xref: /linux/net/wireless/nl80211.c (revision 397692eab35cbbd83681880c6a2dbcdb9fd84386) 
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * This is the new netlink-based wireless configuration interface.
4  *
5  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
6  * Copyright 2013-2014  Intel Mobile Communications GmbH
7  * Copyright 2015-2017	Intel Deutschland GmbH
8  * Copyright (C) 2018-2019 Intel Corporation
9  */
10 
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33 
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 				   struct genl_info *info,
36 				   struct cfg80211_crypto_settings *settings,
37 				   int cipher_limit);
38 
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41 
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 	NL80211_MCGRP_CONFIG,
45 	NL80211_MCGRP_SCAN,
46 	NL80211_MCGRP_REGULATORY,
47 	NL80211_MCGRP_MLME,
48 	NL80211_MCGRP_VENDOR,
49 	NL80211_MCGRP_NAN,
50 	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52 
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 	[NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 	[NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 	[NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 	[NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 	[NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 	[NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 	[NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64 
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
67 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
68 {
69 	struct cfg80211_registered_device *rdev;
70 	struct wireless_dev *result = NULL;
71 	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 	u64 wdev_id;
74 	int wiphy_idx = -1;
75 	int ifidx = -1;
76 
77 	ASSERT_RTNL();
78 
79 	if (!have_ifidx && !have_wdev_id)
80 		return ERR_PTR(-EINVAL);
81 
82 	if (have_ifidx)
83 		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
84 	if (have_wdev_id) {
85 		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
86 		wiphy_idx = wdev_id >> 32;
87 	}
88 
89 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
90 		struct wireless_dev *wdev;
91 
92 		if (wiphy_net(&rdev->wiphy) != netns)
93 			continue;
94 
95 		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
96 			continue;
97 
98 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
99 			if (have_ifidx && wdev->netdev &&
100 			    wdev->netdev->ifindex == ifidx) {
101 				result = wdev;
102 				break;
103 			}
104 			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
105 				result = wdev;
106 				break;
107 			}
108 		}
109 
110 		if (result)
111 			break;
112 	}
113 
114 	if (result)
115 		return result;
116 	return ERR_PTR(-ENODEV);
117 }
118 
119 static struct cfg80211_registered_device *
120 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
121 {
122 	struct cfg80211_registered_device *rdev = NULL, *tmp;
123 	struct net_device *netdev;
124 
125 	ASSERT_RTNL();
126 
127 	if (!attrs[NL80211_ATTR_WIPHY] &&
128 	    !attrs[NL80211_ATTR_IFINDEX] &&
129 	    !attrs[NL80211_ATTR_WDEV])
130 		return ERR_PTR(-EINVAL);
131 
132 	if (attrs[NL80211_ATTR_WIPHY])
133 		rdev = cfg80211_rdev_by_wiphy_idx(
134 				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
135 
136 	if (attrs[NL80211_ATTR_WDEV]) {
137 		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
138 		struct wireless_dev *wdev;
139 		bool found = false;
140 
141 		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
142 		if (tmp) {
143 			/* make sure wdev exists */
144 			list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
145 				if (wdev->identifier != (u32)wdev_id)
146 					continue;
147 				found = true;
148 				break;
149 			}
150 
151 			if (!found)
152 				tmp = NULL;
153 
154 			if (rdev && tmp != rdev)
155 				return ERR_PTR(-EINVAL);
156 			rdev = tmp;
157 		}
158 	}
159 
160 	if (attrs[NL80211_ATTR_IFINDEX]) {
161 		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
162 
163 		netdev = __dev_get_by_index(netns, ifindex);
164 		if (netdev) {
165 			if (netdev->ieee80211_ptr)
166 				tmp = wiphy_to_rdev(
167 					netdev->ieee80211_ptr->wiphy);
168 			else
169 				tmp = NULL;
170 
171 			/* not wireless device -- return error */
172 			if (!tmp)
173 				return ERR_PTR(-EINVAL);
174 
175 			/* mismatch -- return error */
176 			if (rdev && tmp != rdev)
177 				return ERR_PTR(-EINVAL);
178 
179 			rdev = tmp;
180 		}
181 	}
182 
183 	if (!rdev)
184 		return ERR_PTR(-ENODEV);
185 
186 	if (netns != wiphy_net(&rdev->wiphy))
187 		return ERR_PTR(-ENODEV);
188 
189 	return rdev;
190 }
191 
192 /*
193  * This function returns a pointer to the driver
194  * that the genl_info item that is passed refers to.
195  *
196  * The result of this can be a PTR_ERR and hence must
197  * be checked with IS_ERR() for errors.
198  */
199 static struct cfg80211_registered_device *
200 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
201 {
202 	return __cfg80211_rdev_from_attrs(netns, info->attrs);
203 }
204 
205 static int validate_beacon_head(const struct nlattr *attr,
206 				struct netlink_ext_ack *extack)
207 {
208 	const u8 *data = nla_data(attr);
209 	unsigned int len = nla_len(attr);
210 	const struct element *elem;
211 	const struct ieee80211_mgmt *mgmt = (void *)data;
212 	unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
213 					 u.beacon.variable);
214 
215 	if (len < fixedlen)
216 		goto err;
217 
218 	if (ieee80211_hdrlen(mgmt->frame_control) !=
219 	    offsetof(struct ieee80211_mgmt, u.beacon))
220 		goto err;
221 
222 	data += fixedlen;
223 	len -= fixedlen;
224 
225 	for_each_element(elem, data, len) {
226 		/* nothing */
227 	}
228 
229 	if (for_each_element_completed(elem, data, len))
230 		return 0;
231 
232 err:
233 	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
234 	return -EINVAL;
235 }
236 
237 static int validate_ie_attr(const struct nlattr *attr,
238 			    struct netlink_ext_ack *extack)
239 {
240 	const u8 *data = nla_data(attr);
241 	unsigned int len = nla_len(attr);
242 	const struct element *elem;
243 
244 	for_each_element(elem, data, len) {
245 		/* nothing */
246 	}
247 
248 	if (for_each_element_completed(elem, data, len))
249 		return 0;
250 
251 	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
252 	return -EINVAL;
253 }
254 
255 /* policy for the attributes */
256 static const struct nla_policy
257 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
258 	[NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
259 	[NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
260 					.len = U8_MAX },
261 	[NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
262 					     .len = U8_MAX },
263 };
264 
265 static const struct nla_policy
266 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
267 	[NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
268 	[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
269 	[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
270 		NLA_POLICY_MAX(NLA_U8, 15),
271 	[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
272 	[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
273 		NLA_POLICY_MAX(NLA_U8, 15),
274 	[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
275 		NLA_POLICY_MAX(NLA_U8, 31),
276 	[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
277 	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
278 	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
279 };
280 
281 static const struct nla_policy
282 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
283 	[NL80211_PMSR_TYPE_FTM] =
284 		NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
285 };
286 
287 static const struct nla_policy
288 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
289 	[NL80211_PMSR_REQ_ATTR_DATA] =
290 		NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
291 	[NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
292 };
293 
294 static const struct nla_policy
295 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
296 	[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
297 	/*
298 	 * we could specify this again to be the top-level policy,
299 	 * but that would open us up to recursion problems ...
300 	 */
301 	[NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
302 	[NL80211_PMSR_PEER_ATTR_REQ] =
303 		NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
304 	[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
305 };
306 
307 static const struct nla_policy
308 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
309 	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
310 	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
311 	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
312 	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
313 	[NL80211_PMSR_ATTR_PEERS] =
314 		NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
315 };
316 
317 static const struct nla_policy
318 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
319 	[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
320 		NLA_POLICY_RANGE(NLA_U8, 1, 20),
321 	[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
322 		NLA_POLICY_RANGE(NLA_U8, 1, 20),
323 };
324 
325 static const struct nla_policy
326 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
327 	[NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
328 	[NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
329 	[NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
330 };
331 
332 static const struct nla_policy
333 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
334 	[NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
335 	[NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
336 	[NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
337 	[NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
338 	[NL80211_TID_CONFIG_ATTR_NOACK] =
339 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
340 	[NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
341 	[NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
342 	[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
343 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
344 	[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
345 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
346 };
347 
348 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
349 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
350 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
351 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
352 				      .len = 20-1 },
353 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
354 
355 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
356 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
357 	[NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
358 						NL80211_EDMG_CHANNELS_MIN,
359 						NL80211_EDMG_CHANNELS_MAX),
360 	[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
361 						NL80211_EDMG_BW_CONFIG_MIN,
362 						NL80211_EDMG_BW_CONFIG_MAX),
363 
364 	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
365 	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
366 	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
367 
368 	[NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
369 	[NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
370 	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
371 	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
372 	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
373 	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
374 
375 	[NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
376 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
377 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
378 
379 	[NL80211_ATTR_MAC] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
380 	[NL80211_ATTR_PREV_BSSID] = {
381 		.type = NLA_EXACT_LEN_WARN,
382 		.len = ETH_ALEN
383 	},
384 
385 	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
386 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
387 				    .len = WLAN_MAX_KEY_LEN },
388 	[NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
389 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
390 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
391 	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
392 	[NL80211_ATTR_KEY_TYPE] =
393 		NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
394 
395 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
396 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
397 	[NL80211_ATTR_BEACON_HEAD] =
398 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
399 				       IEEE80211_MAX_DATA_LEN),
400 	[NL80211_ATTR_BEACON_TAIL] =
401 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
402 				       IEEE80211_MAX_DATA_LEN),
403 	[NL80211_ATTR_STA_AID] =
404 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
405 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
406 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
407 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
408 					       .len = NL80211_MAX_SUPP_RATES },
409 	[NL80211_ATTR_STA_PLINK_ACTION] =
410 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
411 	[NL80211_ATTR_STA_TX_POWER_SETTING] =
412 		NLA_POLICY_RANGE(NLA_U8,
413 				 NL80211_TX_POWER_AUTOMATIC,
414 				 NL80211_TX_POWER_FIXED),
415 	[NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
416 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
417 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
418 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
419 				   .len = IEEE80211_MAX_MESH_ID_LEN },
420 	[NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
421 
422 	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
423 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
424 
425 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
426 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
427 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
428 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
429 					   .len = NL80211_MAX_SUPP_RATES },
430 	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
431 
432 	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
433 	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
434 
435 	[NL80211_ATTR_HT_CAPABILITY] = {
436 		.type = NLA_EXACT_LEN_WARN,
437 		.len = NL80211_HT_CAPABILITY_LEN
438 	},
439 
440 	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
441 	[NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
442 						   validate_ie_attr,
443 						   IEEE80211_MAX_DATA_LEN),
444 	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
445 	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
446 
447 	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
448 				.len = IEEE80211_MAX_SSID_LEN },
449 	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
450 	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
451 	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
452 	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
453 	[NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
454 						  NL80211_MFP_NO,
455 						  NL80211_MFP_OPTIONAL),
456 	[NL80211_ATTR_STA_FLAGS2] = {
457 		.len = sizeof(struct nl80211_sta_flag_update),
458 	},
459 	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
460 	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
461 	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
462 	[NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
463 	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
464 	[NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
465 	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
466 	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
467 	[NL80211_ATTR_PID] = { .type = NLA_U32 },
468 	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
469 	[NL80211_ATTR_PMKID] = {
470 		.type = NLA_EXACT_LEN_WARN,
471 		.len = WLAN_PMKID_LEN
472 	},
473 	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
474 	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
475 	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
476 	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
477 				 .len = IEEE80211_MAX_DATA_LEN },
478 	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
479 	[NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
480 						   NL80211_PS_DISABLED,
481 						   NL80211_PS_ENABLED),
482 	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
483 	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
484 	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
485 	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
486 	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
487 	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
488 	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
489 	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
490 	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
491 	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
492 	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
493 	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
494 	[NL80211_ATTR_STA_PLINK_STATE] =
495 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
496 	[NL80211_ATTR_MESH_PEER_AID] =
497 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
498 	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
499 	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
500 	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
501 	[NL80211_ATTR_HIDDEN_SSID] =
502 		NLA_POLICY_RANGE(NLA_U32,
503 				 NL80211_HIDDEN_SSID_NOT_IN_USE,
504 				 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
505 	[NL80211_ATTR_IE_PROBE_RESP] =
506 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
507 				       IEEE80211_MAX_DATA_LEN),
508 	[NL80211_ATTR_IE_ASSOC_RESP] =
509 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
510 				       IEEE80211_MAX_DATA_LEN),
511 	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
512 	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
513 	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
514 	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
515 	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
516 	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
517 	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
518 	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
519 	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
520 	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
521 	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
522 				      .len = IEEE80211_MAX_DATA_LEN },
523 	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
524 	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
525 	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
526 		.len = NL80211_HT_CAPABILITY_LEN
527 	},
528 	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
529 	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
530 	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
531 	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
532 	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
533 	[NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
534 	[NL80211_ATTR_VHT_CAPABILITY] = {
535 		.type = NLA_EXACT_LEN_WARN,
536 		.len = NL80211_VHT_CAPABILITY_LEN
537 	},
538 	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
539 	[NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
540 	[NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
541 	[NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
542 		NLA_POLICY_RANGE(NLA_U32,
543 				 NL80211_MESH_POWER_UNKNOWN + 1,
544 				 NL80211_MESH_POWER_MAX),
545 	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
546 	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
547 	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
548 	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
549 	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
550 	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
551 	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
552 		.len = NL80211_VHT_CAPABILITY_LEN,
553 	},
554 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
555 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
556 				  .len = IEEE80211_MAX_DATA_LEN },
557 	[NL80211_ATTR_PEER_AID] =
558 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
559 	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
560 	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
561 	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
562 	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
563 	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
564 	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
565 	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
566 	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
567 	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
568 	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
569 	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
570 	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
571 	[NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
572 				   .len = IEEE80211_QOS_MAP_LEN_MAX },
573 	[NL80211_ATTR_MAC_HINT] = {
574 		.type = NLA_EXACT_LEN_WARN,
575 		.len = ETH_ALEN
576 	},
577 	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
578 	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
579 	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
580 	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
581 	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
582 	[NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
583 	[NL80211_ATTR_USER_PRIO] =
584 		NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
585 	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
586 	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
587 	[NL80211_ATTR_MAC_MASK] = {
588 		.type = NLA_EXACT_LEN_WARN,
589 		.len = ETH_ALEN
590 	},
591 	[NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
592 	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
593 	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
594 	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
595 	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
596 	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
597 	[NL80211_ATTR_STA_SUPPORT_P2P_PS] =
598 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
599 	[NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
600 		.len = VHT_MUMIMO_GROUPS_DATA_LEN
601 	},
602 	[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = {
603 		.type = NLA_EXACT_LEN_WARN,
604 		.len = ETH_ALEN
605 	},
606 	[NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
607 	[NL80211_ATTR_BANDS] = { .type = NLA_U32 },
608 	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
609 	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
610 				    .len = FILS_MAX_KEK_LEN },
611 	[NL80211_ATTR_FILS_NONCES] = {
612 		.type = NLA_EXACT_LEN_WARN,
613 		.len = 2 * FILS_NONCE_LEN
614 	},
615 	[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
616 	[NL80211_ATTR_BSSID] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
617 	[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
618 	[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
619 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
620 	},
621 	[NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
622 	[NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
623 					     .len = FILS_ERP_MAX_USERNAME_LEN },
624 	[NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
625 					  .len = FILS_ERP_MAX_REALM_LEN },
626 	[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
627 	[NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
628 					.len = FILS_ERP_MAX_RRK_LEN },
629 	[NL80211_ATTR_FILS_CACHE_ID] = { .type = NLA_EXACT_LEN_WARN, .len = 2 },
630 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
631 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
632 	[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
633 
634 	[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
635 	[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
636 	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
637 	[NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
638 					 .len = NL80211_HE_MAX_CAPABILITY_LEN },
639 
640 	[NL80211_ATTR_FTM_RESPONDER] = {
641 		.type = NLA_NESTED,
642 		.validation_data = nl80211_ftm_responder_policy,
643 	},
644 	[NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
645 	[NL80211_ATTR_PEER_MEASUREMENTS] =
646 		NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
647 	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
648 	[NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
649 					.len = SAE_PASSWORD_MAX_LEN },
650 	[NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
651 	[NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
652 	[NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
653 	[NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
654 	[NL80211_ATTR_TID_CONFIG] =
655 		NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
656 };
657 
658 /* policy for the key attributes */
659 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
660 	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
661 	[NL80211_KEY_IDX] = { .type = NLA_U8 },
662 	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
663 	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
664 	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
665 	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
666 	[NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
667 	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
668 	[NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
669 };
670 
671 /* policy for the key default flags */
672 static const struct nla_policy
673 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
674 	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
675 	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
676 };
677 
678 #ifdef CONFIG_PM
679 /* policy for WoWLAN attributes */
680 static const struct nla_policy
681 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
682 	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
683 	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
684 	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
685 	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
686 	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
687 	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
688 	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
689 	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
690 	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
691 	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
692 };
693 
694 static const struct nla_policy
695 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
696 	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
697 	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
698 	[NL80211_WOWLAN_TCP_DST_MAC] = {
699 		.type = NLA_EXACT_LEN_WARN,
700 		.len = ETH_ALEN
701 	},
702 	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
703 	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
704 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
705 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
706 		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
707 	},
708 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
709 		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
710 	},
711 	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
712 	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
713 	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .type = NLA_MIN_LEN, .len = 1 },
714 };
715 #endif /* CONFIG_PM */
716 
717 /* policy for coalesce rule attributes */
718 static const struct nla_policy
719 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
720 	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
721 	[NL80211_ATTR_COALESCE_RULE_CONDITION] =
722 		NLA_POLICY_RANGE(NLA_U32,
723 				 NL80211_COALESCE_CONDITION_MATCH,
724 				 NL80211_COALESCE_CONDITION_NO_MATCH),
725 	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
726 };
727 
728 /* policy for GTK rekey offload attributes */
729 static const struct nla_policy
730 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
731 	[NL80211_REKEY_DATA_KEK] = {
732 		.type = NLA_EXACT_LEN_WARN,
733 		.len = NL80211_KEK_LEN,
734 	},
735 	[NL80211_REKEY_DATA_KCK] = {
736 		.type = NLA_EXACT_LEN_WARN,
737 		.len = NL80211_KCK_LEN,
738 	},
739 	[NL80211_REKEY_DATA_REPLAY_CTR] = {
740 		.type = NLA_EXACT_LEN_WARN,
741 		.len = NL80211_REPLAY_CTR_LEN
742 	},
743 };
744 
745 static const struct nla_policy
746 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
747 	[NL80211_BAND_2GHZ] = { .type = NLA_S32 },
748 	[NL80211_BAND_5GHZ] = { .type = NLA_S32 },
749 	[NL80211_BAND_6GHZ] = { .type = NLA_S32 },
750 	[NL80211_BAND_60GHZ] = { .type = NLA_S32 },
751 };
752 
753 static const struct nla_policy
754 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
755 	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
756 						 .len = IEEE80211_MAX_SSID_LEN },
757 	[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = {
758 		.type = NLA_EXACT_LEN_WARN,
759 		.len = ETH_ALEN
760 	},
761 	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
762 	[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
763 		NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
764 };
765 
766 static const struct nla_policy
767 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
768 	[NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
769 	[NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
770 };
771 
772 static const struct nla_policy
773 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
774 	[NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
775 	[NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
776 	[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
777 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
778 	},
779 };
780 
781 /* policy for NAN function attributes */
782 static const struct nla_policy
783 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
784 	[NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
785 	[NL80211_NAN_FUNC_SERVICE_ID] = {
786 				    .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
787 	[NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
788 	[NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
789 	[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
790 	[NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
791 	[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
792 	[NL80211_NAN_FUNC_FOLLOW_UP_DEST] = {
793 		.type = NLA_EXACT_LEN_WARN,
794 		.len = ETH_ALEN
795 	},
796 	[NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
797 	[NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
798 	[NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
799 			.len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
800 	[NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
801 	[NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
802 	[NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
803 	[NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
804 	[NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
805 };
806 
807 /* policy for Service Response Filter attributes */
808 static const struct nla_policy
809 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
810 	[NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
811 	[NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
812 				 .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
813 	[NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
814 	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
815 };
816 
817 /* policy for packet pattern attributes */
818 static const struct nla_policy
819 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
820 	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
821 	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
822 	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
823 };
824 
825 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
826 			      struct cfg80211_registered_device **rdev,
827 			      struct wireless_dev **wdev)
828 {
829 	int err;
830 
831 	if (!cb->args[0]) {
832 		struct nlattr **attrbuf;
833 
834 		attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
835 				  GFP_KERNEL);
836 		if (!attrbuf)
837 			return -ENOMEM;
838 
839 		err = nlmsg_parse_deprecated(cb->nlh,
840 					     GENL_HDRLEN + nl80211_fam.hdrsize,
841 					     attrbuf, nl80211_fam.maxattr,
842 					     nl80211_policy, NULL);
843 		if (err) {
844 			kfree(attrbuf);
845 			return err;
846 		}
847 
848 		*wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk),
849 						   attrbuf);
850 		kfree(attrbuf);
851 		if (IS_ERR(*wdev))
852 			return PTR_ERR(*wdev);
853 		*rdev = wiphy_to_rdev((*wdev)->wiphy);
854 		/* 0 is the first index - add 1 to parse only once */
855 		cb->args[0] = (*rdev)->wiphy_idx + 1;
856 		cb->args[1] = (*wdev)->identifier;
857 	} else {
858 		/* subtract the 1 again here */
859 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
860 		struct wireless_dev *tmp;
861 
862 		if (!wiphy)
863 			return -ENODEV;
864 		*rdev = wiphy_to_rdev(wiphy);
865 		*wdev = NULL;
866 
867 		list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
868 			if (tmp->identifier == cb->args[1]) {
869 				*wdev = tmp;
870 				break;
871 			}
872 		}
873 
874 		if (!*wdev)
875 			return -ENODEV;
876 	}
877 
878 	return 0;
879 }
880 
881 /* message building helper */
882 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
883 		     int flags, u8 cmd)
884 {
885 	/* since there is no private header just add the generic one */
886 	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
887 }
888 
889 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
890 				     const struct ieee80211_reg_rule *rule)
891 {
892 	int j;
893 	struct nlattr *nl_wmm_rules =
894 		nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
895 
896 	if (!nl_wmm_rules)
897 		goto nla_put_failure;
898 
899 	for (j = 0; j < IEEE80211_NUM_ACS; j++) {
900 		struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
901 
902 		if (!nl_wmm_rule)
903 			goto nla_put_failure;
904 
905 		if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
906 				rule->wmm_rule.client[j].cw_min) ||
907 		    nla_put_u16(msg, NL80211_WMMR_CW_MAX,
908 				rule->wmm_rule.client[j].cw_max) ||
909 		    nla_put_u8(msg, NL80211_WMMR_AIFSN,
910 			       rule->wmm_rule.client[j].aifsn) ||
911 		    nla_put_u16(msg, NL80211_WMMR_TXOP,
912 			        rule->wmm_rule.client[j].cot))
913 			goto nla_put_failure;
914 
915 		nla_nest_end(msg, nl_wmm_rule);
916 	}
917 	nla_nest_end(msg, nl_wmm_rules);
918 
919 	return 0;
920 
921 nla_put_failure:
922 	return -ENOBUFS;
923 }
924 
925 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
926 				   struct ieee80211_channel *chan,
927 				   bool large)
928 {
929 	/* Some channels must be completely excluded from the
930 	 * list to protect old user-space tools from breaking
931 	 */
932 	if (!large && chan->flags &
933 	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
934 		return 0;
935 
936 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
937 			chan->center_freq))
938 		goto nla_put_failure;
939 
940 	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
941 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
942 		goto nla_put_failure;
943 	if (chan->flags & IEEE80211_CHAN_NO_IR) {
944 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
945 			goto nla_put_failure;
946 		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
947 			goto nla_put_failure;
948 	}
949 	if (chan->flags & IEEE80211_CHAN_RADAR) {
950 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
951 			goto nla_put_failure;
952 		if (large) {
953 			u32 time;
954 
955 			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
956 
957 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
958 					chan->dfs_state))
959 				goto nla_put_failure;
960 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
961 					time))
962 				goto nla_put_failure;
963 			if (nla_put_u32(msg,
964 					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
965 					chan->dfs_cac_ms))
966 				goto nla_put_failure;
967 		}
968 	}
969 
970 	if (large) {
971 		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
972 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
973 			goto nla_put_failure;
974 		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
975 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
976 			goto nla_put_failure;
977 		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
978 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
979 			goto nla_put_failure;
980 		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
981 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
982 			goto nla_put_failure;
983 		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
984 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
985 			goto nla_put_failure;
986 		if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
987 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
988 			goto nla_put_failure;
989 		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
990 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
991 			goto nla_put_failure;
992 		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
993 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
994 			goto nla_put_failure;
995 		if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
996 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
997 			goto nla_put_failure;
998 	}
999 
1000 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1001 			DBM_TO_MBM(chan->max_power)))
1002 		goto nla_put_failure;
1003 
1004 	if (large) {
1005 		const struct ieee80211_reg_rule *rule =
1006 			freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1007 
1008 		if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1009 			if (nl80211_msg_put_wmm_rules(msg, rule))
1010 				goto nla_put_failure;
1011 		}
1012 	}
1013 
1014 	return 0;
1015 
1016  nla_put_failure:
1017 	return -ENOBUFS;
1018 }
1019 
1020 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1021 				  struct cfg80211_txq_stats *txqstats,
1022 				  int attrtype)
1023 {
1024 	struct nlattr *txqattr;
1025 
1026 #define PUT_TXQVAL_U32(attr, memb) do {					  \
1027 	if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&	  \
1028 	    nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1029 		return false;						  \
1030 	} while (0)
1031 
1032 	txqattr = nla_nest_start_noflag(msg, attrtype);
1033 	if (!txqattr)
1034 		return false;
1035 
1036 	PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1037 	PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1038 	PUT_TXQVAL_U32(FLOWS, flows);
1039 	PUT_TXQVAL_U32(DROPS, drops);
1040 	PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1041 	PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1042 	PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1043 	PUT_TXQVAL_U32(COLLISIONS, collisions);
1044 	PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1045 	PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1046 	PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1047 	nla_nest_end(msg, txqattr);
