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
17579		return -EINVAL;
17580
17581	params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17582
17583	if (info->attrs[NL80211_ATTR_MAC]) {
17584		params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
17585		if (!is_valid_ether_addr(params.link_mac))
17586			return -EINVAL;
17587	}
17588
17589	if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
17590		return -EINVAL;
17591
17592	params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17593
17594	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
17595		params.supported_rates =
17596			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17597		params.supported_rates_len =
17598			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
17599	}
17600
17601	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
17602		params.ht_capa =
17603			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
17604
17605	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
17606		params.vht_capa =
17607			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
17608
17609	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
17610		params.he_capa =
17611			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17612		params.he_capa_len =
17613			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
17614
17615		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
17616			params.eht_capa =
17617				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17618			params.eht_capa_len =
17619				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
17620
17621			if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
17622							(const u8 *)params.eht_capa,
17623							params.eht_capa_len,
17624							false))
17625				return -EINVAL;
17626		}
17627	}
17628
17629	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
17630		params.he_6ghz_capa =
17631			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
17632
17633	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
17634		params.opmode_notif_used = true;
17635		params.opmode_notif =
17636			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
17637	}
17638
17639	err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
17640						&params.txpwr_set);
17641	if (err)
17642		return err;
17643
17644	if (add)
17645		return rdev_add_link_station(rdev, dev, &params);
17646
17647	return rdev_mod_link_station(rdev, dev, &params);
17648}
17649
17650static int
17651nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
17652{
17653	return nl80211_add_mod_link_station(skb, info, true);
17654}
17655
17656static int
17657nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
17658{
17659	return nl80211_add_mod_link_station(skb, info, false);
17660}
17661
17662static int
17663nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
17664{
17665	struct link_station_del_parameters params = {};
17666	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17667	struct net_device *dev = info->user_ptr[1];
17668
17669	if (!rdev->ops->del_link_station)
17670		return -EOPNOTSUPP;
17671
17672	if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
17673	    !info->attrs[NL80211_ATTR_MLO_LINK_ID])
17674		return -EINVAL;
17675
17676	params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
17677	params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
17678
17679	return rdev_del_link_station(rdev, dev, &params);
17680}
17681
17682static int nl80211_set_hw_timestamp(struct sk_buff *skb,
17683				    struct genl_info *info)
17684{
17685	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17686	struct net_device *dev = info->user_ptr[1];
17687	struct cfg80211_set_hw_timestamp hwts = {};
17688
17689	if (!rdev->wiphy.hw_timestamp_max_peers)
17690		return -EOPNOTSUPP;
17691
17692	if (!info->attrs[NL80211_ATTR_MAC] &&
17693	    rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
17694		return -EOPNOTSUPP;
17695
17696	if (info->attrs[NL80211_ATTR_MAC])
17697		hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
17698
17699	hwts.enable =
17700		nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
17701
17702	return rdev_set_hw_timestamp(rdev, dev, &hwts);
17703}
17704
17705static int
17706nl80211_set_ttlm(struct sk_buff *skb, struct genl_info *info)
17707{
17708	struct cfg80211_ttlm_params params = {};
17709	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17710	struct net_device *dev = info->user_ptr[1];
17711	struct wireless_dev *wdev = dev->ieee80211_ptr;
17712
17713	if (wdev->iftype != NL80211_IFTYPE_STATION &&
17714	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17715		return -EOPNOTSUPP;
17716
17717	if (!wdev->connected)
17718		return -ENOLINK;
17719
17720	if (!info->attrs[NL80211_ATTR_MLO_TTLM_DLINK] ||
17721	    !info->attrs[NL80211_ATTR_MLO_TTLM_ULINK])
17722		return -EINVAL;
17723
17724	nla_memcpy(params.dlink,
17725		   info->attrs[NL80211_ATTR_MLO_TTLM_DLINK],
17726		   sizeof(params.dlink));
17727	nla_memcpy(params.ulink,
17728		   info->attrs[NL80211_ATTR_MLO_TTLM_ULINK],
17729		   sizeof(params.ulink));
17730
17731	return rdev_set_ttlm(rdev, dev, &params);
17732}
17733
17734static int nl80211_assoc_ml_reconf(struct sk_buff *skb, struct genl_info *info)
17735{
17736	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17737	struct net_device *dev = info->user_ptr[1];
17738	struct wireless_dev *wdev = dev->ieee80211_ptr;
17739	struct cfg80211_ml_reconf_req req = {};
17740	unsigned int link_id;
17741	u16 add_links;
17742	int err;
17743
17744	if (!wdev->valid_links)
17745		return -EINVAL;
17746
17747	if (dev->ieee80211_ptr->conn_owner_nlportid &&
17748	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
17749		return -EPERM;
17750
17751	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
17752	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
17753		return -EOPNOTSUPP;
17754
17755	add_links = 0;
17756	if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
17757		err = nl80211_process_links(rdev, req.add_links,
17758					    /* mark as MLO, but not assoc */
17759					    IEEE80211_MLD_MAX_NUM_LINKS,
17760					    NULL, 0, info);
17761		if (err)
17762			return err;
17763
17764		for (link_id = 0; link_id < IEEE80211_MLD_MAX_NUM_LINKS;
17765		     link_id++) {
17766			if (!req.add_links[link_id].bss)
17767				continue;
17768			add_links |= BIT(link_id);
17769		}
17770	}
17771
17772	if (info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS])
17773		req.rem_links =
17774			nla_get_u16(info->attrs[NL80211_ATTR_MLO_RECONF_REM_LINKS]);
17775
17776	/* Validate that existing links are not added, removed links are valid
17777	 * and don't allow adding and removing the same links
17778	 */
17779	if ((add_links & req.rem_links) || !(add_links | req.rem_links) ||
17780	    (wdev->valid_links & add_links) ||
17781	    ((wdev->valid_links & req.rem_links) != req.rem_links)) {
17782		err = -EINVAL;
17783		goto out;
17784	}
17785
17786	if (info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS])
17787		req.ext_mld_capa_ops =
17788			nla_get_u16(info->attrs[NL80211_ATTR_ASSOC_MLD_EXT_CAPA_OPS]);
17789
17790	err = cfg80211_assoc_ml_reconf(rdev, dev, &req);
17791
17792out:
17793	for (link_id = 0; link_id < ARRAY_SIZE(req.add_links); link_id++)
17794		cfg80211_put_bss(&rdev->wiphy, req.add_links[link_id].bss);
17795
17796	return err;
17797}
17798
17799static int
17800nl80211_epcs_cfg(struct sk_buff *skb, struct genl_info *info)
17801{
17802	struct cfg80211_registered_device *rdev = info->user_ptr[0];
17803	struct net_device *dev = info->user_ptr[1];
17804	struct wireless_dev *wdev = dev->ieee80211_ptr;
17805	bool val;
17806
17807	if (wdev->iftype != NL80211_IFTYPE_STATION &&
17808	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
17809		return -EOPNOTSUPP;
17810
17811	if (!wdev->connected)
17812		return -ENOLINK;
17813
17814	val = nla_get_flag(info->attrs[NL80211_ATTR_EPCS]);
17815
17816	return rdev_set_epcs(rdev, dev, val);
17817}
17818
17819#define NL80211_FLAG_NEED_WIPHY		0x01
17820#define NL80211_FLAG_NEED_NETDEV	0x02
17821#define NL80211_FLAG_NEED_RTNL		0x04
17822#define NL80211_FLAG_CHECK_NETDEV_UP	0x08
17823#define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
17824					 NL80211_FLAG_CHECK_NETDEV_UP)
17825#define NL80211_FLAG_NEED_WDEV		0x10
17826/* If a netdev is associated, it must be UP, P2P must be started */
17827#define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
17828					 NL80211_FLAG_CHECK_NETDEV_UP)
17829#define NL80211_FLAG_CLEAR_SKB		0x20
17830#define NL80211_FLAG_NO_WIPHY_MTX	0x40
17831#define NL80211_FLAG_MLO_VALID_LINK_ID	0x80
17832#define NL80211_FLAG_MLO_UNSUPPORTED	0x100
17833
17834#define INTERNAL_FLAG_SELECTORS(__sel)			\
17835	SELECTOR(__sel, NONE, 0) /* must be first */	\
17836	SELECTOR(__sel, WIPHY,				\
17837		 NL80211_FLAG_NEED_WIPHY)		\
17838	SELECTOR(__sel, WDEV,				\
17839		 NL80211_FLAG_NEED_WDEV)		\
17840	SELECTOR(__sel, NETDEV,				\
17841		 NL80211_FLAG_NEED_NETDEV)		\
17842	SELECTOR(__sel, NETDEV_LINK,			\
17843		 NL80211_FLAG_NEED_NETDEV |		\
17844		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
17845	SELECTOR(__sel, NETDEV_NO_MLO,			\
17846		 NL80211_FLAG_NEED_NETDEV |		\
17847		 NL80211_FLAG_MLO_UNSUPPORTED)	\
17848	SELECTOR(__sel, WIPHY_RTNL,			\
17849		 NL80211_FLAG_NEED_WIPHY |		\
17850		 NL80211_FLAG_NEED_RTNL)		\
17851	SELECTOR(__sel, WIPHY_RTNL_NOMTX,		\
17852		 NL80211_FLAG_NEED_WIPHY |		\
17853		 NL80211_FLAG_NEED_RTNL |		\
17854		 NL80211_FLAG_NO_WIPHY_MTX)		\
17855	SELECTOR(__sel, WDEV_RTNL,			\
17856		 NL80211_FLAG_NEED_WDEV |		\
17857		 NL80211_FLAG_NEED_RTNL)		\
17858	SELECTOR(__sel, NETDEV_RTNL,			\
17859		 NL80211_FLAG_NEED_NETDEV |		\
17860		 NL80211_FLAG_NEED_RTNL)		\
17861	SELECTOR(__sel, NETDEV_UP,			\
17862		 NL80211_FLAG_NEED_NETDEV_UP)		\
17863	SELECTOR(__sel, NETDEV_UP_LINK,			\
17864		 NL80211_FLAG_NEED_NETDEV_UP |		\
17865		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
17866	SELECTOR(__sel, NETDEV_UP_NO_MLO,		\
17867		 NL80211_FLAG_NEED_NETDEV_UP |		\
17868		 NL80211_FLAG_MLO_UNSUPPORTED)		\
17869	SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,		\
17870		 NL80211_FLAG_NEED_NETDEV_UP |		\
17871		 NL80211_FLAG_CLEAR_SKB |		\
17872		 NL80211_FLAG_MLO_UNSUPPORTED)		\
17873	SELECTOR(__sel, NETDEV_UP_NOTMX,		\
17874		 NL80211_FLAG_NEED_NETDEV_UP |		\
17875		 NL80211_FLAG_NO_WIPHY_MTX)		\
17876	SELECTOR(__sel, NETDEV_UP_NOTMX_MLO,		\
17877		 NL80211_FLAG_NEED_NETDEV_UP |		\
17878		 NL80211_FLAG_NO_WIPHY_MTX |		\
17879		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
17880	SELECTOR(__sel, NETDEV_UP_CLEAR,		\
17881		 NL80211_FLAG_NEED_NETDEV_UP |		\
17882		 NL80211_FLAG_CLEAR_SKB)		\
17883	SELECTOR(__sel, WDEV_UP,			\
17884		 NL80211_FLAG_NEED_WDEV_UP)		\
17885	SELECTOR(__sel, WDEV_UP_LINK,			\
17886		 NL80211_FLAG_NEED_WDEV_UP |		\
17887		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
17888	SELECTOR(__sel, WDEV_UP_RTNL,			\
17889		 NL80211_FLAG_NEED_WDEV_UP |		\
17890		 NL80211_FLAG_NEED_RTNL)		\
17891	SELECTOR(__sel, WIPHY_CLEAR,			\
17892		 NL80211_FLAG_NEED_WIPHY |		\
17893		 NL80211_FLAG_CLEAR_SKB)
17894
17895enum nl80211_internal_flags_selector {
17896#define SELECTOR(_, name, value)	NL80211_IFL_SEL_##name,
17897	INTERNAL_FLAG_SELECTORS(_)
17898#undef SELECTOR
17899};
17900
17901static u32 nl80211_internal_flags[] = {
17902#define SELECTOR(_, name, value)	[NL80211_IFL_SEL_##name] = value,
17903	INTERNAL_FLAG_SELECTORS(_)
17904#undef SELECTOR
17905};
17906
17907static int nl80211_pre_doit(const struct genl_split_ops *ops,
17908			    struct sk_buff *skb,
17909			    struct genl_info *info)
17910{
17911	struct cfg80211_registered_device *rdev = NULL;
17912	struct wireless_dev *wdev = NULL;
17913	struct net_device *dev = NULL;
17914	u32 internal_flags;
17915	int err;
17916
17917	if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
17918		return -EINVAL;
17919
17920	internal_flags = nl80211_internal_flags[ops->internal_flags];
17921
17922	rtnl_lock();
17923	if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
17924		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
17925		if (IS_ERR(rdev)) {
17926			err = PTR_ERR(rdev);
17927			goto out_unlock;
17928		}
17929		info->user_ptr[0] = rdev;
17930	} else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
17931		   internal_flags & NL80211_FLAG_NEED_WDEV) {
17932		wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
17933						  info->attrs);
17934		if (IS_ERR(wdev)) {
17935			err = PTR_ERR(wdev);
17936			goto out_unlock;
17937		}
17938
17939		dev = wdev->netdev;
17940		dev_hold(dev);
17941		rdev = wiphy_to_rdev(wdev->wiphy);
17942
17943		if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
17944			if (!dev) {
17945				err = -EINVAL;
17946				goto out_unlock;
17947			}
17948
17949			info->user_ptr[1] = dev;
17950		} else {
17951			info->user_ptr[1] = wdev;
17952		}
17953
17954		if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
17955		    !wdev_running(wdev)) {
17956			err = -ENETDOWN;
17957			goto out_unlock;
17958		}
17959
17960		info->user_ptr[0] = rdev;
17961	}
17962
17963	if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
17964		struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
17965
17966		if (!wdev) {
17967			err = -EINVAL;
17968			goto out_unlock;
17969		}
17970
17971		/* MLO -> require valid link ID */
17972		if (wdev->valid_links &&
17973		    (!link_id ||
17974		     !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
17975			err = -EINVAL;
17976			goto out_unlock;
17977		}
17978
17979		/* non-MLO -> no link ID attribute accepted */
17980		if (!wdev->valid_links && link_id) {
17981			err = -EINVAL;
17982			goto out_unlock;
17983		}
17984	}
17985
17986	if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
17987		if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
17988		    (wdev && wdev->valid_links)) {
17989			err = -EINVAL;
17990			goto out_unlock;
17991		}
17992	}
17993
17994	if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
17995		wiphy_lock(&rdev->wiphy);
17996		/* we keep the mutex locked until post_doit */
17997		__release(&rdev->wiphy.mtx);
17998	}
17999	if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
18000		rtnl_unlock();
18001
18002	return 0;
18003out_unlock:
18004	rtnl_unlock();
18005	dev_put(dev);
18006	return err;
18007}
18008
18009static void nl80211_post_doit(const struct genl_split_ops *ops,
18010			      struct sk_buff *skb,
18011			      struct genl_info *info)
18012{
18013	u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
18014
18015	if (info->user_ptr[1]) {
18016		if (internal_flags & NL80211_FLAG_NEED_WDEV) {
18017			struct wireless_dev *wdev = info->user_ptr[1];
18018
18019			dev_put(wdev->netdev);
18020		} else {
18021			dev_put(info->user_ptr[1]);
18022		}
18023	}
18024
18025	if (info->user_ptr[0] &&
18026	    !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
18027		struct cfg80211_registered_device *rdev = info->user_ptr[0];
18028
18029		/* we kept the mutex locked since pre_doit */
18030		__acquire(&rdev->wiphy.mtx);
18031		wiphy_unlock(&rdev->wiphy);
18032	}
18033
18034	if (internal_flags & NL80211_FLAG_NEED_RTNL)
18035		rtnl_unlock();
18036
18037	/* If needed, clear the netlink message payload from the SKB
18038	 * as it might contain key data that shouldn't stick around on
18039	 * the heap after the SKB is freed. The netlink message header
18040	 * is still needed for further processing, so leave it intact.