1048 
1049 #undef PUT_TXQVAL_U32
1050 	return true;
1051 }
1052 
1053 /* netlink command implementations */
1054 
1055 struct key_parse {
1056 	struct key_params p;
1057 	int idx;
1058 	int type;
1059 	bool def, defmgmt, defbeacon;
1060 	bool def_uni, def_multi;
1061 };
1062 
1063 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1064 				 struct key_parse *k)
1065 {
1066 	struct nlattr *tb[NL80211_KEY_MAX + 1];
1067 	int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1068 					      nl80211_key_policy,
1069 					      info->extack);
1070 	if (err)
1071 		return err;
1072 
1073 	k->def = !!tb[NL80211_KEY_DEFAULT];
1074 	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1075 	k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1076 
1077 	if (k->def) {
1078 		k->def_uni = true;
1079 		k->def_multi = true;
1080 	}
1081 	if (k->defmgmt || k->defbeacon)
1082 		k->def_multi = true;
1083 
1084 	if (tb[NL80211_KEY_IDX])
1085 		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1086 
1087 	if (tb[NL80211_KEY_DATA]) {
1088 		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1089 		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1090 	}
1091 
1092 	if (tb[NL80211_KEY_SEQ]) {
1093 		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1094 		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1095 	}
1096 
1097 	if (tb[NL80211_KEY_CIPHER])
1098 		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1099 
1100 	if (tb[NL80211_KEY_TYPE])
1101 		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1102 
1103 	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1104 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1105 
1106 		err = nla_parse_nested_deprecated(kdt,
1107 						  NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1108 						  tb[NL80211_KEY_DEFAULT_TYPES],
1109 						  nl80211_key_default_policy,
1110 						  info->extack);
1111 		if (err)
1112 			return err;
1113 
1114 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1115 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1116 	}
1117 
1118 	if (tb[NL80211_KEY_MODE])
1119 		k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1120 
1121 	return 0;
1122 }
1123 
1124 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1125 {
1126 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1127 		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1128 		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1129 	}
1130 
1131 	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1132 		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1133 		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1134 	}
1135 
1136 	if (info->attrs[NL80211_ATTR_KEY_IDX])
1137 		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1138 
1139 	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1140 		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1141 
1142 	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1143 	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1144 
1145 	if (k->def) {
1146 		k->def_uni = true;
1147 		k->def_multi = true;
1148 	}
1149 	if (k->defmgmt)
1150 		k->def_multi = true;
1151 
1152 	if (info->attrs[NL80211_ATTR_KEY_TYPE])
1153 		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1154 
1155 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1156 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1157 		int err = nla_parse_nested_deprecated(kdt,
1158 						      NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1159 						      info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1160 						      nl80211_key_default_policy,
1161 						      info->extack);
1162 		if (err)
1163 			return err;
1164 
1165 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1166 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1167 	}
1168 
1169 	return 0;
1170 }
1171 
1172 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1173 {
1174 	int err;
1175 
1176 	memset(k, 0, sizeof(*k));
1177 	k->idx = -1;
1178 	k->type = -1;
1179 
1180 	if (info->attrs[NL80211_ATTR_KEY])
1181 		err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1182 	else
1183 		err = nl80211_parse_key_old(info, k);
1184 
1185 	if (err)
1186 		return err;
1187 
1188 	if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1189 	    (k->defbeacon ? 1 : 0) > 1) {
1190 		GENL_SET_ERR_MSG(info,
1191 				 "key with multiple default flags is invalid");
1192 		return -EINVAL;
1193 	}
1194 
1195 	if (k->defmgmt || k->defbeacon) {
1196 		if (k->def_uni || !k->def_multi) {
1197 			GENL_SET_ERR_MSG(info,
1198 					 "defmgmt/defbeacon key must be mcast");
1199 			return -EINVAL;
1200 		}
1201 	}
1202 
1203 	if (k->idx != -1) {
1204 		if (k->defmgmt) {
1205 			if (k->idx < 4 || k->idx > 5) {
1206 				GENL_SET_ERR_MSG(info,
1207 						 "defmgmt key idx not 4 or 5");
1208 				return -EINVAL;
1209 			}
1210 		} else if (k->defbeacon) {
1211 			if (k->idx < 6 || k->idx > 7) {
1212 				GENL_SET_ERR_MSG(info,
1213 						 "defbeacon key idx not 6 or 7");
1214 				return -EINVAL;
1215 			}
1216 		} else if (k->def) {
1217 			if (k->idx < 0 || k->idx > 3) {
1218 				GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1219 				return -EINVAL;
1220 			}
1221 		} else {
1222 			if (k->idx < 0 || k->idx > 7) {
1223 				GENL_SET_ERR_MSG(info, "key idx not 0-7");
1224 				return -EINVAL;
1225 			}
1226 		}
1227 	}
1228 
1229 	return 0;
1230 }
1231 
1232 static struct cfg80211_cached_keys *
1233 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1234 		       struct genl_info *info, bool *no_ht)
1235 {
1236 	struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1237 	struct key_parse parse;
1238 	struct nlattr *key;
1239 	struct cfg80211_cached_keys *result;
1240 	int rem, err, def = 0;
1241 	bool have_key = false;
1242 
1243 	nla_for_each_nested(key, keys, rem) {
1244 		have_key = true;
1245 		break;
1246 	}
1247 
1248 	if (!have_key)
1249 		return NULL;
1250 
1251 	result = kzalloc(sizeof(*result), GFP_KERNEL);
1252 	if (!result)
1253 		return ERR_PTR(-ENOMEM);
1254 
1255 	result->def = -1;
1256 
1257 	nla_for_each_nested(key, keys, rem) {
1258 		memset(&parse, 0, sizeof(parse));
1259 		parse.idx = -1;
1260 
1261 		err = nl80211_parse_key_new(info, key, &parse);
1262 		if (err)
1263 			goto error;
1264 		err = -EINVAL;
1265 		if (!parse.p.key)
1266 			goto error;
1267 		if (parse.idx < 0 || parse.idx > 3) {
1268 			GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1269 			goto error;
1270 		}
1271 		if (parse.def) {
1272 			if (def) {
1273 				GENL_SET_ERR_MSG(info,
1274 						 "only one key can be default");
1275 				goto error;
1276 			}
1277 			def = 1;
1278 			result->def = parse.idx;
1279 			if (!parse.def_uni || !parse.def_multi)
1280 				goto error;
1281 		} else if (parse.defmgmt)
1282 			goto error;
1283 		err = cfg80211_validate_key_settings(rdev, &parse.p,
1284 						     parse.idx, false, NULL);
1285 		if (err)
1286 			goto error;
1287 		if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1288 		    parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1289 			GENL_SET_ERR_MSG(info, "connect key must be WEP");
1290 			err = -EINVAL;
1291 			goto error;
1292 		}
1293 		result->params[parse.idx].cipher = parse.p.cipher;
1294 		result->params[parse.idx].key_len = parse.p.key_len;
1295 		result->params[parse.idx].key = result->data[parse.idx];
1296 		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1297 
1298 		/* must be WEP key if we got here */
1299 		if (no_ht)
1300 			*no_ht = true;
1301 	}
1302 
1303 	if (result->def < 0) {
1304 		err = -EINVAL;
1305 		GENL_SET_ERR_MSG(info, "need a default/TX key");
1306 		goto error;
1307 	}
1308 
1309 	return result;
1310  error:
1311 	kfree(result);
1312 	return ERR_PTR(err);
1313 }
1314 
1315 static int nl80211_key_allowed(struct wireless_dev *wdev)
1316 {
1317 	ASSERT_WDEV_LOCK(wdev);
1318 
1319 	switch (wdev->iftype) {
1320 	case NL80211_IFTYPE_AP:
1321 	case NL80211_IFTYPE_AP_VLAN:
1322 	case NL80211_IFTYPE_P2P_GO:
1323 	case NL80211_IFTYPE_MESH_POINT:
1324 		break;
1325 	case NL80211_IFTYPE_ADHOC:
1326 	case NL80211_IFTYPE_STATION:
1327 	case NL80211_IFTYPE_P2P_CLIENT:
1328 		if (!wdev->current_bss)
1329 			return -ENOLINK;
1330 		break;
1331 	case NL80211_IFTYPE_UNSPECIFIED:
1332 	case NL80211_IFTYPE_OCB:
1333 	case NL80211_IFTYPE_MONITOR:
1334 	case NL80211_IFTYPE_NAN:
1335 	case NL80211_IFTYPE_P2P_DEVICE:
1336 	case NL80211_IFTYPE_WDS:
1337 	case NUM_NL80211_IFTYPES:
1338 		return -EINVAL;
1339 	}
1340 
1341 	return 0;
1342 }
1343 
1344 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1345 							struct nlattr *tb)
1346 {
1347 	struct ieee80211_channel *chan;
1348 
1349 	if (tb == NULL)
1350 		return NULL;
1351 	chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1352 	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1353 		return NULL;
1354 	return chan;
1355 }
1356 
1357 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1358 {
1359 	struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1360 	int i;
1361 
1362 	if (!nl_modes)
1363 		goto nla_put_failure;
1364 
1365 	i = 0;
1366 	while (ifmodes) {
1367 		if ((ifmodes & 1) && nla_put_flag(msg, i))
1368 			goto nla_put_failure;
1369 		ifmodes >>= 1;
1370 		i++;
1371 	}
1372 
1373 	nla_nest_end(msg, nl_modes);
1374 	return 0;
1375 
1376 nla_put_failure:
1377 	return -ENOBUFS;
1378 }
1379 
1380 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1381 					  struct sk_buff *msg,
1382 					  bool large)
1383 {
1384 	struct nlattr *nl_combis;
1385 	int i, j;
1386 
1387 	nl_combis = nla_nest_start_noflag(msg,
1388 					  NL80211_ATTR_INTERFACE_COMBINATIONS);
1389 	if (!nl_combis)
1390 		goto nla_put_failure;
1391 
1392 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
1393 		const struct ieee80211_iface_combination *c;
1394 		struct nlattr *nl_combi, *nl_limits;
1395 
1396 		c = &wiphy->iface_combinations[i];
1397 
1398 		nl_combi = nla_nest_start_noflag(msg, i + 1);
1399 		if (!nl_combi)
1400 			goto nla_put_failure;
1401 
1402 		nl_limits = nla_nest_start_noflag(msg,
1403 						  NL80211_IFACE_COMB_LIMITS);
1404 		if (!nl_limits)
1405 			goto nla_put_failure;
1406 
1407 		for (j = 0; j < c->n_limits; j++) {
1408 			struct nlattr *nl_limit;
1409 
1410 			nl_limit = nla_nest_start_noflag(msg, j + 1);
1411 			if (!nl_limit)
1412 				goto nla_put_failure;
1413 			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1414 					c->limits[j].max))
1415 				goto nla_put_failure;
1416 			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1417 						c->limits[j].types))
1418 				goto nla_put_failure;
1419 			nla_nest_end(msg, nl_limit);
1420 		}
1421 
1422 		nla_nest_end(msg, nl_limits);
1423 
1424 		if (c->beacon_int_infra_match &&
1425 		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1426 			goto nla_put_failure;
1427 		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1428 				c->num_different_channels) ||
1429 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1430 				c->max_interfaces))
1431 			goto nla_put_failure;
1432 		if (large &&
1433 		    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1434 				c->radar_detect_widths) ||
1435 		     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1436 				c->radar_detect_regions)))
1437 			goto nla_put_failure;
1438 		if (c->beacon_int_min_gcd &&
1439 		    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1440 				c->beacon_int_min_gcd))
1441 			goto nla_put_failure;
1442 
1443 		nla_nest_end(msg, nl_combi);
1444 	}
1445 
1446 	nla_nest_end(msg, nl_combis);
1447 
1448 	return 0;
1449 nla_put_failure:
1450 	return -ENOBUFS;
1451 }
1452 
1453 #ifdef CONFIG_PM
1454 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1455 					struct sk_buff *msg)
1456 {
1457 	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1458 	struct nlattr *nl_tcp;
1459 
1460 	if (!tcp)
1461 		return 0;
1462 
1463 	nl_tcp = nla_nest_start_noflag(msg,
1464 				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1465 	if (!nl_tcp)
1466 		return -ENOBUFS;
1467 
1468 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1469 			tcp->data_payload_max))
1470 		return -ENOBUFS;
1471 
1472 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1473 			tcp->data_payload_max))
1474 		return -ENOBUFS;
1475 
1476 	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1477 		return -ENOBUFS;
1478 
1479 	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1480 				sizeof(*tcp->tok), tcp->tok))
1481 		return -ENOBUFS;
1482 
1483 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1484 			tcp->data_interval_max))
1485 		return -ENOBUFS;
1486 
1487 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1488 			tcp->wake_payload_max))
1489 		return -ENOBUFS;
1490 
1491 	nla_nest_end(msg, nl_tcp);
1492 	return 0;
1493 }
1494 
1495 static int nl80211_send_wowlan(struct sk_buff *msg,
1496 			       struct cfg80211_registered_device *rdev,
1497 			       bool large)
1498 {
1499 	struct nlattr *nl_wowlan;
1500 
1501 	if (!rdev->wiphy.wowlan)
1502 		return 0;
1503 
1504 	nl_wowlan = nla_nest_start_noflag(msg,
1505 					  NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1506 	if (!nl_wowlan)
1507 		return -ENOBUFS;
1508 
1509 	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1510 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1511 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1512 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1513 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1514 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1515 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1516 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1517 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1518 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1519 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1520 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1521 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1522 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1523 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1524 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1525 		return -ENOBUFS;
1526 
1527 	if (rdev->wiphy.wowlan->n_patterns) {
1528 		struct nl80211_pattern_support pat = {
1529 			.max_patterns = rdev->wiphy.wowlan->n_patterns,
1530 			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1531 			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1532 			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1533 		};
1534 
1535 		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1536 			    sizeof(pat), &pat))
1537 			return -ENOBUFS;
1538 	}
1539 
1540 	if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1541 	    nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1542 			rdev->wiphy.wowlan->max_nd_match_sets))
1543 		return -ENOBUFS;
1544 
1545 	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1546 		return -ENOBUFS;
1547 
1548 	nla_nest_end(msg, nl_wowlan);
1549 
1550 	return 0;
1551 }
1552 #endif
1553 
1554 static int nl80211_send_coalesce(struct sk_buff *msg,
1555 				 struct cfg80211_registered_device *rdev)
1556 {
1557 	struct nl80211_coalesce_rule_support rule;
1558 
1559 	if (!rdev->wiphy.coalesce)
1560 		return 0;
1561 
1562 	rule.max_rules = rdev->wiphy.coalesce->n_rules;
1563 	rule.max_delay = rdev->wiphy.coalesce->max_delay;
1564 	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1565 	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1566 	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1567 	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1568 
1569 	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1570 		return -ENOBUFS;
1571 
1572 	return 0;
1573 }
1574 
1575 static int
1576 nl80211_send_iftype_data(struct sk_buff *msg,
1577 			 const struct ieee80211_sband_iftype_data *iftdata)
1578 {
1579 	const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1580 
1581 	if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1582 				iftdata->types_mask))
1583 		return -ENOBUFS;
1584 
1585 	if (he_cap->has_he) {
1586 		if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1587 			    sizeof(he_cap->he_cap_elem.mac_cap_info),
1588 			    he_cap->he_cap_elem.mac_cap_info) ||
1589 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1590 			    sizeof(he_cap->he_cap_elem.phy_cap_info),
1591 			    he_cap->he_cap_elem.phy_cap_info) ||
1592 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1593 			    sizeof(he_cap->he_mcs_nss_supp),
1594 			    &he_cap->he_mcs_nss_supp) ||
1595 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1596 			    sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1597 			return -ENOBUFS;
1598 	}
1599 
1600 	return 0;
1601 }
1602 
1603 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1604 				      struct ieee80211_supported_band *sband)
1605 {
1606 	struct nlattr *nl_rates, *nl_rate;
1607 	struct ieee80211_rate *rate;
1608 	int i;
1609 
1610 	/* add HT info */
1611 	if (sband->ht_cap.ht_supported &&
1612 	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1613 		     sizeof(sband->ht_cap.mcs),
1614 		     &sband->ht_cap.mcs) ||
1615 	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1616 			 sband->ht_cap.cap) ||
1617 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1618 			sband->ht_cap.ampdu_factor) ||
1619 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1620 			sband->ht_cap.ampdu_density)))
1621 		return -ENOBUFS;
1622 
1623 	/* add VHT info */
1624 	if (sband->vht_cap.vht_supported &&
1625 	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1626 		     sizeof(sband->vht_cap.vht_mcs),
1627 		     &sband->vht_cap.vht_mcs) ||
1628 	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1629 			 sband->vht_cap.cap)))
1630 		return -ENOBUFS;
1631 
1632 	if (sband->n_iftype_data) {
1633 		struct nlattr *nl_iftype_data =
1634 			nla_nest_start_noflag(msg,
1635 					      NL80211_BAND_ATTR_IFTYPE_DATA);
1636 		int err;
1637 
1638 		if (!nl_iftype_data)
1639 			return -ENOBUFS;
1640 
1641 		for (i = 0; i < sband->n_iftype_data; i++) {
1642 			struct nlattr *iftdata;
1643 
1644 			iftdata = nla_nest_start_noflag(msg, i + 1);
1645 			if (!iftdata)
1646 				return -ENOBUFS;
1647 
1648 			err = nl80211_send_iftype_data(msg,
1649 						       &sband->iftype_data[i]);
1650 			if (err)
1651 				return err;
1652 
1653 			nla_nest_end(msg, iftdata);
1654 		}
1655 
1656 		nla_nest_end(msg, nl_iftype_data);
1657 	}
1658 
1659 	/* add EDMG info */
1660 	if (sband->edmg_cap.channels &&
1661 	    (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1662 		       sband->edmg_cap.channels) ||
1663 	    nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1664 		       sband->edmg_cap.bw_config)))
1665 
1666 		return -ENOBUFS;
1667 
1668 	/* add bitrates */
1669 	nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1670 	if (!nl_rates)
1671 		return -ENOBUFS;
1672 
1673 	for (i = 0; i < sband->n_bitrates; i++) {
1674 		nl_rate = nla_nest_start_noflag(msg, i);
1675 		if (!nl_rate)
1676 			return -ENOBUFS;
1677 
1678 		rate = &sband->bitrates[i];
1679 		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1680 				rate->bitrate))
1681 			return -ENOBUFS;
1682 		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1683 		    nla_put_flag(msg,
1684 				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1685 			return -ENOBUFS;
1686 
1687 		nla_nest_end(msg, nl_rate);
1688 	}
1689 
1690 	nla_nest_end(msg, nl_rates);
1691 
1692 	return 0;
1693 }
1694 
1695 static int
1696 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1697 			 const struct ieee80211_txrx_stypes *mgmt_stypes)
1698 {
1699 	u16 stypes;
1700 	struct nlattr *nl_ftypes, *nl_ifs;
1701 	enum nl80211_iftype ift;
1702 	int i;
1703 
1704 	if (!mgmt_stypes)
1705 		return 0;
1706 
1707 	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1708 	if (!nl_ifs)
1709 		return -ENOBUFS;
1710 
1711 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1712 		nl_ftypes = nla_nest_start_noflag(msg, ift);
1713 		if (!nl_ftypes)
1714 			return -ENOBUFS;
1715 		i = 0;
1716 		stypes = mgmt_stypes[ift].tx;
1717 		while (stypes) {
1718 			if ((stypes & 1) &&
1719 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1720 					(i << 4) | IEEE80211_FTYPE_MGMT))
1721 				return -ENOBUFS;
1722 			stypes >>= 1;
1723 			i++;
1724 		}
1725 		nla_nest_end(msg, nl_ftypes);
1726 	}
1727 
1728 	nla_nest_end(msg, nl_ifs);
1729 
1730 	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1731 	if (!nl_ifs)
1732 		return -ENOBUFS;
1733 
1734 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1735 		nl_ftypes = nla_nest_start_noflag(msg, ift);
1736 		if (!nl_ftypes)
1737 			return -ENOBUFS;
1738 		i = 0;
1739 		stypes = mgmt_stypes[ift].rx;
1740 		while (stypes) {
1741 			if ((stypes & 1) &&
1742 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1743 					(i << 4) | IEEE80211_FTYPE_MGMT))
1744 				return -ENOBUFS;
1745 			stypes >>= 1;
1746 			i++;
1747 		}
1748 		nla_nest_end(msg, nl_ftypes);
1749 	}
1750 	nla_nest_end(msg, nl_ifs);
1751 
1752 	return 0;
1753 }
1754 
1755 #define CMD(op, n)							\
1756 	 do {								\
1757 		if (rdev->ops->op) {					\
1758 			i++;						\
1759 			if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) 	\
1760 				goto nla_put_failure;			\
1761 		}							\
1762 	} while (0)
1763 
1764 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1765 					struct sk_buff *msg)
1766 {
1767 	int i = 0;
1768 
1769 	/*
1770 	 * do *NOT* add anything into this function, new things need to be
1771 	 * advertised only to new versions of userspace that can deal with
1772 	 * the split (and they can't possibly care about new features...
1773 	 */
1774 	CMD(add_virtual_intf, NEW_INTERFACE);
1775 	CMD(change_virtual_intf, SET_INTERFACE);
1776 	CMD(add_key, NEW_KEY);
1777 	CMD(start_ap, START_AP);
1778 	CMD(add_station, NEW_STATION);
1779 	CMD(add_mpath, NEW_MPATH);
1780 	CMD(update_mesh_config, SET_MESH_CONFIG);
1781 	CMD(change_bss, SET_BSS);
1782 	CMD(auth, AUTHENTICATE);
1783 	CMD(assoc, ASSOCIATE);
1784 	CMD(deauth, DEAUTHENTICATE);
1785 	CMD(disassoc, DISASSOCIATE);
1786 	CMD(join_ibss, JOIN_IBSS);
1787 	CMD(join_mesh, JOIN_MESH);
1788 	CMD(set_pmksa, SET_PMKSA);
1789 	CMD(del_pmksa, DEL_PMKSA);
1790 	CMD(flush_pmksa, FLUSH_PMKSA);
1791 	if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1792 		CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1793 	CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1794 	CMD(mgmt_tx, FRAME);
1795 	CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1796 	if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1797 		i++;
1798 		if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1799 			goto nla_put_failure;
1800 	}
1801 	if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1802 	    rdev->ops->join_mesh) {
1803 		i++;
1804 		if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1805 			goto nla_put_failure;
1806 	}
1807 	CMD(set_wds_peer, SET_WDS_PEER);
1808 	if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1809 		CMD(tdls_mgmt, TDLS_MGMT);
1810 		CMD(tdls_oper, TDLS_OPER);
1811 	}
1812 	if (rdev->wiphy.max_sched_scan_reqs)
1813 		CMD(sched_scan_start, START_SCHED_SCAN);
1814 	CMD(probe_client, PROBE_CLIENT);
1815 	CMD(set_noack_map, SET_NOACK_MAP);
1816 	if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1817 		i++;
1818 		if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1819 			goto nla_put_failure;
1820 	}
1821 	CMD(start_p2p_device, START_P2P_DEVICE);
1822 	CMD(set_mcast_rate, SET_MCAST_RATE);
1823 #ifdef CONFIG_NL80211_TESTMODE
1824 	CMD(testmode_cmd, TESTMODE);
1825 #endif
1826 
1827 	if (rdev->ops->connect || rdev->ops->auth) {
1828 		i++;
1829 		if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1830 			goto nla_put_failure;
1831 	}
1832 
1833 	if (rdev->ops->disconnect || rdev->ops->deauth) {
1834 		i++;
1835 		if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1836 			goto nla_put_failure;
1837 	}
1838 
1839 	return i;
1840  nla_put_failure:
1841 	return -ENOBUFS;
1842 }
1843 
1844 static int
1845 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1846 			   struct sk_buff *msg)
1847 {
1848 	struct nlattr *ftm;
1849 
1850 	if (!cap->ftm.supported)
1851 		return 0;
1852 
1853 	ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1854 	if (!ftm)
1855 		return -ENOBUFS;
1856 
1857 	if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1858 		return -ENOBUFS;
1859 	if (cap->ftm.non_asap &&
1860 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1861 		return -ENOBUFS;
1862 	if (cap->ftm.request_lci &&
1863 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1864 		return -ENOBUFS;
1865 	if (cap->ftm.request_civicloc &&
1866 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1867 		return -ENOBUFS;
1868 	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1869 			cap->ftm.preambles))
1870 		return -ENOBUFS;
1871 	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1872 			cap->ftm.bandwidths))
1873 		return -ENOBUFS;
1874 	if (cap->ftm.max_bursts_exponent >= 0 &&
1875 	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1876 			cap->ftm.max_bursts_exponent))
1877 		return -ENOBUFS;
1878 	if (cap->ftm.max_ftms_per_burst &&
1879 	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1880 			cap->ftm.max_ftms_per_burst))
1881 		return -ENOBUFS;
1882 
1883 	nla_nest_end(msg, ftm);
1884 	return 0;
1885 }
1886 
1887 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1888 				  struct sk_buff *msg)
1889 {
1890 	const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1891 	struct nlattr *pmsr, *caps;
1892 
1893 	if (!cap)
1894 		return 0;
1895 
1896 	/*
1897 	 * we don't need to clean up anything here since the caller
1898 	 * will genlmsg_cancel() if we fail
1899 	 */
1900 
1901 	pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1902 	if (!pmsr)
1903 		return -ENOBUFS;
1904 
1905 	if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1906 		return -ENOBUFS;
1907 
1908 	if (cap->report_ap_tsf &&
1909 	    nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1910 		return -ENOBUFS;
1911 
1912 	if (cap->randomize_mac_addr &&
1913 	    nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1914 		return -ENOBUFS;
1915 
1916 	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1917 	if (!caps)
1918 		return -ENOBUFS;
1919 
1920 	if (nl80211_send_pmsr_ftm_capa(cap, msg))
1921 		return -ENOBUFS;
1922 
1923 	nla_nest_end(msg, caps);
1924 	nla_nest_end(msg, pmsr);
1925 
1926 	return 0;
1927 }
1928 
1929 static int
1930 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
1931 			      struct sk_buff *msg)
1932 {
1933 	int i;
1934 	struct nlattr *nested, *nested_akms;
1935 	const struct wiphy_iftype_akm_suites *iftype_akms;
1936 
1937 	if (!rdev->wiphy.num_iftype_akm_suites ||
1938 	    !rdev->wiphy.iftype_akm_suites)
1939 		return 0;
1940 
1941 	nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
1942 	if (!nested)
1943 		return -ENOBUFS;
1944 
1945 	for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
1946 		nested_akms = nla_nest_start(msg, i + 1);
1947 		if (!nested_akms)
1948 			return -ENOBUFS;
1949 
1950 		iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
1951 
1952 		if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
1953 					iftype_akms->iftypes_mask))
1954 			return -ENOBUFS;
1955 
1956 		if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
1957 			    sizeof(u32) * iftype_akms->n_akm_suites,
1958 			    iftype_akms->akm_suites)) {
1959 			return -ENOBUFS;
1960 		}
1961 		nla_nest_end(msg, nested_akms);
1962 	}
1963 
1964 	nla_nest_end(msg, nested);
1965 
1966 	return 0;
1967 }
1968 
1969 static int
1970 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
1971 			       struct sk_buff *msg)
1972 {
1973 	struct nlattr *supp;
1974 
1975 	if (!rdev->wiphy.tid_config_support.vif &&
1976 	    !rdev->wiphy.tid_config_support.peer)
1977 		return 0;
1978 
1979 	supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
1980 	if (!supp)
1981 		return -ENOSPC;
1982 
1983 	if (rdev->wiphy.tid_config_support.vif &&
1984 	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
1985 			      rdev->wiphy.tid_config_support.vif,
1986 			      NL80211_TID_CONFIG_ATTR_PAD))
1987 		goto fail;
1988 
1989 	if (rdev->wiphy.tid_config_support.peer &&
1990 	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
1991 			      rdev->wiphy.tid_config_support.peer,
1992 			      NL80211_TID_CONFIG_ATTR_PAD))
1993 		goto fail;
1994 
1995 	/* for now we just use the same value ... makes more sense */
1996 	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
1997 		       rdev->wiphy.tid_config_support.max_retry))
1998 		goto fail;
1999 	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2000 		       rdev->wiphy.tid_config_support.max_retry))
2001 		goto fail;
2002 
2003 	nla_nest_end(msg, supp);
2004 
2005 	return 0;
2006 fail:
2007 	nla_nest_cancel(msg, supp);
2008 	return -ENOBUFS;
2009 }
2010 
2011 struct nl80211_dump_wiphy_state {
2012 	s64 filter_wiphy;
2013 	long start;
2014 	long split_start, band_start, chan_start, capa_start;
2015 	bool split;
2016 };
2017 
2018 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2019 			      enum nl80211_commands cmd,
2020 			      struct sk_buff *msg, u32 portid, u32 seq,
2021 			      int flags, struct nl80211_dump_wiphy_state *state)
2022 {
2023 	void *hdr;
2024 	struct nlattr *nl_bands, *nl_band;
2025 	struct nlattr *nl_freqs, *nl_freq;
2026 	struct nlattr *nl_cmds;
2027 	enum nl80211_band band;
2028 	struct ieee80211_channel *chan;
2029 	int i;
2030 	const struct ieee80211_txrx_stypes *mgmt_stypes =
2031 				rdev->wiphy.mgmt_stypes;
2032 	u32 features;
2033 
2034 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2035 	if (!hdr)
2036 		return -ENOBUFS;
2037 
2038 	if (WARN_ON(!state))
2039 		return -EINVAL;
2040 
2041 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2042 	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2043 			   wiphy_name(&rdev->wiphy)) ||
2044 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
2045 			cfg80211_rdev_list_generation))
2046 		goto nla_put_failure;
2047 
2048 	if (cmd != NL80211_CMD_NEW_WIPHY)
2049 		goto finish;
2050 
2051 	switch (state->split_start) {
2052 	case 0:
2053 		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2054 			       rdev->wiphy.retry_short) ||
2055 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2056 			       rdev->wiphy.retry_long) ||
2057 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2058 				rdev->wiphy.frag_threshold) ||
2059 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2060 				rdev->wiphy.rts_threshold) ||
2061 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2062 			       rdev->wiphy.coverage_class) ||
2063 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2064 			       rdev->wiphy.max_scan_ssids) ||
2065 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2066 			       rdev->wiphy.max_sched_scan_ssids) ||
2067 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2068 				rdev->wiphy.max_scan_ie_len) ||
2069 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2070 				rdev->wiphy.max_sched_scan_ie_len) ||
2071 		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2072 			       rdev->wiphy.max_match_sets) ||
2073 		    nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2074 				rdev->wiphy.max_sched_scan_plans) ||
2075 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2076 				rdev->wiphy.max_sched_scan_plan_interval) ||
2077 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2078 				rdev->wiphy.max_sched_scan_plan_iterations))
2079 			goto nla_put_failure;
2080 
2081 		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2082 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2083 			goto nla_put_failure;
2084 		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2085 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2086 			goto nla_put_failure;
2087 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2088 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2089 			goto nla_put_failure;
2090 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2091 		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2092 			goto nla_put_failure;
2093 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2094 		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2095 			goto nla_put_failure;
2096 		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2097 		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2098 			goto nla_put_failure;
2099 		state->split_start++;
2100 		if (state->split)
2101 			break;
2102 		/* fall through */
2103 	case 1:
2104 		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2105 			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
2106 			    rdev->wiphy.cipher_suites))
2107 			goto nla_put_failure;
2108 
2109 		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2110 			       rdev->wiphy.max_num_pmkids))
2111 			goto nla_put_failure;
2112 
2113 		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2114 		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2115 			goto nla_put_failure;
2116 
2117 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2118 				rdev->wiphy.available_antennas_tx) ||
2119 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2120 				rdev->wiphy.available_antennas_rx))
2121 			goto nla_put_failure;
2122 
2123 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2124 		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2125 				rdev->wiphy.probe_resp_offload))
2126 			goto nla_put_failure;
2127 
2128 		if ((rdev->wiphy.available_antennas_tx ||
2129 		     rdev->wiphy.available_antennas_rx) &&
2130 		    rdev->ops->get_antenna) {
2131 			u32 tx_ant = 0, rx_ant = 0;
2132 			int res;
2133 
2134 			res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2135 			if (!res) {
2136 				if (nla_put_u32(msg,
2137 						NL80211_ATTR_WIPHY_ANTENNA_TX,
2138 						tx_ant) ||
2139 				    nla_put_u32(msg,
2140 						NL80211_ATTR_WIPHY_ANTENNA_RX,
2141 						rx_ant))
2142 					goto nla_put_failure;
2143 			}
2144 		}
2145 
2146 		state->split_start++;
2147 		if (state->split)
2148 			break;
2149 		/* fall through */
2150 	case 2:
2151 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2152 					rdev->wiphy.interface_modes))
2153 				goto nla_put_failure;
2154 		state->split_start++;
2155 		if (state->split)
2156 			break;
2157 		/* fall through */
2158 	case 3:
2159 		nl_bands = nla_nest_start_noflag(msg,
2160 						 NL80211_ATTR_WIPHY_BANDS);
2161 		if (!nl_bands)
2162 			goto nla_put_failure;
2163 
2164 		for (band = state->band_start;
2165 		     band < NUM_NL80211_BANDS; band++) {
2166 			struct ieee80211_supported_band *sband;
2167 
2168 			sband = rdev->wiphy.bands[band];
2169 
2170 			if (!sband)
2171 				continue;
2172 
2173 			nl_band = nla_nest_start_noflag(msg, band);
2174 			if (!nl_band)
2175 				goto nla_put_failure;
2176 
2177 			switch (state->chan_start) {
2178 			case 0:
2179 				if (nl80211_send_band_rateinfo(msg, sband))
2180 					goto nla_put_failure;
2181 				state->chan_start++;
2182 				if (state->split)
2183 					break;
2184 				/* fall through */
2185 			default:
2186 				/* add frequencies */
2187 				nl_freqs = nla_nest_start_noflag(msg,
2188 								 NL80211_BAND_ATTR_FREQS);
2189 				if (!nl_freqs)
2190 					goto nla_put_failure;
2191 
2192 				for (i = state->chan_start - 1;
2193 				     i < sband->n_channels;
2194 				     i++) {
2195 					nl_freq = nla_nest_start_noflag(msg,
2196 									i);
2197 					if (!nl_freq)
2198 						goto nla_put_failure;
2199 
2200 					chan = &sband->channels[i];
2201 
2202 					if (nl80211_msg_put_channel(
2203 							msg, &rdev->wiphy, chan,
2204 							state->split))
2205 						goto nla_put_failure;
2206 
2207 					nla_nest_end(msg, nl_freq);
2208 					if (state->split)
2209 						break;
2210 				}
2211 				if (i < sband->n_channels)
2212 					state->chan_start = i + 2;
2213 				else
2214 					state->chan_start = 0;
2215 				nla_nest_end(msg, nl_freqs);
2216 			}
2217 
2218 			nla_nest_end(msg, nl_band);
2219 
2220 			if (state->split) {
2221 				/* start again here */
2222 				if (state->chan_start)
2223 					band--;
2224 				break;
2225 			}
2226 		}
2227 		nla_nest_end(msg, nl_bands);
2228 
2229 		if (band < NUM_NL80211_BANDS)
2230 			state->band_start = band + 1;
2231 		else
2232 			state->band_start = 0;
2233 
2234 		/* if bands & channels are done, continue outside */
2235 		if (state->band_start == 0 && state->chan_start == 0)
2236 			state->split_start++;
2237 		if (state->split)
2238 			break;
2239 		/* fall through */
2240 	case 4:
2241 		nl_cmds = nla_nest_start_noflag(msg,
2242 						NL80211_ATTR_SUPPORTED_COMMANDS);
2243 		if (!nl_cmds)
2244 			goto nla_put_failure;
2245 
2246 		i = nl80211_add_commands_unsplit(rdev, msg);
2247 		if (i < 0)
2248 			goto nla_put_failure;
2249 		if (state->split) {
2250 			CMD(crit_proto_start, CRIT_PROTOCOL_START);
2251 			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2252 			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2253 				CMD(channel_switch, CHANNEL_SWITCH);
2254 			CMD(set_qos_map, SET_QOS_MAP);
2255 			if (rdev->wiphy.features &
2256 					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2257 				CMD(add_tx_ts, ADD_TX_TS);
2258 			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2259 			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2260 			CMD(update_ft_ies, UPDATE_FT_IES);
2261 		}
2262 #undef CMD
2263 
2264 		nla_nest_end(msg, nl_cmds);
2265 		state->split_start++;
2266 		if (state->split)
2267 			break;
2268 		/* fall through */
2269 	case 5:
2270 		if (rdev->ops->remain_on_channel &&
2271 		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2272 		    nla_put_u32(msg,
2273 				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2274 				rdev->wiphy.max_remain_on_channel_duration))
2275 			goto nla_put_failure;
2276 
2277 		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2278 		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2279 			goto nla_put_failure;
2280 
2281 		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2282 			goto nla_put_failure;
2283 		state->split_start++;
2284 		if (state->split)
2285 			break;
2286 		/* fall through */
2287 	case 6:
2288 #ifdef CONFIG_PM
2289 		if (nl80211_send_wowlan(msg, rdev, state->split))
2290 			goto nla_put_failure;
2291 		state->split_start++;
2292 		if (state->split)
2293 			break;
2294 #else
2295 		state->split_start++;
2296 #endif
2297 		/* fall through */
2298 	case 7:
2299 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2300 					rdev->wiphy.software_iftypes))
2301 			goto nla_put_failure;
2302 
2303 		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2304 						   state->split))
2305 			goto nla_put_failure;
2306 
2307 		state->split_start++;
2308 		if (state->split)
2309 			break;
2310 		/* fall through */
2311 	case 8:
2312 		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2313 		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2314 				rdev->wiphy.ap_sme_capa))
2315 			goto nla_put_failure;
2316 
2317 		features = rdev->wiphy.features;
2318 		/*
2319 		 * We can only add the per-channel limit information if the
2320 		 * dump is split, otherwise it makes it too big. Therefore
2321 		 * only advertise it in that case.
2322 		 */
2323 		if (state->split)
2324 			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2325 		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2326 			goto nla_put_failure;
2327 
2328 		if (rdev->wiphy.ht_capa_mod_mask &&
2329 		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2330 			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
2331 			    rdev->wiphy.ht_capa_mod_mask))
2332 			goto nla_put_failure;
2333 
2334 		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2335 		    rdev->wiphy.max_acl_mac_addrs &&
2336 		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2337 				rdev->wiphy.max_acl_mac_addrs))
2338 			goto nla_put_failure;
2339 
2340 		/*
2341 		 * Any information below this point is only available to
2342 		 * applications that can deal with it being split. This
2343 		 * helps ensure that newly added capabilities don't break
2344 		 * older tools by overrunning their buffers.
2345 		 *
2346 		 * We still increment split_start so that in the split
2347 		 * case we'll continue with more data in the next round,
2348 		 * but break unconditionally so unsplit data stops here.
2349 		 */
2350 		state->split_start++;
2351 		break;
2352 	case 9:
2353 		if (rdev->wiphy.extended_capabilities &&
2354 		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2355 			     rdev->wiphy.extended_capabilities_len,
2356 			     rdev->wiphy.extended_capabilities) ||
2357 		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2358 			     rdev->wiphy.extended_capabilities_len,
2359 			     rdev->wiphy.extended_capabilities_mask)))
2360 			goto nla_put_failure;
2361 
2362 		if (rdev->wiphy.vht_capa_mod_mask &&
2363 		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2364 			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
2365 			    rdev->wiphy.vht_capa_mod_mask))
2366 			goto nla_put_failure;
2367 
2368 		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2369 			    rdev->wiphy.perm_addr))
2370 			goto nla_put_failure;
2371 
2372 		if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2373 		    nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2374 			    rdev->wiphy.addr_mask))
2375 			goto nla_put_failure;
2376 
2377 		if (rdev->wiphy.n_addresses > 1) {
2378 			void *attr;
2379 
2380 			attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2381 			if (!attr)
2382 				goto nla_put_failure;
2383 
2384 			for (i = 0; i < rdev->wiphy.n_addresses; i++)
2385 				if (nla_put(msg, i + 1, ETH_ALEN,
2386 					    rdev->wiphy.addresses[i].addr))
2387 					goto nla_put_failure;
2388 
2389 			nla_nest_end(msg, attr);
2390 		}
2391 
2392 		state->split_start++;
2393 		break;
2394 	case 10:
2395 		if (nl80211_send_coalesce(msg, rdev))
2396 			goto nla_put_failure;
2397 
2398 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2399 		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2400 		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2401 			goto nla_put_failure;
2402 
2403 		if (rdev->wiphy.max_ap_assoc_sta &&
2404 		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2405 				rdev->wiphy.max_ap_assoc_sta))
2406 			goto nla_put_failure;
2407 
2408 		state->split_start++;
2409 		break;
2410 	case 11:
2411 		if (rdev->wiphy.n_vendor_commands) {
2412 			const struct nl80211_vendor_cmd_info *info;
2413 			struct nlattr *nested;
2414 
2415 			nested = nla_nest_start_noflag(msg,
2416 						       NL80211_ATTR_VENDOR_DATA);
2417 			if (!nested)
2418 				goto nla_put_failure;
2419 
2420 			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2421 				info = &rdev->wiphy.vendor_commands[i].info;
2422 				if (nla_put(msg, i + 1, sizeof(*info), info))
2423 					goto nla_put_failure;
2424 			}
2425 			nla_nest_end(msg, nested);
2426 		}
2427 
2428 		if (rdev->wiphy.n_vendor_events) {
2429 			const struct nl80211_vendor_cmd_info *info;
2430 			struct nlattr *nested;
2431 
2432 			nested = nla_nest_start_noflag(msg,
2433 						       NL80211_ATTR_VENDOR_EVENTS);
2434 			if (!nested)
2435 				goto nla_put_failure;
2436 
2437 			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2438 				info = &rdev->wiphy.vendor_events[i];
2439 				if (nla_put(msg, i + 1, sizeof(*info), info))
2440 					goto nla_put_failure;
2441 			}
2442 			nla_nest_end(msg, nested);
2443 		}
2444 		state->split_start++;
2445 		break;
2446 	case 12:
2447 		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2448 		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2449 			       rdev->wiphy.max_num_csa_counters))
2450 			goto nla_put_failure;
2451 
2452 		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2453 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2454 			goto nla_put_failure;
2455 
2456 		if (rdev->wiphy.max_sched_scan_reqs &&
2457 		    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2458 				rdev->wiphy.max_sched_scan_reqs))
2459 			goto nla_put_failure;
2460 
2461 		if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2462 			    sizeof(rdev->wiphy.ext_features),
2463 			    rdev->wiphy.ext_features))
2464 			goto nla_put_failure;
2465 
2466 		if (rdev->wiphy.bss_select_support) {
2467 			struct nlattr *nested;
2468 			u32 bss_select_support = rdev->wiphy.bss_select_support;
2469 
2470 			nested = nla_nest_start_noflag(msg,
2471 						       NL80211_ATTR_BSS_SELECT);
2472 			if (!nested)
2473 				goto nla_put_failure;
2474 
2475 			i = 0;
2476 			while (bss_select_support) {
2477 				if ((bss_select_support & 1) &&
2478 				    nla_put_flag(msg, i))
2479 					goto nla_put_failure;
2480 				i++;
2481 				bss_select_support >>= 1;
2482 			}
2483 			nla_nest_end(msg, nested);
2484 		}
2485 
2486 		state->split_start++;
2487 		break;
2488 	case 13:
2489 		if (rdev->wiphy.num_iftype_ext_capab &&
2490 		    rdev->wiphy.iftype_ext_capab) {
2491 			struct nlattr *nested_ext_capab, *nested;
2492 
2493 			nested = nla_nest_start_noflag(msg,
2494 						       NL80211_ATTR_IFTYPE_EXT_CAPA);
2495 			if (!nested)
2496 				goto nla_put_failure;
2497 
2498 			for (i = state->capa_start;
2499 			     i < rdev->wiphy.num_iftype_ext_capab; i++) {
2500 				const struct wiphy_iftype_ext_capab *capab;
2501 
2502 				capab = &rdev->wiphy.iftype_ext_capab[i];
2503 
2504 				nested_ext_capab = nla_nest_start_noflag(msg,
2505 									 i);
2506 				if (!nested_ext_capab ||
2507 				    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2508 						capab->iftype) ||
2509 				    nla_put(msg, NL80211_ATTR_EXT_CAPA,
2510 					    capab->extended_capabilities_len,
2511 					    capab->extended_capabilities) ||
2512 				    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2513 					    capab->extended_capabilities_len,
2514 					    capab->extended_capabilities_mask))
2515 					goto nla_put_failure;
2516 
2517 				nla_nest_end(msg, nested_ext_capab);
2518 				if (state->split)
2519 					break;
2520 			}
2521 			nla_nest_end(msg, nested);
2522 			if (i < rdev->wiphy.num_iftype_ext_capab) {
2523 				state->capa_start = i + 1;
2524 				break;
2525 			}
2526 		}
2527 
2528 		if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2529 				rdev->wiphy.nan_supported_bands))
2530 			goto nla_put_failure;
2531 
2532 		if (wiphy_ext_feature_isset(&rdev->wiphy,
2533 					    NL80211_EXT_FEATURE_TXQS)) {
2534 			struct cfg80211_txq_stats txqstats = {};
2535 			int res;
2536 
2537 			res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2538 			if (!res &&
2539 			    !nl80211_put_txq_stats(msg, &txqstats,
2540 						   NL80211_ATTR_TXQ_STATS))
2541 				goto nla_put_failure;
2542 
2543 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2544 					rdev->wiphy.txq_limit))
2545 				goto nla_put_failure;
2546 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2547 					rdev->wiphy.txq_memory_limit))
2548 				goto nla_put_failure;
2549 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2550 					rdev->wiphy.txq_quantum))
2551 				goto nla_put_failure;
2552 		}
2553 
2554 		state->split_start++;
2555 		break;
2556 	case 14:
2557 		if (nl80211_send_pmsr_capa(rdev, msg))
2558 			goto nla_put_failure;
2559 
2560 		state->split_start++;
2561 		break;
2562 	case 15:
2563 		if (rdev->wiphy.akm_suites &&
2564 		    nla_put(msg, NL80211_ATTR_AKM_SUITES,
2565 			    sizeof(u32) * rdev->wiphy.n_akm_suites,
2566 			    rdev->wiphy.akm_suites))
2567 			goto nla_put_failure;
2568 
2569 		if (nl80211_put_iftype_akm_suites(rdev, msg))
2570 			goto nla_put_failure;
2571 
2572 		if (nl80211_put_tid_config_support(rdev, msg))
2573 			goto nla_put_failure;
2574 
2575 		/* done */
2576 		state->split_start = 0;
2577 		break;
2578 	}
2579  finish:
2580 	genlmsg_end(msg, hdr);
2581 	return 0;
2582 
2583  nla_put_failure:
2584 	genlmsg_cancel(msg, hdr);
2585 	return -EMSGSIZE;
2586 }
2587 
2588 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2589 				    struct netlink_callback *cb,
2590 				    struct nl80211_dump_wiphy_state *state)
2591 {
2592 	struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2593 	int ret;
2594 
2595 	if (!tb)
2596 		return -ENOMEM;
2597 
2598 	ret = nlmsg_parse_deprecated(cb->nlh,
2599 				     GENL_HDRLEN + nl80211_fam.hdrsize,
2600 				     tb, nl80211_fam.maxattr,
2601 				     nl80211_policy, NULL);
2602 	/* ignore parse errors for backward compatibility */
2603 	if (ret) {
2604 		ret = 0;
2605 		goto out;
2606 	}
2607 
2608 	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2609 	if (tb[NL80211_ATTR_WIPHY])
2610 		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2611 	if (tb[NL80211_ATTR_WDEV])
2612 		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2613 	if (tb[NL80211_ATTR_IFINDEX]) {
2614 		struct net_device *netdev;
2615 		struct cfg80211_registered_device *rdev;
2616 		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2617 
2618 		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2619 		if (!netdev) {
2620 			ret = -ENODEV;
2621 			goto out;
2622 		}
2623 		if (netdev->ieee80211_ptr) {
2624 			rdev = wiphy_to_rdev(
2625 				netdev->ieee80211_ptr->wiphy);
2626 			state->filter_wiphy = rdev->wiphy_idx;
2627 		}
2628 	}
2629 
2630 	ret = 0;
2631 out:
2632 	kfree(tb);
2633 	return ret;
2634 }
2635 
2636 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2637 {
2638 	int idx = 0, ret;
2639 	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2640 	struct cfg80211_registered_device *rdev;
2641 
2642 	rtnl_lock();
2643 	if (!state) {
2644 		state = kzalloc(sizeof(*state), GFP_KERNEL);
2645 		if (!state) {
2646 			rtnl_unlock();
2647 			return -ENOMEM;
2648 		}
2649 		state->filter_wiphy = -1;
2650 		ret = nl80211_dump_wiphy_parse(skb, cb, state);
2651 		if (ret) {
2652 			kfree(state);
2653 			rtnl_unlock();
2654 			return ret;
2655 		}
2656 		cb->args[0] = (long)state;
2657 	}
2658 
2659 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2660 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2661 			continue;
2662 		if (++idx <= state->start)
2663 			continue;
2664 		if (state->filter_wiphy != -1 &&
2665 		    state->filter_wiphy != rdev->wiphy_idx)
2666 			continue;
2667 		/* attempt to fit multiple wiphy data chunks into the skb */
2668 		do {
2669 			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2670 						 skb,
2671 						 NETLINK_CB(cb->skb).portid,
2672 						 cb->nlh->nlmsg_seq,
2673 						 NLM_F_MULTI, state);
2674 			if (ret < 0) {
2675 				/*
2676 				 * If sending the wiphy data didn't fit (ENOBUFS
2677 				 * or EMSGSIZE returned), this SKB is still
2678 				 * empty (so it's not too big because another
2679 				 * wiphy dataset is already in the skb) and
2680 				 * we've not tried to adjust the dump allocation
2681 				 * yet ... then adjust the alloc size to be
2682 				 * bigger, and return 1 but with the empty skb.
2683 				 * This results in an empty message being RX'ed
2684 				 * in userspace, but that is ignored.
2685 				 *
2686 				 * We can then retry with the larger buffer.
2687 				 */
2688 				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2689 				    !skb->len && !state->split &&
2690 				    cb->min_dump_alloc < 4096) {
2691 					cb->min_dump_alloc = 4096;
2692 					state->split_start = 0;
2693 					rtnl_unlock();
2694 					return 1;
2695 				}
2696 				idx--;
2697 				break;
2698 			}
2699 		} while (state->split_start > 0);
2700 		break;
2701 	}
2702 	rtnl_unlock();
2703 
2704 	state->start = idx;
2705 
2706 	return skb->len;
2707 }
2708 
2709 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2710 {
2711 	kfree((void *)cb->args[0]);
2712 	return 0;
2713 }
2714 
2715 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2716 {
2717 	struct sk_buff *msg;
2718 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2719 	struct nl80211_dump_wiphy_state state = {};
2720 
2721 	msg = nlmsg_new(4096, GFP_KERNEL);
2722 	if (!msg)
2723 		return -ENOMEM;
2724 
2725 	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2726 			       info->snd_portid, info->snd_seq, 0,
2727 			       &state) < 0) {
2728 		nlmsg_free(msg);
2729 		return -ENOBUFS;
2730 	}
2731 
2732 	return genlmsg_reply(msg, info);
2733 }
2734 
2735 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2736 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
2737 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
2738 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
2739 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
2740 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
2741 };
2742 
2743 static int parse_txq_params(struct nlattr *tb[],
2744 			    struct ieee80211_txq_params *txq_params)
2745 {
2746 	u8 ac;
2747 
2748 	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2749 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2750 	    !tb[NL80211_TXQ_ATTR_AIFS])
2751 		return -EINVAL;
2752 
2753 	ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2754 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2755 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2756 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2757 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2758 
2759 	if (ac >= NL80211_NUM_ACS)
2760 		return -EINVAL;
2761 	txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2762 	return 0;
2763 }
2764 
2765 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2766 {
2767 	/*
2768 	 * You can only set the channel explicitly for WDS interfaces,
2769 	 * all others have their channel managed via their respective
2770 	 * "establish a connection" command (connect, join, ...)
2771 	 *
2772 	 * For AP/GO and mesh mode, the channel can be set with the
2773 	 * channel userspace API, but is only stored and passed to the
2774 	 * low-level driver when the AP starts or the mesh is joined.
2775 	 * This is for backward compatibility, userspace can also give
2776 	 * the channel in the start-ap or join-mesh commands instead.
2777 	 *
2778 	 * Monitors are special as they are normally slaved to
2779 	 * whatever else is going on, so they have their own special
2780 	 * operation to set the monitor channel if possible.
2781 	 */
2782 	return !wdev ||
2783 		wdev->iftype == NL80211_IFTYPE_AP ||
2784 		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2785 		wdev->iftype == NL80211_IFTYPE_MONITOR ||
2786 		wdev->iftype == NL80211_IFTYPE_P2P_GO;
2787 }
2788 
2789 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2790 			  struct genl_info *info,
2791 			  struct cfg80211_chan_def *chandef)
2792 {
2793 	struct netlink_ext_ack *extack = info->extack;
2794 	struct nlattr **attrs = info->attrs;
2795 	u32 control_freq;
2796 
2797 	if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2798 		return -EINVAL;
2799 
2800 	control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2801 
2802 	memset(chandef, 0, sizeof(*chandef));
2803 
2804 	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2805 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2806 	chandef->center_freq1 = control_freq;
2807 	chandef->center_freq2 = 0;
2808 
2809 	/* Primary channel not allowed */
2810 	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2811 		NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2812 				    "Channel is disabled");
2813 		return -EINVAL;
2814 	}
2815 
2816 	if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2817 		enum nl80211_channel_type chantype;
2818 
2819 		chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2820 
2821 		switch (chantype) {
2822 		case NL80211_CHAN_NO_HT:
2823 		case NL80211_CHAN_HT20:
2824 		case NL80211_CHAN_HT40PLUS:
2825 		case NL80211_CHAN_HT40MINUS:
2826 			cfg80211_chandef_create(chandef, chandef->chan,
2827 						chantype);
2828 			/* user input for center_freq is incorrect */
2829 			if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2830 			    chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2831 				NL_SET_ERR_MSG_ATTR(extack,
2832 						    attrs[NL80211_ATTR_CENTER_FREQ1],
2833 						    "bad center frequency 1");
2834 				return -EINVAL;
2835 			}
2836 			/* center_freq2 must be zero */
2837 			if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2838 			    nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2839 				NL_SET_ERR_MSG_ATTR(extack,
2840 						    attrs[NL80211_ATTR_CENTER_FREQ2],
2841 						    "center frequency 2 can't be used");
2842 				return -EINVAL;
2843 			}
2844 			break;
2845 		default:
2846 			NL_SET_ERR_MSG_ATTR(extack,
2847 					    attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2848 					    "invalid channel type");
2849 			return -EINVAL;
2850 		}
2851 	} else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2852 		chandef->width =
2853 			nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2854 		if (attrs[NL80211_ATTR_CENTER_FREQ1])
2855 			chandef->center_freq1 =
2856 				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2857 		if (attrs[NL80211_ATTR_CENTER_FREQ2])
2858 			chandef->center_freq2 =
2859 				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2860 	}
2861 
2862 	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
2863 		chandef->edmg.channels =
2864 		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
2865 
2866 		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
2867 			chandef->edmg.bw_config =
2868 		     nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
2869 	} else {
2870 		chandef->edmg.bw_config = 0;
2871 		chandef->edmg.channels = 0;
2872 	}
2873 
2874 	if (!cfg80211_chandef_valid(chandef)) {
2875 		NL_SET_ERR_MSG(extack, "invalid channel definition");
2876 		return -EINVAL;
2877 	}
2878 
2879 	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2880 				     IEEE80211_CHAN_DISABLED)) {
2881 		NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2882 		return -EINVAL;
2883 	}
2884 
2885 	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2886 	     chandef->width == NL80211_CHAN_WIDTH_10) &&
2887 	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2888 		NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2889 		return -EINVAL;
2890 	}
2891 
2892 	return 0;
2893 }
2894 
2895 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2896 				 struct net_device *dev,
2897 				 struct genl_info *info)
2898 {
2899 	struct cfg80211_chan_def chandef;
2900 	int result;
2901 	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2902 	struct wireless_dev *wdev = NULL;
2903 
2904 	if (dev)
2905 		wdev = dev->ieee80211_ptr;
2906 	if (!nl80211_can_set_dev_channel(wdev))
2907 		return -EOPNOTSUPP;
2908 	if (wdev)
2909 		iftype = wdev->iftype;
2910 
2911 	result = nl80211_parse_chandef(rdev, info, &chandef);
2912 	if (result)
2913 		return result;
2914 
2915 	switch (iftype) {
2916 	case NL80211_IFTYPE_AP:
2917 	case NL80211_IFTYPE_P2P_GO:
2918 		if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2919 						   iftype)) {
2920 			result = -EINVAL;
2921 			break;
2922 		}
2923 		if (wdev->beacon_interval) {
2924 			if (!dev || !rdev->ops->set_ap_chanwidth ||
2925 			    !(rdev->wiphy.features &
2926 			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2927 				result = -EBUSY;
2928 				break;
2929 			}
2930 
2931 			/* Only allow dynamic channel width changes */
2932 			if (chandef.chan != wdev->preset_chandef.chan) {
2933 				result = -EBUSY;
2934 				break;
2935 			}
2936 			result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2937 			if (result)
2938 				break;
2939 		}
2940 		wdev->preset_chandef = chandef;
2941 		result = 0;
2942 		break;
2943 	case NL80211_IFTYPE_MESH_POINT:
2944 		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2945 		break;
2946 	case NL80211_IFTYPE_MONITOR:
2947 		result = cfg80211_set_monitor_channel(rdev, &chandef);
2948 		break;
2949 	default:
2950 		result = -EINVAL;
2951 	}
2952 
2953 	return result;
2954 }
2955 
2956 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2957 {
2958 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2959 	struct net_device *netdev = info->user_ptr[1];
2960 
2961 	return __nl80211_set_channel(rdev, netdev, info);
2962 }
2963 
2964 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2965 {
2966 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2967 	struct net_device *dev = info->user_ptr[1];
2968 	struct wireless_dev *wdev = dev->ieee80211_ptr;
2969 	const u8 *bssid;
2970 
2971 	if (!info->attrs[NL80211_ATTR_MAC])
2972 		return -EINVAL;
2973 
2974 	if (netif_running(dev))
2975 		return -EBUSY;
2976 
2977 	if (!rdev->ops->set_wds_peer)
2978 		return -EOPNOTSUPP;
2979 
2980 	if (wdev->iftype != NL80211_IFTYPE_WDS)
2981 		return -EOPNOTSUPP;
2982 
2983 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2984 	return rdev_set_wds_peer(rdev, dev, bssid);
2985 }
2986 
2987 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2988 {
2989 	struct cfg80211_registered_device *rdev;
2990 	struct net_device *netdev = NULL;
2991 	struct wireless_dev *wdev;
2992 	int result = 0, rem_txq_params = 0;
2993 	struct nlattr *nl_txq_params;
2994 	u32 changed;
2995 	u8 retry_short = 0, retry_long = 0;
2996 	u32 frag_threshold = 0, rts_threshold = 0;
2997 	u8 coverage_class = 0;
2998 	u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2999 
3000 	ASSERT_RTNL();
3001 
3002 	/*
3003 	 * Try to find the wiphy and netdev. Normally this
3004 	 * function shouldn't need the netdev, but this is
3005 	 * done for backward compatibility -- previously
3006 	 * setting the channel was done per wiphy, but now
3007 	 * it is per netdev. Previous userland like hostapd
3008 	 * also passed a netdev to set_wiphy, so that it is
3009 	 * possible to let that go to the right netdev!
3010 	 */
3011 
3012 	if (info->attrs[NL80211_ATTR_IFINDEX]) {
3013 		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3014 
3015 		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3016 		if (netdev && netdev->ieee80211_ptr)
3017 			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3018 		else
3019 			netdev = NULL;
3020 	}
3021 
3022 	if (!netdev) {
3023 		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3024 						  info->attrs);
3025 		if (IS_ERR(rdev))
3026 			return PTR_ERR(rdev);
3027 		wdev = NULL;
3028 		netdev = NULL;
3029 		result = 0;
3030 	} else
3031 		wdev = netdev->ieee80211_ptr;
3032 
3033 	/*
3034 	 * end workaround code, by now the rdev is available
3035 	 * and locked, and wdev may or may not be NULL.
3036 	 */
3037 
3038 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3039 		result = cfg80211_dev_rename(
3040 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3041 
3042 	if (result)
3043 		return result;
3044 
3045 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3046 		struct ieee80211_txq_params txq_params;
3047 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3048 
3049 		if (!rdev->ops->set_txq_params)
3050 			return -EOPNOTSUPP;
3051 
3052 		if (!netdev)
3053 			return -EINVAL;
3054 
3055 		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3056 		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3057 			return -EINVAL;
3058 
3059 		if (!netif_running(netdev))
3060 			return -ENETDOWN;
3061 
3062 		nla_for_each_nested(nl_txq_params,
3063 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3064 				    rem_txq_params) {
3065 			result = nla_parse_nested_deprecated(tb,
3066 							     NL80211_TXQ_ATTR_MAX,
3067 							     nl_txq_params,
3068 							     txq_params_policy,
3069 							     info->extack);
3070 			if (result)
3071 				return result;
3072 			result = parse_txq_params(tb, &txq_params);
3073 			if (result)
3074 				return result;
3075 
3076 			result = rdev_set_txq_params(rdev, netdev,
3077 						     &txq_params);
3078 			if (result)
3079 				return result;
3080 		}
3081 	}
3082 
3083 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3084 		result = __nl80211_set_channel(
3085 			rdev,
3086 			nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3087 			info);
3088 		if (result)
3089 			return result;
3090 	}
3091 
3092 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3093 		struct wireless_dev *txp_wdev = wdev;
3094 		enum nl80211_tx_power_setting type;
3095 		int idx, mbm = 0;
3096 
3097 		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3098 			txp_wdev = NULL;
3099 
3100 		if (!rdev->ops->set_tx_power)
3101 			return -EOPNOTSUPP;
3102 
3103 		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3104 		type = nla_get_u32(info->attrs[idx]);
3105 
3106 		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3107 		    (type != NL80211_TX_POWER_AUTOMATIC))
3108 			return -EINVAL;
3109 
3110 		if (type != NL80211_TX_POWER_AUTOMATIC) {
3111 			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3112 			mbm = nla_get_u32(info->attrs[idx]);
3113 		}
3114 
3115 		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3116 		if (result)
3117 			return result;
3118 	}
3119 
3120 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3121 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3122 		u32 tx_ant, rx_ant;
3123 
3124 		if ((!rdev->wiphy.available_antennas_tx &&
3125 		     !rdev->wiphy.available_antennas_rx) ||
3126 		    !rdev->ops->set_antenna)
3127 			return -EOPNOTSUPP;
3128 
3129 		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3130 		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3131 
3132 		/* reject antenna configurations which don't match the
3133 		 * available antenna masks, except for the "all" mask */
3134 		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3135 		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3136 			return -EINVAL;
3137 
3138 		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3139 		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3140 
3141 		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3142 		if (result)
3143 			return result;
3144 	}
3145 
3146 	changed = 0;
3147 
3148 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3149 		retry_short = nla_get_u8(
3150 			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3151 
3152 		changed |= WIPHY_PARAM_RETRY_SHORT;
3153 	}
3154 
3155 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3156 		retry_long = nla_get_u8(
3157 			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3158 
3159 		changed |= WIPHY_PARAM_RETRY_LONG;
3160 	}
3161 
3162 	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3163 		frag_threshold = nla_get_u32(
3164 			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3165 		if (frag_threshold < 256)
3166 			return -EINVAL;
3167 
3168 		if (frag_threshold != (u32) -1) {
3169 			/*
3170 			 * Fragments (apart from the last one) are required to
3171 			 * have even length. Make the fragmentation code
3172 			 * simpler by stripping LSB should someone try to use
3173 			 * odd threshold value.
3174 			 */
3175 			frag_threshold &= ~0x1;
3176 		}
3177 		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3178 	}
3179 
3180 	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3181 		rts_threshold = nla_get_u32(
3182 			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3183 		changed |= WIPHY_PARAM_RTS_THRESHOLD;
3184 	}
3185 
3186 	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3187 		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3188 			return -EINVAL;
3189 
3190 		coverage_class = nla_get_u8(
3191 			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3192 		changed |= WIPHY_PARAM_COVERAGE_CLASS;
3193 	}
3194 
3195 	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3196 		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3197 			return -EOPNOTSUPP;
3198 
3199 		changed |= WIPHY_PARAM_DYN_ACK;
3200 	}
3201 
3202 	if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3203 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3204 					     NL80211_EXT_FEATURE_TXQS))
3205 			return -EOPNOTSUPP;
3206 		txq_limit = nla_get_u32(
3207 			info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3208 		changed |= WIPHY_PARAM_TXQ_LIMIT;
3209 	}
3210 
3211 	if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3212 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3213 					     NL80211_EXT_FEATURE_TXQS))
3214 			return -EOPNOTSUPP;
3215 		txq_memory_limit = nla_get_u32(
3216 			info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3217 		changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3218 	}
3219 
3220 	if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3221 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3222 					     NL80211_EXT_FEATURE_TXQS))
3223 			return -EOPNOTSUPP;
3224 		txq_quantum = nla_get_u32(
3225 			info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3226 		changed |= WIPHY_PARAM_TXQ_QUANTUM;
3227 	}
3228 
3229 	if (changed) {
3230 		u8 old_retry_short, old_retry_long;
3231 		u32 old_frag_threshold, old_rts_threshold;
3232 		u8 old_coverage_class;
3233 		u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3234 
3235 		if (!rdev->ops->set_wiphy_params)
3236 			return -EOPNOTSUPP;
3237 
3238 		old_retry_short = rdev->wiphy.retry_short;
3239 		old_retry_long = rdev->wiphy.retry_long;
3240 		old_frag_threshold = rdev->wiphy.frag_threshold;
3241 		old_rts_threshold = rdev->wiphy.rts_threshold;
3242 		old_coverage_class = rdev->wiphy.coverage_class;
3243 		old_txq_limit = rdev->wiphy.txq_limit;
3244 		old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3245 		old_txq_quantum = rdev->wiphy.txq_quantum;
3246 
3247 		if (changed & WIPHY_PARAM_RETRY_SHORT)
3248 			rdev->wiphy.retry_short = retry_short;
3249 		if (changed & WIPHY_PARAM_RETRY_LONG)
3250 			rdev->wiphy.retry_long = retry_long;
3251 		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3252 			rdev->wiphy.frag_threshold = frag_threshold;
3253 		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3254 			rdev->wiphy.rts_threshold = rts_threshold;
3255 		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3256 			rdev->wiphy.coverage_class = coverage_class;
3257 		if (changed & WIPHY_PARAM_TXQ_LIMIT)
3258 			rdev->wiphy.txq_limit = txq_limit;
3259 		if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3260 			rdev->wiphy.txq_memory_limit = txq_memory_limit;
3261 		if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3262 			rdev->wiphy.txq_quantum = txq_quantum;
3263 
3264 		result = rdev_set_wiphy_params(rdev, changed);
3265 		if (result) {
3266 			rdev->wiphy.retry_short = old_retry_short;
3267 			rdev->wiphy.retry_long = old_retry_long;
3268 			rdev->wiphy.frag_threshold = old_frag_threshold;
3269 			rdev->wiphy.rts_threshold = old_rts_threshold;
3270 			rdev->wiphy.coverage_class = old_coverage_class;
3271 			rdev->wiphy.txq_limit = old_txq_limit;
3272 			rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3273 			rdev->wiphy.txq_quantum = old_txq_quantum;
3274 			return result;
3275 		}
3276 	}
3277 	return 0;
3278 }
3279 
3280 static int nl80211_send_chandef(struct sk_buff *msg,
3281 				const struct cfg80211_chan_def *chandef)
3282 {
3283 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3284 		return -EINVAL;
3285 
3286 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3287 			chandef->chan->center_freq))
3288 		return -ENOBUFS;
3289 	switch (chandef->width) {
3290 	case NL80211_CHAN_WIDTH_20_NOHT:
3291 	case NL80211_CHAN_WIDTH_20:
3292 	case NL80211_CHAN_WIDTH_40:
3293 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3294 				cfg80211_get_chandef_type(chandef)))
3295 			return -ENOBUFS;
3296 		break;
3297 	default:
3298 		break;
3299 	}
3300 	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3301 		return -ENOBUFS;
3302 	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3303 		return -ENOBUFS;
3304 	if (chandef->center_freq2 &&
3305 	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3306 		return -ENOBUFS;
3307 	return 0;
3308 }
3309 
3310 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3311 			      struct cfg80211_registered_device *rdev,
3312 			      struct wireless_dev *wdev,
3313 			      enum nl80211_commands cmd)
3314 {
3315 	struct net_device *dev = wdev->netdev;
3316 	void *hdr;
3317 
3318 	WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3319 		cmd != NL80211_CMD_DEL_INTERFACE &&
3320 		cmd != NL80211_CMD_SET_INTERFACE);
3321 
3322 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3323 	if (!hdr)
3324 		return -1;
3325 
3326 	if (dev &&
3327 	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3328 	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3329 		goto nla_put_failure;
3330 
3331 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3332 	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3333 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3334 			      NL80211_ATTR_PAD) ||
3335 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3336 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
3337 			rdev->devlist_generation ^
3338 			(cfg80211_rdev_list_generation << 2)) ||
3339 	    nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3340 		goto nla_put_failure;
3341 
3342 	if (rdev->ops->get_channel) {
3343 		int ret;
3344 		struct cfg80211_chan_def chandef = {};
3345 
3346 		ret = rdev_get_channel(rdev, wdev, &chandef);
3347 		if (ret == 0) {
3348 			if (nl80211_send_chandef(msg, &chandef))
3349 				goto nla_put_failure;
3350 		}
3351 	}
3352 
3353 	if (rdev->ops->get_tx_power) {
3354 		int dbm, ret;
3355 
3356 		ret = rdev_get_tx_power(rdev, wdev, &dbm);
3357 		if (ret == 0 &&
3358 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3359 				DBM_TO_MBM(dbm)))
3360 			goto nla_put_failure;
3361 	}
3362 
3363 	wdev_lock(wdev);
3364 	switch (wdev->iftype) {
3365 	case NL80211_IFTYPE_AP:
3366 		if (wdev->ssid_len &&
3367 		    nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3368 			goto nla_put_failure_locked;
3369 		break;
3370 	case NL80211_IFTYPE_STATION:
3371 	case NL80211_IFTYPE_P2P_CLIENT:
3372 	case NL80211_IFTYPE_ADHOC: {
3373 		const u8 *ssid_ie;
3374 		if (!wdev->current_bss)
3375 			break;
3376 		rcu_read_lock();
3377 		ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3378 					       WLAN_EID_SSID);
3379 		if (ssid_ie &&
3380 		    nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3381 			goto nla_put_failure_rcu_locked;
3382 		rcu_read_unlock();
3383 		break;
3384 		}
3385 	default:
3386 		/* nothing */
3387 		break;
3388 	}
3389 	wdev_unlock(wdev);
3390 
3391 	if (rdev->ops->get_txq_stats) {
3392 		struct cfg80211_txq_stats txqstats = {};
3393 		int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3394 
3395 		if (ret == 0 &&
3396 		    !nl80211_put_txq_stats(msg, &txqstats,
3397 					   NL80211_ATTR_TXQ_STATS))
3398 			goto nla_put_failure;
3399 	}
3400 
3401 	genlmsg_end(msg, hdr);
3402 	return 0;
3403 
3404  nla_put_failure_rcu_locked:
3405 	rcu_read_unlock();
3406  nla_put_failure_locked:
3407 	wdev_unlock(wdev);
3408  nla_put_failure:
3409 	genlmsg_cancel(msg, hdr);
3410 	return -EMSGSIZE;
3411 }
3412 
3413 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3414 {
3415 	int wp_idx = 0;
3416 	int if_idx = 0;
3417 	int wp_start = cb->args[0];
3418 	int if_start = cb->args[1];
3419 	int filter_wiphy = -1;
3420 	struct cfg80211_registered_device *rdev;
3421 	struct wireless_dev *wdev;
3422 	int ret;
3423 
3424 	rtnl_lock();
3425 	if (!cb->args[2]) {
3426 		struct nl80211_dump_wiphy_state state = {
3427 			.filter_wiphy = -1,
3428 		};
3429 
3430 		ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3431 		if (ret)
3432 			goto out_unlock;
3433 
3434 		filter_wiphy = state.filter_wiphy;
3435 
3436 		/*
3437 		 * if filtering, set cb->args[2] to +1 since 0 is the default
3438 		 * value needed to determine that parsing is necessary.