18041	 */
18042	if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
18043		struct nlmsghdr *nlh = nlmsg_hdr(skb);
18044
18045		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
18046	}
18047}
18048
18049static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
18050				     struct cfg80211_sar_specs *sar_specs,
18051				     struct nlattr *spec[], int index)
18052{
18053	u32 range_index, i;
18054
18055	if (!sar_specs || !spec)
18056		return -EINVAL;
18057
18058	if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
18059	    !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
18060		return -EINVAL;
18061
18062	range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
18063
18064	/* check if range_index exceeds num_freq_ranges */
18065	if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
18066		return -EINVAL;
18067
18068	/* check if range_index duplicates */
18069	for (i = 0; i < index; i++) {
18070		if (sar_specs->sub_specs[i].freq_range_index == range_index)
18071			return -EINVAL;
18072	}
18073
18074	sar_specs->sub_specs[index].power =
18075		nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
18076
18077	sar_specs->sub_specs[index].freq_range_index = range_index;
18078
18079	return 0;
18080}
18081
18082static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
18083{
18084	struct cfg80211_registered_device *rdev = info->user_ptr[0];
18085	struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
18086	struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
18087	struct cfg80211_sar_specs *sar_spec;
18088	enum nl80211_sar_type type;
18089	struct nlattr *spec_list;
18090	u32 specs;
18091	int rem, err;
18092
18093	if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
18094		return -EOPNOTSUPP;
18095
18096	if (!info->attrs[NL80211_ATTR_SAR_SPEC])
18097		return -EINVAL;
18098
18099	nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
18100			 info->attrs[NL80211_ATTR_SAR_SPEC],
18101			 NULL, NULL);
18102
18103	if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
18104		return -EINVAL;
18105
18106	type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
18107	if (type != rdev->wiphy.sar_capa->type)
18108		return -EINVAL;
18109
18110	specs = 0;
18111	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
18112		specs++;
18113
18114	if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
18115		return -EINVAL;
18116
18117	sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
18118	if (!sar_spec)
18119		return -ENOMEM;
18120
18121	sar_spec->num_sub_specs = specs;
18122	sar_spec->type = type;
18123	specs = 0;
18124	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
18125		nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
18126				 spec_list, NULL, NULL);
18127
18128		switch (type) {
18129		case NL80211_SAR_TYPE_POWER:
18130			if (nl80211_set_sar_sub_specs(rdev, sar_spec,
18131						      spec, specs)) {
18132				err = -EINVAL;
18133				goto error;
18134			}
18135			break;
18136		default:
18137			err = -EINVAL;
18138			goto error;
18139		}
18140		specs++;
18141	}
18142
18143	sar_spec->num_sub_specs = specs;
18144
18145	rdev->cur_cmd_info = info;
18146	err = rdev_set_sar_specs(rdev, sar_spec);
18147	rdev->cur_cmd_info = NULL;
18148error:
18149	kfree(sar_spec);
18150	return err;
18151}
18152
18153#define SELECTOR(__sel, name, value) \
18154	((__sel) == (value)) ? NL80211_IFL_SEL_##name :
18155int __missing_selector(void);
18156#define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
18157
18158static const struct genl_ops nl80211_ops[] = {
18159	{
18160		.cmd = NL80211_CMD_GET_WIPHY,
18161		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18162		.doit = nl80211_get_wiphy,
18163		.dumpit = nl80211_dump_wiphy,
18164		.done = nl80211_dump_wiphy_done,
18165		/* can be retrieved by unprivileged users */
18166		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18167	},
18168};
18169
18170static const struct genl_small_ops nl80211_small_ops[] = {
18171	{
18172		.cmd = NL80211_CMD_SET_WIPHY,
18173		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18174		.doit = nl80211_set_wiphy,
18175		.flags = GENL_UNS_ADMIN_PERM,
18176	},
18177	{
18178		.cmd = NL80211_CMD_GET_INTERFACE,
18179		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18180		.doit = nl80211_get_interface,
18181		.dumpit = nl80211_dump_interface,
18182		/* can be retrieved by unprivileged users */
18183		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18184	},
18185	{
18186		.cmd = NL80211_CMD_SET_INTERFACE,
18187		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18188		.doit = nl80211_set_interface,
18189		.flags = GENL_UNS_ADMIN_PERM,
18190		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18191					 NL80211_FLAG_NEED_RTNL),
18192	},
18193	{
18194		.cmd = NL80211_CMD_NEW_INTERFACE,
18195		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18196		.doit = nl80211_new_interface,
18197		.flags = GENL_UNS_ADMIN_PERM,
18198		.internal_flags =
18199			IFLAGS(NL80211_FLAG_NEED_WIPHY |
18200			       NL80211_FLAG_NEED_RTNL |
18201			       /* we take the wiphy mutex later ourselves */
18202			       NL80211_FLAG_NO_WIPHY_MTX),
18203	},
18204	{
18205		.cmd = NL80211_CMD_DEL_INTERFACE,
18206		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18207		.doit = nl80211_del_interface,
18208		.flags = GENL_UNS_ADMIN_PERM,
18209		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18210					 NL80211_FLAG_NEED_RTNL),
18211	},
18212	{
18213		.cmd = NL80211_CMD_GET_KEY,
18214		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18215		.doit = nl80211_get_key,
18216		.flags = GENL_UNS_ADMIN_PERM,
18217		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18218	},
18219	{
18220		.cmd = NL80211_CMD_SET_KEY,
18221		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18222		.doit = nl80211_set_key,
18223		.flags = GENL_UNS_ADMIN_PERM,
18224		/* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
18225		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18226					 NL80211_FLAG_CLEAR_SKB),
18227	},
18228	{
18229		.cmd = NL80211_CMD_NEW_KEY,
18230		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18231		.doit = nl80211_new_key,
18232		.flags = GENL_UNS_ADMIN_PERM,
18233		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18234					 NL80211_FLAG_CLEAR_SKB),
18235	},
18236	{
18237		.cmd = NL80211_CMD_DEL_KEY,
18238		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18239		.doit = nl80211_del_key,
18240		.flags = GENL_UNS_ADMIN_PERM,
18241		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18242	},
18243	{
18244		.cmd = NL80211_CMD_SET_BEACON,
18245		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18246		.flags = GENL_UNS_ADMIN_PERM,
18247		.doit = nl80211_set_beacon,
18248		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18249					 NL80211_FLAG_MLO_VALID_LINK_ID),
18250	},
18251	{
18252		.cmd = NL80211_CMD_START_AP,
18253		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18254		.flags = GENL_UNS_ADMIN_PERM,
18255		.doit = nl80211_start_ap,
18256		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18257					 NL80211_FLAG_MLO_VALID_LINK_ID),
18258	},
18259	{
18260		.cmd = NL80211_CMD_STOP_AP,
18261		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18262		.flags = GENL_UNS_ADMIN_PERM,
18263		.doit = nl80211_stop_ap,
18264		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18265					 NL80211_FLAG_MLO_VALID_LINK_ID),
18266	},
18267	{
18268		.cmd = NL80211_CMD_GET_STATION,
18269		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18270		.doit = nl80211_get_station,
18271		.dumpit = nl80211_dump_station,
18272		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18273	},
18274	{
18275		.cmd = NL80211_CMD_SET_STATION,
18276		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18277		.doit = nl80211_set_station,
18278		.flags = GENL_UNS_ADMIN_PERM,
18279		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18280	},
18281	{
18282		.cmd = NL80211_CMD_NEW_STATION,
18283		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18284		.doit = nl80211_new_station,
18285		.flags = GENL_UNS_ADMIN_PERM,
18286		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18287	},
18288	{
18289		.cmd = NL80211_CMD_DEL_STATION,
18290		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18291		.doit = nl80211_del_station,
18292		.flags = GENL_UNS_ADMIN_PERM,
18293		/* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on
18294		 * whether MAC address is passed or not. If MAC address is
18295		 * passed, then even during MLO, link ID is not required.
18296		 */
18297		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18298	},
18299	{
18300		.cmd = NL80211_CMD_GET_MPATH,
18301		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18302		.doit = nl80211_get_mpath,
18303		.dumpit = nl80211_dump_mpath,
18304		.flags = GENL_UNS_ADMIN_PERM,
18305		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18306	},
18307	{
18308		.cmd = NL80211_CMD_GET_MPP,
18309		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18310		.doit = nl80211_get_mpp,
18311		.dumpit = nl80211_dump_mpp,
18312		.flags = GENL_UNS_ADMIN_PERM,
18313		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18314	},
18315	{
18316		.cmd = NL80211_CMD_SET_MPATH,
18317		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18318		.doit = nl80211_set_mpath,
18319		.flags = GENL_UNS_ADMIN_PERM,
18320		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18321	},
18322	{
18323		.cmd = NL80211_CMD_NEW_MPATH,
18324		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18325		.doit = nl80211_new_mpath,
18326		.flags = GENL_UNS_ADMIN_PERM,
18327		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18328	},
18329	{
18330		.cmd = NL80211_CMD_DEL_MPATH,
18331		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18332		.doit = nl80211_del_mpath,
18333		.flags = GENL_UNS_ADMIN_PERM,
18334		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18335	},
18336	{
18337		.cmd = NL80211_CMD_SET_BSS,
18338		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18339		.doit = nl80211_set_bss,
18340		.flags = GENL_UNS_ADMIN_PERM,
18341		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18342					 NL80211_FLAG_MLO_VALID_LINK_ID),
18343	},
18344	{
18345		.cmd = NL80211_CMD_GET_REG,
18346		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18347		.doit = nl80211_get_reg_do,
18348		.dumpit = nl80211_get_reg_dump,
18349		/* can be retrieved by unprivileged users */
18350	},
18351#ifdef CONFIG_CFG80211_CRDA_SUPPORT
18352	{
18353		.cmd = NL80211_CMD_SET_REG,
18354		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18355		.doit = nl80211_set_reg,
18356		.flags = GENL_ADMIN_PERM,
18357	},
18358#endif
18359	{
18360		.cmd = NL80211_CMD_REQ_SET_REG,
18361		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18362		.doit = nl80211_req_set_reg,
18363		.flags = GENL_ADMIN_PERM,
18364	},
18365	{
18366		.cmd = NL80211_CMD_RELOAD_REGDB,
18367		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18368		.doit = nl80211_reload_regdb,
18369		.flags = GENL_ADMIN_PERM,
18370	},
18371	{
18372		.cmd = NL80211_CMD_GET_MESH_CONFIG,
18373		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18374		.doit = nl80211_get_mesh_config,
18375		/* can be retrieved by unprivileged users */
18376		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18377	},
18378	{
18379		.cmd = NL80211_CMD_SET_MESH_CONFIG,
18380		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18381		.doit = nl80211_update_mesh_config,
18382		.flags = GENL_UNS_ADMIN_PERM,
18383		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18384	},
18385	{
18386		.cmd = NL80211_CMD_TRIGGER_SCAN,
18387		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18388		.doit = nl80211_trigger_scan,
18389		.flags = GENL_UNS_ADMIN_PERM,
18390		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18391	},
18392	{
18393		.cmd = NL80211_CMD_ABORT_SCAN,
18394		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18395		.doit = nl80211_abort_scan,
18396		.flags = GENL_UNS_ADMIN_PERM,
18397		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18398	},
18399	{
18400		.cmd = NL80211_CMD_GET_SCAN,
18401		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18402		.dumpit = nl80211_dump_scan,
18403	},
18404	{
18405		.cmd = NL80211_CMD_START_SCHED_SCAN,
18406		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18407		.doit = nl80211_start_sched_scan,
18408		.flags = GENL_UNS_ADMIN_PERM,
18409		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18410	},
18411	{
18412		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
18413		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18414		.doit = nl80211_stop_sched_scan,
18415		.flags = GENL_UNS_ADMIN_PERM,
18416		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18417	},
18418	{
18419		.cmd = NL80211_CMD_AUTHENTICATE,
18420		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18421		.doit = nl80211_authenticate,
18422		.flags = GENL_UNS_ADMIN_PERM,
18423		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18424					 NL80211_FLAG_CLEAR_SKB),
18425	},
18426	{
18427		.cmd = NL80211_CMD_ASSOCIATE,
18428		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18429		.doit = nl80211_associate,
18430		.flags = GENL_UNS_ADMIN_PERM,
18431		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18432					 NL80211_FLAG_CLEAR_SKB),
18433	},
18434	{
18435		.cmd = NL80211_CMD_DEAUTHENTICATE,
18436		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18437		.doit = nl80211_deauthenticate,
18438		.flags = GENL_UNS_ADMIN_PERM,
18439		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18440	},
18441	{
18442		.cmd = NL80211_CMD_DISASSOCIATE,
18443		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18444		.doit = nl80211_disassociate,
18445		.flags = GENL_UNS_ADMIN_PERM,
18446		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18447	},
18448	{
18449		.cmd = NL80211_CMD_JOIN_IBSS,
18450		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18451		.doit = nl80211_join_ibss,
18452		.flags = GENL_UNS_ADMIN_PERM,
18453		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18454	},
18455	{
18456		.cmd = NL80211_CMD_LEAVE_IBSS,
18457		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18458		.doit = nl80211_leave_ibss,
18459		.flags = GENL_UNS_ADMIN_PERM,
18460		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18461	},
18462#ifdef CONFIG_NL80211_TESTMODE
18463	{
18464		.cmd = NL80211_CMD_TESTMODE,
18465		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18466		.doit = nl80211_testmode_do,
18467		.dumpit = nl80211_testmode_dump,
18468		.flags = GENL_UNS_ADMIN_PERM,
18469		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18470	},
18471#endif
18472	{
18473		.cmd = NL80211_CMD_CONNECT,
18474		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18475		.doit = nl80211_connect,
18476		.flags = GENL_UNS_ADMIN_PERM,
18477		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18478					 NL80211_FLAG_CLEAR_SKB),
18479	},
18480	{
18481		.cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
18482		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18483		.doit = nl80211_update_connect_params,
18484		.flags = GENL_ADMIN_PERM,
18485		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18486					 NL80211_FLAG_CLEAR_SKB),
18487	},
18488	{
18489		.cmd = NL80211_CMD_DISCONNECT,
18490		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18491		.doit = nl80211_disconnect,
18492		.flags = GENL_UNS_ADMIN_PERM,
18493		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18494	},
18495	{
18496		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
18497		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18498		.doit = nl80211_wiphy_netns,
18499		.flags = GENL_UNS_ADMIN_PERM,
18500		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18501					 NL80211_FLAG_NEED_RTNL |
18502					 NL80211_FLAG_NO_WIPHY_MTX),
18503	},
18504	{
18505		.cmd = NL80211_CMD_GET_SURVEY,
18506		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18507		.dumpit = nl80211_dump_survey,
18508	},
18509	{
18510		.cmd = NL80211_CMD_SET_PMKSA,
18511		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18512		.doit = nl80211_set_pmksa,
18513		.flags = GENL_UNS_ADMIN_PERM,
18514		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18515					 NL80211_FLAG_CLEAR_SKB),
18516	},
18517	{
18518		.cmd = NL80211_CMD_DEL_PMKSA,
18519		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18520		.doit = nl80211_del_pmksa,
18521		.flags = GENL_UNS_ADMIN_PERM,
18522		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18523	},
18524	{
18525		.cmd = NL80211_CMD_FLUSH_PMKSA,
18526		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18527		.doit = nl80211_flush_pmksa,
18528		.flags = GENL_UNS_ADMIN_PERM,
18529		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18530	},
18531	{
18532		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
18533		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18534		.doit = nl80211_remain_on_channel,
18535		.flags = GENL_UNS_ADMIN_PERM,
18536		/* FIXME: requiring a link ID here is probably not good */