3439 		 */
3440 		if (filter_wiphy >= 0)
3441 			cb->args[2] = filter_wiphy + 1;
3442 		else
3443 			cb->args[2] = -1;
3444 	} else if (cb->args[2] > 0) {
3445 		filter_wiphy = cb->args[2] - 1;
3446 	}
3447 
3448 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3449 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3450 			continue;
3451 		if (wp_idx < wp_start) {
3452 			wp_idx++;
3453 			continue;
3454 		}
3455 
3456 		if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3457 			continue;
3458 
3459 		if_idx = 0;
3460 
3461 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3462 			if (if_idx < if_start) {
3463 				if_idx++;
3464 				continue;
3465 			}
3466 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3467 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
3468 					       rdev, wdev,
3469 					       NL80211_CMD_NEW_INTERFACE) < 0) {
3470 				goto out;
3471 			}
3472 			if_idx++;
3473 		}
3474 
3475 		wp_idx++;
3476 	}
3477  out:
3478 	cb->args[0] = wp_idx;
3479 	cb->args[1] = if_idx;
3480 
3481 	ret = skb->len;
3482  out_unlock:
3483 	rtnl_unlock();
3484 
3485 	return ret;
3486 }
3487 
3488 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3489 {
3490 	struct sk_buff *msg;
3491 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3492 	struct wireless_dev *wdev = info->user_ptr[1];
3493 
3494 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3495 	if (!msg)
3496 		return -ENOMEM;
3497 
3498 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3499 			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3500 		nlmsg_free(msg);
3501 		return -ENOBUFS;
3502 	}
3503 
3504 	return genlmsg_reply(msg, info);
3505 }
3506 
3507 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3508 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3509 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3510 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3511 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3512 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3513 	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3514 };
3515 
3516 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3517 {
3518 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3519 	int flag;
3520 
3521 	*mntrflags = 0;
3522 
3523 	if (!nla)
3524 		return -EINVAL;
3525 
3526 	if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3527 		return -EINVAL;
3528 
3529 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3530 		if (flags[flag])
3531 			*mntrflags |= (1<<flag);
3532 
3533 	*mntrflags |= MONITOR_FLAG_CHANGED;
3534 
3535 	return 0;
3536 }
3537 
3538 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3539 				     enum nl80211_iftype type,
3540 				     struct genl_info *info,
3541 				     struct vif_params *params)
3542 {
3543 	bool change = false;
3544 	int err;
3545 
3546 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3547 		if (type != NL80211_IFTYPE_MONITOR)
3548 			return -EINVAL;
3549 
3550 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3551 					  &params->flags);
3552 		if (err)
3553 			return err;
3554 
3555 		change = true;
3556 	}
3557 
3558 	if (params->flags & MONITOR_FLAG_ACTIVE &&
3559 	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3560 		return -EOPNOTSUPP;
3561 
3562 	if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3563 		const u8 *mumimo_groups;
3564 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3565 
3566 		if (type != NL80211_IFTYPE_MONITOR)
3567 			return -EINVAL;
3568 
3569 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3570 			return -EOPNOTSUPP;
3571 
3572 		mumimo_groups =
3573 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3574 
3575 		/* bits 0 and 63 are reserved and must be zero */
3576 		if ((mumimo_groups[0] & BIT(0)) ||
3577 		    (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3578 			return -EINVAL;
3579 
3580 		params->vht_mumimo_groups = mumimo_groups;
3581 		change = true;
3582 	}
3583 
3584 	if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3585 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3586 
3587 		if (type != NL80211_IFTYPE_MONITOR)
3588 			return -EINVAL;
3589 
3590 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3591 			return -EOPNOTSUPP;
3592 
3593 		params->vht_mumimo_follow_addr =
3594 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3595 		change = true;
3596 	}
3597 
3598 	return change ? 1 : 0;
3599 }
3600 
3601 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3602 			       struct net_device *netdev, u8 use_4addr,
3603 			       enum nl80211_iftype iftype)
3604 {
3605 	if (!use_4addr) {
3606 		if (netdev && netif_is_bridge_port(netdev))
3607 			return -EBUSY;
3608 		return 0;
3609 	}
3610 
3611 	switch (iftype) {
3612 	case NL80211_IFTYPE_AP_VLAN:
3613 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3614 			return 0;
3615 		break;
3616 	case NL80211_IFTYPE_STATION:
3617 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3618 			return 0;
3619 		break;
3620 	default:
3621 		break;
3622 	}
3623 
3624 	return -EOPNOTSUPP;
3625 }
3626 
3627 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3628 {
3629 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3630 	struct vif_params params;
3631 	int err;
3632 	enum nl80211_iftype otype, ntype;
3633 	struct net_device *dev = info->user_ptr[1];
3634 	bool change = false;
3635 
3636 	memset(&params, 0, sizeof(params));
3637 
3638 	otype = ntype = dev->ieee80211_ptr->iftype;
3639 
3640 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
3641 		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3642 		if (otype != ntype)
3643 			change = true;
3644 	}
3645 
3646 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
3647 		struct wireless_dev *wdev = dev->ieee80211_ptr;
3648 
3649 		if (ntype != NL80211_IFTYPE_MESH_POINT)
3650 			return -EINVAL;
3651 		if (netif_running(dev))
3652 			return -EBUSY;
3653 
3654 		wdev_lock(wdev);
3655 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3656 			     IEEE80211_MAX_MESH_ID_LEN);
3657 		wdev->mesh_id_up_len =
3658 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3659 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3660 		       wdev->mesh_id_up_len);
3661 		wdev_unlock(wdev);
3662 	}
3663 
3664 	if (info->attrs[NL80211_ATTR_4ADDR]) {
3665 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3666 		change = true;
3667 		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3668 		if (err)
3669 			return err;
3670 	} else {
3671 		params.use_4addr = -1;
3672 	}
3673 
3674 	err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3675 	if (err < 0)
3676 		return err;
3677 	if (err > 0)
3678 		change = true;
3679 
3680 	if (change)
3681 		err = cfg80211_change_iface(rdev, dev, ntype, &params);
3682 	else
3683 		err = 0;
3684 
3685 	if (!err && params.use_4addr != -1)
3686 		dev->ieee80211_ptr->use_4addr = params.use_4addr;
3687 
3688 	if (change && !err) {
3689 		struct wireless_dev *wdev = dev->ieee80211_ptr;
3690 
3691 		nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3692 	}
3693 
3694 	return err;
3695 }
3696 
3697 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3698 {
3699 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3700 	struct vif_params params;
3701 	struct wireless_dev *wdev;
3702 	struct sk_buff *msg;
3703 	int err;
3704 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3705 
3706 	/* to avoid failing a new interface creation due to pending removal */
3707 	cfg80211_destroy_ifaces(rdev);
3708 
3709 	memset(&params, 0, sizeof(params));
3710 
3711 	if (!info->attrs[NL80211_ATTR_IFNAME])
3712 		return -EINVAL;
3713 
3714 	if (info->attrs[NL80211_ATTR_IFTYPE])
3715 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3716 
3717 	if (!rdev->ops->add_virtual_intf)
3718 		return -EOPNOTSUPP;
3719 
3720 	if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3721 	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3722 	    info->attrs[NL80211_ATTR_MAC]) {
3723 		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3724 			   ETH_ALEN);
3725 		if (!is_valid_ether_addr(params.macaddr))
3726 			return -EADDRNOTAVAIL;
3727 	}
3728 
3729 	if (info->attrs[NL80211_ATTR_4ADDR]) {
3730 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3731 		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3732 		if (err)
3733 			return err;
3734 	}
3735 
3736 	if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3737 		return -EOPNOTSUPP;
3738 
3739 	err = nl80211_parse_mon_options(rdev, type, info, &params);
3740 	if (err < 0)
3741 		return err;
3742 
3743 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3744 	if (!msg)
3745 		return -ENOMEM;
3746 
3747 	wdev = rdev_add_virtual_intf(rdev,
3748 				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3749 				NET_NAME_USER, type, &params);
3750 	if (WARN_ON(!wdev)) {
3751 		nlmsg_free(msg);
3752 		return -EPROTO;
3753 	} else if (IS_ERR(wdev)) {
3754 		nlmsg_free(msg);
3755 		return PTR_ERR(wdev);
3756 	}
3757 
3758 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3759 		wdev->owner_nlportid = info->snd_portid;
3760 
3761 	switch (type) {
3762 	case NL80211_IFTYPE_MESH_POINT:
3763 		if (!info->attrs[NL80211_ATTR_MESH_ID])
3764 			break;
3765 		wdev_lock(wdev);
3766 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3767 			     IEEE80211_MAX_MESH_ID_LEN);
3768 		wdev->mesh_id_up_len =
3769 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3770 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3771 		       wdev->mesh_id_up_len);
3772 		wdev_unlock(wdev);
3773 		break;
3774 	case NL80211_IFTYPE_NAN:
3775 	case NL80211_IFTYPE_P2P_DEVICE:
3776 		/*
3777 		 * P2P Device and NAN do not have a netdev, so don't go
3778 		 * through the netdev notifier and must be added here
3779 		 */
3780 		cfg80211_init_wdev(rdev, wdev);
3781 		break;
3782 	default:
3783 		break;
3784 	}
3785 
3786 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3787 			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3788 		nlmsg_free(msg);
3789 		return -ENOBUFS;
3790 	}
3791 
3792 	return genlmsg_reply(msg, info);
3793 }
3794 
3795 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3796 {
3797 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3798 	struct wireless_dev *wdev = info->user_ptr[1];
3799 
3800 	if (!rdev->ops->del_virtual_intf)
3801 		return -EOPNOTSUPP;
3802 
3803 	/*
3804 	 * If we remove a wireless device without a netdev then clear
3805 	 * user_ptr[1] so that nl80211_post_doit won't dereference it
3806 	 * to check if it needs to do dev_put(). Otherwise it crashes
3807 	 * since the wdev has been freed, unlike with a netdev where
3808 	 * we need the dev_put() for the netdev to really be freed.
3809 	 */
3810 	if (!wdev->netdev)
3811 		info->user_ptr[1] = NULL;
3812 
3813 	return rdev_del_virtual_intf(rdev, wdev);
3814 }
3815 
3816 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3817 {
3818 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3819 	struct net_device *dev = info->user_ptr[1];
3820 	u16 noack_map;
3821 
3822 	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3823 		return -EINVAL;
3824 
3825 	if (!rdev->ops->set_noack_map)
3826 		return -EOPNOTSUPP;
3827 
3828 	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3829 
3830 	return rdev_set_noack_map(rdev, dev, noack_map);
3831 }
3832 
3833 struct get_key_cookie {
3834 	struct sk_buff *msg;
3835 	int error;
3836 	int idx;
3837 };
3838 
3839 static void get_key_callback(void *c, struct key_params *params)
3840 {
3841 	struct nlattr *key;
3842 	struct get_key_cookie *cookie = c;
3843 
3844 	if ((params->key &&
3845 	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3846 		     params->key_len, params->key)) ||
3847 	    (params->seq &&
3848 	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3849 		     params->seq_len, params->seq)) ||
3850 	    (params->cipher &&
3851 	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3852 			 params->cipher)))
3853 		goto nla_put_failure;
3854 
3855 	key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3856 	if (!key)
3857 		goto nla_put_failure;
3858 
3859 	if ((params->key &&
3860 	     nla_put(cookie->msg, NL80211_KEY_DATA,
3861 		     params->key_len, params->key)) ||
3862 	    (params->seq &&
3863 	     nla_put(cookie->msg, NL80211_KEY_SEQ,
3864 		     params->seq_len, params->seq)) ||
3865 	    (params->cipher &&
3866 	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3867 			 params->cipher)))
3868 		goto nla_put_failure;
3869 
3870 	if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3871 		goto nla_put_failure;
3872 
3873 	nla_nest_end(cookie->msg, key);
3874 
3875 	return;
3876  nla_put_failure:
3877 	cookie->error = 1;
3878 }
3879 
3880 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3881 {
3882 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3883 	int err;
3884 	struct net_device *dev = info->user_ptr[1];
3885 	u8 key_idx = 0;
3886 	const u8 *mac_addr = NULL;
3887 	bool pairwise;
3888 	struct get_key_cookie cookie = {
3889 		.error = 0,
3890 	};
3891 	void *hdr;
3892 	struct sk_buff *msg;
3893 
3894 	if (info->attrs[NL80211_ATTR_KEY_IDX]) {
3895 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3896 		if (key_idx > 5 &&
3897 		    !wiphy_ext_feature_isset(
3898 			    &rdev->wiphy,
3899 			    NL80211_EXT_FEATURE_BEACON_PROTECTION))
3900 			return -EINVAL;
3901 	}
3902 
3903 	if (info->attrs[NL80211_ATTR_MAC])
3904 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3905 
3906 	pairwise = !!mac_addr;
3907 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3908 		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3909 
3910 		if (kt != NL80211_KEYTYPE_GROUP &&
3911 		    kt != NL80211_KEYTYPE_PAIRWISE)
3912 			return -EINVAL;
3913 		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3914 	}
3915 
3916 	if (!rdev->ops->get_key)
3917 		return -EOPNOTSUPP;
3918 
3919 	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3920 		return -ENOENT;
3921 
3922 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3923 	if (!msg)
3924 		return -ENOMEM;
3925 
3926 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3927 			     NL80211_CMD_NEW_KEY);
3928 	if (!hdr)
3929 		goto nla_put_failure;
3930 
3931 	cookie.msg = msg;
3932 	cookie.idx = key_idx;
3933 
3934 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3935 	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3936 		goto nla_put_failure;
3937 	if (mac_addr &&
3938 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3939 		goto nla_put_failure;
3940 
3941 	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3942 			   get_key_callback);
3943 
3944 	if (err)
3945 		goto free_msg;
3946 
3947 	if (cookie.error)
3948 		goto nla_put_failure;
3949 
3950 	genlmsg_end(msg, hdr);
3951 	return genlmsg_reply(msg, info);
3952 
3953  nla_put_failure:
3954 	err = -ENOBUFS;
3955  free_msg:
3956 	nlmsg_free(msg);
3957 	return err;
3958 }
3959 
3960 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3961 {
3962 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3963 	struct key_parse key;
3964 	int err;
3965 	struct net_device *dev = info->user_ptr[1];
3966 
3967 	err = nl80211_parse_key(info, &key);
3968 	if (err)
3969 		return err;
3970 
3971 	if (key.idx < 0)
3972 		return -EINVAL;
3973 
3974 	/* Only support setting default key and
3975 	 * Extended Key ID action NL80211_KEY_SET_TX.
3976 	 */
3977 	if (!key.def && !key.defmgmt && !key.defbeacon &&
3978 	    !(key.p.mode == NL80211_KEY_SET_TX))
3979 		return -EINVAL;
3980 
3981 	wdev_lock(dev->ieee80211_ptr);
3982 
3983 	if (key.def) {
3984 		if (!rdev->ops->set_default_key) {
3985 			err = -EOPNOTSUPP;
3986 			goto out;
3987 		}
3988 
3989 		err = nl80211_key_allowed(dev->ieee80211_ptr);
3990 		if (err)
3991 			goto out;
3992 
3993 		err = rdev_set_default_key(rdev, dev, key.idx,
3994 						 key.def_uni, key.def_multi);
3995 
3996 		if (err)
3997 			goto out;
3998 
3999 #ifdef CONFIG_CFG80211_WEXT
4000 		dev->ieee80211_ptr->wext.default_key = key.idx;
4001 #endif
4002 	} else if (key.defmgmt) {
4003 		if (key.def_uni || !key.def_multi) {
4004 			err = -EINVAL;
4005 			goto out;
4006 		}
4007 
4008 		if (!rdev->ops->set_default_mgmt_key) {
4009 			err = -EOPNOTSUPP;
4010 			goto out;
4011 		}
4012 
4013 		err = nl80211_key_allowed(dev->ieee80211_ptr);
4014 		if (err)
4015 			goto out;
4016 
4017 		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4018 		if (err)
4019 			goto out;
4020 
4021 #ifdef CONFIG_CFG80211_WEXT
4022 		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4023 #endif
4024 	} else if (key.defbeacon) {
4025 		if (key.def_uni || !key.def_multi) {
4026 			err = -EINVAL;
4027 			goto out;
4028 		}
4029 
4030 		if (!rdev->ops->set_default_beacon_key) {
4031 			err = -EOPNOTSUPP;
4032 			goto out;
4033 		}
4034 
4035 		err = nl80211_key_allowed(dev->ieee80211_ptr);
4036 		if (err)
4037 			goto out;
4038 
4039 		err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4040 		if (err)
4041 			goto out;
4042 	} else if (key.p.mode == NL80211_KEY_SET_TX &&
4043 		   wiphy_ext_feature_isset(&rdev->wiphy,
4044 					   NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4045 		u8 *mac_addr = NULL;
4046 
4047 		if (info->attrs[NL80211_ATTR_MAC])
4048 			mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4049 
4050 		if (!mac_addr || key.idx < 0 || key.idx > 1) {
4051 			err = -EINVAL;
4052 			goto out;
4053 		}
4054 
4055 		err = rdev_add_key(rdev, dev, key.idx,
4056 				   NL80211_KEYTYPE_PAIRWISE,
4057 				   mac_addr, &key.p);
4058 	} else {
4059 		err = -EINVAL;
4060 	}
4061  out:
4062 	wdev_unlock(dev->ieee80211_ptr);
4063 
4064 	return err;
4065 }
4066 
4067 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4068 {
4069 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4070 	int err;
4071 	struct net_device *dev = info->user_ptr[1];
4072 	struct key_parse key;
4073 	const u8 *mac_addr = NULL;
4074 
4075 	err = nl80211_parse_key(info, &key);
4076 	if (err)
4077 		return err;
4078 
4079 	if (!key.p.key) {
4080 		GENL_SET_ERR_MSG(info, "no key");
4081 		return -EINVAL;
4082 	}
4083 
4084 	if (info->attrs[NL80211_ATTR_MAC])
4085 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4086 
4087 	if (key.type == -1) {
4088 		if (mac_addr)
4089 			key.type = NL80211_KEYTYPE_PAIRWISE;
4090 		else
4091 			key.type = NL80211_KEYTYPE_GROUP;
4092 	}
4093 
4094 	/* for now */
4095 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4096 	    key.type != NL80211_KEYTYPE_GROUP) {
4097 		GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4098 		return -EINVAL;
4099 	}
4100 
4101 	if (key.type == NL80211_KEYTYPE_GROUP &&
4102 	    info->attrs[NL80211_ATTR_VLAN_ID])
4103 		key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4104 
4105 	if (!rdev->ops->add_key)
4106 		return -EOPNOTSUPP;
4107 
4108 	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4109 					   key.type == NL80211_KEYTYPE_PAIRWISE,
4110 					   mac_addr)) {
4111 		GENL_SET_ERR_MSG(info, "key setting validation failed");
4112 		return -EINVAL;
4113 	}
4114 
4115 	wdev_lock(dev->ieee80211_ptr);
4116 	err = nl80211_key_allowed(dev->ieee80211_ptr);
4117 	if (err)
4118 		GENL_SET_ERR_MSG(info, "key not allowed");
4119 	if (!err) {
4120 		err = rdev_add_key(rdev, dev, key.idx,
4121 				   key.type == NL80211_KEYTYPE_PAIRWISE,
4122 				    mac_addr, &key.p);
4123 		if (err)
4124 			GENL_SET_ERR_MSG(info, "key addition failed");
4125 	}
4126 	wdev_unlock(dev->ieee80211_ptr);
4127 
4128 	return err;
4129 }
4130 
4131 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4132 {
4133 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4134 	int err;
4135 	struct net_device *dev = info->user_ptr[1];
4136 	u8 *mac_addr = NULL;
4137 	struct key_parse key;
4138 
4139 	err = nl80211_parse_key(info, &key);
4140 	if (err)
4141 		return err;
4142 
4143 	if (info->attrs[NL80211_ATTR_MAC])
4144 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4145 
4146 	if (key.type == -1) {
4147 		if (mac_addr)
4148 			key.type = NL80211_KEYTYPE_PAIRWISE;
4149 		else
4150 			key.type = NL80211_KEYTYPE_GROUP;
4151 	}
4152 
4153 	/* for now */
4154 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4155 	    key.type != NL80211_KEYTYPE_GROUP)
4156 		return -EINVAL;
4157 
4158 	if (!rdev->ops->del_key)
4159 		return -EOPNOTSUPP;
4160 
4161 	wdev_lock(dev->ieee80211_ptr);
4162 	err = nl80211_key_allowed(dev->ieee80211_ptr);
4163 
4164 	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4165 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4166 		err = -ENOENT;
4167 
4168 	if (!err)
4169 		err = rdev_del_key(rdev, dev, key.idx,
4170 				   key.type == NL80211_KEYTYPE_PAIRWISE,
4171 				   mac_addr);
4172 
4173 #ifdef CONFIG_CFG80211_WEXT
4174 	if (!err) {
4175 		if (key.idx == dev->ieee80211_ptr->wext.default_key)
4176 			dev->ieee80211_ptr->wext.default_key = -1;
4177 		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4178 			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4179 	}
4180 #endif
4181 	wdev_unlock(dev->ieee80211_ptr);
4182 
4183 	return err;
4184 }
4185 
4186 /* This function returns an error or the number of nested attributes */
4187 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4188 {
4189 	struct nlattr *attr;
4190 	int n_entries = 0, tmp;
4191 
4192 	nla_for_each_nested(attr, nl_attr, tmp) {
4193 		if (nla_len(attr) != ETH_ALEN)
4194 			return -EINVAL;
4195 
4196 		n_entries++;
4197 	}
4198 
4199 	return n_entries;
4200 }
4201 
4202 /*
4203  * This function parses ACL information and allocates memory for ACL data.
4204  * On successful return, the calling function is responsible to free the
4205  * ACL buffer returned by this function.
4206  */
4207 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4208 						struct genl_info *info)
4209 {
4210 	enum nl80211_acl_policy acl_policy;
4211 	struct nlattr *attr;
4212 	struct cfg80211_acl_data *acl;
4213 	int i = 0, n_entries, tmp;
4214 
4215 	if (!wiphy->max_acl_mac_addrs)
4216 		return ERR_PTR(-EOPNOTSUPP);
4217 
4218 	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4219 		return ERR_PTR(-EINVAL);
4220 
4221 	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4222 	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4223 	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4224 		return ERR_PTR(-EINVAL);
4225 
4226 	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4227 		return ERR_PTR(-EINVAL);
4228 
4229 	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4230 	if (n_entries < 0)
4231 		return ERR_PTR(n_entries);
4232 
4233 	if (n_entries > wiphy->max_acl_mac_addrs)
4234 		return ERR_PTR(-ENOTSUPP);
4235 
4236 	acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4237 	if (!acl)
4238 		return ERR_PTR(-ENOMEM);
4239 
4240 	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4241 		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4242 		i++;
4243 	}
4244 
4245 	acl->n_acl_entries = n_entries;
4246 	acl->acl_policy = acl_policy;
4247 
4248 	return acl;
4249 }
4250 
4251 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4252 {
4253 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4254 	struct net_device *dev = info->user_ptr[1];
4255 	struct cfg80211_acl_data *acl;
4256 	int err;
4257 
4258 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4259 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4260 		return -EOPNOTSUPP;
4261 
4262 	if (!dev->ieee80211_ptr->beacon_interval)
4263 		return -EINVAL;
4264 
4265 	acl = parse_acl_data(&rdev->wiphy, info);
4266 	if (IS_ERR(acl))
4267 		return PTR_ERR(acl);
4268 
4269 	err = rdev_set_mac_acl(rdev, dev, acl);
4270 
4271 	kfree(acl);
4272 
4273 	return err;
4274 }
4275 
4276 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4277 			   u8 *rates, u8 rates_len)
4278 {
4279 	u8 i;
4280 	u32 mask = 0;
4281 
4282 	for (i = 0; i < rates_len; i++) {
4283 		int rate = (rates[i] & 0x7f) * 5;
4284 		int ridx;
4285 
4286 		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4287 			struct ieee80211_rate *srate =
4288 				&sband->bitrates[ridx];
4289 			if (rate == srate->bitrate) {
4290 				mask |= 1 << ridx;
4291 				break;
4292 			}
4293 		}
4294 		if (ridx == sband->n_bitrates)
4295 			return 0; /* rate not found */
4296 	}
4297 
4298 	return mask;
4299 }
4300 
4301 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4302 			       u8 *rates, u8 rates_len,
4303 			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4304 {
4305 	u8 i;
4306 
4307 	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4308 
4309 	for (i = 0; i < rates_len; i++) {
4310 		int ridx, rbit;
4311 
4312 		ridx = rates[i] / 8;
4313 		rbit = BIT(rates[i] % 8);
4314 
4315 		/* check validity */
4316 		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4317 			return false;
4318 
4319 		/* check availability */
4320 		ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4321 		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4322 			mcs[ridx] |= rbit;
4323 		else
4324 			return false;
4325 	}
4326 
4327 	return true;
4328 }
4329 
4330 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4331 {
4332 	u16 mcs_mask = 0;
4333 
4334 	switch (vht_mcs_map) {
4335 	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4336 		break;
4337 	case IEEE80211_VHT_MCS_SUPPORT_0_7:
4338 		mcs_mask = 0x00FF;
4339 		break;
4340 	case IEEE80211_VHT_MCS_SUPPORT_0_8:
4341 		mcs_mask = 0x01FF;
4342 		break;
4343 	case IEEE80211_VHT_MCS_SUPPORT_0_9:
4344 		mcs_mask = 0x03FF;
4345 		break;
4346 	default:
4347 		break;
4348 	}
4349 
4350 	return mcs_mask;
4351 }
4352 
4353 static void vht_build_mcs_mask(u16 vht_mcs_map,
4354 			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4355 {
4356 	u8 nss;
4357 
4358 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4359 		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4360 		vht_mcs_map >>= 2;
4361 	}
4362 }
4363 
4364 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4365 			     struct nl80211_txrate_vht *txrate,
4366 			     u16 mcs[NL80211_VHT_NSS_MAX])
4367 {
4368 	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4369 	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4370 	u8 i;
4371 
4372 	if (!sband->vht_cap.vht_supported)
4373 		return false;
4374 
4375 	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4376 
4377 	/* Build vht_mcs_mask from VHT capabilities */
4378 	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4379 
4380 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4381 		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4382 			mcs[i] = txrate->mcs[i];
4383 		else
4384 			return false;
4385 	}
4386 
4387 	return true;
4388 }
4389 
4390 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4391 	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4392 				    .len = NL80211_MAX_SUPP_RATES },
4393 	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4394 				.len = NL80211_MAX_SUPP_HT_RATES },
4395 	[NL80211_TXRATE_VHT] = {
4396 		.type = NLA_EXACT_LEN_WARN,
4397 		.len = sizeof(struct nl80211_txrate_vht),
4398 	},
4399 	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
4400 };
4401 
4402 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4403 					 struct cfg80211_bitrate_mask *mask)
4404 {
4405 	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4406 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4407 	int rem, i;
4408 	struct nlattr *tx_rates;
4409 	struct ieee80211_supported_band *sband;
4410 	u16 vht_tx_mcs_map;
4411 
4412 	memset(mask, 0, sizeof(*mask));
4413 	/* Default to all rates enabled */
4414 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
4415 		sband = rdev->wiphy.bands[i];
4416 
4417 		if (!sband)
4418 			continue;
4419 
4420 		mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4421 		memcpy(mask->control[i].ht_mcs,
4422 		       sband->ht_cap.mcs.rx_mask,
4423 		       sizeof(mask->control[i].ht_mcs));
4424 
4425 		if (!sband->vht_cap.vht_supported)
4426 			continue;
4427 
4428 		vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4429 		vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4430 	}
4431 
4432 	/* if no rates are given set it back to the defaults */
4433 	if (!info->attrs[NL80211_ATTR_TX_RATES])
4434 		goto out;
4435 
4436 	/* The nested attribute uses enum nl80211_band as the index. This maps
4437 	 * directly to the enum nl80211_band values used in cfg80211.
4438 	 */
4439 	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4440 	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4441 		enum nl80211_band band = nla_type(tx_rates);
4442 		int err;
4443 
4444 		if (band < 0 || band >= NUM_NL80211_BANDS)
4445 			return -EINVAL;
4446 		sband = rdev->wiphy.bands[band];
4447 		if (sband == NULL)
4448 			return -EINVAL;
4449 		err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4450 						  tx_rates,
4451 						  nl80211_txattr_policy,
4452 						  info->extack);
4453 		if (err)
4454 			return err;
4455 		if (tb[NL80211_TXRATE_LEGACY]) {
4456 			mask->control[band].legacy = rateset_to_mask(
4457 				sband,
4458 				nla_data(tb[NL80211_TXRATE_LEGACY]),
4459 				nla_len(tb[NL80211_TXRATE_LEGACY]));
4460 			if ((mask->control[band].legacy == 0) &&
4461 			    nla_len(tb[NL80211_TXRATE_LEGACY]))
4462 				return -EINVAL;
4463 		}
4464 		if (tb[NL80211_TXRATE_HT]) {
4465 			if (!ht_rateset_to_mask(
4466 					sband,
4467 					nla_data(tb[NL80211_TXRATE_HT]),
4468 					nla_len(tb[NL80211_TXRATE_HT]),
4469 					mask->control[band].ht_mcs))
4470 				return -EINVAL;
4471 		}
4472 		if (tb[NL80211_TXRATE_VHT]) {
4473 			if (!vht_set_mcs_mask(
4474 					sband,
4475 					nla_data(tb[NL80211_TXRATE_VHT]),
4476 					mask->control[band].vht_mcs))
4477 				return -EINVAL;
4478 		}
4479 		if (tb[NL80211_TXRATE_GI]) {
4480 			mask->control[band].gi =
4481 				nla_get_u8(tb[NL80211_TXRATE_GI]);
4482 			if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4483 				return -EINVAL;
4484 		}
4485 
4486 		if (mask->control[band].legacy == 0) {
4487 			/* don't allow empty legacy rates if HT or VHT
4488 			 * are not even supported.
4489 			 */
4490 			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4491 			      rdev->wiphy.bands[band]->vht_cap.vht_supported))
4492 				return -EINVAL;
4493 
4494 			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4495 				if (mask->control[band].ht_mcs[i])
4496 					goto out;
4497 
4498 			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4499 				if (mask->control[band].vht_mcs[i])
4500 					goto out;
4501 
4502 			/* legacy and mcs rates may not be both empty */
4503 			return -EINVAL;
4504 		}
4505 	}
4506 
4507 out:
4508 	return 0;
4509 }
4510 
4511 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4512 				   enum nl80211_band band,
4513 				   struct cfg80211_bitrate_mask *beacon_rate)
4514 {
4515 	u32 count_ht, count_vht, i;
4516 	u32 rate = beacon_rate->control[band].legacy;
4517 
4518 	/* Allow only one rate */
4519 	if (hweight32(rate) > 1)
4520 		return -EINVAL;
4521 
4522 	count_ht = 0;
4523 	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4524 		if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4525 			return -EINVAL;
4526 		} else if (beacon_rate->control[band].ht_mcs[i]) {
4527 			count_ht++;
4528 			if (count_ht > 1)
4529 				return -EINVAL;
4530 		}
4531 		if (count_ht && rate)
4532 			return -EINVAL;
4533 	}
4534 
4535 	count_vht = 0;
4536 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4537 		if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4538 			return -EINVAL;
4539 		} else if (beacon_rate->control[band].vht_mcs[i]) {
4540 			count_vht++;
4541 			if (count_vht > 1)
4542 				return -EINVAL;
4543 		}
4544 		if (count_vht && rate)
4545 			return -EINVAL;
4546 	}
4547 
4548 	if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4549 		return -EINVAL;
4550 
4551 	if (rate &&
4552 	    !wiphy_ext_feature_isset(&rdev->wiphy,
4553 				     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4554 		return -EINVAL;
4555 	if (count_ht &&
4556 	    !wiphy_ext_feature_isset(&rdev->wiphy,
4557 				     NL80211_EXT_FEATURE_BEACON_RATE_HT))
4558 		return -EINVAL;
4559 	if (count_vht &&
4560 	    !wiphy_ext_feature_isset(&rdev->wiphy,
4561 				     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4562 		return -EINVAL;
4563 
4564 	return 0;
4565 }
4566 
4567 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4568 				struct nlattr *attrs[],
4569 				struct cfg80211_beacon_data *bcn)
4570 {
4571 	bool haveinfo = false;
4572 	int err;
4573 
4574 	memset(bcn, 0, sizeof(*bcn));
4575 
4576 	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4577 		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4578 		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4579 		if (!bcn->head_len)
4580 			return -EINVAL;
4581 		haveinfo = true;
4582 	}
4583 
4584 	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4585 		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4586 		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4587 		haveinfo = true;
4588 	}
4589 
4590 	if (!haveinfo)
4591 		return -EINVAL;
4592 
4593 	if (attrs[NL80211_ATTR_IE]) {
4594 		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4595 		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4596 	}
4597 
4598 	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4599 		bcn->proberesp_ies =
4600 			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4601 		bcn->proberesp_ies_len =
4602 			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4603 	}
4604 
4605 	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4606 		bcn->assocresp_ies =
4607 			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4608 		bcn->assocresp_ies_len =
4609 			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4610 	}
4611 
4612 	if (attrs[NL80211_ATTR_PROBE_RESP]) {
4613 		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4614 		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4615 	}
4616 
4617 	if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4618 		struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4619 
4620 		err = nla_parse_nested_deprecated(tb,
4621 						  NL80211_FTM_RESP_ATTR_MAX,
4622 						  attrs[NL80211_ATTR_FTM_RESPONDER],
4623 						  NULL, NULL);
4624 		if (err)
4625 			return err;
4626 
4627 		if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4628 		    wiphy_ext_feature_isset(&rdev->wiphy,
4629 					    NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4630 			bcn->ftm_responder = 1;
4631 		else
4632 			return -EOPNOTSUPP;
4633 
4634 		if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4635 			bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4636 			bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4637 		}
4638 
4639 		if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4640 			bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4641 			bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4642 		}
4643 	} else {
4644 		bcn->ftm_responder = -1;
4645 	}
4646 
4647 	return 0;
4648 }
4649 
4650 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
4651 				    struct ieee80211_he_obss_pd *he_obss_pd)
4652 {
4653 	struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
4654 	int err;
4655 
4656 	err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
4657 			       he_obss_pd_policy, NULL);
4658 	if (err)
4659 		return err;
4660 
4661 	if (!tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] ||
4662 	    !tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
4663 		return -EINVAL;
4664 
4665 	he_obss_pd->min_offset =
4666 		nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
4667 	he_obss_pd->max_offset =
4668 		nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
4669 
4670 	if (he_obss_pd->min_offset >= he_obss_pd->max_offset)
4671 		return -EINVAL;
4672 
4673 	he_obss_pd->enable = true;
4674 
4675 	return 0;
4676 }
4677 
4678 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
4679 				      struct cfg80211_he_bss_color *he_bss_color)
4680 {
4681 	struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
4682 	int err;
4683 
4684 	err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
4685 			       he_bss_color_policy, NULL);
4686 	if (err)
4687 		return err;
4688 
4689 	if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
4690 		return -EINVAL;
4691 
4692 	he_bss_color->color =
4693 		nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
4694 	he_bss_color->disabled =
4695 		nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
4696 	he_bss_color->partial =
4697 		nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
4698 
4699 	return 0;
4700 }
4701 
4702 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4703 					    const u8 *rates)
4704 {
4705 	int i;
4706 
4707 	if (!rates)
4708 		return;
4709 
4710 	for (i = 0; i < rates[1]; i++) {
4711 		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4712 			params->ht_required = true;
4713 		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4714 			params->vht_required = true;
4715 	}
4716 }
4717 
4718 /*
4719  * Since the nl80211 API didn't include, from the beginning, attributes about
4720  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4721  * benefit of drivers that rebuild IEs in the firmware.
4722  */
4723 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4724 {
4725 	const struct cfg80211_beacon_data *bcn = &params->beacon;
4726 	size_t ies_len = bcn->tail_len;
4727 	const u8 *ies = bcn->tail;
4728 	const u8 *rates;
4729 	const u8 *cap;
4730 
4731 	rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4732 	nl80211_check_ap_rate_selectors(params, rates);
4733 
4734 	rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4735 	nl80211_check_ap_rate_selectors(params, rates);
4736 
4737 	cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4738 	if (cap && cap[1] >= sizeof(*params->ht_cap))
4739 		params->ht_cap = (void *)(cap + 2);
4740 	cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4741 	if (cap && cap[1] >= sizeof(*params->vht_cap))
4742 		params->vht_cap = (void *)(cap + 2);
4743 	cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4744 	if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4745 		params->he_cap = (void *)(cap + 3);
4746 }
4747 
4748 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4749 				   struct cfg80211_ap_settings *params)
4750 {
4751 	struct wireless_dev *wdev;
4752 	bool ret = false;
4753 
4754 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4755 		if (wdev->iftype != NL80211_IFTYPE_AP &&
4756 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
4757 			continue;
4758 
4759 		if (!wdev->preset_chandef.chan)
4760 			continue;
4761 
4762 		params->chandef = wdev->preset_chandef;
4763 		ret = true;
4764 		break;
4765 	}
4766 
4767 	return ret;
4768 }
4769 
4770 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4771 				    enum nl80211_auth_type auth_type,
4772 				    enum nl80211_commands cmd)
4773 {
4774 	if (auth_type > NL80211_AUTHTYPE_MAX)
4775 		return false;
4776 
4777 	switch (cmd) {
4778 	case NL80211_CMD_AUTHENTICATE:
4779 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4780 		    auth_type == NL80211_AUTHTYPE_SAE)
4781 			return false;
4782 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
4783 					     NL80211_EXT_FEATURE_FILS_STA) &&
4784 		    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4785 		     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4786 		     auth_type == NL80211_AUTHTYPE_FILS_PK))
4787 			return false;
4788 		return true;
4789 	case NL80211_CMD_CONNECT:
4790 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4791 		    !wiphy_ext_feature_isset(&rdev->wiphy,
4792 					     NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
4793 		    auth_type == NL80211_AUTHTYPE_SAE)
4794 			return false;
4795 
4796 		/* FILS with SK PFS or PK not supported yet */
4797 		if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4798 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
4799 			return false;
4800 		if (!wiphy_ext_feature_isset(
4801 			    &rdev->wiphy,
4802 			    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4803 		    auth_type == NL80211_AUTHTYPE_FILS_SK)
4804 			return false;
4805 		return true;
4806 	case NL80211_CMD_START_AP:
4807 		/* SAE not supported yet */
4808 		if (auth_type == NL80211_AUTHTYPE_SAE)
4809 			return false;
4810 		/* FILS not supported yet */
4811 		if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4812 		    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4813 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
4814 			return false;
4815 		return true;
4816 	default:
4817 		return false;
4818 	}
4819 }
4820 
4821 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4822 {
4823 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4824 	struct net_device *dev = info->user_ptr[1];
4825 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4826 	struct cfg80211_ap_settings params;
4827 	int err;
4828 
4829 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4830 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4831 		return -EOPNOTSUPP;
4832 
4833 	if (!rdev->ops->start_ap)
4834 		return -EOPNOTSUPP;
4835 
4836 	if (wdev->beacon_interval)
4837 		return -EALREADY;
4838 
4839 	memset(&params, 0, sizeof(params));
4840 
4841 	/* these are required for START_AP */
4842 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4843 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4844 	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
4845 		return -EINVAL;
4846 
4847 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4848 	if (err)
4849 		return err;
4850 
4851 	params.beacon_interval =
4852 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4853 	params.dtim_period =
4854 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4855 
4856 	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4857 					   params.beacon_interval);
4858 	if (err)
4859 		return err;
4860 
4861 	/*
4862 	 * In theory, some of these attributes should be required here
4863 	 * but since they were not used when the command was originally
4864 	 * added, keep them optional for old user space programs to let
4865 	 * them continue to work with drivers that do not need the
4866 	 * additional information -- drivers must check!
4867 	 */
4868 	if (info->attrs[NL80211_ATTR_SSID]) {
4869 		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4870 		params.ssid_len =
4871 			nla_len(info->attrs[NL80211_ATTR_SSID]);
4872 		if (params.ssid_len == 0 ||
4873 		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
4874 			return -EINVAL;
4875 	}
4876 
4877 	if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4878 		params.hidden_ssid = nla_get_u32(
4879 			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4880 
4881 	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4882 
4883 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4884 		params.auth_type = nla_get_u32(
4885 			info->attrs[NL80211_ATTR_AUTH_TYPE]);
4886 		if (!nl80211_valid_auth_type(rdev, params.auth_type,
4887 					     NL80211_CMD_START_AP))
4888 			return -EINVAL;
4889 	} else
4890 		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4891 
4892 	err = nl80211_crypto_settings(rdev, info, &params.crypto,
4893 				      NL80211_MAX_NR_CIPHER_SUITES);
4894 	if (err)
4895 		return err;
4896 
4897 	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4898 		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4899 			return -EOPNOTSUPP;
4900 		params.inactivity_timeout = nla_get_u16(
4901 			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4902 	}
4903 
4904 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4905 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4906 			return -EINVAL;
4907 		params.p2p_ctwindow =
4908 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4909 		if (params.p2p_ctwindow != 0 &&
4910 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4911 			return -EINVAL;
4912 	}
4913 
4914 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4915 		u8 tmp;
4916 
4917 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4918 			return -EINVAL;
4919 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4920 		params.p2p_opp_ps = tmp;
4921 		if (params.p2p_opp_ps != 0 &&
4922 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4923 			return -EINVAL;
4924 	}
4925 
4926 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4927 		err = nl80211_parse_chandef(rdev, info, &params.chandef);
4928 		if (err)
4929 			return err;
4930 	} else if (wdev->preset_chandef.chan) {
4931 		params.chandef = wdev->preset_chandef;
4932 	} else if (!nl80211_get_ap_channel(rdev, &params))
4933 		return -EINVAL;
4934 
4935 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4936 					   wdev->iftype))
4937 		return -EINVAL;
4938 
4939 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
4940 		err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4941 		if (err)
4942 			return err;
4943 
4944 		err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4945 					      &params.beacon_rate);
4946 		if (err)
4947 			return err;
4948 	}
4949 
4950 	if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4951 		params.smps_mode =
4952 			nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4953 		switch (params.smps_mode) {
4954 		case NL80211_SMPS_OFF:
4955 			break;
4956 		case NL80211_SMPS_STATIC:
4957 			if (!(rdev->wiphy.features &
4958 			      NL80211_FEATURE_STATIC_SMPS))
4959 				return -EINVAL;
4960 			break;
4961 		case NL80211_SMPS_DYNAMIC:
4962 			if (!(rdev->wiphy.features &
4963 			      NL80211_FEATURE_DYNAMIC_SMPS))
4964 				return -EINVAL;
4965 			break;
4966 		default:
4967 			return -EINVAL;
4968 		}
4969 	} else {
4970 		params.smps_mode = NL80211_SMPS_OFF;
4971 	}
4972 
4973 	params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4974 	if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4975 		return -EOPNOTSUPP;
4976 
4977 	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4978 		params.acl = parse_acl_data(&rdev->wiphy, info);
4979 		if (IS_ERR(params.acl))
4980 			return PTR_ERR(params.acl);
4981 	}
4982 
4983 	params.twt_responder =
4984 		    nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
4985 
4986 	if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
4987 		err = nl80211_parse_he_obss_pd(
4988 					info->attrs[NL80211_ATTR_HE_OBSS_PD],
4989 					&params.he_obss_pd);
4990 		goto out;
4991 	}
4992 
4993 	if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
4994 		err = nl80211_parse_he_bss_color(
4995 					info->attrs[NL80211_ATTR_HE_BSS_COLOR],
4996 					&params.he_bss_color);
4997 		if (err)
4998 			return err;
4999 	}
5000 
5001 	nl80211_calculate_ap_params(&params);
5002 
5003 	if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5004 		params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5005 
5006 	wdev_lock(wdev);
5007 	err = rdev_start_ap(rdev, dev, &params);
5008 	if (!err) {
5009 		wdev->preset_chandef = params.chandef;
5010 		wdev->beacon_interval = params.beacon_interval;
5011 		wdev->chandef = params.chandef;
5012 		wdev->ssid_len = params.ssid_len;
5013 		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5014 
5015 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5016 			wdev->conn_owner_nlportid = info->snd_portid;
5017 	}
5018 	wdev_unlock(wdev);
5019 
5020 out:
5021 	kfree(params.acl);
5022 
5023 	return err;
5024 }
5025 
5026 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5027 {
5028 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5029 	struct net_device *dev = info->user_ptr[1];
5030 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5031 	struct cfg80211_beacon_data params;
5032 	int err;
5033 
5034 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5035 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5036 		return -EOPNOTSUPP;
5037 
5038 	if (!rdev->ops->change_beacon)
5039 		return -EOPNOTSUPP;
5040 
5041 	if (!wdev->beacon_interval)
5042 		return -EINVAL;
5043 
5044 	err = nl80211_parse_beacon(rdev, info->attrs, &params);
5045 	if (err)
5046 		return err;
5047 
5048 	wdev_lock(wdev);
5049 	err = rdev_change_beacon(rdev, dev, &params);
5050 	wdev_unlock(wdev);
5051 
5052 	return err;
5053 }
5054 
5055 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5056 {
5057 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5058 	struct net_device *dev = info->user_ptr[1];
5059 
5060 	return cfg80211_stop_ap(rdev, dev, false);
5061 }
5062 
5063 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5064 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5065 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5066 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5067 	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5068 	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5069 	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5070 };
5071 
5072 static int parse_station_flags(struct genl_info *info,
5073 			       enum nl80211_iftype iftype,
5074 			       struct station_parameters *params)
5075 {
5076 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5077 	struct nlattr *nla;
5078 	int flag;
5079 
5080 	/*
5081 	 * Try parsing the new attribute first so userspace
5082 	 * can specify both for older kernels.
5083 	 */
5084 	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5085 	if (nla) {
5086 		struct nl80211_sta_flag_update *sta_flags;
5087 
5088 		sta_flags = nla_data(nla);
5089 		params->sta_flags_mask = sta_flags->mask;
5090 		params->sta_flags_set = sta_flags->set;
5091 		params->sta_flags_set &= params->sta_flags_mask;
5092 		if ((params->sta_flags_mask |
5093 		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5094 			return -EINVAL;
5095 		return 0;
5096 	}
5097 
5098 	/* if present, parse the old attribute */
5099 
5100 	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5101 	if (!nla)
5102 		return 0;
5103 
5104 	if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5105 		return -EINVAL;
5106 
5107 	/*
5108 	 * Only allow certain flags for interface types so that
5109 	 * other attributes are silently ignored. Remember that
5110 	 * this is backward compatibility code with old userspace
5111 	 * and shouldn't be hit in other cases anyway.
5112 	 */
5113 	switch (iftype) {
5114 	case NL80211_IFTYPE_AP:
5115 	case NL80211_IFTYPE_AP_VLAN:
5116 	case NL80211_IFTYPE_P2P_GO:
5117 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5118 					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5119 					 BIT(NL80211_STA_FLAG_WME) |
5120 					 BIT(NL80211_STA_FLAG_MFP);
5121 		break;
5122 	case NL80211_IFTYPE_P2P_CLIENT:
5123 	case NL80211_IFTYPE_STATION:
5124 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5125 					 BIT(NL80211_STA_FLAG_TDLS_PEER);
5126 		break;
5127 	case NL80211_IFTYPE_MESH_POINT:
5128 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5129 					 BIT(NL80211_STA_FLAG_MFP) |
5130 					 BIT(NL80211_STA_FLAG_AUTHORIZED);
5131 		break;
5132 	default:
5133 		return -EINVAL;
5134 	}
5135 
5136 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5137 		if (flags[flag]) {
5138 			params->sta_flags_set |= (1<<flag);
5139 
5140 			/* no longer support new API additions in old API */
5141 			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5142 				return -EINVAL;
5143 		}
5144 	}
5145 
5146 	return 0;
5147 }
5148 
5149 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5150 {
5151 	struct nlattr *rate;
5152 	u32 bitrate;
5153 	u16 bitrate_compat;
5154 	enum nl80211_rate_info rate_flg;
5155 
5156 	rate = nla_nest_start_noflag(msg, attr);
5157 	if (!rate)
5158 		return false;
5159 
5160 	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5161 	bitrate = cfg80211_calculate_bitrate(info);
5162 	/* report 16-bit bitrate only if we can */
5163 	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5164 	if (bitrate > 0 &&
5165 	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5166 		return false;
5167 	if (bitrate_compat > 0 &&
5168 	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5169 		return false;
5170 
5171 	switch (info->bw) {
5172 	case RATE_INFO_BW_5:
5173 		rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5174 		break;
5175 	case RATE_INFO_BW_10:
5176 		rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5177 		break;
5178 	default:
5179 		WARN_ON(1);
5180 		/* fall through */
5181 	case RATE_INFO_BW_20:
5182 		rate_flg = 0;
5183 		break;
5184 	case RATE_INFO_BW_40:
5185 		rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5186 		break;
5187 	case RATE_INFO_BW_80:
5188 		rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5189 		break;
5190 	case RATE_INFO_BW_160:
5191 		rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5192 		break;
5193 	case RATE_INFO_BW_HE_RU:
5194 		rate_flg = 0;
5195 		WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5196 	}
5197 
5198 	if (rate_flg && nla_put_flag(msg, rate_flg))
5199 		return false;
5200 
5201 	if (info->flags & RATE_INFO_FLAGS_MCS) {
5202 		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5203 			return false;
5204 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5205 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5206 			return false;
5207 	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5208 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5209 			return false;
5210 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5211 			return false;
5212 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5213 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5214 			return false;
5215 	} else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5216 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5217 			return false;
5218 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5219 			return false;
5220 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5221 			return false;
5222 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5223 			return false;
5224 		if (info->bw == RATE_INFO_BW_HE_RU &&
5225 		    nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5226 			       info->he_ru_alloc))
5227 			return false;
5228 	}
5229 
5230 	nla_nest_end(msg, rate);
5231 	return true;
5232 }
5233 
5234 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5235 			       int id)
5236 {
5237 	void *attr;
5238 	int i = 0;
5239 
5240 	if (!mask)
5241 		return true;
5242 
5243 	attr = nla_nest_start_noflag(msg, id);
5244 	if (!attr)
5245 		return false;
5246 
5247 	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5248 		if (!(mask & BIT(i)))
5249 			continue;
5250 
5251 		if (nla_put_u8(msg, i, signal[i]))
5252 			return false;
5253 	}
5254 
5255 	nla_nest_end(msg, attr);
5256 
5257 	return true;
5258 }
5259 
5260 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5261 				u32 seq, int flags,
5262 				struct cfg80211_registered_device *rdev,
5263 				struct net_device *dev,
5264 				const u8 *mac_addr, struct station_info *sinfo)
5265 {
5266 	void *hdr;
5267 	struct nlattr *sinfoattr, *bss_param;
5268 
5269 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5270 	if (!hdr) {
5271 		cfg80211_sinfo_release_content(sinfo);
5272 		return -1;
5273 	}
5274 
5275 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5276 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5277 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5278 		goto nla_put_failure;
5279 
5280 	sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5281 	if (!sinfoattr)
5282 		goto nla_put_failure;
5283 
5284 #define PUT_SINFO(attr, memb, type) do {				\
5285 	BUILD_BUG_ON(sizeof(type) == sizeof(u64));			\
5286 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
5287 	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
5288 			     sinfo->memb))				\
5289 		goto nla_put_failure;					\
5290 	} while (0)
5291 #define PUT_SINFO_U64(attr, memb) do {					\
5292 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
5293 	    nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,		\
5294 			      sinfo->memb, NL80211_STA_INFO_PAD))	\
5295 		goto nla_put_failure;					\
5296 	} while (0)
5297 
5298 	PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5299 	PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5300 	PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5301 
5302 	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5303 			     BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5304 	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5305 			(u32)sinfo->rx_bytes))
5306 		goto nla_put_failure;
5307 
5308 	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5309 			     BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5310 	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5311 			(u32)sinfo->tx_bytes))
5312 		goto nla_put_failure;
5313 
5314 	PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5315 	PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5316 	PUT_SINFO(LLID, llid, u16);
5317 	PUT_SINFO(PLID, plid, u16);
5318 	PUT_SINFO(PLINK_STATE, plink_state, u8);
5319 	PUT_SINFO_U64(RX_DURATION, rx_duration);
5320 	PUT_SINFO_U64(TX_DURATION, tx_duration);
5321 
5322 	if (wiphy_ext_feature_isset(&rdev->wiphy,
5323 				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5324 		PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5325 
5326 	switch (rdev->wiphy.signal_type) {
5327 	case CFG80211_SIGNAL_TYPE_MBM:
5328 		PUT_SINFO(SIGNAL, signal, u8);
5329 		PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5330 		break;
5331 	default:
5332 		break;
5333 	}
5334 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5335 		if (!nl80211_put_signal(msg, sinfo->chains,
5336 					sinfo->chain_signal,
5337 					NL80211_STA_INFO_CHAIN_SIGNAL))
5338 			goto nla_put_failure;
5339 	}
5340 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5341 		if (!nl80211_put_signal(msg, sinfo->chains,
5342 					sinfo->chain_signal_avg,
5343 					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5344 			goto nla_put_failure;
5345 	}
5346 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5347 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5348 					  NL80211_STA_INFO_TX_BITRATE))
5349 			goto nla_put_failure;
5350 	}
5351 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5352 		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5353 					  NL80211_STA_INFO_RX_BITRATE))
5354 			goto nla_put_failure;
5355 	}
5356 
5357 	PUT_SINFO(RX_PACKETS, rx_packets, u32);
5358 	PUT_SINFO(TX_PACKETS, tx_packets, u32);
5359 	PUT_SINFO(TX_RETRIES, tx_retries, u32);
5360 	PUT_SINFO(TX_FAILED, tx_failed, u32);
5361 	PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5362 	PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5363 	PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5364 	PUT_SINFO(LOCAL_PM, local_pm, u32);
5365 	PUT_SINFO(PEER_PM, peer_pm, u32);
5366 	PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5367 	PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5368 
5369 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5370 		bss_param = nla_nest_start_noflag(msg,
5371 						  NL80211_STA_INFO_BSS_PARAM);
5372 		if (!bss_param)
5373 			goto nla_put_failure;
5374 
5375 		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5376 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5377 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5378 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5379 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5380 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5381 		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5382 			       sinfo->bss_param.dtim_period) ||
5383 		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5384 				sinfo->bss_param.beacon_interval))
5385 			goto nla_put_failure;
5386 
5387 		nla_nest_end(msg, bss_param);
5388 	}
5389 	if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5390 	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5391 		    sizeof(struct nl80211_sta_flag_update),
5392 		    &sinfo->sta_flags))
5393 		goto nla_put_failure;
5394 
5395 	PUT_SINFO_U64(T_OFFSET, t_offset);
5396 	PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5397 	PUT_SINFO_U64(BEACON_RX, rx_beacon);
5398 	PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5399 	PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5400 	PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5401 	if (wiphy_ext_feature_isset(&rdev->wiphy,
5402 				    NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5403 		PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5404 		PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5405 	}
5406 
5407 #undef PUT_SINFO
5408 #undef PUT_SINFO_U64
5409 
5410 	if (sinfo->pertid) {
5411 		struct nlattr *tidsattr;
5412 		int tid;
5413 
5414 		tidsattr = nla_nest_start_noflag(msg,
5415 						 NL80211_STA_INFO_TID_STATS);
5416 		if (!tidsattr)
5417 			goto nla_put_failure;
5418 
5419 		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5420 			struct cfg80211_tid_stats *tidstats;
5421 			struct nlattr *tidattr;
5422 
5423 			tidstats = &sinfo->pertid[tid];
5424 
5425 			if (!tidstats->filled)
5426 				continue;
5427 
5428 			tidattr = nla_nest_start_noflag(msg, tid + 1);
5429 			if (!tidattr)
5430 				goto nla_put_failure;
5431 
5432 #define PUT_TIDVAL_U64(attr, memb) do {					\
5433 	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
5434 	    nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,		\
5435 			      tidstats->memb, NL80211_TID_STATS_PAD))	\
5436 		goto nla_put_failure;					\
5437 	} while (0)
5438 
5439 			PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5440 			PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5441 			PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5442 			PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5443 
5444 #undef PUT_TIDVAL_U64
5445 			if ((tidstats->filled &
5446 			     BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5447 			    !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5448 						   NL80211_TID_STATS_TXQ_STATS))
5449 				goto nla_put_failure;
5450 
5451 			nla_nest_end(msg, tidattr);
5452 		}
5453 
5454 		nla_nest_end(msg, tidsattr);
5455 	}
5456 
5457 	nla_nest_end(msg, sinfoattr);
5458 
5459 	if (sinfo->assoc_req_ies_len &&
5460 	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5461 		    sinfo->assoc_req_ies))
5462 		goto nla_put_failure;
5463 
5464 	cfg80211_sinfo_release_content(sinfo);
5465 	genlmsg_end(msg, hdr);
5466 	return 0;
5467 
5468  nla_put_failure:
5469 	cfg80211_sinfo_release_content(sinfo);
5470 	genlmsg_cancel(msg, hdr);
5471 	return -EMSGSIZE;
5472 }
5473 
5474 static int nl80211_dump_station(struct sk_buff *skb,
5475 				struct netlink_callback *cb)
5476 {
5477 	struct station_info sinfo;
5478 	struct cfg80211_registered_device *rdev;
5479 	struct wireless_dev *wdev;
5480 	u8 mac_addr[ETH_ALEN];
5481 	int sta_idx = cb->args[2];
5482 	int err;
5483 
5484 	rtnl_lock();
5485 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5486 	if (err)
5487 		goto out_err;
5488 
5489 	if (!wdev->netdev) {
5490 		err = -EINVAL;
5491 		goto out_err;
5492 	}
5493 
5494 	if (!rdev->ops->dump_station) {
5495 		err = -EOPNOTSUPP;
5496 		goto out_err;
5497 	}
5498 
5499 	while (1) {
5500 		memset(&sinfo, 0, sizeof(sinfo));
5501 		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5502 					mac_addr, &sinfo);
5503 		if (err == -ENOENT)
5504 			break;
5505 		if (err)
5506 			goto out_err;
5507 
5508 		if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5509 				NETLINK_CB(cb->skb).portid,
5510 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
5511 				rdev, wdev->netdev, mac_addr,
5512 				&sinfo) < 0)
5513 			goto out;
5514 
5515 		sta_idx++;
5516 	}
5517 
5518  out:
5519 	cb->args[2] = sta_idx;
5520 	err = skb->len;
5521  out_err:
5522 	rtnl_unlock();
5523 
5524 	return err;
5525 }
5526 
5527 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5528 {
5529 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5530 	struct net_device *dev = info->user_ptr[1];
5531 	struct station_info sinfo;
5532 	struct sk_buff *msg;
5533 	u8 *mac_addr = NULL;
5534 	int err;
5535 
5536 	memset(&sinfo, 0, sizeof(sinfo));
5537 
5538 	if (!info->attrs[NL80211_ATTR_MAC])
5539 		return -EINVAL;
5540 
5541 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5542 
5543 	if (!rdev->ops->get_station)
5544 		return -EOPNOTSUPP;
5545 
5546 	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5547 	if (err)
5548 		return err;
5549 
5550 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5551 	if (!msg) {
5552 		cfg80211_sinfo_release_content(&sinfo);
5553 		return -ENOMEM;
5554 	}
5555 
5556 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5557 				 info->snd_portid, info->snd_seq, 0,
5558 				 rdev, dev, mac_addr, &sinfo) < 0) {
5559 		nlmsg_free(msg);
5560 		return -ENOBUFS;
5561 	}
5562 
5563 	return genlmsg_reply(msg, info);
5564 }
5565 
5566 int cfg80211_check_station_change(struct wiphy *wiphy,
5567 				  struct station_parameters *params,
5568 				  enum cfg80211_station_type statype)
5569 {
5570 	if (params->listen_interval != -1 &&
5571 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5572 		return -EINVAL;
5573 
5574 	if (params->support_p2p_ps != -1 &&
5575 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5576 		return -EINVAL;
5577 
5578 	if (params->aid &&
5579 	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5580 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5581 		return -EINVAL;
5582 
5583 	/* When you run into this, adjust the code below for the new flag */
5584 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5585 
5586 	switch (statype) {
5587 	case CFG80211_STA_MESH_PEER_KERNEL:
5588 	case CFG80211_STA_MESH_PEER_USER:
5589 		/*
5590 		 * No ignoring the TDLS flag here -- the userspace mesh
5591 		 * code doesn't have the bug of including TDLS in the
5592 		 * mask everywhere.
5593 		 */
5594 		if (params->sta_flags_mask &
5595 				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5596 				  BIT(NL80211_STA_FLAG_MFP) |
5597 				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
5598 			return -EINVAL;
5599 		break;
5600 	case CFG80211_STA_TDLS_PEER_SETUP:
5601 	case CFG80211_STA_TDLS_PEER_ACTIVE:
5602 		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5603 			return -EINVAL;
5604 		/* ignore since it can't change */
5605 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5606 		break;
5607 	default:
5608 		/* disallow mesh-specific things */
5609 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5610 			return -EINVAL;
5611 		if (params->local_pm)
5612 			return -EINVAL;
5613 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5614 			return -EINVAL;
5615 	}
5616 
5617 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5618 	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5619 		/* TDLS can't be set, ... */
5620 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5621 			return -EINVAL;
5622 		/*
5623 		 * ... but don't bother the driver with it. This works around
5624 		 * a hostapd/wpa_supplicant issue -- it always includes the
5625 		 * TLDS_PEER flag in the mask even for AP mode.