18537		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18538					 NL80211_FLAG_MLO_VALID_LINK_ID),
18539	},
18540	{
18541		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18542		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18543		.doit = nl80211_cancel_remain_on_channel,
18544		.flags = GENL_UNS_ADMIN_PERM,
18545		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18546	},
18547	{
18548		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
18549		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18550		.doit = nl80211_set_tx_bitrate_mask,
18551		.flags = GENL_UNS_ADMIN_PERM,
18552		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18553					 NL80211_FLAG_MLO_VALID_LINK_ID),
18554	},
18555	{
18556		.cmd = NL80211_CMD_REGISTER_FRAME,
18557		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18558		.doit = nl80211_register_mgmt,
18559		.flags = GENL_UNS_ADMIN_PERM,
18560		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
18561	},
18562	{
18563		.cmd = NL80211_CMD_FRAME,
18564		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18565		.doit = nl80211_tx_mgmt,
18566		.flags = GENL_UNS_ADMIN_PERM,
18567		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18568	},
18569	{
18570		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
18571		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18572		.doit = nl80211_tx_mgmt_cancel_wait,
18573		.flags = GENL_UNS_ADMIN_PERM,
18574		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18575	},
18576	{
18577		.cmd = NL80211_CMD_SET_POWER_SAVE,
18578		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18579		.doit = nl80211_set_power_save,
18580		.flags = GENL_UNS_ADMIN_PERM,
18581		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18582	},
18583	{
18584		.cmd = NL80211_CMD_GET_POWER_SAVE,
18585		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18586		.doit = nl80211_get_power_save,
18587		/* can be retrieved by unprivileged users */
18588		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18589	},
18590	{
18591		.cmd = NL80211_CMD_SET_CQM,
18592		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18593		.doit = nl80211_set_cqm,
18594		.flags = GENL_UNS_ADMIN_PERM,
18595		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18596	},
18597	{
18598		.cmd = NL80211_CMD_SET_CHANNEL,
18599		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18600		.doit = nl80211_set_channel,
18601		.flags = GENL_UNS_ADMIN_PERM,
18602		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18603					 NL80211_FLAG_MLO_VALID_LINK_ID),
18604	},
18605	{
18606		.cmd = NL80211_CMD_JOIN_MESH,
18607		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18608		.doit = nl80211_join_mesh,
18609		.flags = GENL_UNS_ADMIN_PERM,
18610		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18611	},
18612	{
18613		.cmd = NL80211_CMD_LEAVE_MESH,
18614		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18615		.doit = nl80211_leave_mesh,
18616		.flags = GENL_UNS_ADMIN_PERM,
18617		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18618	},
18619	{
18620		.cmd = NL80211_CMD_JOIN_OCB,
18621		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18622		.doit = nl80211_join_ocb,
18623		.flags = GENL_UNS_ADMIN_PERM,
18624		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18625	},
18626	{
18627		.cmd = NL80211_CMD_LEAVE_OCB,
18628		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18629		.doit = nl80211_leave_ocb,
18630		.flags = GENL_UNS_ADMIN_PERM,
18631		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18632	},
18633#ifdef CONFIG_PM
18634	{
18635		.cmd = NL80211_CMD_GET_WOWLAN,
18636		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18637		.doit = nl80211_get_wowlan,
18638		/* can be retrieved by unprivileged users */
18639		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18640	},
18641	{
18642		.cmd = NL80211_CMD_SET_WOWLAN,
18643		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18644		.doit = nl80211_set_wowlan,
18645		.flags = GENL_UNS_ADMIN_PERM,
18646		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18647	},
18648#endif
18649	{
18650		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
18651		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18652		.doit = nl80211_set_rekey_data,
18653		.flags = GENL_UNS_ADMIN_PERM,
18654		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18655					 NL80211_FLAG_CLEAR_SKB),
18656	},
18657	{
18658		.cmd = NL80211_CMD_TDLS_MGMT,
18659		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18660		.doit = nl80211_tdls_mgmt,
18661		.flags = GENL_UNS_ADMIN_PERM,
18662		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18663					 NL80211_FLAG_MLO_VALID_LINK_ID),
18664	},
18665	{
18666		.cmd = NL80211_CMD_TDLS_OPER,
18667		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18668		.doit = nl80211_tdls_oper,
18669		.flags = GENL_UNS_ADMIN_PERM,
18670		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18671	},
18672	{
18673		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
18674		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18675		.doit = nl80211_register_unexpected_frame,
18676		.flags = GENL_UNS_ADMIN_PERM,
18677		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18678	},
18679	{
18680		.cmd = NL80211_CMD_PROBE_CLIENT,
18681		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18682		.doit = nl80211_probe_client,
18683		.flags = GENL_UNS_ADMIN_PERM,
18684		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18685	},
18686	{
18687		.cmd = NL80211_CMD_REGISTER_BEACONS,
18688		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18689		.doit = nl80211_register_beacons,
18690		.flags = GENL_UNS_ADMIN_PERM,
18691		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18692	},
18693	{
18694		.cmd = NL80211_CMD_SET_NOACK_MAP,
18695		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18696		.doit = nl80211_set_noack_map,
18697		.flags = GENL_UNS_ADMIN_PERM,
18698		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18699	},
18700	{
18701		.cmd = NL80211_CMD_START_P2P_DEVICE,
18702		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18703		.doit = nl80211_start_p2p_device,
18704		.flags = GENL_UNS_ADMIN_PERM,
18705		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18706					 NL80211_FLAG_NEED_RTNL),
18707	},
18708	{
18709		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
18710		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18711		.doit = nl80211_stop_p2p_device,
18712		.flags = GENL_UNS_ADMIN_PERM,
18713		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18714					 NL80211_FLAG_NEED_RTNL),
18715	},
18716	{
18717		.cmd = NL80211_CMD_START_NAN,
18718		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18719		.doit = nl80211_start_nan,
18720		.flags = GENL_ADMIN_PERM,
18721		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
18722					 NL80211_FLAG_NEED_RTNL),
18723	},
18724	{
18725		.cmd = NL80211_CMD_STOP_NAN,
18726		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18727		.doit = nl80211_stop_nan,
18728		.flags = GENL_ADMIN_PERM,
18729		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
18730					 NL80211_FLAG_NEED_RTNL),
18731	},
18732	{
18733		.cmd = NL80211_CMD_ADD_NAN_FUNCTION,
18734		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18735		.doit = nl80211_nan_add_func,
18736		.flags = GENL_ADMIN_PERM,
18737		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18738	},
18739	{
18740		.cmd = NL80211_CMD_DEL_NAN_FUNCTION,
18741		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18742		.doit = nl80211_nan_del_func,
18743		.flags = GENL_ADMIN_PERM,
18744		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18745	},
18746	{
18747		.cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
18748		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18749		.doit = nl80211_nan_change_config,
18750		.flags = GENL_ADMIN_PERM,
18751		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18752	},
18753	{
18754		.cmd = NL80211_CMD_SET_MCAST_RATE,
18755		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18756		.doit = nl80211_set_mcast_rate,
18757		.flags = GENL_UNS_ADMIN_PERM,
18758		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18759	},
18760	{
18761		.cmd = NL80211_CMD_SET_MAC_ACL,
18762		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18763		.doit = nl80211_set_mac_acl,
18764		.flags = GENL_UNS_ADMIN_PERM,
18765		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18766					 NL80211_FLAG_MLO_UNSUPPORTED),
18767	},
18768	{
18769		.cmd = NL80211_CMD_RADAR_DETECT,
18770		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18771		.doit = nl80211_start_radar_detection,
18772		.flags = GENL_UNS_ADMIN_PERM,
18773		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18774					 NL80211_FLAG_NO_WIPHY_MTX |
18775					 NL80211_FLAG_MLO_VALID_LINK_ID),
18776	},
18777	{
18778		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
18779		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18780		.doit = nl80211_get_protocol_features,
18781	},
18782	{
18783		.cmd = NL80211_CMD_UPDATE_FT_IES,
18784		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18785		.doit = nl80211_update_ft_ies,
18786		.flags = GENL_UNS_ADMIN_PERM,
18787		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18788	},
18789	{
18790		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
18791		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18792		.doit = nl80211_crit_protocol_start,
18793		.flags = GENL_UNS_ADMIN_PERM,
18794		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18795	},
18796	{
18797		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
18798		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18799		.doit = nl80211_crit_protocol_stop,
18800		.flags = GENL_UNS_ADMIN_PERM,
18801		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18802	},
18803	{
18804		.cmd = NL80211_CMD_GET_COALESCE,
18805		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18806		.doit = nl80211_get_coalesce,
18807		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18808	},
18809	{
18810		.cmd = NL80211_CMD_SET_COALESCE,
18811		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18812		.doit = nl80211_set_coalesce,
18813		.flags = GENL_UNS_ADMIN_PERM,
18814		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
18815	},
18816	{
18817		.cmd = NL80211_CMD_CHANNEL_SWITCH,
18818		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18819		.doit = nl80211_channel_switch,
18820		.flags = GENL_UNS_ADMIN_PERM,
18821		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18822					 NL80211_FLAG_MLO_VALID_LINK_ID),
18823	},
18824	{
18825		.cmd = NL80211_CMD_VENDOR,
18826		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18827		.doit = nl80211_vendor_cmd,
18828		.dumpit = nl80211_vendor_cmd_dump,
18829		.flags = GENL_UNS_ADMIN_PERM,
18830		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18831					 NL80211_FLAG_CLEAR_SKB),
18832	},
18833	{
18834		.cmd = NL80211_CMD_SET_QOS_MAP,
18835		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18836		.doit = nl80211_set_qos_map,
18837		.flags = GENL_UNS_ADMIN_PERM,
18838		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18839	},
18840	{
18841		.cmd = NL80211_CMD_ADD_TX_TS,
18842		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18843		.doit = nl80211_add_tx_ts,
18844		.flags = GENL_UNS_ADMIN_PERM,
18845		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18846					 NL80211_FLAG_MLO_UNSUPPORTED),
18847	},
18848	{
18849		.cmd = NL80211_CMD_DEL_TX_TS,
18850		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18851		.doit = nl80211_del_tx_ts,
18852		.flags = GENL_UNS_ADMIN_PERM,
18853		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18854	},
18855	{
18856		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
18857		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18858		.doit = nl80211_tdls_channel_switch,
18859		.flags = GENL_UNS_ADMIN_PERM,
18860		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18861	},
18862	{
18863		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
18864		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18865		.doit = nl80211_tdls_cancel_channel_switch,
18866		.flags = GENL_UNS_ADMIN_PERM,
18867		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18868	},
18869	{
18870		.cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
18871		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18872		.doit = nl80211_set_multicast_to_unicast,
18873		.flags = GENL_UNS_ADMIN_PERM,
18874		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
18875	},
18876	{
18877		.cmd = NL80211_CMD_SET_PMK,
18878		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18879		.doit = nl80211_set_pmk,
18880		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18881					 NL80211_FLAG_CLEAR_SKB),
18882	},
18883	{
18884		.cmd = NL80211_CMD_DEL_PMK,
18885		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18886		.doit = nl80211_del_pmk,
18887		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18888	},
18889	{
18890		.cmd = NL80211_CMD_EXTERNAL_AUTH,
18891		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18892		.doit = nl80211_external_auth,
18893		.flags = GENL_ADMIN_PERM,
18894		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18895	},
18896	{
18897		.cmd = NL80211_CMD_CONTROL_PORT_FRAME,
18898		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18899		.doit = nl80211_tx_control_port,
18900		.flags = GENL_UNS_ADMIN_PERM,
18901		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18902	},
18903	{
18904		.cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
18905		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18906		.doit = nl80211_get_ftm_responder_stats,
18907		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18908					 NL80211_FLAG_MLO_VALID_LINK_ID),
18909	},
18910	{
18911		.cmd = NL80211_CMD_PEER_MEASUREMENT_START,
18912		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18913		.doit = nl80211_pmsr_start,
18914		.flags = GENL_UNS_ADMIN_PERM,
18915		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
18916	},
18917	{
18918		.cmd = NL80211_CMD_NOTIFY_RADAR,
18919		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18920		.doit = nl80211_notify_radar_detection,
18921		.flags = GENL_UNS_ADMIN_PERM,
18922		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18923	},
18924	{
18925		.cmd = NL80211_CMD_UPDATE_OWE_INFO,
18926		.doit = nl80211_update_owe_info,
18927		.flags = GENL_ADMIN_PERM,
18928		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18929	},
18930	{
18931		.cmd = NL80211_CMD_PROBE_MESH_LINK,
18932		.doit = nl80211_probe_mesh_link,
18933		.flags = GENL_UNS_ADMIN_PERM,
18934		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18935	},
18936	{
18937		.cmd = NL80211_CMD_SET_TID_CONFIG,
18938		.doit = nl80211_set_tid_config,
18939		.flags = GENL_UNS_ADMIN_PERM,
18940		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
18941					 NL80211_FLAG_MLO_VALID_LINK_ID),
18942	},
18943	{
18944		.cmd = NL80211_CMD_SET_SAR_SPECS,
18945		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18946		.doit = nl80211_set_sar_specs,
18947		.flags = GENL_UNS_ADMIN_PERM,
18948		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
18949					 NL80211_FLAG_NEED_RTNL),
18950	},
18951	{
18952		.cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
18953		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18954		.doit = nl80211_color_change,
18955		.flags = GENL_UNS_ADMIN_PERM,
18956		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18957					 NL80211_FLAG_MLO_VALID_LINK_ID),
18958	},
18959	{
18960		.cmd = NL80211_CMD_SET_FILS_AAD,
18961		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
18962		.doit = nl80211_set_fils_aad,
18963		.flags = GENL_UNS_ADMIN_PERM,
18964		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18965	},
18966	{
18967		.cmd = NL80211_CMD_ADD_LINK,
18968		.doit = nl80211_add_link,
18969		.flags = GENL_UNS_ADMIN_PERM,
18970		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
18971	},
18972	{
18973		.cmd = NL80211_CMD_REMOVE_LINK,
18974		.doit = nl80211_remove_link,
18975		.flags = GENL_UNS_ADMIN_PERM,
18976		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18977					 NL80211_FLAG_MLO_VALID_LINK_ID),
18978	},
18979	{
18980		.cmd = NL80211_CMD_ADD_LINK_STA,
18981		.doit = nl80211_add_link_station,
18982		.flags = GENL_UNS_ADMIN_PERM,
18983		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18984					 NL80211_FLAG_MLO_VALID_LINK_ID),
18985	},
18986	{
18987		.cmd = NL80211_CMD_MODIFY_LINK_STA,
18988		.doit = nl80211_modify_link_station,
18989		.flags = GENL_UNS_ADMIN_PERM,
18990		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18991					 NL80211_FLAG_MLO_VALID_LINK_ID),
18992	},
18993	{
18994		.cmd = NL80211_CMD_REMOVE_LINK_STA,
18995		.doit = nl80211_remove_link_station,
18996		.flags = GENL_UNS_ADMIN_PERM,
18997		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
18998					 NL80211_FLAG_MLO_VALID_LINK_ID),
18999	},
19000	{
19001		.cmd = NL80211_CMD_SET_HW_TIMESTAMP,
19002		.doit = nl80211_set_hw_timestamp,
19003		.flags = GENL_UNS_ADMIN_PERM,
19004		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19005	},