5626 		 */
5627 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5628 	}
5629 
5630 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5631 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5632 		/* reject other things that can't change */
5633 		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5634 			return -EINVAL;
5635 		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5636 			return -EINVAL;
5637 		if (params->supported_rates)
5638 			return -EINVAL;
5639 		if (params->ext_capab || params->ht_capa || params->vht_capa ||
5640 		    params->he_capa)
5641 			return -EINVAL;
5642 	}
5643 
5644 	if (statype != CFG80211_STA_AP_CLIENT &&
5645 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5646 		if (params->vlan)
5647 			return -EINVAL;
5648 	}
5649 
5650 	switch (statype) {
5651 	case CFG80211_STA_AP_MLME_CLIENT:
5652 		/* Use this only for authorizing/unauthorizing a station */
5653 		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5654 			return -EOPNOTSUPP;
5655 		break;
5656 	case CFG80211_STA_AP_CLIENT:
5657 	case CFG80211_STA_AP_CLIENT_UNASSOC:
5658 		/* accept only the listed bits */
5659 		if (params->sta_flags_mask &
5660 				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5661 				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5662 				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
5663 				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5664 				  BIT(NL80211_STA_FLAG_WME) |
5665 				  BIT(NL80211_STA_FLAG_MFP)))
5666 			return -EINVAL;
5667 
5668 		/* but authenticated/associated only if driver handles it */
5669 		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5670 		    params->sta_flags_mask &
5671 				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5672 				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
5673 			return -EINVAL;
5674 		break;
5675 	case CFG80211_STA_IBSS:
5676 	case CFG80211_STA_AP_STA:
5677 		/* reject any changes other than AUTHORIZED */
5678 		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5679 			return -EINVAL;
5680 		break;
5681 	case CFG80211_STA_TDLS_PEER_SETUP:
5682 		/* reject any changes other than AUTHORIZED or WME */
5683 		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5684 					       BIT(NL80211_STA_FLAG_WME)))
5685 			return -EINVAL;
5686 		/* force (at least) rates when authorizing */
5687 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5688 		    !params->supported_rates)
5689 			return -EINVAL;
5690 		break;
5691 	case CFG80211_STA_TDLS_PEER_ACTIVE:
5692 		/* reject any changes */
5693 		return -EINVAL;
5694 	case CFG80211_STA_MESH_PEER_KERNEL:
5695 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5696 			return -EINVAL;
5697 		break;
5698 	case CFG80211_STA_MESH_PEER_USER:
5699 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5700 		    params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5701 			return -EINVAL;
5702 		break;
5703 	}
5704 
5705 	/*
5706 	 * Older kernel versions ignored this attribute entirely, so don't
5707 	 * reject attempts to update it but mark it as unused instead so the
5708 	 * driver won't look at the data.
5709 	 */
5710 	if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5711 	    statype != CFG80211_STA_TDLS_PEER_SETUP)
5712 		params->opmode_notif_used = false;
5713 
5714 	return 0;
5715 }
5716 EXPORT_SYMBOL(cfg80211_check_station_change);
5717 
5718 /*
5719  * Get vlan interface making sure it is running and on the right wiphy.
5720  */
5721 static struct net_device *get_vlan(struct genl_info *info,
5722 				   struct cfg80211_registered_device *rdev)
5723 {
5724 	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5725 	struct net_device *v;
5726 	int ret;
5727 
5728 	if (!vlanattr)
5729 		return NULL;
5730 
5731 	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5732 	if (!v)
5733 		return ERR_PTR(-ENODEV);
5734 
5735 	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5736 		ret = -EINVAL;
5737 		goto error;
5738 	}
5739 
5740 	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5741 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5742 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5743 		ret = -EINVAL;
5744 		goto error;
5745 	}
5746 
5747 	if (!netif_running(v)) {
5748 		ret = -ENETDOWN;
5749 		goto error;
5750 	}
5751 
5752 	return v;
5753  error:
5754 	dev_put(v);
5755 	return ERR_PTR(ret);
5756 }
5757 
5758 static const struct nla_policy
5759 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5760 	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5761 	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5762 };
5763 
5764 static int nl80211_parse_sta_wme(struct genl_info *info,
5765 				 struct station_parameters *params)
5766 {
5767 	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5768 	struct nlattr *nla;
5769 	int err;
5770 
5771 	/* parse WME attributes if present */
5772 	if (!info->attrs[NL80211_ATTR_STA_WME])
5773 		return 0;
5774 
5775 	nla = info->attrs[NL80211_ATTR_STA_WME];
5776 	err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
5777 					  nl80211_sta_wme_policy,
5778 					  info->extack);
5779 	if (err)
5780 		return err;
5781 
5782 	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5783 		params->uapsd_queues = nla_get_u8(
5784 			tb[NL80211_STA_WME_UAPSD_QUEUES]);
5785 	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5786 		return -EINVAL;
5787 
5788 	if (tb[NL80211_STA_WME_MAX_SP])
5789 		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5790 
5791 	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5792 		return -EINVAL;
5793 
5794 	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5795 
5796 	return 0;
5797 }
5798 
5799 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5800 				      struct station_parameters *params)
5801 {
5802 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5803 		params->supported_channels =
5804 		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5805 		params->supported_channels_len =
5806 		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5807 		/*
5808 		 * Need to include at least one (first channel, number of
5809 		 * channels) tuple for each subband, and must have proper
5810 		 * tuples for the rest of the data as well.
5811 		 */
5812 		if (params->supported_channels_len < 2)
5813 			return -EINVAL;
5814 		if (params->supported_channels_len % 2)
5815 			return -EINVAL;
5816 	}
5817 
5818 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5819 		params->supported_oper_classes =
5820 		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5821 		params->supported_oper_classes_len =
5822 		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5823 		/*
5824 		 * The value of the Length field of the Supported Operating
5825 		 * Classes element is between 2 and 253.
5826 		 */
5827 		if (params->supported_oper_classes_len < 2 ||
5828 		    params->supported_oper_classes_len > 253)
5829 			return -EINVAL;
5830 	}
5831 	return 0;
5832 }
5833 
5834 static int nl80211_set_station_tdls(struct genl_info *info,
5835 				    struct station_parameters *params)
5836 {
5837 	int err;
5838 	/* Dummy STA entry gets updated once the peer capabilities are known */
5839 	if (info->attrs[NL80211_ATTR_PEER_AID])
5840 		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5841 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5842 		params->ht_capa =
5843 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5844 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5845 		params->vht_capa =
5846 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5847 	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5848 		params->he_capa =
5849 			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5850 		params->he_capa_len =
5851 			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5852 
5853 		if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5854 			return -EINVAL;
5855 	}
5856 
5857 	err = nl80211_parse_sta_channel_info(info, params);
5858 	if (err)
5859 		return err;
5860 
5861 	return nl80211_parse_sta_wme(info, params);
5862 }
5863 
5864 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
5865 					     struct station_parameters *params)
5866 {
5867 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5868 	int idx;
5869 
5870 	if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
5871 		if (!rdev->ops->set_tx_power ||
5872 		    !wiphy_ext_feature_isset(&rdev->wiphy,
5873 					 NL80211_EXT_FEATURE_STA_TX_PWR))
5874 			return -EOPNOTSUPP;
5875 
5876 		idx = NL80211_ATTR_STA_TX_POWER_SETTING;
5877 		params->txpwr.type = nla_get_u8(info->attrs[idx]);
5878 
5879 		if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
5880 			idx = NL80211_ATTR_STA_TX_POWER;
5881 
5882 			if (info->attrs[idx])
5883 				params->txpwr.power =
5884 					nla_get_s16(info->attrs[idx]);
5885 			else
5886 				return -EINVAL;
5887 		}
5888 		params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
5889 	}
5890 
5891 	return 0;
5892 }
5893 
5894 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5895 {
5896 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5897 	struct net_device *dev = info->user_ptr[1];
5898 	struct station_parameters params;
5899 	u8 *mac_addr;
5900 	int err;
5901 
5902 	memset(&params, 0, sizeof(params));
5903 
5904 	if (!rdev->ops->change_station)
5905 		return -EOPNOTSUPP;
5906 
5907 	/*
5908 	 * AID and listen_interval properties can be set only for unassociated
5909 	 * station. Include these parameters here and will check them in
5910 	 * cfg80211_check_station_change().
5911 	 */
5912 	if (info->attrs[NL80211_ATTR_STA_AID])
5913 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5914 
5915 	if (info->attrs[NL80211_ATTR_VLAN_ID])
5916 		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
5917 
5918 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5919 		params.listen_interval =
5920 		     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5921 	else
5922 		params.listen_interval = -1;
5923 
5924 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5925 		params.support_p2p_ps =
5926 			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5927 	else
5928 		params.support_p2p_ps = -1;
5929 
5930 	if (!info->attrs[NL80211_ATTR_MAC])
5931 		return -EINVAL;
5932 
5933 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5934 
5935 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5936 		params.supported_rates =
5937 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5938 		params.supported_rates_len =
5939 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5940 	}
5941 
5942 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5943 		params.capability =
5944 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5945 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5946 	}
5947 
5948 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5949 		params.ext_capab =
5950 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5951 		params.ext_capab_len =
5952 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5953 	}
5954 
5955 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5956 		return -EINVAL;
5957 
5958 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5959 		params.plink_action =
5960 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5961 
5962 	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5963 		params.plink_state =
5964 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5965 		if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5966 			params.peer_aid = nla_get_u16(
5967 				info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5968 		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5969 	}
5970 
5971 	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5972 		params.local_pm = nla_get_u32(
5973 			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5974 
5975 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5976 		params.opmode_notif_used = true;
5977 		params.opmode_notif =
5978 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5979 	}
5980 
5981 	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5982 		params.airtime_weight =
5983 			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5984 
5985 	if (params.airtime_weight &&
5986 	    !wiphy_ext_feature_isset(&rdev->wiphy,
5987 				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5988 		return -EOPNOTSUPP;
5989 
5990 	err = nl80211_parse_sta_txpower_setting(info, &params);
5991 	if (err)
5992 		return err;
5993 
5994 	/* Include parameters for TDLS peer (will check later) */
5995 	err = nl80211_set_station_tdls(info, &params);
5996 	if (err)
5997 		return err;
5998 
5999 	params.vlan = get_vlan(info, rdev);
6000 	if (IS_ERR(params.vlan))
6001 		return PTR_ERR(params.vlan);
6002 
6003 	switch (dev->ieee80211_ptr->iftype) {
6004 	case NL80211_IFTYPE_AP:
6005 	case NL80211_IFTYPE_AP_VLAN:
6006 	case NL80211_IFTYPE_P2P_GO:
6007 	case NL80211_IFTYPE_P2P_CLIENT:
6008 	case NL80211_IFTYPE_STATION:
6009 	case NL80211_IFTYPE_ADHOC:
6010 	case NL80211_IFTYPE_MESH_POINT:
6011 		break;
6012 	default:
6013 		err = -EOPNOTSUPP;
6014 		goto out_put_vlan;
6015 	}
6016 
6017 	/* driver will call cfg80211_check_station_change() */
6018 	err = rdev_change_station(rdev, dev, mac_addr, &params);
6019 
6020  out_put_vlan:
6021 	if (params.vlan)
6022 		dev_put(params.vlan);
6023 
6024 	return err;
6025 }
6026 
6027 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6028 {
6029 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6030 	int err;
6031 	struct net_device *dev = info->user_ptr[1];
6032 	struct station_parameters params;
6033 	u8 *mac_addr = NULL;
6034 	u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6035 			 BIT(NL80211_STA_FLAG_ASSOCIATED);
6036 
6037 	memset(&params, 0, sizeof(params));
6038 
6039 	if (!rdev->ops->add_station)
6040 		return -EOPNOTSUPP;
6041 
6042 	if (!info->attrs[NL80211_ATTR_MAC])
6043 		return -EINVAL;
6044 
6045 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6046 		return -EINVAL;
6047 
6048 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6049 		return -EINVAL;
6050 
6051 	if (!info->attrs[NL80211_ATTR_STA_AID] &&
6052 	    !info->attrs[NL80211_ATTR_PEER_AID])
6053 		return -EINVAL;
6054 
6055 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6056 	params.supported_rates =
6057 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6058 	params.supported_rates_len =
6059 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6060 	params.listen_interval =
6061 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6062 
6063 	if (info->attrs[NL80211_ATTR_VLAN_ID])
6064 		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6065 
6066 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6067 		params.support_p2p_ps =
6068 			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6069 	} else {
6070 		/*
6071 		 * if not specified, assume it's supported for P2P GO interface,
6072 		 * and is NOT supported for AP interface
6073 		 */
6074 		params.support_p2p_ps =
6075 			dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6076 	}
6077 
6078 	if (info->attrs[NL80211_ATTR_PEER_AID])
6079 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6080 	else
6081 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6082 
6083 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6084 		params.capability =
6085 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6086 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6087 	}
6088 
6089 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6090 		params.ext_capab =
6091 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6092 		params.ext_capab_len =
6093 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6094 	}
6095 
6096 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6097 		params.ht_capa =
6098 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6099 
6100 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6101 		params.vht_capa =
6102 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6103 
6104 	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6105 		params.he_capa =
6106 			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6107 		params.he_capa_len =
6108 			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6109 
6110 		/* max len is validated in nla policy */
6111 		if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
6112 			return -EINVAL;
6113 	}
6114 
6115 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6116 		params.opmode_notif_used = true;
6117 		params.opmode_notif =
6118 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6119 	}
6120 
6121 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6122 		params.plink_action =
6123 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6124 
6125 	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6126 		params.airtime_weight =
6127 			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6128 
6129 	if (params.airtime_weight &&
6130 	    !wiphy_ext_feature_isset(&rdev->wiphy,
6131 				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6132 		return -EOPNOTSUPP;
6133 
6134 	err = nl80211_parse_sta_txpower_setting(info, &params);
6135 	if (err)
6136 		return err;
6137 
6138 	err = nl80211_parse_sta_channel_info(info, &params);
6139 	if (err)
6140 		return err;
6141 
6142 	err = nl80211_parse_sta_wme(info, &params);
6143 	if (err)
6144 		return err;
6145 
6146 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6147 		return -EINVAL;
6148 
6149 	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6150 	 * as userspace might just pass through the capabilities from the IEs
6151 	 * directly, rather than enforcing this restriction and returning an
6152 	 * error in this case.
6153 	 */
6154 	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6155 		params.ht_capa = NULL;
6156 		params.vht_capa = NULL;
6157 
6158 		/* HE requires WME */
6159 		if (params.he_capa_len)
6160 			return -EINVAL;
6161 	}
6162 
6163 	/* When you run into this, adjust the code below for the new flag */
6164 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6165 
6166 	switch (dev->ieee80211_ptr->iftype) {
6167 	case NL80211_IFTYPE_AP:
6168 	case NL80211_IFTYPE_AP_VLAN:
6169 	case NL80211_IFTYPE_P2P_GO:
6170 		/* ignore WME attributes if iface/sta is not capable */
6171 		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6172 		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6173 			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6174 
6175 		/* TDLS peers cannot be added */
6176 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6177 		    info->attrs[NL80211_ATTR_PEER_AID])
6178 			return -EINVAL;
6179 		/* but don't bother the driver with it */
6180 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6181 
6182 		/* allow authenticated/associated only if driver handles it */
6183 		if (!(rdev->wiphy.features &
6184 				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6185 		    params.sta_flags_mask & auth_assoc)
6186 			return -EINVAL;
6187 
6188 		/* Older userspace, or userspace wanting to be compatible with
6189 		 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6190 		 * and assoc flags in the mask, but assumes the station will be
6191 		 * added as associated anyway since this was the required driver
6192 		 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6193 		 * introduced.
6194 		 * In order to not bother drivers with this quirk in the API
6195 		 * set the flags in both the mask and set for new stations in
6196 		 * this case.
6197 		 */
6198 		if (!(params.sta_flags_mask & auth_assoc)) {
6199 			params.sta_flags_mask |= auth_assoc;
6200 			params.sta_flags_set |= auth_assoc;
6201 		}
6202 
6203 		/* must be last in here for error handling */
6204 		params.vlan = get_vlan(info, rdev);
6205 		if (IS_ERR(params.vlan))
6206 			return PTR_ERR(params.vlan);
6207 		break;
6208 	case NL80211_IFTYPE_MESH_POINT:
6209 		/* ignore uAPSD data */
6210 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6211 
6212 		/* associated is disallowed */
6213 		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6214 			return -EINVAL;
6215 		/* TDLS peers cannot be added */
6216 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6217 		    info->attrs[NL80211_ATTR_PEER_AID])
6218 			return -EINVAL;
6219 		break;
6220 	case NL80211_IFTYPE_STATION:
6221 	case NL80211_IFTYPE_P2P_CLIENT:
6222 		/* ignore uAPSD data */
6223 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6224 
6225 		/* these are disallowed */
6226 		if (params.sta_flags_mask &
6227 				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
6228 				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6229 			return -EINVAL;
6230 		/* Only TDLS peers can be added */
6231 		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6232 			return -EINVAL;
6233 		/* Can only add if TDLS ... */
6234 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6235 			return -EOPNOTSUPP;
6236 		/* ... with external setup is supported */
6237 		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6238 			return -EOPNOTSUPP;
6239 		/*
6240 		 * Older wpa_supplicant versions always mark the TDLS peer
6241 		 * as authorized, but it shouldn't yet be.
6242 		 */
6243 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6244 		break;
6245 	default:
6246 		return -EOPNOTSUPP;
6247 	}
6248 
6249 	/* be aware of params.vlan when changing code here */
6250 
6251 	err = rdev_add_station(rdev, dev, mac_addr, &params);
6252 
6253 	if (params.vlan)
6254 		dev_put(params.vlan);
6255 	return err;
6256 }
6257 
6258 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6259 {
6260 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6261 	struct net_device *dev = info->user_ptr[1];
6262 	struct station_del_parameters params;
6263 
6264 	memset(&params, 0, sizeof(params));
6265 
6266 	if (info->attrs[NL80211_ATTR_MAC])
6267 		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6268 
6269 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6270 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6271 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
6272 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6273 		return -EINVAL;
6274 
6275 	if (!rdev->ops->del_station)
6276 		return -EOPNOTSUPP;
6277 
6278 	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6279 		params.subtype =
6280 			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6281 		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6282 		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6283 			return -EINVAL;
6284 	} else {
6285 		/* Default to Deauthentication frame */
6286 		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6287 	}
6288 
6289 	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6290 		params.reason_code =
6291 			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6292 		if (params.reason_code == 0)
6293 			return -EINVAL; /* 0 is reserved */
6294 	} else {
6295 		/* Default to reason code 2 */
6296 		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6297 	}
6298 
6299 	return rdev_del_station(rdev, dev, &params);
6300 }
6301 
6302 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6303 				int flags, struct net_device *dev,
6304 				u8 *dst, u8 *next_hop,
6305 				struct mpath_info *pinfo)
6306 {
6307 	void *hdr;
6308 	struct nlattr *pinfoattr;
6309 
6310 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6311 	if (!hdr)
6312 		return -1;
6313 
6314 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6315 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6316 	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6317 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6318 		goto nla_put_failure;
6319 
6320 	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6321 	if (!pinfoattr)
6322 		goto nla_put_failure;
6323 	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6324 	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6325 			pinfo->frame_qlen))
6326 		goto nla_put_failure;
6327 	if (((pinfo->filled & MPATH_INFO_SN) &&
6328 	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6329 	    ((pinfo->filled & MPATH_INFO_METRIC) &&
6330 	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6331 			 pinfo->metric)) ||
6332 	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6333 	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6334 			 pinfo->exptime)) ||
6335 	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
6336 	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6337 			pinfo->flags)) ||
6338 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6339 	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6340 			 pinfo->discovery_timeout)) ||
6341 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6342 	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6343 			pinfo->discovery_retries)) ||
6344 	    ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6345 	     nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6346 			pinfo->hop_count)) ||
6347 	    ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6348 	     nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6349 			 pinfo->path_change_count)))
6350 		goto nla_put_failure;
6351 
6352 	nla_nest_end(msg, pinfoattr);
6353 
6354 	genlmsg_end(msg, hdr);
6355 	return 0;
6356 
6357  nla_put_failure:
6358 	genlmsg_cancel(msg, hdr);
6359 	return -EMSGSIZE;
6360 }
6361 
6362 static int nl80211_dump_mpath(struct sk_buff *skb,
6363 			      struct netlink_callback *cb)
6364 {
6365 	struct mpath_info pinfo;
6366 	struct cfg80211_registered_device *rdev;
6367 	struct wireless_dev *wdev;
6368 	u8 dst[ETH_ALEN];
6369 	u8 next_hop[ETH_ALEN];
6370 	int path_idx = cb->args[2];
6371 	int err;
6372 
6373 	rtnl_lock();
6374 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6375 	if (err)
6376 		goto out_err;
6377 
6378 	if (!rdev->ops->dump_mpath) {
6379 		err = -EOPNOTSUPP;
6380 		goto out_err;
6381 	}
6382 
6383 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6384 		err = -EOPNOTSUPP;
6385 		goto out_err;
6386 	}
6387 
6388 	while (1) {
6389 		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6390 				      next_hop, &pinfo);
6391 		if (err == -ENOENT)
6392 			break;
6393 		if (err)
6394 			goto out_err;
6395 
6396 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6397 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
6398 				       wdev->netdev, dst, next_hop,
6399 				       &pinfo) < 0)
6400 			goto out;
6401 
6402 		path_idx++;
6403 	}
6404 
6405  out:
6406 	cb->args[2] = path_idx;
6407 	err = skb->len;
6408  out_err:
6409 	rtnl_unlock();
6410 	return err;
6411 }
6412 
6413 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6414 {
6415 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6416 	int err;
6417 	struct net_device *dev = info->user_ptr[1];
6418 	struct mpath_info pinfo;
6419 	struct sk_buff *msg;
6420 	u8 *dst = NULL;
6421 	u8 next_hop[ETH_ALEN];
6422 
6423 	memset(&pinfo, 0, sizeof(pinfo));
6424 
6425 	if (!info->attrs[NL80211_ATTR_MAC])
6426 		return -EINVAL;
6427 
6428 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6429 
6430 	if (!rdev->ops->get_mpath)
6431 		return -EOPNOTSUPP;
6432 
6433 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6434 		return -EOPNOTSUPP;
6435 
6436 	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6437 	if (err)
6438 		return err;
6439 
6440 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6441 	if (!msg)
6442 		return -ENOMEM;
6443 
6444 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6445 				 dev, dst, next_hop, &pinfo) < 0) {
6446 		nlmsg_free(msg);
6447 		return -ENOBUFS;
6448 	}
6449 
6450 	return genlmsg_reply(msg, info);
6451 }
6452 
6453 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6454 {
6455 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6456 	struct net_device *dev = info->user_ptr[1];
6457 	u8 *dst = NULL;
6458 	u8 *next_hop = NULL;
6459 
6460 	if (!info->attrs[NL80211_ATTR_MAC])
6461 		return -EINVAL;
6462 
6463 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6464 		return -EINVAL;
6465 
6466 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6467 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6468 
6469 	if (!rdev->ops->change_mpath)
6470 		return -EOPNOTSUPP;
6471 
6472 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6473 		return -EOPNOTSUPP;
6474 
6475 	return rdev_change_mpath(rdev, dev, dst, next_hop);
6476 }
6477 
6478 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6479 {
6480 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6481 	struct net_device *dev = info->user_ptr[1];
6482 	u8 *dst = NULL;
6483 	u8 *next_hop = NULL;
6484 
6485 	if (!info->attrs[NL80211_ATTR_MAC])
6486 		return -EINVAL;
6487 
6488 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6489 		return -EINVAL;
6490 
6491 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6492 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6493 
6494 	if (!rdev->ops->add_mpath)
6495 		return -EOPNOTSUPP;
6496 
6497 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6498 		return -EOPNOTSUPP;
6499 
6500 	return rdev_add_mpath(rdev, dev, dst, next_hop);
6501 }
6502 
6503 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6504 {
6505 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6506 	struct net_device *dev = info->user_ptr[1];
6507 	u8 *dst = NULL;
6508 
6509 	if (info->attrs[NL80211_ATTR_MAC])
6510 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6511 
6512 	if (!rdev->ops->del_mpath)
6513 		return -EOPNOTSUPP;
6514 
6515 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6516 		return -EOPNOTSUPP;
6517 
6518 	return rdev_del_mpath(rdev, dev, dst);
6519 }
6520 
6521 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6522 {
6523 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6524 	int err;
6525 	struct net_device *dev = info->user_ptr[1];
6526 	struct mpath_info pinfo;
6527 	struct sk_buff *msg;
6528 	u8 *dst = NULL;
6529 	u8 mpp[ETH_ALEN];
6530 
6531 	memset(&pinfo, 0, sizeof(pinfo));
6532 
6533 	if (!info->attrs[NL80211_ATTR_MAC])
6534 		return -EINVAL;
6535 
6536 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6537 
6538 	if (!rdev->ops->get_mpp)
6539 		return -EOPNOTSUPP;
6540 
6541 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6542 		return -EOPNOTSUPP;
6543 
6544 	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6545 	if (err)
6546 		return err;
6547 
6548 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6549 	if (!msg)
6550 		return -ENOMEM;
6551 
6552 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6553 			       dev, dst, mpp, &pinfo) < 0) {
6554 		nlmsg_free(msg);
6555 		return -ENOBUFS;
6556 	}
6557 
6558 	return genlmsg_reply(msg, info);
6559 }
6560 
6561 static int nl80211_dump_mpp(struct sk_buff *skb,
6562 			    struct netlink_callback *cb)
6563 {
6564 	struct mpath_info pinfo;
6565 	struct cfg80211_registered_device *rdev;
6566 	struct wireless_dev *wdev;
6567 	u8 dst[ETH_ALEN];
6568 	u8 mpp[ETH_ALEN];
6569 	int path_idx = cb->args[2];
6570 	int err;
6571 
6572 	rtnl_lock();
6573 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6574 	if (err)
6575 		goto out_err;
6576 
6577 	if (!rdev->ops->dump_mpp) {
6578 		err = -EOPNOTSUPP;
6579 		goto out_err;
6580 	}
6581 
6582 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6583 		err = -EOPNOTSUPP;
6584 		goto out_err;
6585 	}
6586 
6587 	while (1) {
6588 		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6589 				    mpp, &pinfo);
6590 		if (err == -ENOENT)
6591 			break;
6592 		if (err)
6593 			goto out_err;
6594 
6595 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6596 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
6597 				       wdev->netdev, dst, mpp,
6598 				       &pinfo) < 0)
6599 			goto out;
6600 
6601 		path_idx++;
6602 	}
6603 
6604  out:
6605 	cb->args[2] = path_idx;
6606 	err = skb->len;
6607  out_err:
6608 	rtnl_unlock();
6609 	return err;
6610 }
6611 
6612 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6613 {
6614 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6615 	struct net_device *dev = info->user_ptr[1];
6616 	struct wireless_dev *wdev = dev->ieee80211_ptr;
6617 	struct bss_parameters params;
6618 	int err;
6619 
6620 	memset(&params, 0, sizeof(params));
6621 	/* default to not changing parameters */
6622 	params.use_cts_prot = -1;
6623 	params.use_short_preamble = -1;
6624 	params.use_short_slot_time = -1;
6625 	params.ap_isolate = -1;
6626 	params.ht_opmode = -1;
6627 	params.p2p_ctwindow = -1;
6628 	params.p2p_opp_ps = -1;
6629 
6630 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6631 		params.use_cts_prot =
6632 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6633 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6634 		params.use_short_preamble =
6635 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6636 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6637 		params.use_short_slot_time =
6638 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6639 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6640 		params.basic_rates =
6641 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6642 		params.basic_rates_len =
6643 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6644 	}
6645 	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6646 		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6647 	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6648 		params.ht_opmode =
6649 			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6650 
6651 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6652 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6653 			return -EINVAL;
6654 		params.p2p_ctwindow =
6655 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6656 		if (params.p2p_ctwindow != 0 &&
6657 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6658 			return -EINVAL;
6659 	}
6660 
6661 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6662 		u8 tmp;
6663 
6664 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6665 			return -EINVAL;
6666 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6667 		params.p2p_opp_ps = tmp;
6668 		if (params.p2p_opp_ps &&
6669 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6670 			return -EINVAL;
6671 	}
6672 
6673 	if (!rdev->ops->change_bss)
6674 		return -EOPNOTSUPP;
6675 
6676 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6677 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6678 		return -EOPNOTSUPP;
6679 
6680 	wdev_lock(wdev);
6681 	err = rdev_change_bss(rdev, dev, &params);
6682 	wdev_unlock(wdev);
6683 
6684 	return err;
6685 }
6686 
6687 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6688 {
6689 	char *data = NULL;
6690 	bool is_indoor;
6691 	enum nl80211_user_reg_hint_type user_reg_hint_type;
6692 	u32 owner_nlportid;
6693 
6694 	/*
6695 	 * You should only get this when cfg80211 hasn't yet initialized
6696 	 * completely when built-in to the kernel right between the time
6697 	 * window between nl80211_init() and regulatory_init(), if that is
6698 	 * even possible.
6699 	 */
6700 	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6701 		return -EINPROGRESS;
6702 
6703 	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6704 		user_reg_hint_type =
6705 		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6706 	else
6707 		user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6708 
6709 	switch (user_reg_hint_type) {
6710 	case NL80211_USER_REG_HINT_USER:
6711 	case NL80211_USER_REG_HINT_CELL_BASE:
6712 		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6713 			return -EINVAL;
6714 
6715 		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6716 		return regulatory_hint_user(data, user_reg_hint_type);
6717 	case NL80211_USER_REG_HINT_INDOOR:
6718 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6719 			owner_nlportid = info->snd_portid;
6720 			is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6721 		} else {
6722 			owner_nlportid = 0;
6723 			is_indoor = true;
6724 		}
6725 
6726 		return regulatory_hint_indoor(is_indoor, owner_nlportid);
6727 	default:
6728 		return -EINVAL;
6729 	}
6730 }
6731 
6732 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6733 {
6734 	return reg_reload_regdb();
6735 }
6736 
6737 static int nl80211_get_mesh_config(struct sk_buff *skb,
6738 				   struct genl_info *info)
6739 {
6740 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6741 	struct net_device *dev = info->user_ptr[1];
6742 	struct wireless_dev *wdev = dev->ieee80211_ptr;
6743 	struct mesh_config cur_params;
6744 	int err = 0;
6745 	void *hdr;
6746 	struct nlattr *pinfoattr;
6747 	struct sk_buff *msg;
6748 
6749 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6750 		return -EOPNOTSUPP;
6751 
6752 	if (!rdev->ops->get_mesh_config)
6753 		return -EOPNOTSUPP;
6754 
6755 	wdev_lock(wdev);
6756 	/* If not connected, get default parameters */
6757 	if (!wdev->mesh_id_len)
6758 		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6759 	else
6760 		err = rdev_get_mesh_config(rdev, dev, &cur_params);
6761 	wdev_unlock(wdev);
6762 
6763 	if (err)
6764 		return err;
6765 
6766 	/* Draw up a netlink message to send back */
6767 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6768 	if (!msg)
6769 		return -ENOMEM;
6770 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6771 			     NL80211_CMD_GET_MESH_CONFIG);
6772 	if (!hdr)
6773 		goto out;
6774 	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
6775 	if (!pinfoattr)
6776 		goto nla_put_failure;
6777 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6778 	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6779 			cur_params.dot11MeshRetryTimeout) ||
6780 	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6781 			cur_params.dot11MeshConfirmTimeout) ||
6782 	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6783 			cur_params.dot11MeshHoldingTimeout) ||
6784 	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6785 			cur_params.dot11MeshMaxPeerLinks) ||
6786 	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6787 		       cur_params.dot11MeshMaxRetries) ||
6788 	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
6789 		       cur_params.dot11MeshTTL) ||
6790 	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6791 		       cur_params.element_ttl) ||
6792 	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6793 		       cur_params.auto_open_plinks) ||
6794 	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6795 			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6796 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6797 		       cur_params.dot11MeshHWMPmaxPREQretries) ||
6798 	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6799 			cur_params.path_refresh_time) ||
6800 	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6801 			cur_params.min_discovery_timeout) ||
6802 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6803 			cur_params.dot11MeshHWMPactivePathTimeout) ||
6804 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6805 			cur_params.dot11MeshHWMPpreqMinInterval) ||
6806 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6807 			cur_params.dot11MeshHWMPperrMinInterval) ||
6808 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6809 			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6810 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6811 		       cur_params.dot11MeshHWMPRootMode) ||
6812 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6813 			cur_params.dot11MeshHWMPRannInterval) ||
6814 	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6815 		       cur_params.dot11MeshGateAnnouncementProtocol) ||
6816 	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6817 		       cur_params.dot11MeshForwarding) ||
6818 	    nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6819 			cur_params.rssi_threshold) ||
6820 	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6821 			cur_params.ht_opmode) ||
6822 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6823 			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6824 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6825 			cur_params.dot11MeshHWMProotInterval) ||
6826 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6827 			cur_params.dot11MeshHWMPconfirmationInterval) ||
6828 	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6829 			cur_params.power_mode) ||
6830 	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6831 			cur_params.dot11MeshAwakeWindowDuration) ||
6832 	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6833 			cur_params.plink_timeout) ||
6834 	    nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6835 		       cur_params.dot11MeshConnectedToMeshGate))
6836 		goto nla_put_failure;
6837 	nla_nest_end(msg, pinfoattr);
6838 	genlmsg_end(msg, hdr);
6839 	return genlmsg_reply(msg, info);
6840 
6841  nla_put_failure:
6842  out:
6843 	nlmsg_free(msg);
6844 	return -ENOBUFS;
6845 }
6846 
6847 static const struct nla_policy
6848 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6849 	[NL80211_MESHCONF_RETRY_TIMEOUT] =
6850 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
6851 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6852 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
6853 	[NL80211_MESHCONF_HOLDING_TIMEOUT] =
6854 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
6855 	[NL80211_MESHCONF_MAX_PEER_LINKS] =
6856 		NLA_POLICY_RANGE(NLA_U16, 0, 255),
6857 	[NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6858 	[NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6859 	[NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6860 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6861 	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6862 		NLA_POLICY_RANGE(NLA_U32, 1, 255),
6863 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6864 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6865 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6866 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6867 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6868 		NLA_POLICY_MIN(NLA_U16, 1),
6869 	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6870 		NLA_POLICY_MIN(NLA_U16, 1),
6871 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6872 		NLA_POLICY_MIN(NLA_U16, 1),
6873 	[NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6874 	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6875 		NLA_POLICY_MIN(NLA_U16, 1),
6876 	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6877 	[NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6878 	[NL80211_MESHCONF_RSSI_THRESHOLD] =
6879 		NLA_POLICY_RANGE(NLA_S32, -255, 0),
6880 	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6881 	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6882 	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6883 		NLA_POLICY_MIN(NLA_U16, 1),
6884 	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6885 		NLA_POLICY_MIN(NLA_U16, 1),
6886 	[NL80211_MESHCONF_POWER_MODE] =
6887 		NLA_POLICY_RANGE(NLA_U32,
6888 				 NL80211_MESH_POWER_ACTIVE,
6889 				 NL80211_MESH_POWER_MAX),
6890 	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6891 	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6892 	[NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6893 };
6894 
6895 static const struct nla_policy
6896 	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6897 	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6898 	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6899 	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6900 	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6901 	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6902 	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6903 	[NL80211_MESH_SETUP_IE] =
6904 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6905 				       IEEE80211_MAX_DATA_LEN),
6906 	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6907 };
6908 
6909 static int nl80211_parse_mesh_config(struct genl_info *info,
6910 				     struct mesh_config *cfg,
6911 				     u32 *mask_out)
6912 {
6913 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6914 	u32 mask = 0;
6915 	u16 ht_opmode;
6916 
6917 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)	\
6918 do {									\
6919 	if (tb[attr]) {							\
6920 		cfg->param = fn(tb[attr]);				\
6921 		mask |= BIT((attr) - 1);				\
6922 	}								\
6923 } while (0)
6924 
6925 	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6926 		return -EINVAL;
6927 	if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
6928 		return -EINVAL;
6929 
6930 	/* This makes sure that there aren't more than 32 mesh config
6931 	 * parameters (otherwise our bitfield scheme would not work.) */
6932 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6933 
6934 	/* Fill in the params struct */
6935 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6936 				  NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6937 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6938 				  NL80211_MESHCONF_CONFIRM_TIMEOUT,
6939 				  nla_get_u16);
6940 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6941 				  NL80211_MESHCONF_HOLDING_TIMEOUT,
6942 				  nla_get_u16);
6943 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6944 				  NL80211_MESHCONF_MAX_PEER_LINKS,
6945 				  nla_get_u16);
6946 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6947 				  NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6948 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6949 				  NL80211_MESHCONF_TTL, nla_get_u8);
6950 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6951 				  NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6952 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6953 				  NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6954 				  nla_get_u8);
6955 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6956 				  mask,
6957 				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6958 				  nla_get_u32);
6959 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6960 				  NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6961 				  nla_get_u8);
6962 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6963 				  NL80211_MESHCONF_PATH_REFRESH_TIME,
6964 				  nla_get_u32);
6965 	if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6966 	    (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6967 		return -EINVAL;
6968 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6969 				  NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6970 				  nla_get_u16);
6971 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6972 				  mask,
6973 				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6974 				  nla_get_u32);
6975 	if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6976 	    (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6977 	     cfg->dot11MeshHWMPactivePathTimeout > 65535))
6978 		return -EINVAL;
6979 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6980 				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6981 				  nla_get_u16);
6982 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6983 				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6984 				  nla_get_u16);
6985 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6986 				  dot11MeshHWMPnetDiameterTraversalTime, mask,
6987 				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6988 				  nla_get_u16);
6989 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6990 				  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6991 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6992 				  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6993 				  nla_get_u16);
6994 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6995 				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6996 				  nla_get_u8);
6997 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6998 				  NL80211_MESHCONF_FORWARDING, nla_get_u8);
6999 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7000 				  NL80211_MESHCONF_RSSI_THRESHOLD,
7001 				  nla_get_s32);
7002 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7003 				  NL80211_MESHCONF_CONNECTED_TO_GATE,
7004 				  nla_get_u8);
7005 	/*
7006 	 * Check HT operation mode based on
7007 	 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7008 	 */
7009 	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7010 		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7011 
7012 		if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7013 				  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7014 				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7015 			return -EINVAL;
7016 
7017 		/* NON_HT_STA bit is reserved, but some programs set it */
7018 		ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7019 
7020 		cfg->ht_opmode = ht_opmode;
7021 		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7022 	}
7023 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7024 				  dot11MeshHWMPactivePathToRootTimeout, mask,
7025 				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7026 				  nla_get_u32);
7027 	if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7028 	    (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7029 	     cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7030 		return -EINVAL;
7031 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7032 				  NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7033 				  nla_get_u16);
7034 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7035 				  mask,
7036 				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7037 				  nla_get_u16);
7038 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7039 				  NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7040 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7041 				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7042 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7043 				  NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7044 	if (mask_out)
7045 		*mask_out = mask;
7046 
7047 	return 0;
7048 
7049 #undef FILL_IN_MESH_PARAM_IF_SET
7050 }
7051 
7052 static int nl80211_parse_mesh_setup(struct genl_info *info,
7053 				     struct mesh_setup *setup)
7054 {
7055 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7056 	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7057 
7058 	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7059 		return -EINVAL;
7060 	if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7061 		return -EINVAL;
7062 
7063 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7064 		setup->sync_method =
7065 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7066 		 IEEE80211_SYNC_METHOD_VENDOR :
7067 		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7068 
7069 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7070 		setup->path_sel_proto =
7071 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7072 		 IEEE80211_PATH_PROTOCOL_VENDOR :
7073 		 IEEE80211_PATH_PROTOCOL_HWMP;
7074 
7075 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7076 		setup->path_metric =
7077 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7078 		 IEEE80211_PATH_METRIC_VENDOR :
7079 		 IEEE80211_PATH_METRIC_AIRTIME;
7080 
7081 	if (tb[NL80211_MESH_SETUP_IE]) {
7082 		struct nlattr *ieattr =
7083 			tb[NL80211_MESH_SETUP_IE];
7084 		setup->ie = nla_data(ieattr);
7085 		setup->ie_len = nla_len(ieattr);
7086 	}
7087 	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7088 	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7089 		return -EINVAL;
7090 	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7091 	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7092 	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7093 	if (setup->is_secure)
7094 		setup->user_mpm = true;
7095 
7096 	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7097 		if (!setup->user_mpm)
7098 			return -EINVAL;
7099 		setup->auth_id =
7100 			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7101 	}
7102 
7103 	return 0;
7104 }
7105 
7106 static int nl80211_update_mesh_config(struct sk_buff *skb,
7107 				      struct genl_info *info)
7108 {
7109 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7110 	struct net_device *dev = info->user_ptr[1];
7111 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7112 	struct mesh_config cfg;
7113 	u32 mask;
7114 	int err;
7115 
7116 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7117 		return -EOPNOTSUPP;
7118 
7119 	if (!rdev->ops->update_mesh_config)
7120 		return -EOPNOTSUPP;
7121 
7122 	err = nl80211_parse_mesh_config(info, &cfg, &mask);
7123 	if (err)
7124 		return err;
7125 
7126 	wdev_lock(wdev);
7127 	if (!wdev->mesh_id_len)
7128 		err = -ENOLINK;
7129 
7130 	if (!err)
7131 		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7132 
7133 	wdev_unlock(wdev);
7134 
7135 	return err;
7136 }
7137 
7138 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7139 			      struct sk_buff *msg)
7140 {
7141 	struct nlattr *nl_reg_rules;
7142 	unsigned int i;
7143 
7144 	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7145 	    (regdom->dfs_region &&
7146 	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7147 		goto nla_put_failure;
7148 
7149 	nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7150 	if (!nl_reg_rules)
7151 		goto nla_put_failure;
7152 
7153 	for (i = 0; i < regdom->n_reg_rules; i++) {
7154 		struct nlattr *nl_reg_rule;
7155 		const struct ieee80211_reg_rule *reg_rule;
7156 		const struct ieee80211_freq_range *freq_range;
7157 		const struct ieee80211_power_rule *power_rule;
7158 		unsigned int max_bandwidth_khz;
7159 
7160 		reg_rule = &regdom->reg_rules[i];
7161 		freq_range = &reg_rule->freq_range;
7162 		power_rule = &reg_rule->power_rule;
7163 
7164 		nl_reg_rule = nla_nest_start_noflag(msg, i);
7165 		if (!nl_reg_rule)
7166 			goto nla_put_failure;
7167 
7168 		max_bandwidth_khz = freq_range->max_bandwidth_khz;
7169 		if (!max_bandwidth_khz)
7170 			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7171 								  reg_rule);
7172 
7173 		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7174 				reg_rule->flags) ||
7175 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7176 				freq_range->start_freq_khz) ||
7177 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7178 				freq_range->end_freq_khz) ||
7179 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7180 				max_bandwidth_khz) ||
7181 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7182 				power_rule->max_antenna_gain) ||
7183 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7184 				power_rule->max_eirp) ||
7185 		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7186 				reg_rule->dfs_cac_ms))
7187 			goto nla_put_failure;
7188 
7189 		nla_nest_end(msg, nl_reg_rule);
7190 	}
7191 
7192 	nla_nest_end(msg, nl_reg_rules);
7193 	return 0;
7194 
7195 nla_put_failure:
7196 	return -EMSGSIZE;
7197 }
7198 
7199 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7200 {
7201 	const struct ieee80211_regdomain *regdom = NULL;
7202 	struct cfg80211_registered_device *rdev;
7203 	struct wiphy *wiphy = NULL;
7204 	struct sk_buff *msg;
7205 	void *hdr;
7206 
7207 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7208 	if (!msg)
7209 		return -ENOBUFS;
7210 
7211 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7212 			     NL80211_CMD_GET_REG);
7213 	if (!hdr)
7214 		goto put_failure;
7215 
7216 	if (info->attrs[NL80211_ATTR_WIPHY]) {
7217 		bool self_managed;
7218 
7219 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7220 		if (IS_ERR(rdev)) {
7221 			nlmsg_free(msg);
7222 			return PTR_ERR(rdev);
7223 		}
7224 
7225 		wiphy = &rdev->wiphy;
7226 		self_managed = wiphy->regulatory_flags &
7227 			       REGULATORY_WIPHY_SELF_MANAGED;
7228 		regdom = get_wiphy_regdom(wiphy);
7229 
7230 		/* a self-managed-reg device must have a private regdom */
7231 		if (WARN_ON(!regdom && self_managed)) {
7232 			nlmsg_free(msg);
7233 			return -EINVAL;
7234 		}
7235 
7236 		if (regdom &&
7237 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7238 			goto nla_put_failure;
7239 	}
7240 
7241 	if (!wiphy && reg_last_request_cell_base() &&
7242 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7243 			NL80211_USER_REG_HINT_CELL_BASE))
7244 		goto nla_put_failure;
7245 
7246 	rcu_read_lock();
7247 
7248 	if (!regdom)
7249 		regdom = rcu_dereference(cfg80211_regdomain);
7250 
7251 	if (nl80211_put_regdom(regdom, msg))
7252 		goto nla_put_failure_rcu;
7253 
7254 	rcu_read_unlock();
7255 
7256 	genlmsg_end(msg, hdr);
7257 	return genlmsg_reply(msg, info);
7258 
7259 nla_put_failure_rcu:
7260 	rcu_read_unlock();
7261 nla_put_failure:
7262 put_failure:
7263 	nlmsg_free(msg);
7264 	return -EMSGSIZE;
7265 }
7266 
7267 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7268 			       u32 seq, int flags, struct wiphy *wiphy,
7269 			       const struct ieee80211_regdomain *regdom)
7270 {
7271 	void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7272 				   NL80211_CMD_GET_REG);
7273 
7274 	if (!hdr)
7275 		return -1;
7276 
7277 	genl_dump_check_consistent(cb, hdr);
7278 
7279 	if (nl80211_put_regdom(regdom, msg))
7280 		goto nla_put_failure;
7281 
7282 	if (!wiphy && reg_last_request_cell_base() &&
7283 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7284 			NL80211_USER_REG_HINT_CELL_BASE))
7285 		goto nla_put_failure;
7286 
7287 	if (wiphy &&
7288 	    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7289 		goto nla_put_failure;
7290 
7291 	if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7292 	    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7293 		goto nla_put_failure;
7294 
7295 	genlmsg_end(msg, hdr);
7296 	return 0;
7297 
7298 nla_put_failure:
7299 	genlmsg_cancel(msg, hdr);
7300 	return -EMSGSIZE;
7301 }
7302 
7303 static int nl80211_get_reg_dump(struct sk_buff *skb,
7304 				struct netlink_callback *cb)
7305 {
7306 	const struct ieee80211_regdomain *regdom = NULL;
7307 	struct cfg80211_registered_device *rdev;
7308 	int err, reg_idx, start = cb->args[2];
7309 
7310 	rtnl_lock();
7311 
7312 	if (cfg80211_regdomain && start == 0) {
7313 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7314 					  NLM_F_MULTI, NULL,
7315 					  rtnl_dereference(cfg80211_regdomain));
7316 		if (err < 0)
7317 			goto out_err;
7318 	}
7319 
7320 	/* the global regdom is idx 0 */
7321 	reg_idx = 1;
7322 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7323 		regdom = get_wiphy_regdom(&rdev->wiphy);
7324 		if (!regdom)
7325 			continue;
7326 
7327 		if (++reg_idx <= start)
7328 			continue;
7329 
7330 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7331 					  NLM_F_MULTI, &rdev->wiphy, regdom);
7332 		if (err < 0) {
7333 			reg_idx--;
7334 			break;
7335 		}
7336 	}
7337 
7338 	cb->args[2] = reg_idx;
7339 	err = skb->len;
7340 out_err:
7341 	rtnl_unlock();
7342 	return err;
7343 }
7344 
7345 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7346 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7347 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
7348 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
7349 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
7350 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
7351 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
7352 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
7353 	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
7354 };
7355 
7356 static int parse_reg_rule(struct nlattr *tb[],
7357 	struct ieee80211_reg_rule *reg_rule)
7358 {
7359 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7360 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7361 
7362 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7363 		return -EINVAL;
7364 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7365 		return -EINVAL;
7366 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7367 		return -EINVAL;
7368 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7369 		return -EINVAL;
7370 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7371 		return -EINVAL;
7372 
7373 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7374 
7375 	freq_range->start_freq_khz =
7376 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7377 	freq_range->end_freq_khz =
7378 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7379 	freq_range->max_bandwidth_khz =
7380 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7381 
7382 	power_rule->max_eirp =
7383 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7384 
7385 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7386 		power_rule->max_antenna_gain =
7387 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7388 
7389 	if (tb[NL80211_ATTR_DFS_CAC_TIME])
7390 		reg_rule->dfs_cac_ms =
7391 			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7392 
7393 	return 0;
7394 }
7395 
7396 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7397 {
7398 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7399 	struct nlattr *nl_reg_rule;
7400 	char *alpha2;
7401 	int rem_reg_rules, r;
7402 	u32 num_rules = 0, rule_idx = 0;
7403 	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7404 	struct ieee80211_regdomain *rd;
7405 
7406 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7407 		return -EINVAL;
7408 
7409 	if (!info->attrs[NL80211_ATTR_REG_RULES])
7410 		return -EINVAL;
7411 
7412 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7413 
7414 	if (info->attrs[NL80211_ATTR_DFS_REGION])
7415 		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7416 
7417 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7418 			    rem_reg_rules) {
7419 		num_rules++;
7420 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7421 			return -EINVAL;
7422 	}
7423 
7424 	if (!reg_is_valid_request(alpha2))
7425 		return -EINVAL;
7426 
7427 	rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7428 	if (!rd)
7429 		return -ENOMEM;
7430 
7431 	rd->n_reg_rules = num_rules;
7432 	rd->alpha2[0] = alpha2[0];
7433 	rd->alpha2[1] = alpha2[1];
7434 
7435 	/*
7436 	 * Disable DFS master mode if the DFS region was
7437 	 * not supported or known on this kernel.
7438 	 */
7439 	if (reg_supported_dfs_region(dfs_region))
7440 		rd->dfs_region = dfs_region;
7441 
7442 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7443 			    rem_reg_rules) {
7444 		r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7445 						nl_reg_rule, reg_rule_policy,
7446 						info->extack);
7447 		if (r)
7448 			goto bad_reg;
7449 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7450 		if (r)
7451 			goto bad_reg;
7452 
7453 		rule_idx++;
7454 
7455 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7456 			r = -EINVAL;
7457 			goto bad_reg;
7458 		}
7459 	}
7460 
7461 	/* set_regdom takes ownership of rd */
7462 	return set_regdom(rd, REGD_SOURCE_CRDA);
7463  bad_reg:
7464 	kfree(rd);
7465 	return r;
7466 }
7467 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7468 
7469 static int validate_scan_freqs(struct nlattr *freqs)
7470 {
7471 	struct nlattr *attr1, *attr2;
7472 	int n_channels = 0, tmp1, tmp2;
7473 
7474 	nla_for_each_nested(attr1, freqs, tmp1)
7475 		if (nla_len(attr1) != sizeof(u32))
7476 			return 0;
7477 
7478 	nla_for_each_nested(attr1, freqs, tmp1) {
7479 		n_channels++;
7480 		/*
7481 		 * Some hardware has a limited channel list for
7482 		 * scanning, and it is pretty much nonsensical
7483 		 * to scan for a channel twice, so disallow that
7484 		 * and don't require drivers to check that the
7485 		 * channel list they get isn't longer than what
7486 		 * they can scan, as long as they can scan all
7487 		 * the channels they registered at once.
7488 		 */
7489 		nla_for_each_nested(attr2, freqs, tmp2)
7490 			if (attr1 != attr2 &&
7491 			    nla_get_u32(attr1) == nla_get_u32(attr2))
7492 				return 0;
7493 	}
7494 
7495 	return n_channels;
7496 }
7497 
7498 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7499 {
7500 	return b < NUM_NL80211_BANDS && wiphy->bands[b];
7501 }
7502 
7503 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7504 			    struct cfg80211_bss_selection *bss_select)
7505 {
7506 	struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7507 	struct nlattr *nest;
7508 	int err;
7509 	bool found = false;
7510 	int i;
7511 
7512 	/* only process one nested attribute */
7513 	nest = nla_data(nla);
7514 	if (!nla_ok(nest, nla_len(nest)))
7515 		return -EINVAL;
7516 
7517 	err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
7518 					  nest, nl80211_bss_select_policy,
7519 					  NULL);
7520 	if (err)
7521 		return err;
7522 
7523 	/* only one attribute may be given */
7524 	for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7525 		if (attr[i]) {
7526 			if (found)
7527 				return -EINVAL;
7528 			found = true;
7529 		}
7530 	}
7531 
7532 	bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7533 
7534 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7535 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7536 
7537 	if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7538 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7539 		bss_select->param.band_pref =
7540 			nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7541 		if (!is_band_valid(wiphy, bss_select->param.band_pref))
7542 			return -EINVAL;
7543 	}
7544 
7545 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7546 		struct nl80211_bss_select_rssi_adjust *adj_param;
7547 
7548 		adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7549 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7550 		bss_select->param.adjust.band = adj_param->band;
7551 		bss_select->param.adjust.delta = adj_param->delta;
7552 		if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7553 			return -EINVAL;
7554 	}
7555 
7556 	/* user-space did not provide behaviour attribute */
7557 	if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7558 		return -EINVAL;
7559 
7560 	if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7561 		return -EINVAL;
7562 
7563 	return 0;
7564 }
7565 
7566 int nl80211_parse_random_mac(struct nlattr **attrs,
7567 			     u8 *mac_addr, u8 *mac_addr_mask)
7568 {
7569 	int i;
7570 
7571 	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7572 		eth_zero_addr(mac_addr);
7573 		eth_zero_addr(mac_addr_mask);
7574 		mac_addr[0] = 0x2;
7575 		mac_addr_mask[0] = 0x3;
7576 
7577 		return 0;
7578 	}
7579 
7580 	/* need both or none */
7581 	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7582 		return -EINVAL;
7583 
7584 	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7585 	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7586 
7587 	/* don't allow or configure an mcast address */
7588 	if (!is_multicast_ether_addr(mac_addr_mask) ||
7589 	    is_multicast_ether_addr(mac_addr))
7590 		return -EINVAL;
7591 
7592 	/*
7593 	 * allow users to pass a MAC address that has bits set outside
7594 	 * of the mask, but don't bother drivers with having to deal
7595 	 * with such bits
7596 	 */
7597 	for (i = 0; i < ETH_ALEN; i++)
7598 		mac_addr[i] &= mac_addr_mask[i];
7599 
7600 	return 0;
7601 }
7602 
7603 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7604 {
7605 	ASSERT_WDEV_LOCK(wdev);
7606 
7607 	if (!cfg80211_beaconing_iface_active(wdev))
7608 		return true;
7609 
7610 	if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7611 		return true;
7612 
7613 	return regulatory_pre_cac_allowed(wdev->wiphy);
7614 }
7615 
7616 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7617 				    enum nl80211_ext_feature_index feat)
7618 {
7619 	if (!(flags & flag))
7620 		return true;
7621 	if (wiphy_ext_feature_isset(wiphy, feat))
7622 		return true;
7623 	return false;
7624 }
7625 
7626 static int
7627 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7628 			 void *request, struct nlattr **attrs,
7629 			 bool is_sched_scan)
7630 {
7631 	u8 *mac_addr, *mac_addr_mask;
7632 	u32 *flags;
7633 	enum nl80211_feature_flags randomness_flag;
7634 
7635 	if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7636 		return 0;
7637 
7638 	if (is_sched_scan) {
7639 		struct cfg80211_sched_scan_request *req = request;
7640 
7641 		randomness_flag = wdev ?
7642 				  NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7643 				  NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7644 		flags = &req->flags;
7645 		mac_addr = req->mac_addr;
7646 		mac_addr_mask = req->mac_addr_mask;
7647 	} else {
7648 		struct cfg80211_scan_request *req = request;
7649 
7650 		randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7651 		flags = &req->flags;
7652 		mac_addr = req->mac_addr;
7653 		mac_addr_mask = req->mac_addr_mask;
7654 	}
7655 
7656 	*flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7657 
7658 	if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7659 	     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7660 	    !nl80211_check_scan_feat(wiphy, *flags,
7661 				     NL80211_SCAN_FLAG_LOW_SPAN,
7662 				     NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7663 	    !nl80211_check_scan_feat(wiphy, *flags,
7664 				     NL80211_SCAN_FLAG_LOW_POWER,
7665 				     NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7666 	    !nl80211_check_scan_feat(wiphy, *flags,
7667 				     NL80211_SCAN_FLAG_HIGH_ACCURACY,
7668 				     NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7669 	    !nl80211_check_scan_feat(wiphy, *flags,
7670 				     NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7671 				     NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7672 	    !nl80211_check_scan_feat(wiphy, *flags,
7673 				     NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7674 				     NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7675 	    !nl80211_check_scan_feat(wiphy, *flags,
7676 				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7677 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7678 	    !nl80211_check_scan_feat(wiphy, *flags,
7679 				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7680 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7681 	    !nl80211_check_scan_feat(wiphy, *flags,
7682 				     NL80211_SCAN_FLAG_RANDOM_SN,
7683 				     NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7684 	    !nl80211_check_scan_feat(wiphy, *flags,
7685 				     NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7686 				     NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7687 		return -EOPNOTSUPP;
7688 
7689 	if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7690 		int err;
7691 
7692 		if (!(wiphy->features & randomness_flag) ||
7693 		    (wdev && wdev->current_bss))
7694 			return -EOPNOTSUPP;
7695 
7696 		err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7697 		if (err)
7698 			return err;
7699 	}
7700 
7701 	return 0;
7702 }
7703 
7704 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7705 {
7706 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7707 	struct wireless_dev *wdev = info->user_ptr[1];
7708 	struct cfg80211_scan_request *request;
7709 	struct nlattr *attr;
7710 	struct wiphy *wiphy;
7711 	int err, tmp, n_ssids = 0, n_channels, i;
7712 	size_t ie_len;
7713 
7714 	wiphy = &rdev->wiphy;
7715 
7716 	if (wdev->iftype == NL80211_IFTYPE_NAN)
7717 		return -EOPNOTSUPP;
7718 
7719 	if (!rdev->ops->scan)
7720 		return -EOPNOTSUPP;
7721 
7722 	if (rdev->scan_req || rdev->scan_msg) {
7723 		err = -EBUSY;
7724 		goto unlock;
7725 	}
7726 
7727 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7728 		n_channels = validate_scan_freqs(
7729 				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7730 		if (!n_channels) {
7731 			err = -EINVAL;
7732 			goto unlock;
7733 		}
7734 	} else {
7735 		n_channels = ieee80211_get_num_supported_channels(wiphy);
7736 	}
7737 
7738 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7739 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7740 			n_ssids++;
7741 
7742 	if (n_ssids > wiphy->max_scan_ssids) {
7743 		err = -EINVAL;
7744 		goto unlock;
7745 	}
7746 
7747 	if (info->attrs[NL80211_ATTR_IE])
7748 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7749 	else
7750 		ie_len = 0;
7751 
7752 	if (ie_len > wiphy->max_scan_ie_len) {
7753 		err = -EINVAL;
7754 		goto unlock;
7755 	}
7756 
7757 	request = kzalloc(sizeof(*request)
7758 			+ sizeof(*request->ssids) * n_ssids
7759 			+ sizeof(*request->channels) * n_channels
7760 			+ ie_len, GFP_KERNEL);
7761 	if (!request) {
7762 		err = -ENOMEM;
7763 		goto unlock;
7764 	}
7765 
7766 	if (n_ssids)
7767 		request->ssids = (void *)&request->channels[n_channels];
7768 	request->n_ssids = n_ssids;
7769 	if (ie_len) {
7770 		if (n_ssids)
7771 			request->ie = (void *)(request->ssids + n_ssids);
7772 		else
7773 			request->ie = (void *)(request->channels + n_channels);
7774 	}
7775 
7776 	i = 0;
7777 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7778 		/* user specified, bail out if channel not found */
7779 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7780 			struct ieee80211_channel *chan;
7781 
7782 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7783 
7784 			if (!chan) {
7785 				err = -EINVAL;
7786 				goto out_free;
7787 			}
7788 
7789 			/* ignore disabled channels */
7790 			if (chan->flags & IEEE80211_CHAN_DISABLED)
7791 				continue;
7792 
7793 			request->channels[i] = chan;
7794 			i++;
7795 		}
7796 	} else {
7797 		enum nl80211_band band;
7798 
7799 		/* all channels */
7800 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
7801 			int j;
7802 
7803 			if (!wiphy->bands[band])
7804 				continue;
7805 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7806 				struct ieee80211_channel *chan;
7807 
7808 				chan = &wiphy->bands[band]->channels[j];
7809 
7810 				if (chan->flags & IEEE80211_CHAN_DISABLED)
7811 					continue;
7812 
7813 				request->channels[i] = chan;
7814 				i++;
7815 			}
7816 		}
7817 	}
7818 
7819 	if (!i) {
7820 		err = -EINVAL;
7821 		goto out_free;
7822 	}
7823 
7824 	request->n_channels = i;
7825 
7826 	wdev_lock(wdev);
7827 	if (!cfg80211_off_channel_oper_allowed(wdev)) {
7828 		struct ieee80211_channel *chan;
7829 
7830 		if (request->n_channels != 1) {
7831 			wdev_unlock(wdev);
7832 			err = -EBUSY;
7833 			goto out_free;
7834 		}
7835 
7836 		chan = request->channels[0];
7837 		if (chan->center_freq != wdev->chandef.chan->center_freq) {
7838 			wdev_unlock(wdev);
7839 			err = -EBUSY;
7840 			goto out_free;
7841 		}
7842 	}
7843 	wdev_unlock(wdev);
7844 
7845 	i = 0;
7846 	if (n_ssids) {
7847 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7848 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7849 				err = -EINVAL;
7850 				goto out_free;
7851 			}
7852 			request->ssids[i].ssid_len = nla_len(attr);
7853 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7854 			i++;
7855 		}
7856 	}
7857 
7858 	if (info->attrs[NL80211_ATTR_IE]) {
7859 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7860 		memcpy((void *)request->ie,
7861 		       nla_data(info->attrs[NL80211_ATTR_IE]),
7862 		       request->ie_len);
7863 	}
7864 
7865 	for (i = 0; i < NUM_NL80211_BANDS; i++)
7866 		if (wiphy->bands[i])
7867 			request->rates[i] =
7868 				(1 << wiphy->bands[i]->n_bitrates) - 1;
7869 
7870 	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7871 		nla_for_each_nested(attr,
7872 				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7873 				    tmp) {
7874 			enum nl80211_band band = nla_type(attr);
7875 
7876 			if (band < 0 || band >= NUM_NL80211_BANDS) {
7877 				err = -EINVAL;
7878 				goto out_free;
7879 			}
7880 
7881 			if (!wiphy->bands[band])
7882 				continue;
7883 
7884 			err = ieee80211_get_ratemask(wiphy->bands[band],
7885 						     nla_data(attr),
7886 						     nla_len(attr),
7887 						     &request->rates[band]);
7888 			if (err)
7889 				goto out_free;
7890 		}
7891 	}
7892 
7893 	if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7894 		if (!wiphy_ext_feature_isset(wiphy,
7895 					NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7896 			err = -EOPNOTSUPP;
7897 			goto out_free;
7898 		}
7899 
7900 		request->duration =
7901 			nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7902 		request->duration_mandatory =
7903 			nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7904 	}
7905 
7906 	err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7907 				       false);
7908 	if (err)
7909 		goto out_free;
7910 
7911 	request->no_cck =
7912 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7913 
7914 	/* Initial implementation used NL80211_ATTR_MAC to set the specific
7915 	 * BSSID to scan for. This was problematic because that same attribute
7916 	 * was already used for another purpose (local random MAC address). The
7917 	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7918 	 * compatibility with older userspace components, also use the
7919 	 * NL80211_ATTR_MAC value here if it can be determined to be used for
7920 	 * the specific BSSID use case instead of the random MAC address
7921 	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7922 	 */
7923 	if (info->attrs[NL80211_ATTR_BSSID])
7924 		memcpy(request->bssid,
7925 		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7926 	else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7927 		 info->attrs[NL80211_ATTR_MAC])
7928 		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7929 		       ETH_ALEN);
7930 	else
7931 		eth_broadcast_addr(request->bssid);
7932 
7933 	request->wdev = wdev;
7934 	request->wiphy = &rdev->wiphy;
7935 	request->scan_start = jiffies;
7936 
7937 	rdev->scan_req = request;
7938 	err = rdev_scan(rdev, request);
7939 
7940 	if (!err) {
7941 		nl80211_send_scan_start(rdev, wdev);
7942 		if (wdev->netdev)
7943 			dev_hold(wdev->netdev);
7944 	} else {
7945  out_free:
7946 		rdev->scan_req = NULL;
7947 		kfree(request);
7948 	}
7949 
7950  unlock:
7951 	return err;
7952 }
7953 
7954 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7955 {
7956 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7957 	struct wireless_dev *wdev = info->user_ptr[1];
7958 
7959 	if (!rdev->ops->abort_scan)
7960 		return -EOPNOTSUPP;
7961 
7962 	if (rdev->scan_msg)
7963 		return 0;
7964 
7965 	if (!rdev->scan_req)
7966 		return -ENOENT;
7967 
7968 	rdev_abort_scan(rdev, wdev);
7969 	return 0;
7970 }
7971 
7972 static int
7973 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7974 			       struct cfg80211_sched_scan_request *request,
7975 			       struct nlattr **attrs)
7976 {
7977 	int tmp, err, i = 0;
7978 	struct nlattr *attr;
7979 
7980 	if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7981 		u32 interval;
7982 
7983 		/*
7984 		 * If scan plans are not specified,
7985 		 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7986 		 * case one scan plan will be set with the specified scan
7987 		 * interval and infinite number of iterations.