19006	{
19007		.cmd = NL80211_CMD_SET_TID_TO_LINK_MAPPING,
19008		.doit = nl80211_set_ttlm,
19009		.flags = GENL_UNS_ADMIN_PERM,
19010		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19011	},
19012	{
19013		.cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19014		.doit = nl80211_assoc_ml_reconf,
19015		.flags = GENL_UNS_ADMIN_PERM,
19016		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19017	},
19018	{
19019		.cmd = NL80211_CMD_EPCS_CFG,
19020		.doit = nl80211_epcs_cfg,
19021		.flags = GENL_UNS_ADMIN_PERM,
19022		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
19023	},
19024};
19025
19026static struct genl_family nl80211_fam __ro_after_init = {
19027	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
19028	.hdrsize = 0,			/* no private header */
19029	.version = 1,			/* no particular meaning now */
19030	.maxattr = NL80211_ATTR_MAX,
19031	.policy = nl80211_policy,
19032	.netnsok = true,
19033	.pre_doit = nl80211_pre_doit,
19034	.post_doit = nl80211_post_doit,
19035	.module = THIS_MODULE,
19036	.ops = nl80211_ops,
19037	.n_ops = ARRAY_SIZE(nl80211_ops),
19038	.small_ops = nl80211_small_ops,
19039	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
19040	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
19041	.mcgrps = nl80211_mcgrps,
19042	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
19043	.parallel_ops = true,
19044};
19045
19046/* notification functions */
19047
19048void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
19049			  enum nl80211_commands cmd)
19050{
19051	struct sk_buff *msg;
19052	struct nl80211_dump_wiphy_state state = {};
19053
19054	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
19055		cmd != NL80211_CMD_DEL_WIPHY);
19056
19057	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19058	if (!msg)
19059		return;
19060
19061	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
19062		nlmsg_free(msg);
19063		return;
19064	}
19065
19066	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19067				NL80211_MCGRP_CONFIG, GFP_KERNEL);
19068}
19069
19070void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
19071				struct wireless_dev *wdev,
19072				enum nl80211_commands cmd)
19073{
19074	struct sk_buff *msg;
19075
19076	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19077	if (!msg)
19078		return;
19079
19080	if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
19081		nlmsg_free(msg);
19082		return;
19083	}
19084
19085	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19086				NL80211_MCGRP_CONFIG, GFP_KERNEL);
19087}
19088
19089static int nl80211_add_scan_req(struct sk_buff *msg,
19090				struct cfg80211_registered_device *rdev)
19091{
19092	struct cfg80211_scan_request_int *req = rdev->scan_req;
19093	struct nlattr *nest;
19094	int i;
19095	struct cfg80211_scan_info *info;
19096
19097	if (WARN_ON(!req))
19098		return 0;
19099
19100	nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
19101	if (!nest)
19102		goto nla_put_failure;
19103	for (i = 0; i < req->req.n_ssids; i++) {
19104		if (nla_put(msg, i, req->req.ssids[i].ssid_len,
19105			    req->req.ssids[i].ssid))
19106			goto nla_put_failure;
19107	}
19108	nla_nest_end(msg, nest);
19109
19110	if (req->req.flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
19111		nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
19112		if (!nest)
19113			goto nla_put_failure;
19114		for (i = 0; i < req->req.n_channels; i++) {
19115			if (nla_put_u32(msg, i,
19116					ieee80211_channel_to_khz(req->req.channels[i])))
19117				goto nla_put_failure;
19118		}
19119		nla_nest_end(msg, nest);
19120	} else {
19121		nest = nla_nest_start_noflag(msg,
19122					     NL80211_ATTR_SCAN_FREQUENCIES);
19123		if (!nest)
19124			goto nla_put_failure;
19125		for (i = 0; i < req->req.n_channels; i++) {
19126			if (nla_put_u32(msg, i,
19127					req->req.channels[i]->center_freq))
19128				goto nla_put_failure;
19129		}
19130		nla_nest_end(msg, nest);
19131	}
19132
19133	if (req->req.ie &&
19134	    nla_put(msg, NL80211_ATTR_IE, req->req.ie_len, req->req.ie))
19135		goto nla_put_failure;
19136
19137	if (req->req.flags &&
19138	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->req.flags))
19139		goto nla_put_failure;
19140
19141	info = rdev->int_scan_req ? &rdev->int_scan_req->info :
19142		&rdev->scan_req->info;
19143	if (info->scan_start_tsf &&
19144	    (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
19145			       info->scan_start_tsf, NL80211_BSS_PAD) ||
19146	     nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
19147		     info->tsf_bssid)))
19148		goto nla_put_failure;
19149
19150	return 0;
19151 nla_put_failure:
19152	return -ENOBUFS;
19153}
19154
19155static int nl80211_prep_scan_msg(struct sk_buff *msg,
19156				 struct cfg80211_registered_device *rdev,
19157				 struct wireless_dev *wdev,
19158				 u32 portid, u32 seq, int flags,
19159				 u32 cmd)
19160{
19161	void *hdr;
19162
19163	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
19164	if (!hdr)
19165		return -1;
19166
19167	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19168	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19169					 wdev->netdev->ifindex)) ||
19170	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19171			      NL80211_ATTR_PAD))
19172		goto nla_put_failure;
19173
19174	/* ignore errors and send incomplete event anyway */
19175	nl80211_add_scan_req(msg, rdev);
19176
19177	genlmsg_end(msg, hdr);
19178	return 0;
19179
19180 nla_put_failure:
19181	genlmsg_cancel(msg, hdr);
19182	return -EMSGSIZE;
19183}
19184
19185static int
19186nl80211_prep_sched_scan_msg(struct sk_buff *msg,
19187			    struct cfg80211_sched_scan_request *req, u32 cmd)
19188{
19189	void *hdr;
19190
19191	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19192	if (!hdr)
19193		return -1;
19194
19195	if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
19196			wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
19197	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
19198	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
19199			      NL80211_ATTR_PAD))
19200		goto nla_put_failure;
19201
19202	genlmsg_end(msg, hdr);
19203	return 0;
19204
19205 nla_put_failure:
19206	genlmsg_cancel(msg, hdr);
19207	return -EMSGSIZE;
19208}
19209
19210void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
19211			     struct wireless_dev *wdev)
19212{
19213	struct sk_buff *msg;
19214
19215	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19216	if (!msg)
19217		return;
19218
19219	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19220				  NL80211_CMD_TRIGGER_SCAN) < 0) {
19221		nlmsg_free(msg);
19222		return;
19223	}
19224
19225	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19226				NL80211_MCGRP_SCAN, GFP_KERNEL);
19227}
19228
19229struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
19230				       struct wireless_dev *wdev, bool aborted)
19231{
19232	struct sk_buff *msg;
19233
19234	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19235	if (!msg)
19236		return NULL;
19237
19238	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
19239				  aborted ? NL80211_CMD_SCAN_ABORTED :
19240					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
19241		nlmsg_free(msg);
19242		return NULL;
19243	}
19244
19245	return msg;
19246}
19247
19248/* send message created by nl80211_build_scan_msg() */
19249void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
19250			   struct sk_buff *msg)
19251{
19252	if (!msg)
19253		return;
19254
19255	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19256				NL80211_MCGRP_SCAN, GFP_KERNEL);
19257}
19258
19259void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
19260{
19261	struct sk_buff *msg;
19262
19263	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19264	if (!msg)
19265		return;
19266
19267	if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
19268		nlmsg_free(msg);
19269		return;
19270	}
19271
19272	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
19273				NL80211_MCGRP_SCAN, GFP_KERNEL);
19274}
19275
19276static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
19277					  struct regulatory_request *request)
19278{
19279	/* Userspace can always count this one always being set */
19280	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
19281		goto nla_put_failure;
19282
19283	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
19284		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19285			       NL80211_REGDOM_TYPE_WORLD))
19286			goto nla_put_failure;
19287	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
19288		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19289			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
19290			goto nla_put_failure;
19291	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
19292		   request->intersect) {
19293		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19294			       NL80211_REGDOM_TYPE_INTERSECTION))
19295			goto nla_put_failure;
19296	} else {
19297		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
19298			       NL80211_REGDOM_TYPE_COUNTRY) ||
19299		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
19300				   request->alpha2))
19301			goto nla_put_failure;
19302	}
19303
19304	if (request->wiphy_idx != WIPHY_IDX_INVALID) {
19305		struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
19306
19307		if (wiphy &&
19308		    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
19309			goto nla_put_failure;
19310
19311		if (wiphy &&
19312		    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
19313		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
19314			goto nla_put_failure;
19315	}
19316
19317	return true;
19318
19319nla_put_failure:
19320	return false;
19321}
19322
19323/*
19324 * This can happen on global regulatory changes or device specific settings
19325 * based on custom regulatory domains.
19326 */
19327void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
19328				     struct regulatory_request *request)
19329{
19330	struct sk_buff *msg;
19331	void *hdr;
19332
19333	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19334	if (!msg)
19335		return;
19336
19337	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
19338	if (!hdr)
19339		goto nla_put_failure;
19340
19341	if (!nl80211_reg_change_event_fill(msg, request))
19342		goto nla_put_failure;
19343
19344	genlmsg_end(msg, hdr);
19345
19346	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
19347				NL80211_MCGRP_REGULATORY);
19348
19349	return;
19350
19351nla_put_failure:
19352	nlmsg_free(msg);
19353}
19354
19355struct nl80211_mlme_event {
19356	enum nl80211_commands cmd;
19357	const u8 *buf;
19358	size_t buf_len;
19359	int uapsd_queues;
19360	const u8 *req_ies;
19361	size_t req_ies_len;
19362	bool reconnect;
19363};
19364
19365static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
19366				    struct net_device *netdev,
19367				    const struct nl80211_mlme_event *event,
19368				    gfp_t gfp)
19369{
19370	struct sk_buff *msg;
19371	void *hdr;
19372
19373	msg = nlmsg_new(100 + event->buf_len + event->req_ies_len, gfp);
19374	if (!msg)
19375		return;
19376
19377	hdr = nl80211hdr_put(msg, 0, 0, 0, event->cmd);
19378	if (!hdr) {
19379		nlmsg_free(msg);
19380		return;
19381	}
19382
19383	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19384	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19385	    nla_put(msg, NL80211_ATTR_FRAME, event->buf_len, event->buf) ||
19386	    (event->req_ies &&
19387	     nla_put(msg, NL80211_ATTR_REQ_IE, event->req_ies_len,
19388		     event->req_ies)))
19389		goto nla_put_failure;
19390
19391	if (event->reconnect &&
19392	    nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
19393		goto nla_put_failure;
19394
19395	if (event->uapsd_queues >= 0) {
19396		struct nlattr *nla_wmm =
19397			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
19398		if (!nla_wmm)
19399			goto nla_put_failure;
19400
19401		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
19402			       event->uapsd_queues))
19403			goto nla_put_failure;
19404
19405		nla_nest_end(msg, nla_wmm);
19406	}
19407
19408	genlmsg_end(msg, hdr);
19409
19410	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19411				NL80211_MCGRP_MLME, gfp);
19412	return;
19413
19414 nla_put_failure:
19415	nlmsg_free(msg);
19416}
19417
19418void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
19419			  struct net_device *netdev, const u8 *buf,
19420			  size_t len, gfp_t gfp)
19421{
19422	struct nl80211_mlme_event event = {
19423		.cmd = NL80211_CMD_AUTHENTICATE,
19424		.buf = buf,
19425		.buf_len = len,
19426		.uapsd_queues = -1,
19427	};
19428
19429	nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19430}
19431
19432void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
19433			   struct net_device *netdev,
19434			   const struct cfg80211_rx_assoc_resp_data *data)
19435{
19436	struct nl80211_mlme_event event = {
19437		.cmd = NL80211_CMD_ASSOCIATE,
19438		.buf = data->buf,
19439		.buf_len = data->len,
19440		.uapsd_queues = data->uapsd_queues,
19441		.req_ies = data->req_ies,
19442		.req_ies_len = data->req_ies_len,
19443	};
19444
19445	nl80211_send_mlme_event(rdev, netdev, &event, GFP_KERNEL);
19446}
19447
19448void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
19449			 struct net_device *netdev, const u8 *buf,
19450			 size_t len, bool reconnect, gfp_t gfp)
19451{
19452	struct nl80211_mlme_event event = {
19453		.cmd = NL80211_CMD_DEAUTHENTICATE,
19454		.buf = buf,
19455		.buf_len = len,
19456		.reconnect = reconnect,
19457		.uapsd_queues = -1,
19458	};
19459
19460	nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19461}
19462
19463void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
19464			   struct net_device *netdev, const u8 *buf,
19465			   size_t len, bool reconnect, gfp_t gfp)
19466{
19467	struct nl80211_mlme_event event = {
19468		.cmd = NL80211_CMD_DISASSOCIATE,
19469		.buf = buf,
19470		.buf_len = len,
19471		.reconnect = reconnect,
19472		.uapsd_queues = -1,
19473	};
19474
19475	nl80211_send_mlme_event(rdev, netdev, &event, gfp);
19476}
19477
19478void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
19479				  size_t len)
19480{
19481	struct wireless_dev *wdev = dev->ieee80211_ptr;
19482	struct wiphy *wiphy = wdev->wiphy;
19483	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19484	const struct ieee80211_mgmt *mgmt = (void *)buf;
19485	struct nl80211_mlme_event event = {
19486		.buf = buf,
19487		.buf_len = len,
19488		.uapsd_queues = -1,
19489	};
19490
19491	if (WARN_ON(len < 2))
19492		return;
19493
19494	if (ieee80211_is_deauth(mgmt->frame_control)) {
19495		event.cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
19496	} else if (ieee80211_is_disassoc(mgmt->frame_control)) {
19497		event.cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
19498	} else if (ieee80211_is_beacon(mgmt->frame_control)) {
19499		if (wdev->unprot_beacon_reported &&
19500		    elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
19501			return;
19502		event.cmd = NL80211_CMD_UNPROT_BEACON;
19503		wdev->unprot_beacon_reported = jiffies;
19504	} else {
19505		return;
19506	}
19507
19508	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
19509	nl80211_send_mlme_event(rdev, dev, &event, GFP_ATOMIC);
19510}
19511EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
19512
19513static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
19514				      struct net_device *netdev, int cmd,
19515				      const u8 *addr, gfp_t gfp)
19516{
19517	struct sk_buff *msg;
19518	void *hdr;
19519
19520	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19521	if (!msg)
19522		return;
19523
19524	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19525	if (!hdr) {
19526		nlmsg_free(msg);
19527		return;
19528	}
19529
19530	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19531	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19532	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19533	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
19534		goto nla_put_failure;
19535
19536	genlmsg_end(msg, hdr);
19537
19538	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19539				NL80211_MCGRP_MLME, gfp);
19540	return;
19541
19542 nla_put_failure:
19543	nlmsg_free(msg);
19544}
19545
19546void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
19547			       struct net_device *netdev, const u8 *addr,
19548			       gfp_t gfp)
19549{
19550	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
19551				  addr, gfp);
19552}
19553
19554void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
19555				struct net_device *netdev, const u8 *addr,
19556				gfp_t gfp)
19557{
19558	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
19559				  addr, gfp);
19560}
19561
19562void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
19563				 struct net_device *netdev,
19564				 struct cfg80211_connect_resp_params *cr,
19565				 gfp_t gfp)
19566{
19567	struct sk_buff *msg;
19568	void *hdr;
19569	unsigned int link;
19570	size_t link_info_size = 0;
19571	const u8 *connected_addr = cr->valid_links ?
19572				   cr->ap_mld_addr : cr->links[0].bssid;
19573
19574	if (cr->valid_links) {
19575		for_each_valid_link(cr, link) {
19576			/* Nested attribute header */
19577			link_info_size += NLA_HDRLEN;
19578			/* Link ID */
19579			link_info_size += nla_total_size(sizeof(u8));
19580			link_info_size += cr->links[link].addr ?
19581					  nla_total_size(ETH_ALEN) : 0;
19582			link_info_size += (cr->links[link].bssid ||
19583					   cr->links[link].bss) ?
19584					  nla_total_size(ETH_ALEN) : 0;
19585			link_info_size += nla_total_size(sizeof(u16));
19586		}
19587	}
19588
19589	msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
19590			cr->fils.kek_len + cr->fils.pmk_len +
19591			(cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
19592			gfp);
19593	if (!msg)
19594		return;
19595
19596	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
19597	if (!hdr) {
19598		nlmsg_free(msg);
19599		return;
19600	}
19601
19602	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19603	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19604	    (connected_addr &&
19605	     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
19606	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19607			cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
19608			cr->status) ||
19609	    (cr->status < 0 &&
19610	     (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
19611	      nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
19612			  cr->timeout_reason))) ||
19613	    (cr->req_ie &&
19614	     nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
19615	    (cr->resp_ie &&
19616	     nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
19617		     cr->resp_ie)) ||
19618	    (cr->fils.update_erp_next_seq_num &&
19619	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19620			 cr->fils.erp_next_seq_num)) ||
19621	    (cr->status == WLAN_STATUS_SUCCESS &&
19622	     ((cr->fils.kek &&
19623	       nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
19624		       cr->fils.kek)) ||
19625	      (cr->fils.pmk &&
19626	       nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
19627	      (cr->fils.pmkid &&
19628	       nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
19629		goto nla_put_failure;
19630
19631	if (cr->valid_links) {
19632		int i = 1;
19633		struct nlattr *nested;
19634
19635		nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19636		if (!nested)
19637			goto nla_put_failure;
19638
19639		for_each_valid_link(cr, link) {
19640			struct nlattr *nested_mlo_links;
19641			const u8 *bssid = cr->links[link].bss ?
19642					  cr->links[link].bss->bssid :
19643					  cr->links[link].bssid;
19644
19645			nested_mlo_links = nla_nest_start(msg, i);
19646			if (!nested_mlo_links)
19647				goto nla_put_failure;
19648
19649			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19650			    (bssid &&
19651			     nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19652			    (cr->links[link].addr &&
19653			     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19654				     cr->links[link].addr)) ||
19655			    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
19656					cr->links[link].status))
19657				goto nla_put_failure;
19658
19659			nla_nest_end(msg, nested_mlo_links);
19660			i++;
19661		}
19662		nla_nest_end(msg, nested);
19663	}
19664
19665	genlmsg_end(msg, hdr);
19666
19667	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19668				NL80211_MCGRP_MLME, gfp);
19669	return;
19670
19671 nla_put_failure:
19672	nlmsg_free(msg);
19673}
19674
19675void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
19676			 struct net_device *netdev,
19677			 struct cfg80211_roam_info *info, gfp_t gfp)
19678{
19679	struct sk_buff *msg;
19680	void *hdr;
19681	size_t link_info_size = 0;
19682	unsigned int link;
19683	const u8 *connected_addr = info->ap_mld_addr ?
19684				   info->ap_mld_addr :
19685				   (info->links[0].bss ?
19686				    info->links[0].bss->bssid :
19687				    info->links[0].bssid);
19688
19689	if (info->valid_links) {
19690		for_each_valid_link(info, link) {
19691			/* Nested attribute header */
19692			link_info_size += NLA_HDRLEN;
19693			/* Link ID */
19694			link_info_size += nla_total_size(sizeof(u8));
19695			link_info_size += info->links[link].addr ?
19696					  nla_total_size(ETH_ALEN) : 0;
19697			link_info_size += (info->links[link].bssid ||
19698					   info->links[link].bss) ?
19699					  nla_total_size(ETH_ALEN) : 0;
19700		}
19701	}
19702
19703	msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
19704			info->fils.kek_len + info->fils.pmk_len +
19705			(info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
19706			link_info_size, gfp);
19707	if (!msg)
19708		return;
19709
19710	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
19711	if (!hdr) {
19712		nlmsg_free(msg);
19713		return;
19714	}
19715
19716	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19717	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19718	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
19719	    (info->req_ie &&
19720	     nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
19721		     info->req_ie)) ||
19722	    (info->resp_ie &&
19723	     nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
19724		     info->resp_ie)) ||
19725	    (info->fils.update_erp_next_seq_num &&
19726	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
19727			 info->fils.erp_next_seq_num)) ||
19728	    (info->fils.kek &&
19729	     nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
19730		     info->fils.kek)) ||
19731	    (info->fils.pmk &&
19732	     nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
19733	    (info->fils.pmkid &&
19734	     nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
19735		goto nla_put_failure;
19736
19737	if (info->valid_links) {
19738		int i = 1;
19739		struct nlattr *nested;
19740
19741		nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19742		if (!nested)
19743			goto nla_put_failure;
19744
19745		for_each_valid_link(info, link) {
19746			struct nlattr *nested_mlo_links;
19747			const u8 *bssid = info->links[link].bss ?
19748					  info->links[link].bss->bssid :
19749					  info->links[link].bssid;
19750
19751			nested_mlo_links = nla_nest_start(msg, i);
19752			if (!nested_mlo_links)
19753				goto nla_put_failure;
19754
19755			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
19756			    (bssid &&
19757			     nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
19758			    (info->links[link].addr &&
19759			     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
19760				     info->links[link].addr)))
19761				goto nla_put_failure;
19762
19763			nla_nest_end(msg, nested_mlo_links);
19764			i++;
19765		}
19766		nla_nest_end(msg, nested);
19767	}
19768
19769	genlmsg_end(msg, hdr);
19770
19771	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19772				NL80211_MCGRP_MLME, gfp);
19773	return;
19774
19775 nla_put_failure:
19776	nlmsg_free(msg);
19777}
19778
19779void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
19780				  struct net_device *netdev, const u8 *peer_addr,
19781				  const u8 *td_bitmap, u8 td_bitmap_len)
19782{
19783	struct sk_buff *msg;
19784	void *hdr;
19785
19786	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19787	if (!msg)
19788		return;
19789
19790	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
19791	if (!hdr) {
19792		nlmsg_free(msg);
19793		return;
19794	}
19795
19796	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19797	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19798	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
19799		goto nla_put_failure;
19800
19801	if (td_bitmap_len > 0 && td_bitmap &&
19802	    nla_put(msg, NL80211_ATTR_TD_BITMAP, td_bitmap_len, td_bitmap))
19803		goto nla_put_failure;
19804
19805	genlmsg_end(msg, hdr);
19806
19807	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19808				NL80211_MCGRP_MLME, GFP_KERNEL);
19809	return;
19810
19811 nla_put_failure:
19812	nlmsg_free(msg);
19813}
19814
19815void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
19816			       struct net_device *netdev, u16 reason,
19817			       const u8 *ie, size_t ie_len, bool from_ap)
19818{
19819	struct sk_buff *msg;
19820	void *hdr;
19821
19822	msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
19823	if (!msg)
19824		return;
19825
19826	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
19827	if (!hdr) {
19828		nlmsg_free(msg);
19829		return;
19830	}
19831
19832	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19833	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19834	    (reason &&
19835	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
19836	    (from_ap &&
19837	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
19838	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
19839		goto nla_put_failure;
19840
19841	genlmsg_end(msg, hdr);
19842
19843	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19844				NL80211_MCGRP_MLME, GFP_KERNEL);
19845	return;
19846
19847 nla_put_failure:
19848	nlmsg_free(msg);
19849}
19850
19851void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
19852{
19853	struct wireless_dev *wdev = dev->ieee80211_ptr;
19854	struct wiphy *wiphy = wdev->wiphy;
19855	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19856	struct sk_buff *msg;
19857	struct nlattr *links;
19858	void *hdr;
19859
19860	lockdep_assert_wiphy(wdev->wiphy);
19861	trace_cfg80211_links_removed(dev, link_mask);
19862
19863	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
19864		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
19865		return;
19866
19867	if (WARN_ON(!wdev->valid_links || !link_mask ||
19868		    (wdev->valid_links & link_mask) != link_mask ||
19869		    wdev->valid_links == link_mask))
19870		return;
19871
19872	cfg80211_wdev_release_link_bsses(wdev, link_mask);
19873	wdev->valid_links &= ~link_mask;
19874
19875	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19876	if (!msg)
19877		return;
19878
19879	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
19880	if (!hdr) {
19881		nlmsg_free(msg);
19882		return;
19883	}
19884
19885	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19886	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19887		goto nla_put_failure;
19888
19889	links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
19890	if (!links)
19891		goto nla_put_failure;
19892
19893	while (link_mask) {
19894		struct nlattr *link;
19895		int link_id = __ffs(link_mask);
19896
19897		link = nla_nest_start(msg, link_id + 1);
19898		if (!link)
19899			goto nla_put_failure;
19900
19901		if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19902			goto nla_put_failure;
19903
19904		nla_nest_end(msg, link);
19905		link_mask &= ~(1 << link_id);
19906	}
19907
19908	nla_nest_end(msg, links);
19909
19910	genlmsg_end(msg, hdr);
19911
19912	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19913				NL80211_MCGRP_MLME, GFP_KERNEL);
19914	return;
19915
19916 nla_put_failure:
19917	nlmsg_free(msg);
19918}
19919EXPORT_SYMBOL(cfg80211_links_removed);
19920
19921void nl80211_mlo_reconf_add_done(struct net_device *dev,
19922				 struct cfg80211_mlo_reconf_done_data *data)
19923{
19924	struct wireless_dev *wdev = dev->ieee80211_ptr;
19925	struct wiphy *wiphy = wdev->wiphy;
19926	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19927	struct nl80211_mlme_event event = {
19928		.cmd = NL80211_CMD_ASSOC_MLO_RECONF,
19929		.buf = data->buf,
19930		.buf_len = data->len,
19931		.uapsd_queues = -1,
19932	};
19933
19934	nl80211_send_mlme_event(rdev, dev, &event, GFP_KERNEL);
19935}
19936EXPORT_SYMBOL(nl80211_mlo_reconf_add_done);
19937
19938void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
19939			     struct net_device *netdev, const u8 *bssid,
19940			     gfp_t gfp)
19941{
19942	struct sk_buff *msg;
19943	void *hdr;
19944
19945	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19946	if (!msg)
19947		return;
19948
19949	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
19950	if (!hdr) {
19951		nlmsg_free(msg);
19952		return;
19953	}
19954
19955	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19956	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19957	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19958		goto nla_put_failure;
19959
19960	genlmsg_end(msg, hdr);
19961
19962	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19963				NL80211_MCGRP_MLME, gfp);
19964	return;
19965
19966 nla_put_failure:
19967	nlmsg_free(msg);
19968}
19969
19970void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
19971					const u8 *ie, u8 ie_len,
19972					int sig_dbm, gfp_t gfp)
19973{
19974	struct wireless_dev *wdev = dev->ieee80211_ptr;
19975	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19976	struct sk_buff *msg;
19977	void *hdr;
19978
19979	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
19980		return;
19981
19982	trace_cfg80211_notify_new_peer_candidate(dev, addr);
19983
19984	msg = nlmsg_new(100 + ie_len, gfp);
19985	if (!msg)
19986		return;
19987
19988	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
19989	if (!hdr) {
19990		nlmsg_free(msg);
19991		return;
19992	}
19993
19994	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19995	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19996	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19997	    (ie_len && ie &&
19998	     nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
19999	    (sig_dbm &&
20000	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
20001		goto nla_put_failure;
20002
20003	genlmsg_end(msg, hdr);
20004
20005	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20006				NL80211_MCGRP_MLME, gfp);
20007	return;
20008
20009 nla_put_failure:
20010	nlmsg_free(msg);
20011}
20012EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
20013
20014void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
20015				 struct net_device *netdev, const u8 *addr,
20016				 enum nl80211_key_type key_type, int key_id,
20017				 const u8 *tsc, gfp_t gfp)
20018{
20019	struct sk_buff *msg;
20020	void *hdr;
20021
20022	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20023	if (!msg)
20024		return;
20025
20026	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
20027	if (!hdr) {
20028		nlmsg_free(msg);
20029		return;
20030	}
20031
20032	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20033	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20034	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
20035	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
20036	    (key_id != -1 &&
20037	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
20038	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
20039		goto nla_put_failure;
20040
20041	genlmsg_end(msg, hdr);
20042
20043	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20044				NL80211_MCGRP_MLME, gfp);
20045	return;
20046
20047 nla_put_failure:
20048	nlmsg_free(msg);
20049}
20050
20051void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
20052				    struct ieee80211_channel *channel_before,
20053				    struct ieee80211_channel *channel_after)
20054{
20055	struct sk_buff *msg;
20056	void *hdr;
20057	struct nlattr *nl_freq;
20058
20059	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
20060	if (!msg)
20061		return;
20062
20063	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
20064	if (!hdr) {
20065		nlmsg_free(msg);
20066		return;
20067	}
20068
20069	/*
20070	 * Since we are applying the beacon hint to a wiphy we know its
20071	 * wiphy_idx is valid
20072	 */
20073	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
20074		goto nla_put_failure;
20075
20076	/* Before */
20077	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
20078	if (!nl_freq)
20079		goto nla_put_failure;
20080
20081	if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
20082		goto nla_put_failure;
20083	nla_nest_end(msg, nl_freq);
20084
20085	/* After */
20086	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
20087	if (!nl_freq)
20088		goto nla_put_failure;
20089
20090	if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
20091		goto nla_put_failure;
20092	nla_nest_end(msg, nl_freq);
20093
20094	genlmsg_end(msg, hdr);
20095
20096	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
20097				NL80211_MCGRP_REGULATORY);
20098
20099	return;
20100
20101nla_put_failure:
20102	nlmsg_free(msg);
20103}
20104
20105static void nl80211_send_remain_on_chan_event(
20106	int cmd, struct cfg80211_registered_device *rdev,
20107	struct wireless_dev *wdev, u64 cookie,
20108	struct ieee80211_channel *chan,
20109	unsigned int duration, gfp_t gfp)
20110{
20111	struct sk_buff *msg;
20112	void *hdr;
20113
20114	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20115	if (!msg)
20116		return;
20117
20118	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20119	if (!hdr) {
20120		nlmsg_free(msg);
20121		return;
20122	}
20123
20124	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20125	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20126					 wdev->netdev->ifindex)) ||
20127	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20128			      NL80211_ATTR_PAD) ||
20129	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
20130	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
20131			NL80211_CHAN_NO_HT) ||
20132	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
20133			      NL80211_ATTR_PAD))
20134		goto nla_put_failure;
20135
20136	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
20137	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
20138		goto nla_put_failure;
20139
20140	genlmsg_end(msg, hdr);
20141
20142	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20143				NL80211_MCGRP_MLME, gfp);
20144	return;
20145
20146 nla_put_failure:
20147	nlmsg_free(msg);
20148}
20149
20150void cfg80211_assoc_comeback(struct net_device *netdev,
20151			     const u8 *ap_addr, u32 timeout)
20152{
20153	struct wireless_dev *wdev = netdev->ieee80211_ptr;
20154	struct wiphy *wiphy = wdev->wiphy;
20155	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20156	struct sk_buff *msg;
20157	void *hdr;
20158
20159	trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
20160
20161	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20162	if (!msg)
20163		return;
20164
20165	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
20166	if (!hdr) {
20167		nlmsg_free(msg);
20168		return;
20169	}
20170
20171	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20172	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20173	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
20174	    nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
20175		goto nla_put_failure;
20176
20177	genlmsg_end(msg, hdr);
20178
20179	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20180				NL80211_MCGRP_MLME, GFP_KERNEL);
20181	return;
20182
20183 nla_put_failure:
20184	nlmsg_free(msg);
20185}
20186EXPORT_SYMBOL(cfg80211_assoc_comeback);
20187
20188void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
20189			       struct ieee80211_channel *chan,
20190			       unsigned int duration, gfp_t gfp)
20191{
20192	struct wiphy *wiphy = wdev->wiphy;
20193	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20194
20195	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
20196	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
20197					  rdev, wdev, cookie, chan,
20198					  duration, gfp);
20199}
20200EXPORT_SYMBOL(cfg80211_ready_on_channel);
20201
20202void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
20203					struct ieee80211_channel *chan,
20204					gfp_t gfp)
20205{
20206	struct wiphy *wiphy = wdev->wiphy;
20207	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20208
20209	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
20210	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
20211					  rdev, wdev, cookie, chan, 0, gfp);
20212}
20213EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
20214
20215void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
20216					struct ieee80211_channel *chan,
20217					gfp_t gfp)
20218{
20219	struct wiphy *wiphy = wdev->wiphy;
20220	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20221
20222	trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
20223	nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
20224					  rdev, wdev, cookie, chan, 0, gfp);
20225}
20226EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
20227
20228void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
20229		      struct station_info *sinfo, gfp_t gfp)
20230{
20231	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20232	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20233	struct sk_buff *msg;
20234
20235	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
20236
20237	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20238	if (!msg)
20239		return;
20240
20241	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
20242				 rdev, dev, mac_addr, sinfo, false) < 0) {
20243		nlmsg_free(msg);
20244		return;
20245	}
20246
20247	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20248				NL80211_MCGRP_MLME, gfp);
20249}
20250EXPORT_SYMBOL(cfg80211_new_sta);
20251
20252void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
20253			    struct station_info *sinfo, gfp_t gfp)
20254{
20255	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20256	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20257	struct sk_buff *msg;
20258	struct station_info empty_sinfo = {};
20259
20260	if (!sinfo)
20261		sinfo = &empty_sinfo;
20262
20263	trace_cfg80211_del_sta(dev, mac_addr);
20264
20265	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20266	if (!msg) {
20267		cfg80211_sinfo_release_content(sinfo);
20268		return;
20269	}
20270
20271	if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
20272				 rdev, dev, mac_addr, sinfo, false) < 0) {
20273		nlmsg_free(msg);
20274		return;
20275	}
20276
20277	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20278				NL80211_MCGRP_MLME, gfp);
20279}
20280EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
20281
20282void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
20283			  enum nl80211_connect_failed_reason reason,
20284			  gfp_t gfp)
20285{
20286	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
20287	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20288	struct sk_buff *msg;
20289	void *hdr;
20290
20291	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
20292	if (!msg)
20293		return;
20294
20295	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
20296	if (!hdr) {
20297		nlmsg_free(msg);
20298		return;
20299	}
20300
20301	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20302	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
20303	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
20304		goto nla_put_failure;
20305
20306	genlmsg_end(msg, hdr);
20307
20308	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20309				NL80211_MCGRP_MLME, gfp);
20310	return;
20311
20312 nla_put_failure:
20313	nlmsg_free(msg);
20314}
20315EXPORT_SYMBOL(cfg80211_conn_failed);
20316
20317static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
20318				       const u8 *addr, int link_id, gfp_t gfp)
20319{
20320	struct wireless_dev *wdev = dev->ieee80211_ptr;
20321	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20322	struct sk_buff *msg;
20323	void *hdr;
20324	u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
20325
20326	if (!nlportid)
20327		return false;
20328
20329	msg = nlmsg_new(100, gfp);
20330	if (!msg)
20331		return true;
20332
20333	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
20334	if (!hdr) {
20335		nlmsg_free(msg);
20336		return true;
20337	}
20338
20339	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20340	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20341	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20342	    (link_id >= 0 &&
20343	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20344		goto nla_put_failure;
20345
20346	genlmsg_end(msg, hdr);
20347	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20348	return true;
20349
20350 nla_put_failure:
20351	nlmsg_free(msg);
20352	return true;
20353}
20354
20355bool cfg80211_rx_spurious_frame(struct net_device *dev, const u8 *addr,
20356				int link_id, gfp_t gfp)
20357{
20358	struct wireless_dev *wdev = dev->ieee80211_ptr;
20359	bool ret;
20360
20361	trace_cfg80211_rx_spurious_frame(dev, addr, link_id);
20362
20363	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20364		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
20365		trace_cfg80211_return_bool(false);
20366		return false;
20367	}
20368	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
20369					 addr, link_id, gfp);
20370	trace_cfg80211_return_bool(ret);
20371	return ret;
20372}
20373EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
20374
20375bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev, const u8 *addr,
20376					int link_id, gfp_t gfp)
20377{
20378	struct wireless_dev *wdev = dev->ieee80211_ptr;
20379	bool ret;
20380
20381	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr, link_id);
20382
20383	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
20384		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
20385		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
20386		trace_cfg80211_return_bool(false);
20387		return false;
20388	}
20389	ret = __nl80211_unexpected_frame(dev,
20390					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
20391					 addr, link_id, gfp);
20392	trace_cfg80211_return_bool(ret);
20393	return ret;
20394}
20395EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
20396
20397int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
20398		      struct wireless_dev *wdev, u32 nlportid,
20399		      struct cfg80211_rx_info *info, gfp_t gfp)
20400{
20401	struct net_device *netdev = wdev->netdev;
20402	struct sk_buff *msg;
20403	void *hdr;
20404
20405	msg = nlmsg_new(100 + info->len, gfp);
20406	if (!msg)
20407		return -ENOMEM;
20408
20409	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
20410	if (!hdr) {
20411		nlmsg_free(msg);
20412		return -ENOMEM;
20413	}
20414
20415	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20416	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20417					netdev->ifindex)) ||
20418	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20419			      NL80211_ATTR_PAD) ||
20420	    (info->have_link_id &&
20421	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
20422	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
20423	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
20424	    (info->sig_dbm &&
20425	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
20426	    nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
20427	    (info->flags &&
20428	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
20429	    (info->rx_tstamp && nla_put_u64_64bit(msg,
20430						  NL80211_ATTR_RX_HW_TIMESTAMP,
20431						  info->rx_tstamp,
20432						  NL80211_ATTR_PAD)) ||
20433	    (info->ack_tstamp && nla_put_u64_64bit(msg,
20434						   NL80211_ATTR_TX_HW_TIMESTAMP,
20435						   info->ack_tstamp,
20436						   NL80211_ATTR_PAD)))
20437		goto nla_put_failure;
20438
20439	genlmsg_end(msg, hdr);
20440
20441	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20442
20443 nla_put_failure:
20444	nlmsg_free(msg);
20445	return -ENOBUFS;
20446}
20447
20448static void nl80211_frame_tx_status(struct wireless_dev *wdev,
20449				    struct cfg80211_tx_status *status,
20450				    gfp_t gfp, enum nl80211_commands command)
20451{
20452	struct wiphy *wiphy = wdev->wiphy;
20453	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20454	struct net_device *netdev = wdev->netdev;
20455	struct sk_buff *msg;
20456	void *hdr;
20457
20458	if (command == NL80211_CMD_FRAME_TX_STATUS)
20459		trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
20460					      status->ack);
20461	else
20462		trace_cfg80211_control_port_tx_status(wdev, status->cookie,
20463						      status->ack);
20464
20465	msg = nlmsg_new(100 + status->len, gfp);
20466	if (!msg)
20467		return;
20468
20469	hdr = nl80211hdr_put(msg, 0, 0, 0, command);
20470	if (!hdr) {
20471		nlmsg_free(msg);
20472		return;
20473	}
20474
20475	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20476	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
20477				   netdev->ifindex)) ||
20478	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20479			      NL80211_ATTR_PAD) ||
20480	    nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
20481	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
20482			      NL80211_ATTR_PAD) ||
20483	    (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
20484	    (status->tx_tstamp &&
20485	     nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
20486			       status->tx_tstamp, NL80211_ATTR_PAD)) ||
20487	    (status->ack_tstamp &&
20488	     nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
20489			       status->ack_tstamp, NL80211_ATTR_PAD)))
20490		goto nla_put_failure;
20491
20492	genlmsg_end(msg, hdr);
20493
20494	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20495				NL80211_MCGRP_MLME, gfp);
20496	return;
20497
20498nla_put_failure:
20499	nlmsg_free(msg);
20500}
20501
20502void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
20503				     const u8 *buf, size_t len, bool ack,
20504				     gfp_t gfp)
20505{
20506	struct cfg80211_tx_status status = {
20507		.cookie = cookie,
20508		.buf = buf,
20509		.len = len,
20510		.ack = ack
20511	};
20512
20513	nl80211_frame_tx_status(wdev, &status, gfp,
20514				NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
20515}
20516EXPORT_SYMBOL(cfg80211_control_port_tx_status);
20517
20518void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
20519				 struct cfg80211_tx_status *status, gfp_t gfp)
20520{
20521	nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
20522}
20523EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
20524
20525static int __nl80211_rx_control_port(struct net_device *dev,
20526				     struct sk_buff *skb,
20527				     bool unencrypted,
20528				     int link_id,
20529				     gfp_t gfp)
20530{
20531	struct wireless_dev *wdev = dev->ieee80211_ptr;
20532	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20533	struct ethhdr *ehdr = eth_hdr(skb);
20534	const u8 *addr = ehdr->h_source;
20535	u16 proto = be16_to_cpu(skb->protocol);
20536	struct sk_buff *msg;
20537	void *hdr;
20538	struct nlattr *frame;
20539
20540	u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
20541
20542	if (!nlportid)
20543		return -ENOENT;
20544
20545	msg = nlmsg_new(100 + skb->len, gfp);
20546	if (!msg)
20547		return -ENOMEM;
20548
20549	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
20550	if (!hdr) {
20551		nlmsg_free(msg);
20552		return -ENOBUFS;
20553	}
20554
20555	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20556	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20557	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20558			      NL80211_ATTR_PAD) ||
20559	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
20560	    nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
20561	    (link_id >= 0 &&
20562	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
20563	    (unencrypted && nla_put_flag(msg,
20564					 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
20565		goto nla_put_failure;
20566
20567	frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
20568	if (!frame)
20569		goto nla_put_failure;
20570
20571	skb_copy_bits(skb, 0, nla_data(frame), skb->len);
20572	genlmsg_end(msg, hdr);
20573
20574	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20575
20576 nla_put_failure:
20577	nlmsg_free(msg);
20578	return -ENOBUFS;
20579}
20580
20581bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
20582			      bool unencrypted, int link_id)
20583{
20584	int ret;
20585
20586	trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
20587	ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
20588					GFP_ATOMIC);
20589	trace_cfg80211_return_bool(ret == 0);
20590	return ret == 0;
20591}
20592EXPORT_SYMBOL(cfg80211_rx_control_port);
20593
20594static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
20595					    const char *mac, gfp_t gfp)
20596{
20597	struct wireless_dev *wdev = dev->ieee80211_ptr;
20598	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20599	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20600	void **cb;
20601
20602	if (!msg)
20603		return NULL;
20604
20605	cb = (void **)msg->cb;
20606
20607	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
20608	if (!cb[0]) {
20609		nlmsg_free(msg);
20610		return NULL;
20611	}
20612
20613	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20614	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
20615		goto nla_put_failure;
20616
20617	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
20618		goto nla_put_failure;
20619
20620	cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
20621	if (!cb[1])
20622		goto nla_put_failure;
20623
20624	cb[2] = rdev;
20625
20626	return msg;
20627 nla_put_failure:
20628	nlmsg_free(msg);
20629	return NULL;
20630}
20631
20632static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
20633{
20634	void **cb = (void **)msg->cb;
20635	struct cfg80211_registered_device *rdev = cb[2];
20636
20637	nla_nest_end(msg, cb[1]);
20638	genlmsg_end(msg, cb[0]);
20639
20640	memset(msg->cb, 0, sizeof(msg->cb));
20641
20642	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20643				NL80211_MCGRP_MLME, gfp);
20644}
20645
20646void cfg80211_cqm_rssi_notify(struct net_device *dev,
20647			      enum nl80211_cqm_rssi_threshold_event rssi_event,
20648			      s32 rssi_level, gfp_t gfp)
20649{
20650	struct wireless_dev *wdev = dev->ieee80211_ptr;
20651	struct cfg80211_cqm_config *cqm_config;
20652
20653	trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
20654
20655	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
20656		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
20657		return;
20658
20659	rcu_read_lock();
20660	cqm_config = rcu_dereference(wdev->cqm_config);
20661	if (cqm_config) {
20662		cqm_config->last_rssi_event_value = rssi_level;
20663		cqm_config->last_rssi_event_type = rssi_event;
20664		wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
20665	}
20666	rcu_read_unlock();
20667}
20668EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
20669
20670void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
20671{
20672	struct wireless_dev *wdev = container_of(work, struct wireless_dev,
20673						 cqm_rssi_work);
20674	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20675	enum nl80211_cqm_rssi_threshold_event rssi_event;
20676	struct cfg80211_cqm_config *cqm_config;
20677	struct sk_buff *msg;
20678	s32 rssi_level;
20679
20680	cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
20681	if (!cqm_config)
20682		return;
20683
20684	if (cqm_config->use_range_api)
20685		cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
20686
20687	rssi_level = cqm_config->last_rssi_event_value;
20688	rssi_event = cqm_config->last_rssi_event_type;
20689
20690	msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
20691	if (!msg)
20692		return;
20693
20694	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
20695			rssi_event))
20696		goto nla_put_failure;
20697
20698	if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
20699				      rssi_level))
20700		goto nla_put_failure;
20701
20702	cfg80211_send_cqm(msg, GFP_KERNEL);
20703
20704	return;
20705
20706 nla_put_failure:
20707	nlmsg_free(msg);
20708}
20709
20710void cfg80211_cqm_txe_notify(struct net_device *dev,
20711			     const u8 *peer, u32 num_packets,
20712			     u32 rate, u32 intvl, gfp_t gfp)
20713{
20714	struct sk_buff *msg;
20715
20716	msg = cfg80211_prepare_cqm(dev, peer, gfp);
20717	if (!msg)
20718		return;
20719
20720	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
20721		goto nla_put_failure;
20722
20723	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
20724		goto nla_put_failure;
20725
20726	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
20727		goto nla_put_failure;
20728
20729	cfg80211_send_cqm(msg, gfp);
20730	return;
20731
20732 nla_put_failure:
20733	nlmsg_free(msg);
20734}
20735EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
20736
20737void cfg80211_cqm_pktloss_notify(struct net_device *dev,
20738				 const u8 *peer, u32 num_packets, gfp_t gfp)
20739{
20740	struct sk_buff *msg;
20741
20742	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
20743
20744	msg = cfg80211_prepare_cqm(dev, peer, gfp);
20745	if (!msg)
20746		return;
20747
20748	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
20749		goto nla_put_failure;
20750
20751	cfg80211_send_cqm(msg, gfp);
20752	return;
20753
20754 nla_put_failure:
20755	nlmsg_free(msg);
20756}
20757EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
20758
20759void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
20760{
20761	struct sk_buff *msg;
20762
20763	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
20764	if (!msg)
20765		return;
20766
20767	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
20768		goto nla_put_failure;
20769
20770	cfg80211_send_cqm(msg, gfp);
20771	return;
20772
20773 nla_put_failure:
20774	nlmsg_free(msg);
20775}
20776EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
20777
20778static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
20779				     struct net_device *netdev, const u8 *bssid,
20780				     const u8 *replay_ctr, gfp_t gfp)
20781{
20782	struct sk_buff *msg;
20783	struct nlattr *rekey_attr;
20784	void *hdr;
20785
20786	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20787	if (!msg)
20788		return;
20789
20790	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
20791	if (!hdr) {
20792		nlmsg_free(msg);
20793		return;
20794	}
20795
20796	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20797	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20798	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
20799		goto nla_put_failure;
20800
20801	rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
20802	if (!rekey_attr)
20803		goto nla_put_failure;
20804
20805	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
20806		    NL80211_REPLAY_CTR_LEN, replay_ctr))
20807		goto nla_put_failure;
20808
20809	nla_nest_end(msg, rekey_attr);
20810
20811	genlmsg_end(msg, hdr);
20812
20813	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20814				NL80211_MCGRP_MLME, gfp);
20815	return;
20816
20817 nla_put_failure:
20818	nlmsg_free(msg);
20819}
20820
20821void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
20822			       const u8 *replay_ctr, gfp_t gfp)
20823{
20824	struct wireless_dev *wdev = dev->ieee80211_ptr;
20825	struct wiphy *wiphy = wdev->wiphy;
20826	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20827
20828	trace_cfg80211_gtk_rekey_notify(dev, bssid);
20829	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
20830}
20831EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
20832
20833static void
20834nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
20835			       struct net_device *netdev, int index,
20836			       const u8 *bssid, bool preauth, gfp_t gfp)
20837{
20838	struct sk_buff *msg;
20839	struct nlattr *attr;
20840	void *hdr;
20841
20842	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20843	if (!msg)
20844		return;
20845
20846	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
20847	if (!hdr) {
20848		nlmsg_free(msg);
20849		return;
20850	}
20851
20852	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20853	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20854		goto nla_put_failure;
20855
20856	attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
20857	if (!attr)
20858		goto nla_put_failure;
20859
20860	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
20861	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
20862	    (preauth &&
20863	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
20864		goto nla_put_failure;
20865
20866	nla_nest_end(msg, attr);
20867
20868	genlmsg_end(msg, hdr);
20869
20870	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20871				NL80211_MCGRP_MLME, gfp);
20872	return;
20873
20874 nla_put_failure:
20875	nlmsg_free(msg);
20876}
20877
20878void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
20879				     const u8 *bssid, bool preauth, gfp_t gfp)
20880{
20881	struct wireless_dev *wdev = dev->ieee80211_ptr;
20882	struct wiphy *wiphy = wdev->wiphy;
20883	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20884
20885	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
20886	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
20887}
20888EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
20889
20890static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
20891				     struct net_device *netdev,
20892				     unsigned int link_id,
20893				     struct cfg80211_chan_def *chandef,
20894				     gfp_t gfp,
20895				     enum nl80211_commands notif,
20896				     u8 count, bool quiet)
20897{
20898	struct wireless_dev *wdev = netdev->ieee80211_ptr;
20899	struct sk_buff *msg;
20900	void *hdr;
20901
20902	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20903	if (!msg)
20904		return;
20905
20906	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
20907	if (!hdr) {
20908		nlmsg_free(msg);
20909		return;
20910	}
20911
20912	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
20913		goto nla_put_failure;
20914
20915	if (wdev->valid_links &&
20916	    nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
20917		goto nla_put_failure;
20918
20919	if (nl80211_send_chandef(msg, chandef))
20920		goto nla_put_failure;
20921
20922	if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
20923		if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
20924			goto nla_put_failure;
20925		if (quiet &&
20926		    nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
20927			goto nla_put_failure;
20928	}
20929
20930	genlmsg_end(msg, hdr);
20931
20932	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20933				NL80211_MCGRP_MLME, gfp);
20934	return;
20935
20936 nla_put_failure:
20937	nlmsg_free(msg);
20938}
20939
20940void cfg80211_ch_switch_notify(struct net_device *dev,
20941			       struct cfg80211_chan_def *chandef,
20942			       unsigned int link_id)
20943{
20944	struct wireless_dev *wdev = dev->ieee80211_ptr;
20945	struct wiphy *wiphy = wdev->wiphy;
20946	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20947
20948	lockdep_assert_wiphy(wdev->wiphy);
20949	WARN_INVALID_LINK_ID(wdev, link_id);
20950
20951	trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
20952
20953	switch (wdev->iftype) {
20954	case NL80211_IFTYPE_STATION:
20955	case NL80211_IFTYPE_P2P_CLIENT:
20956		if (!WARN_ON(!wdev->links[link_id].client.current_bss))
20957			cfg80211_update_assoc_bss_entry(wdev, link_id,
20958							chandef->chan);
20959		break;
20960	case NL80211_IFTYPE_MESH_POINT:
20961		wdev->u.mesh.chandef = *chandef;
20962		wdev->u.mesh.preset_chandef = *chandef;
20963		break;
20964	case NL80211_IFTYPE_AP:
20965	case NL80211_IFTYPE_P2P_GO:
20966		wdev->links[link_id].ap.chandef = *chandef;
20967		break;
20968	case NL80211_IFTYPE_ADHOC:
20969		wdev->u.ibss.chandef = *chandef;
20970		break;
20971	default:
20972		WARN_ON(1);
20973		break;
20974	}
20975
20976	cfg80211_schedule_channels_check(wdev);
20977	cfg80211_sched_dfs_chan_update(rdev);
20978
20979	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
20980				 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
20981}
20982EXPORT_SYMBOL(cfg80211_ch_switch_notify);
20983
20984void cfg80211_ch_switch_started_notify(struct net_device *dev,
20985				       struct cfg80211_chan_def *chandef,
20986				       unsigned int link_id, u8 count,
20987				       bool quiet)
20988{
20989	struct wireless_dev *wdev = dev->ieee80211_ptr;
20990	struct wiphy *wiphy = wdev->wiphy;
20991	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20992
20993	lockdep_assert_wiphy(wdev->wiphy);
20994	WARN_INVALID_LINK_ID(wdev, link_id);
20995
20996	trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
20997
20998
20999	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
21000				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
21001				 count, quiet);
21002}
21003EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
21004
21005int cfg80211_bss_color_notify(struct net_device *dev,
21006			      enum nl80211_commands cmd, u8 count,
21007			      u64 color_bitmap, u8 link_id)
21008{
21009	struct wireless_dev *wdev = dev->ieee80211_ptr;
21010	struct wiphy *wiphy = wdev->wiphy;
21011	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21012	struct sk_buff *msg;
21013	void *hdr;
21014
21015	lockdep_assert_wiphy(wdev->wiphy);
21016
21017	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
21018
21019	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21020	if (!msg)
21021		return -ENOMEM;
21022
21023	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
21024	if (!hdr)
21025		goto nla_put_failure;
21026
21027	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21028		goto nla_put_failure;
21029
21030	if (wdev->valid_links &&
21031	    nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
21032		goto nla_put_failure;
21033
21034	if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
21035	    nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
21036		goto nla_put_failure;
21037
21038	if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
21039	    nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
21040			      color_bitmap, NL80211_ATTR_PAD))
21041		goto nla_put_failure;
21042
21043	genlmsg_end(msg, hdr);
21044
21045	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
21046				       msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
21047
21048nla_put_failure:
21049	nlmsg_free(msg);
21050	return -EINVAL;
21051}
21052EXPORT_SYMBOL(cfg80211_bss_color_notify);
21053
21054void
21055nl80211_radar_notify(struct cfg80211_registered_device *rdev,
21056		     const struct cfg80211_chan_def *chandef,
21057		     enum nl80211_radar_event event,
21058		     struct net_device *netdev, gfp_t gfp)
21059{
21060	struct sk_buff *msg;
21061	void *hdr;
21062
21063	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21064	if (!msg)
21065		return;
21066
21067	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
21068	if (!hdr) {
21069		nlmsg_free(msg);
21070		return;
21071	}
21072
21073	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21074		goto nla_put_failure;
21075
21076	/* NOP and radar events don't need a netdev parameter */
21077	if (netdev) {
21078		struct wireless_dev *wdev = netdev->ieee80211_ptr;
21079
21080		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21081		    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21082				      NL80211_ATTR_PAD))
21083			goto nla_put_failure;
21084	}
21085
21086	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
21087		goto nla_put_failure;
21088
21089	if (nl80211_send_chandef(msg, chandef))
21090		goto nla_put_failure;
21091
21092	genlmsg_end(msg, hdr);
21093
21094	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21095				NL80211_MCGRP_MLME, gfp);
21096	return;
21097
21098 nla_put_failure:
21099	nlmsg_free(msg);
21100}
21101
21102void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
21103				       struct sta_opmode_info *sta_opmode,
21104				       gfp_t gfp)
21105{
21106	struct sk_buff *msg;
21107	struct wireless_dev *wdev = dev->ieee80211_ptr;
21108	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21109	void *hdr;
21110
21111	if (WARN_ON(!mac))
21112		return;
21113
21114	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21115	if (!msg)
21116		return;
21117
21118	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
21119	if (!hdr) {
21120		nlmsg_free(msg);
21121		return;
21122	}
21123
21124	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
21125		goto nla_put_failure;
21126
21127	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
21128		goto nla_put_failure;
21129
21130	if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
21131		goto nla_put_failure;
21132
21133	if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
21134	    nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
21135		goto nla_put_failure;
21136
21137	if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
21138	    nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
21139		goto nla_put_failure;
21140
21141	if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
21142	    nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
21143		goto nla_put_failure;
21144
21145	genlmsg_end(msg, hdr);
21146
21147	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21148				NL80211_MCGRP_MLME, gfp);
21149
21150	return;
21151
21152nla_put_failure:
21153	nlmsg_free(msg);
21154}
21155EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
21156
21157void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
21158			   u64 cookie, bool acked, s32 ack_signal,
21159			   bool is_valid_ack_signal, gfp_t gfp)
21160{
21161	struct wireless_dev *wdev = dev->ieee80211_ptr;
21162	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21163	struct sk_buff *msg;
21164	void *hdr;
21165
21166	trace_cfg80211_probe_status(dev, addr, cookie, acked);
21167
21168	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21169
21170	if (!msg)
21171		return;
21172
21173	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
21174	if (!hdr) {
21175		nlmsg_free(msg);
21176		return;
21177	}
21178
21179	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21180	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21181	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
21182	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
21183			      NL80211_ATTR_PAD) ||
21184	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
21185	    (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
21186						ack_signal)))
21187		goto nla_put_failure;
21188
21189	genlmsg_end(msg, hdr);
21190
21191	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21192				NL80211_MCGRP_MLME, gfp);
21193	return;
21194
21195 nla_put_failure:
21196	nlmsg_free(msg);
21197}
21198EXPORT_SYMBOL(cfg80211_probe_status);
21199
21200void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
21201				     size_t len, int freq, int sig_dbm)
21202{
21203	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21204	struct sk_buff *msg;
21205	void *hdr;
21206	struct cfg80211_beacon_registration *reg;
21207
21208	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
21209
21210	spin_lock_bh(&rdev->beacon_registrations_lock);
21211	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
21212		msg = nlmsg_new(len + 100, GFP_ATOMIC);
21213		if (!msg) {
21214			spin_unlock_bh(&rdev->beacon_registrations_lock);
21215			return;
21216		}
21217
21218		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
21219		if (!hdr)
21220			goto nla_put_failure;
21221
21222		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21223		    (freq &&
21224		     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
21225				  KHZ_TO_MHZ(freq)) ||
21226		      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
21227				  freq % 1000))) ||
21228		    (sig_dbm &&
21229		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
21230		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
21231			goto nla_put_failure;
21232
21233		genlmsg_end(msg, hdr);
21234
21235		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
21236	}
21237	spin_unlock_bh(&rdev->beacon_registrations_lock);
21238	return;
21239
21240 nla_put_failure:
21241	spin_unlock_bh(&rdev->beacon_registrations_lock);
21242	nlmsg_free(msg);
21243}
21244EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
21245
21246#ifdef CONFIG_PM
21247static int cfg80211_net_detect_results(struct sk_buff *msg,
21248				       struct cfg80211_wowlan_wakeup *wakeup)
21249{
21250	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
21251	struct nlattr *nl_results, *nl_match, *nl_freqs;
21252	int i, j;
21253
21254	nl_results = nla_nest_start_noflag(msg,
21255					   NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
21256	if (!nl_results)
21257		return -EMSGSIZE;
21258
21259	for (i = 0; i < nd->n_matches; i++) {
21260		struct cfg80211_wowlan_nd_match *match = nd->matches[i];
21261
21262		nl_match = nla_nest_start_noflag(msg, i);
21263		if (!nl_match)
21264			break;
21265
21266		/* The SSID attribute is optional in nl80211, but for
21267		 * simplicity reasons it's always present in the
21268		 * cfg80211 structure.  If a driver can't pass the
21269		 * SSID, that needs to be changed.  A zero length SSID
21270		 * is still a valid SSID (wildcard), so it cannot be
21271		 * used for this purpose.
21272		 */
21273		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
21274			    match->ssid.ssid)) {
21275			nla_nest_cancel(msg, nl_match);
21276			goto out;
21277		}
21278
21279		if (match->n_channels) {
21280			nl_freqs = nla_nest_start_noflag(msg,
21281							 NL80211_ATTR_SCAN_FREQUENCIES);
21282			if (!nl_freqs) {
21283				nla_nest_cancel(msg, nl_match);
21284				goto out;
21285			}
21286
21287			for (j = 0; j < match->n_channels; j++) {
21288				if (nla_put_u32(msg, j, match->channels[j])) {
21289					nla_nest_cancel(msg, nl_freqs);
21290					nla_nest_cancel(msg, nl_match);
21291					goto out;
21292				}
21293			}
21294
21295			nla_nest_end(msg, nl_freqs);
21296		}
21297
21298		nla_nest_end(msg, nl_match);
21299	}
21300
21301out:
21302	nla_nest_end(msg, nl_results);
21303	return 0;
21304}
21305
21306void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
21307				   struct cfg80211_wowlan_wakeup *wakeup,
21308				   gfp_t gfp)
21309{
21310	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21311	struct sk_buff *msg;
21312	void *hdr;
21313	int size = 200;
21314
21315	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
21316
21317	if (wakeup)
21318		size += wakeup->packet_present_len;
21319
21320	msg = nlmsg_new(size, gfp);
21321	if (!msg)
21322		return;
21323
21324	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
21325	if (!hdr)
21326		goto free_msg;
21327
21328	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21329	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21330			      NL80211_ATTR_PAD))
21331		goto free_msg;
21332
21333	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
21334					wdev->netdev->ifindex))
21335		goto free_msg;
21336
21337	if (wakeup) {
21338		struct nlattr *reasons;
21339
21340		reasons = nla_nest_start_noflag(msg,
21341						NL80211_ATTR_WOWLAN_TRIGGERS);
21342		if (!reasons)
21343			goto free_msg;
21344
21345		if (wakeup->disconnect &&
21346		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
21347			goto free_msg;
21348		if (wakeup->magic_pkt &&
21349		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
21350			goto free_msg;
21351		if (wakeup->gtk_rekey_failure &&
21352		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
21353			goto free_msg;
21354		if (wakeup->eap_identity_req &&
21355		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
21356			goto free_msg;
21357		if (wakeup->four_way_handshake &&
21358		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
21359			goto free_msg;
21360		if (wakeup->rfkill_release &&
21361		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
21362			goto free_msg;
21363
21364		if (wakeup->pattern_idx >= 0 &&
21365		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
21366				wakeup->pattern_idx))
21367			goto free_msg;
21368
21369		if (wakeup->tcp_match &&
21370		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
21371			goto free_msg;
21372
21373		if (wakeup->tcp_connlost &&
21374		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
21375			goto free_msg;
21376
21377		if (wakeup->tcp_nomoretokens &&
21378		    nla_put_flag(msg,
21379				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
21380			goto free_msg;
21381
21382		if (wakeup->unprot_deauth_disassoc &&
21383		    nla_put_flag(msg,
21384				 NL80211_WOWLAN_TRIG_UNPROTECTED_DEAUTH_DISASSOC))
21385			goto free_msg;
21386
21387		if (wakeup->packet) {
21388			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
21389			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
21390
21391			if (!wakeup->packet_80211) {
21392				pkt_attr =
21393					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
21394				len_attr =
21395					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
21396			}
21397
21398			if (wakeup->packet_len &&
21399			    nla_put_u32(msg, len_attr, wakeup->packet_len))
21400				goto free_msg;
21401
21402			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
21403				    wakeup->packet))
21404				goto free_msg;
21405		}
21406
21407		if (wakeup->net_detect &&
21408		    cfg80211_net_detect_results(msg, wakeup))
21409				goto free_msg;
21410
21411		nla_nest_end(msg, reasons);
21412	}
21413
21414	genlmsg_end(msg, hdr);
21415
21416	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21417				NL80211_MCGRP_MLME, gfp);
21418	return;
21419
21420 free_msg:
21421	nlmsg_free(msg);
21422}
21423EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
21424#endif
21425
21426void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
21427				enum nl80211_tdls_operation oper,
21428				u16 reason_code, gfp_t gfp)
21429{
21430	struct wireless_dev *wdev = dev->ieee80211_ptr;
21431	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21432	struct sk_buff *msg;
21433	void *hdr;
21434
21435	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
21436					 reason_code);
21437
21438	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21439	if (!msg)
21440		return;
21441
21442	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
21443	if (!hdr) {
21444		nlmsg_free(msg);
21445		return;
21446	}
21447
21448	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21449	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21450	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
21451	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
21452	    (reason_code > 0 &&
21453	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
21454		goto nla_put_failure;
21455
21456	genlmsg_end(msg, hdr);
21457
21458	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21459				NL80211_MCGRP_MLME, gfp);
21460	return;
21461
21462 nla_put_failure:
21463	nlmsg_free(msg);
21464}
21465EXPORT_SYMBOL(cfg80211_tdls_oper_request);
21466
21467static int nl80211_netlink_notify(struct notifier_block * nb,
21468				  unsigned long state,
21469				  void *_notify)
21470{
21471	struct netlink_notify *notify = _notify;
21472	struct cfg80211_registered_device *rdev;
21473	struct wireless_dev *wdev;
21474	struct cfg80211_beacon_registration *reg, *tmp;
21475
21476	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
21477		return NOTIFY_DONE;
21478
21479	rcu_read_lock();
21480
21481	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
21482		struct cfg80211_sched_scan_request *sched_scan_req;
21483
21484		list_for_each_entry_rcu(sched_scan_req,
21485					&rdev->sched_scan_req_list,
21486					list) {
21487			if (sched_scan_req->owner_nlportid == notify->portid) {
21488				sched_scan_req->nl_owner_dead = true;
21489				wiphy_work_queue(&rdev->wiphy,
21490						 &rdev->sched_scan_stop_wk);
21491			}
21492		}
21493
21494		list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
21495			cfg80211_mlme_unregister_socket(wdev, notify->portid);
21496
21497			if (wdev->owner_nlportid == notify->portid) {
21498				wdev->nl_owner_dead = true;
21499				schedule_work(&rdev->destroy_work);
21500			} else if (wdev->conn_owner_nlportid == notify->portid) {
21501				schedule_work(&wdev->disconnect_wk);
21502			}
21503
21504			cfg80211_release_pmsr(wdev, notify->portid);
21505		}
21506
21507		spin_lock_bh(&rdev->beacon_registrations_lock);
21508		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
21509					 list) {
21510			if (reg->nlportid == notify->portid) {
21511				list_del(&reg->list);
21512				kfree(reg);
21513				break;
21514			}
21515		}
21516		spin_unlock_bh(&rdev->beacon_registrations_lock);
21517	}
21518
21519	rcu_read_unlock();
21520
21521	/*
21522	 * It is possible that the user space process that is controlling the
21523	 * indoor setting disappeared, so notify the regulatory core.
21524	 */
21525	regulatory_netlink_notify(notify->portid);
21526	return NOTIFY_OK;
21527}
21528
21529static struct notifier_block nl80211_netlink_notifier = {
21530	.notifier_call = nl80211_netlink_notify,
21531};
21532
21533void cfg80211_ft_event(struct net_device *netdev,
21534		       struct cfg80211_ft_event_params *ft_event)
21535{
21536	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21537	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21538	struct sk_buff *msg;
21539	void *hdr;
21540
21541	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
21542
21543	if (!ft_event->target_ap)
21544		return;
21545
21546	msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
21547			GFP_KERNEL);
21548	if (!msg)
21549		return;
21550
21551	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
21552	if (!hdr)
21553		goto out;
21554
21555	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21556	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21557	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
21558		goto out;
21559
21560	if (ft_event->ies &&
21561	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
21562		goto out;
21563	if (ft_event->ric_ies &&
21564	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
21565		    ft_event->ric_ies))
21566		goto out;
21567
21568	genlmsg_end(msg, hdr);
21569
21570	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21571				NL80211_MCGRP_MLME, GFP_KERNEL);
21572	return;
21573 out:
21574	nlmsg_free(msg);
21575}
21576EXPORT_SYMBOL(cfg80211_ft_event);
21577
21578void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
21579{
21580	struct cfg80211_registered_device *rdev;
21581	struct sk_buff *msg;
21582	void *hdr;
21583	u32 nlportid;
21584
21585	rdev = wiphy_to_rdev(wdev->wiphy);
21586	if (!rdev->crit_proto_nlportid)
21587		return;
21588
21589	nlportid = rdev->crit_proto_nlportid;
21590	rdev->crit_proto_nlportid = 0;
21591
21592	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21593	if (!msg)
21594		return;
21595
21596	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
21597	if (!hdr)
21598		goto nla_put_failure;
21599
21600	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21601	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21602			      NL80211_ATTR_PAD))
21603		goto nla_put_failure;
21604
21605	genlmsg_end(msg, hdr);
21606
21607	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
21608	return;
21609
21610 nla_put_failure:
21611	nlmsg_free(msg);
21612}
21613EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
21614
21615void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
21616{
21617	struct wiphy *wiphy = wdev->wiphy;
21618	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21619	struct sk_buff *msg;
21620	void *hdr;
21621
21622	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21623	if (!msg)
21624		return;
21625
21626	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
21627	if (!hdr)
21628		goto out;
21629
21630	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21631	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
21632	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21633			      NL80211_ATTR_PAD) ||
21634	    (wdev->valid_links &&
21635	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
21636		goto out;
21637
21638	genlmsg_end(msg, hdr);
21639
21640	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
21641				NL80211_MCGRP_MLME, GFP_KERNEL);
21642	return;
21643 out:
21644	nlmsg_free(msg);
21645}
21646
21647int cfg80211_external_auth_request(struct net_device *dev,
21648				   struct cfg80211_external_auth_params *params,
21649				   gfp_t gfp)
21650{
21651	struct wireless_dev *wdev = dev->ieee80211_ptr;
21652	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
21653	struct sk_buff *msg;
21654	void *hdr;
21655
21656	if (!wdev->conn_owner_nlportid)
21657		return -EINVAL;
21658
21659	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21660	if (!msg)
21661		return -ENOMEM;
21662
21663	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
21664	if (!hdr)
21665		goto nla_put_failure;
21666
21667	/* Some historical mistakes in drivers <-> userspace interface (notably
21668	 * between drivers and wpa_supplicant) led to a big-endian conversion
21669	 * being needed on NL80211_ATTR_AKM_SUITES _only_ when its value is
21670	 * WLAN_AKM_SUITE_SAE. This is now fixed on userspace side, but for the
21671	 * benefit of older wpa_supplicant versions, send this particular value
21672	 * in big-endian. Note that newer wpa_supplicant will also detect this
21673	 * particular value in big endian still, so it all continues to work.
21674	 */
21675	if (params->key_mgmt_suite == WLAN_AKM_SUITE_SAE) {
21676		if (nla_put_be32(msg, NL80211_ATTR_AKM_SUITES,
21677				 cpu_to_be32(WLAN_AKM_SUITE_SAE)))
21678			goto nla_put_failure;
21679	} else {
21680		if (nla_put_u32(msg, NL80211_ATTR_AKM_SUITES,
21681				params->key_mgmt_suite))
21682			goto nla_put_failure;
21683	}
21684
21685	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21686	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
21687	    nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
21688			params->action) ||
21689	    nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
21690	    nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
21691		    params->ssid.ssid) ||
21692	    (!is_zero_ether_addr(params->mld_addr) &&
21693	     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
21694		goto nla_put_failure;
21695
21696	genlmsg_end(msg, hdr);
21697	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
21698			wdev->conn_owner_nlportid);
21699	return 0;
21700
21701 nla_put_failure:
21702	nlmsg_free(msg);
21703	return -ENOBUFS;
21704}
21705EXPORT_SYMBOL(cfg80211_external_auth_request);
21706
21707void cfg80211_update_owe_info_event(struct net_device *netdev,
21708				    struct cfg80211_update_owe_info *owe_info,
21709				    gfp_t gfp)
21710{
21711	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
21712	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21713	struct sk_buff *msg;
21714	void *hdr;
21715
21716	trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
21717
21718	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21719	if (!msg)
21720		return;
21721
21722	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
21723	if (!hdr)
21724		goto nla_put_failure;
21725
21726	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21727	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
21728	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
21729		goto nla_put_failure;
21730
21731	if (!owe_info->ie_len ||
21732	    nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
21733		goto nla_put_failure;
21734
21735	if (owe_info->assoc_link_id != -1) {
21736		if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
21737			       owe_info->assoc_link_id))
21738			goto nla_put_failure;
21739
21740		if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
21741		    nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
21742			    owe_info->peer_mld_addr))
21743			goto nla_put_failure;
21744	}
21745
21746	genlmsg_end(msg, hdr);
21747
21748	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21749				NL80211_MCGRP_MLME, gfp);
21750	return;
21751
21752nla_put_failure:
21753	genlmsg_cancel(msg, hdr);
21754	nlmsg_free(msg);
21755}
21756EXPORT_SYMBOL(cfg80211_update_owe_info_event);
21757
21758void cfg80211_schedule_channels_check(struct wireless_dev *wdev)
21759{
21760	struct wiphy *wiphy = wdev->wiphy;
21761
21762	/* Schedule channels check if NO_IR or DFS relaxations are supported */
21763	if (wdev->iftype == NL80211_IFTYPE_STATION &&
21764	    (wiphy_ext_feature_isset(wiphy,
21765				     NL80211_EXT_FEATURE_DFS_CONCURRENT) ||
21766	    (IS_ENABLED(CONFIG_CFG80211_REG_RELAX_NO_IR) &&
21767	     wiphy->regulatory_flags & REGULATORY_ENABLE_RELAX_NO_IR)))
21768		reg_check_channels();
21769}
21770EXPORT_SYMBOL(cfg80211_schedule_channels_check);
21771
21772void cfg80211_epcs_changed(struct net_device *netdev, bool enabled)
21773{
21774	struct wireless_dev *wdev = netdev->ieee80211_ptr;
21775	struct wiphy *wiphy = wdev->wiphy;
21776	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21777	struct sk_buff *msg;
21778	void *hdr;
21779
21780	trace_cfg80211_epcs_changed(wdev, enabled);
21781
21782	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
21783	if (!msg)
21784		return;
21785
21786	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EPCS_CFG);
21787	if (!hdr) {
21788		nlmsg_free(msg);
21789		return;
21790	}
21791
21792	if (enabled && nla_put_flag(msg, NL80211_ATTR_EPCS))
21793		goto nla_put_failure;
21794
21795	genlmsg_end(msg, hdr);
21796	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
21797				NL80211_MCGRP_MLME, GFP_KERNEL);
21798	return;
21799
21800 nla_put_failure:
21801	nlmsg_free(msg);
21802}
21803EXPORT_SYMBOL(cfg80211_epcs_changed);
21804
21805void cfg80211_next_nan_dw_notif(struct wireless_dev *wdev,
21806				struct ieee80211_channel *chan, gfp_t gfp)
21807{
21808	struct wiphy *wiphy = wdev->wiphy;
21809	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21810	struct sk_buff *msg;
21811	void *hdr;
21812
21813	trace_cfg80211_next_nan_dw_notif(wdev, chan);
21814
21815	if (!wdev->owner_nlportid)
21816		return;
21817
21818	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21819	if (!msg)
21820		return;
21821
21822	hdr = nl80211hdr_put(msg, 0, 0, 0,
21823			     NL80211_CMD_NAN_NEXT_DW_NOTIFICATION);
21824	if (!hdr)
21825		goto nla_put_failure;
21826
21827	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21828	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21829			      NL80211_ATTR_PAD) ||
21830	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq))
21831		goto nla_put_failure;
21832
21833	genlmsg_end(msg, hdr);
21834
21835	genlmsg_unicast(wiphy_net(wiphy), msg, wdev->owner_nlportid);
21836
21837	return;
21838
21839 nla_put_failure:
21840	nlmsg_free(msg);
21841}
21842EXPORT_SYMBOL(cfg80211_next_nan_dw_notif);
21843
21844void cfg80211_nan_cluster_joined(struct wireless_dev *wdev,
21845				 const u8 *cluster_id, bool new_cluster,
21846				 gfp_t gfp)
21847{
21848	struct wiphy *wiphy = wdev->wiphy;
21849	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
21850	struct sk_buff *msg;
21851	void *hdr;
21852
21853	trace_cfg80211_nan_cluster_joined(wdev, cluster_id, new_cluster);
21854
21855	memcpy(wdev->u.nan.cluster_id, cluster_id, ETH_ALEN);
21856
21857	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
21858	if (!msg)
21859		return;
21860
21861	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_CLUSTER_JOINED);
21862	if (!hdr)
21863		goto nla_put_failure;
21864
21865	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
21866	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
21867			      NL80211_ATTR_PAD) ||
21868	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cluster_id) ||
21869	    (new_cluster && nla_put_flag(msg, NL80211_ATTR_NAN_NEW_CLUSTER)))
21870		goto nla_put_failure;
21871
21872	genlmsg_end(msg, hdr);
21873
21874	if (!wdev->owner_nlportid)
21875		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy),
21876					msg, 0, NL80211_MCGRP_NAN, gfp);
21877	else
21878		genlmsg_unicast(wiphy_net(wiphy), msg,
21879				wdev->owner_nlportid);
21880	return;
21881
21882 nla_put_failure:
21883	nlmsg_free(msg);
21884}
21885EXPORT_SYMBOL(cfg80211_nan_cluster_joined);
21886
21887/* initialisation/exit functions */
21888
21889int __init nl80211_init(void)
21890{
21891	int err;
21892
21893	err = genl_register_family(&nl80211_fam);
21894	if (err)
21895		return err;
21896
21897	err = netlink_register_notifier(&nl80211_netlink_notifier);
21898	if (err)
21899		goto err_out;
21900
21901	return 0;
21902 err_out:
21903	genl_unregister_family(&nl80211_fam);
21904	return err;
21905}
21906
21907void nl80211_exit(void)
21908{
21909	netlink_unregister_notifier(&nl80211_netlink_notifier);
21910	genl_unregister_family(&nl80211_fam);
21911}