7988 		 */
7989 		interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7990 		if (!interval)
7991 			return -EINVAL;
7992 
7993 		request->scan_plans[0].interval =
7994 			DIV_ROUND_UP(interval, MSEC_PER_SEC);
7995 		if (!request->scan_plans[0].interval)
7996 			return -EINVAL;
7997 
7998 		if (request->scan_plans[0].interval >
7999 		    wiphy->max_sched_scan_plan_interval)
8000 			request->scan_plans[0].interval =
8001 				wiphy->max_sched_scan_plan_interval;
8002 
8003 		return 0;
8004 	}
8005 
8006 	nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8007 		struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8008 
8009 		if (WARN_ON(i >= n_plans))
8010 			return -EINVAL;
8011 
8012 		err = nla_parse_nested_deprecated(plan,
8013 						  NL80211_SCHED_SCAN_PLAN_MAX,
8014 						  attr, nl80211_plan_policy,
8015 						  NULL);
8016 		if (err)
8017 			return err;
8018 
8019 		if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8020 			return -EINVAL;
8021 
8022 		request->scan_plans[i].interval =
8023 			nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8024 		if (!request->scan_plans[i].interval ||
8025 		    request->scan_plans[i].interval >
8026 		    wiphy->max_sched_scan_plan_interval)
8027 			return -EINVAL;
8028 
8029 		if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8030 			request->scan_plans[i].iterations =
8031 				nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8032 			if (!request->scan_plans[i].iterations ||
8033 			    (request->scan_plans[i].iterations >
8034 			     wiphy->max_sched_scan_plan_iterations))
8035 				return -EINVAL;
8036 		} else if (i < n_plans - 1) {
8037 			/*
8038 			 * All scan plans but the last one must specify
8039 			 * a finite number of iterations
8040 			 */
8041 			return -EINVAL;
8042 		}
8043 
8044 		i++;
8045 	}
8046 
8047 	/*
8048 	 * The last scan plan must not specify the number of
8049 	 * iterations, it is supposed to run infinitely
8050 	 */
8051 	if (request->scan_plans[n_plans - 1].iterations)
8052 		return  -EINVAL;
8053 
8054 	return 0;
8055 }
8056 
8057 static int
8058 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8059 				       struct cfg80211_match_set *match_sets,
8060 				       struct nlattr *tb_band_rssi,
8061 				       s32 rssi_thold)
8062 {
8063 	struct nlattr *attr;
8064 	int i, tmp, ret = 0;
8065 
8066 	if (!wiphy_ext_feature_isset(wiphy,
8067 		    NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8068 		if (tb_band_rssi)
8069 			ret = -EOPNOTSUPP;
8070 		else
8071 			for (i = 0; i < NUM_NL80211_BANDS; i++)
8072 				match_sets->per_band_rssi_thold[i] =
8073 					NL80211_SCAN_RSSI_THOLD_OFF;
8074 		return ret;
8075 	}
8076 
8077 	for (i = 0; i < NUM_NL80211_BANDS; i++)
8078 		match_sets->per_band_rssi_thold[i] = rssi_thold;
8079 
8080 	nla_for_each_nested(attr, tb_band_rssi, tmp) {
8081 		enum nl80211_band band = nla_type(attr);
8082 
8083 		if (band < 0 || band >= NUM_NL80211_BANDS)
8084 			return -EINVAL;
8085 
8086 		match_sets->per_band_rssi_thold[band] =	nla_get_s32(attr);
8087 	}
8088 
8089 	return 0;
8090 }
8091 
8092 static struct cfg80211_sched_scan_request *
8093 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8094 			 struct nlattr **attrs, int max_match_sets)
8095 {
8096 	struct cfg80211_sched_scan_request *request;
8097 	struct nlattr *attr;
8098 	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8099 	enum nl80211_band band;
8100 	size_t ie_len;
8101 	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8102 	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8103 
8104 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8105 		n_channels = validate_scan_freqs(
8106 				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8107 		if (!n_channels)
8108 			return ERR_PTR(-EINVAL);
8109 	} else {
8110 		n_channels = ieee80211_get_num_supported_channels(wiphy);
8111 	}
8112 
8113 	if (attrs[NL80211_ATTR_SCAN_SSIDS])
8114 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8115 				    tmp)
8116 			n_ssids++;
8117 
8118 	if (n_ssids > wiphy->max_sched_scan_ssids)
8119 		return ERR_PTR(-EINVAL);
8120 
8121 	/*
8122 	 * First, count the number of 'real' matchsets. Due to an issue with
8123 	 * the old implementation, matchsets containing only the RSSI attribute
8124 	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8125 	 * RSSI for all matchsets, rather than their own matchset for reporting
8126 	 * all APs with a strong RSSI. This is needed to be compatible with
8127 	 * older userspace that treated a matchset with only the RSSI as the
8128 	 * global RSSI for all other matchsets - if there are other matchsets.
8129 	 */
8130 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8131 		nla_for_each_nested(attr,
8132 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8133 				    tmp) {
8134 			struct nlattr *rssi;
8135 
8136 			err = nla_parse_nested_deprecated(tb,
8137 							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8138 							  attr,
8139 							  nl80211_match_policy,
8140 							  NULL);
8141 			if (err)
8142 				return ERR_PTR(err);
8143 
8144 			/* SSID and BSSID are mutually exclusive */
8145 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8146 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8147 				return ERR_PTR(-EINVAL);
8148 
8149 			/* add other standalone attributes here */
8150 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8151 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8152 				n_match_sets++;
8153 				continue;
8154 			}
8155 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8156 			if (rssi)
8157 				default_match_rssi = nla_get_s32(rssi);
8158 		}
8159 	}
8160 
8161 	/* However, if there's no other matchset, add the RSSI one */
8162 	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8163 		n_match_sets = 1;
8164 
8165 	if (n_match_sets > max_match_sets)
8166 		return ERR_PTR(-EINVAL);
8167 
8168 	if (attrs[NL80211_ATTR_IE])
8169 		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8170 	else
8171 		ie_len = 0;
8172 
8173 	if (ie_len > wiphy->max_sched_scan_ie_len)
8174 		return ERR_PTR(-EINVAL);
8175 
8176 	if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8177 		/*
8178 		 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8179 		 * each scan plan already specifies its own interval
8180 		 */
8181 		if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8182 			return ERR_PTR(-EINVAL);
8183 
8184 		nla_for_each_nested(attr,
8185 				    attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8186 			n_plans++;
8187 	} else {
8188 		/*
8189 		 * The scan interval attribute is kept for backward
8190 		 * compatibility. If no scan plans are specified and sched scan
8191 		 * interval is specified, one scan plan will be set with this
8192 		 * scan interval and infinite number of iterations.
8193 		 */
8194 		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8195 			return ERR_PTR(-EINVAL);
8196 
8197 		n_plans = 1;
8198 	}
8199 
8200 	if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8201 		return ERR_PTR(-EINVAL);
8202 
8203 	if (!wiphy_ext_feature_isset(
8204 		    wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8205 	    (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8206 	     attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8207 		return ERR_PTR(-EINVAL);
8208 
8209 	request = kzalloc(sizeof(*request)
8210 			+ sizeof(*request->ssids) * n_ssids
8211 			+ sizeof(*request->match_sets) * n_match_sets
8212 			+ sizeof(*request->scan_plans) * n_plans
8213 			+ sizeof(*request->channels) * n_channels
8214 			+ ie_len, GFP_KERNEL);
8215 	if (!request)
8216 		return ERR_PTR(-ENOMEM);
8217 
8218 	if (n_ssids)
8219 		request->ssids = (void *)&request->channels[n_channels];
8220 	request->n_ssids = n_ssids;
8221 	if (ie_len) {
8222 		if (n_ssids)
8223 			request->ie = (void *)(request->ssids + n_ssids);
8224 		else
8225 			request->ie = (void *)(request->channels + n_channels);
8226 	}
8227 
8228 	if (n_match_sets) {
8229 		if (request->ie)
8230 			request->match_sets = (void *)(request->ie + ie_len);
8231 		else if (n_ssids)
8232 			request->match_sets =
8233 				(void *)(request->ssids + n_ssids);
8234 		else
8235 			request->match_sets =
8236 				(void *)(request->channels + n_channels);
8237 	}
8238 	request->n_match_sets = n_match_sets;
8239 
8240 	if (n_match_sets)
8241 		request->scan_plans = (void *)(request->match_sets +
8242 					       n_match_sets);
8243 	else if (request->ie)
8244 		request->scan_plans = (void *)(request->ie + ie_len);
8245 	else if (n_ssids)
8246 		request->scan_plans = (void *)(request->ssids + n_ssids);
8247 	else
8248 		request->scan_plans = (void *)(request->channels + n_channels);
8249 
8250 	request->n_scan_plans = n_plans;
8251 
8252 	i = 0;
8253 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8254 		/* user specified, bail out if channel not found */
8255 		nla_for_each_nested(attr,
8256 				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8257 				    tmp) {
8258 			struct ieee80211_channel *chan;
8259 
8260 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8261 
8262 			if (!chan) {
8263 				err = -EINVAL;
8264 				goto out_free;
8265 			}
8266 
8267 			/* ignore disabled channels */
8268 			if (chan->flags & IEEE80211_CHAN_DISABLED)
8269 				continue;
8270 
8271 			request->channels[i] = chan;
8272 			i++;
8273 		}
8274 	} else {
8275 		/* all channels */
8276 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
8277 			int j;
8278 
8279 			if (!wiphy->bands[band])
8280 				continue;
8281 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8282 				struct ieee80211_channel *chan;
8283 
8284 				chan = &wiphy->bands[band]->channels[j];
8285 
8286 				if (chan->flags & IEEE80211_CHAN_DISABLED)
8287 					continue;
8288 
8289 				request->channels[i] = chan;
8290 				i++;
8291 			}
8292 		}
8293 	}
8294 
8295 	if (!i) {
8296 		err = -EINVAL;
8297 		goto out_free;
8298 	}
8299 
8300 	request->n_channels = i;
8301 
8302 	i = 0;
8303 	if (n_ssids) {
8304 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8305 				    tmp) {
8306 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8307 				err = -EINVAL;
8308 				goto out_free;
8309 			}
8310 			request->ssids[i].ssid_len = nla_len(attr);
8311 			memcpy(request->ssids[i].ssid, nla_data(attr),
8312 			       nla_len(attr));
8313 			i++;
8314 		}
8315 	}
8316 
8317 	i = 0;
8318 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8319 		nla_for_each_nested(attr,
8320 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8321 				    tmp) {
8322 			struct nlattr *ssid, *bssid, *rssi;
8323 
8324 			err = nla_parse_nested_deprecated(tb,
8325 							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8326 							  attr,
8327 							  nl80211_match_policy,
8328 							  NULL);
8329 			if (err)
8330 				goto out_free;
8331 			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8332 			bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8333 
8334 			if (!ssid && !bssid) {
8335 				i++;
8336 				continue;
8337 			}
8338 
8339 			if (WARN_ON(i >= n_match_sets)) {
8340 				/* this indicates a programming error,
8341 				 * the loop above should have verified
8342 				 * things properly
8343 				 */
8344 				err = -EINVAL;
8345 				goto out_free;
8346 			}
8347 
8348 			if (ssid) {
8349 				if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
8350 					err = -EINVAL;
8351 					goto out_free;
8352 				}
8353 				memcpy(request->match_sets[i].ssid.ssid,
8354 				       nla_data(ssid), nla_len(ssid));
8355 				request->match_sets[i].ssid.ssid_len =
8356 					nla_len(ssid);
8357 			}
8358 			if (bssid) {
8359 				if (nla_len(bssid) != ETH_ALEN) {
8360 					err = -EINVAL;
8361 					goto out_free;
8362 				}
8363 				memcpy(request->match_sets[i].bssid,
8364 				       nla_data(bssid), ETH_ALEN);
8365 			}
8366 
8367 			/* special attribute - old implementation w/a */
8368 			request->match_sets[i].rssi_thold = default_match_rssi;
8369 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8370 			if (rssi)
8371 				request->match_sets[i].rssi_thold =
8372 					nla_get_s32(rssi);
8373 
8374 			/* Parse per band RSSI attribute */
8375 			err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8376 				&request->match_sets[i],
8377 				tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8378 				request->match_sets[i].rssi_thold);
8379 			if (err)
8380 				goto out_free;
8381 
8382 			i++;
8383 		}
8384 
8385 		/* there was no other matchset, so the RSSI one is alone */
8386 		if (i == 0 && n_match_sets)
8387 			request->match_sets[0].rssi_thold = default_match_rssi;
8388 
8389 		request->min_rssi_thold = INT_MAX;
8390 		for (i = 0; i < n_match_sets; i++)
8391 			request->min_rssi_thold =
8392 				min(request->match_sets[i].rssi_thold,
8393 				    request->min_rssi_thold);
8394 	} else {
8395 		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8396 	}
8397 
8398 	if (ie_len) {
8399 		request->ie_len = ie_len;
8400 		memcpy((void *)request->ie,
8401 		       nla_data(attrs[NL80211_ATTR_IE]),
8402 		       request->ie_len);
8403 	}
8404 
8405 	err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8406 	if (err)
8407 		goto out_free;
8408 
8409 	if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8410 		request->delay =
8411 			nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8412 
8413 	if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8414 		request->relative_rssi = nla_get_s8(
8415 			attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8416 		request->relative_rssi_set = true;
8417 	}
8418 
8419 	if (request->relative_rssi_set &&
8420 	    attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8421 		struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8422 
8423 		rssi_adjust = nla_data(
8424 			attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8425 		request->rssi_adjust.band = rssi_adjust->band;
8426 		request->rssi_adjust.delta = rssi_adjust->delta;
8427 		if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8428 			err = -EINVAL;
8429 			goto out_free;
8430 		}
8431 	}
8432 
8433 	err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8434 	if (err)
8435 		goto out_free;
8436 
8437 	request->scan_start = jiffies;
8438 
8439 	return request;
8440 
8441 out_free:
8442 	kfree(request);
8443 	return ERR_PTR(err);
8444 }
8445 
8446 static int nl80211_start_sched_scan(struct sk_buff *skb,
8447 				    struct genl_info *info)
8448 {
8449 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8450 	struct net_device *dev = info->user_ptr[1];
8451 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8452 	struct cfg80211_sched_scan_request *sched_scan_req;
8453 	bool want_multi;
8454 	int err;
8455 
8456 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8457 		return -EOPNOTSUPP;
8458 
8459 	want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8460 	err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8461 	if (err)
8462 		return err;
8463 
8464 	sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8465 						  info->attrs,
8466 						  rdev->wiphy.max_match_sets);
8467 
8468 	err = PTR_ERR_OR_ZERO(sched_scan_req);
8469 	if (err)
8470 		goto out_err;
8471 
8472 	/* leave request id zero for legacy request
8473 	 * or if driver does not support multi-scheduled scan
8474 	 */
8475 	if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
8476 		sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8477 
8478 	err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8479 	if (err)
8480 		goto out_free;
8481 
8482 	sched_scan_req->dev = dev;
8483 	sched_scan_req->wiphy = &rdev->wiphy;
8484 
8485 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8486 		sched_scan_req->owner_nlportid = info->snd_portid;
8487 
8488 	cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8489 
8490 	nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8491 	return 0;
8492 
8493 out_free:
8494 	kfree(sched_scan_req);
8495 out_err:
8496 	return err;
8497 }
8498 
8499 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8500 				   struct genl_info *info)
8501 {
8502 	struct cfg80211_sched_scan_request *req;
8503 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8504 	u64 cookie;
8505 
8506 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8507 		return -EOPNOTSUPP;
8508 
8509 	if (info->attrs[NL80211_ATTR_COOKIE]) {
8510 		cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8511 		return __cfg80211_stop_sched_scan(rdev, cookie, false);
8512 	}
8513 
8514 	req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8515 				     struct cfg80211_sched_scan_request,
8516 				     list);
8517 	if (!req || req->reqid ||
8518 	    (req->owner_nlportid &&
8519 	     req->owner_nlportid != info->snd_portid))
8520 		return -ENOENT;
8521 
8522 	return cfg80211_stop_sched_scan_req(rdev, req, false);
8523 }
8524 
8525 static int nl80211_start_radar_detection(struct sk_buff *skb,
8526 					 struct genl_info *info)
8527 {
8528 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8529 	struct net_device *dev = info->user_ptr[1];
8530 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8531 	struct wiphy *wiphy = wdev->wiphy;
8532 	struct cfg80211_chan_def chandef;
8533 	enum nl80211_dfs_regions dfs_region;
8534 	unsigned int cac_time_ms;
8535 	int err;
8536 
8537 	dfs_region = reg_get_dfs_region(wiphy);
8538 	if (dfs_region == NL80211_DFS_UNSET)
8539 		return -EINVAL;
8540 
8541 	err = nl80211_parse_chandef(rdev, info, &chandef);
8542 	if (err)
8543 		return err;
8544 
8545 	if (netif_carrier_ok(dev))
8546 		return -EBUSY;
8547 
8548 	if (wdev->cac_started)
8549 		return -EBUSY;
8550 
8551 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8552 	if (err < 0)
8553 		return err;
8554 
8555 	if (err == 0)
8556 		return -EINVAL;
8557 
8558 	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8559 		return -EINVAL;
8560 
8561 	/* CAC start is offloaded to HW and can't be started manually */
8562 	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8563 		return -EOPNOTSUPP;
8564 
8565 	if (!rdev->ops->start_radar_detection)
8566 		return -EOPNOTSUPP;
8567 
8568 	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8569 	if (WARN_ON(!cac_time_ms))
8570 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8571 
8572 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8573 	if (!err) {
8574 		wdev->chandef = chandef;
8575 		wdev->cac_started = true;
8576 		wdev->cac_start_time = jiffies;
8577 		wdev->cac_time_ms = cac_time_ms;
8578 	}
8579 	return err;
8580 }
8581 
8582 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8583 					  struct genl_info *info)
8584 {
8585 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8586 	struct net_device *dev = info->user_ptr[1];
8587 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8588 	struct wiphy *wiphy = wdev->wiphy;
8589 	struct cfg80211_chan_def chandef;
8590 	enum nl80211_dfs_regions dfs_region;
8591 	int err;
8592 
8593 	dfs_region = reg_get_dfs_region(wiphy);
8594 	if (dfs_region == NL80211_DFS_UNSET) {
8595 		GENL_SET_ERR_MSG(info,
8596 				 "DFS Region is not set. Unexpected Radar indication");
8597 		return -EINVAL;
8598 	}
8599 
8600 	err = nl80211_parse_chandef(rdev, info, &chandef);
8601 	if (err) {
8602 		GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8603 		return err;
8604 	}
8605 
8606 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8607 	if (err < 0) {
8608 		GENL_SET_ERR_MSG(info, "chandef is invalid");
8609 		return err;
8610 	}
8611 
8612 	if (err == 0) {
8613 		GENL_SET_ERR_MSG(info,
8614 				 "Unexpected Radar indication for chandef/iftype");
8615 		return -EINVAL;
8616 	}
8617 
8618 	/* Do not process this notification if radar is already detected
8619 	 * by kernel on this channel, and return success.
8620 	 */
8621 	if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8622 		return 0;
8623 
8624 	cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8625 
8626 	cfg80211_sched_dfs_chan_update(rdev);
8627 
8628 	rdev->radar_chandef = chandef;
8629 
8630 	/* Propagate this notification to other radios as well */
8631 	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8632 
8633 	return 0;
8634 }
8635 
8636 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8637 {
8638 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8639 	struct net_device *dev = info->user_ptr[1];
8640 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8641 	struct cfg80211_csa_settings params;
8642 	/* csa_attrs is defined static to avoid waste of stack size - this
8643 	 * function is called under RTNL lock, so this should not be a problem.
8644 	 */
8645 	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8646 	int err;
8647 	bool need_new_beacon = false;
8648 	bool need_handle_dfs_flag = true;
8649 	int len, i;
8650 	u32 cs_count;
8651 
8652 	if (!rdev->ops->channel_switch ||
8653 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8654 		return -EOPNOTSUPP;
8655 
8656 	switch (dev->ieee80211_ptr->iftype) {
8657 	case NL80211_IFTYPE_AP:
8658 	case NL80211_IFTYPE_P2P_GO:
8659 		need_new_beacon = true;
8660 		/* For all modes except AP the handle_dfs flag needs to be
8661 		 * supplied to tell the kernel that userspace will handle radar
8662 		 * events when they happen. Otherwise a switch to a channel
8663 		 * requiring DFS will be rejected.
8664 		 */
8665 		need_handle_dfs_flag = false;
8666 
8667 		/* useless if AP is not running */
8668 		if (!wdev->beacon_interval)
8669 			return -ENOTCONN;
8670 		break;
8671 	case NL80211_IFTYPE_ADHOC:
8672 		if (!wdev->ssid_len)
8673 			return -ENOTCONN;
8674 		break;
8675 	case NL80211_IFTYPE_MESH_POINT:
8676 		if (!wdev->mesh_id_len)
8677 			return -ENOTCONN;
8678 		break;
8679 	default:
8680 		return -EOPNOTSUPP;
8681 	}
8682 
8683 	memset(&params, 0, sizeof(params));
8684 	params.beacon_csa.ftm_responder = -1;
8685 
8686 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8687 	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8688 		return -EINVAL;
8689 
8690 	/* only important for AP, IBSS and mesh create IEs internally */
8691 	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8692 		return -EINVAL;
8693 
8694 	/* Even though the attribute is u32, the specification says
8695 	 * u8, so let's make sure we don't overflow.
8696 	 */
8697 	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8698 	if (cs_count > 255)
8699 		return -EINVAL;
8700 
8701 	params.count = cs_count;
8702 
8703 	if (!need_new_beacon)
8704 		goto skip_beacons;
8705 
8706 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8707 	if (err)
8708 		return err;
8709 
8710 	err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
8711 					  info->attrs[NL80211_ATTR_CSA_IES],
8712 					  nl80211_policy, info->extack);
8713 	if (err)
8714 		return err;
8715 
8716 	err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8717 	if (err)
8718 		return err;
8719 
8720 	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8721 		return -EINVAL;
8722 
8723 	len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8724 	if (!len || (len % sizeof(u16)))
8725 		return -EINVAL;
8726 
8727 	params.n_counter_offsets_beacon = len / sizeof(u16);
8728 	if (rdev->wiphy.max_num_csa_counters &&
8729 	    (params.n_counter_offsets_beacon >
8730 	     rdev->wiphy.max_num_csa_counters))
8731 		return -EINVAL;
8732 
8733 	params.counter_offsets_beacon =
8734 		nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8735 
8736 	/* sanity checks - counters should fit and be the same */
8737 	for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8738 		u16 offset = params.counter_offsets_beacon[i];
8739 
8740 		if (offset >= params.beacon_csa.tail_len)
8741 			return -EINVAL;
8742 
8743 		if (params.beacon_csa.tail[offset] != params.count)
8744 			return -EINVAL;
8745 	}
8746 
8747 	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8748 		len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8749 		if (!len || (len % sizeof(u16)))
8750 			return -EINVAL;
8751 
8752 		params.n_counter_offsets_presp = len / sizeof(u16);
8753 		if (rdev->wiphy.max_num_csa_counters &&
8754 		    (params.n_counter_offsets_presp >
8755 		     rdev->wiphy.max_num_csa_counters))
8756 			return -EINVAL;
8757 
8758 		params.counter_offsets_presp =
8759 			nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8760 
8761 		/* sanity checks - counters should fit and be the same */
8762 		for (i = 0; i < params.n_counter_offsets_presp; i++) {
8763 			u16 offset = params.counter_offsets_presp[i];
8764 
8765 			if (offset >= params.beacon_csa.probe_resp_len)
8766 				return -EINVAL;
8767 
8768 			if (params.beacon_csa.probe_resp[offset] !=
8769 			    params.count)
8770 				return -EINVAL;
8771 		}
8772 	}
8773 
8774 skip_beacons:
8775 	err = nl80211_parse_chandef(rdev, info, &params.chandef);
8776 	if (err)
8777 		return err;
8778 
8779 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8780 					   wdev->iftype))
8781 		return -EINVAL;
8782 
8783 	err = cfg80211_chandef_dfs_required(wdev->wiphy,
8784 					    &params.chandef,
8785 					    wdev->iftype);
8786 	if (err < 0)
8787 		return err;
8788 
8789 	if (err > 0) {
8790 		params.radar_required = true;
8791 		if (need_handle_dfs_flag &&
8792 		    !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8793 			return -EINVAL;
8794 		}
8795 	}
8796 
8797 	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8798 		params.block_tx = true;
8799 
8800 	wdev_lock(wdev);
8801 	err = rdev_channel_switch(rdev, dev, &params);
8802 	wdev_unlock(wdev);
8803 
8804 	return err;
8805 }
8806 
8807 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8808 			    u32 seq, int flags,
8809 			    struct cfg80211_registered_device *rdev,
8810 			    struct wireless_dev *wdev,
8811 			    struct cfg80211_internal_bss *intbss)
8812 {
8813 	struct cfg80211_bss *res = &intbss->pub;
8814 	const struct cfg80211_bss_ies *ies;
8815 	void *hdr;
8816 	struct nlattr *bss;
8817 
8818 	ASSERT_WDEV_LOCK(wdev);
8819 
8820 	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8821 			     NL80211_CMD_NEW_SCAN_RESULTS);
8822 	if (!hdr)
8823 		return -1;
8824 
8825 	genl_dump_check_consistent(cb, hdr);
8826 
8827 	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8828 		goto nla_put_failure;
8829 	if (wdev->netdev &&
8830 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8831 		goto nla_put_failure;
8832 	if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8833 			      NL80211_ATTR_PAD))
8834 		goto nla_put_failure;
8835 
8836 	bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
8837 	if (!bss)
8838 		goto nla_put_failure;
8839 	if ((!is_zero_ether_addr(res->bssid) &&
8840 	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8841 		goto nla_put_failure;
8842 
8843 	rcu_read_lock();
8844 	/* indicate whether we have probe response data or not */
8845 	if (rcu_access_pointer(res->proberesp_ies) &&
8846 	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8847 		goto fail_unlock_rcu;
8848 
8849 	/* this pointer prefers to be pointed to probe response data
8850 	 * but is always valid
8851 	 */
8852 	ies = rcu_dereference(res->ies);
8853 	if (ies) {
8854 		if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8855 				      NL80211_BSS_PAD))
8856 			goto fail_unlock_rcu;
8857 		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8858 					ies->len, ies->data))
8859 			goto fail_unlock_rcu;
8860 	}
8861 
8862 	/* and this pointer is always (unless driver didn't know) beacon data */
8863 	ies = rcu_dereference(res->beacon_ies);
8864 	if (ies && ies->from_beacon) {
8865 		if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8866 				      NL80211_BSS_PAD))
8867 			goto fail_unlock_rcu;
8868 		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8869 					ies->len, ies->data))
8870 			goto fail_unlock_rcu;
8871 	}
8872 	rcu_read_unlock();
8873 
8874 	if (res->beacon_interval &&
8875 	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8876 		goto nla_put_failure;
8877 	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8878 	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8879 	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8880 	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8881 			jiffies_to_msecs(jiffies - intbss->ts)))
8882 		goto nla_put_failure;
8883 
8884 	if (intbss->parent_tsf &&
8885 	    (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8886 			       intbss->parent_tsf, NL80211_BSS_PAD) ||
8887 	     nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8888 		     intbss->parent_bssid)))
8889 		goto nla_put_failure;
8890 
8891 	if (intbss->ts_boottime &&
8892 	    nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8893 			      intbss->ts_boottime, NL80211_BSS_PAD))
8894 		goto nla_put_failure;
8895 
8896 	if (!nl80211_put_signal(msg, intbss->pub.chains,
8897 				intbss->pub.chain_signal,
8898 				NL80211_BSS_CHAIN_SIGNAL))
8899 		goto nla_put_failure;
8900 
8901 	switch (rdev->wiphy.signal_type) {
8902 	case CFG80211_SIGNAL_TYPE_MBM:
8903 		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8904 			goto nla_put_failure;
8905 		break;
8906 	case CFG80211_SIGNAL_TYPE_UNSPEC:
8907 		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8908 			goto nla_put_failure;
8909 		break;
8910 	default:
8911 		break;
8912 	}
8913 
8914 	switch (wdev->iftype) {
8915 	case NL80211_IFTYPE_P2P_CLIENT:
8916 	case NL80211_IFTYPE_STATION:
8917 		if (intbss == wdev->current_bss &&
8918 		    nla_put_u32(msg, NL80211_BSS_STATUS,
8919 				NL80211_BSS_STATUS_ASSOCIATED))
8920 			goto nla_put_failure;
8921 		break;
8922 	case NL80211_IFTYPE_ADHOC:
8923 		if (intbss == wdev->current_bss &&
8924 		    nla_put_u32(msg, NL80211_BSS_STATUS,
8925 				NL80211_BSS_STATUS_IBSS_JOINED))
8926 			goto nla_put_failure;
8927 		break;
8928 	default:
8929 		break;
8930 	}
8931 
8932 	nla_nest_end(msg, bss);
8933 
8934 	genlmsg_end(msg, hdr);
8935 	return 0;
8936 
8937  fail_unlock_rcu:
8938 	rcu_read_unlock();
8939  nla_put_failure:
8940 	genlmsg_cancel(msg, hdr);
8941 	return -EMSGSIZE;
8942 }
8943 
8944 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8945 {
8946 	struct cfg80211_registered_device *rdev;
8947 	struct cfg80211_internal_bss *scan;
8948 	struct wireless_dev *wdev;
8949 	int start = cb->args[2], idx = 0;
8950 	int err;
8951 
8952 	rtnl_lock();
8953 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8954 	if (err) {
8955 		rtnl_unlock();
8956 		return err;
8957 	}
8958 
8959 	wdev_lock(wdev);
8960 	spin_lock_bh(&rdev->bss_lock);
8961 
8962 	/*
8963 	 * dump_scan will be called multiple times to break up the scan results
8964 	 * into multiple messages.  It is unlikely that any more bss-es will be
8965 	 * expired after the first call, so only call only call this on the
8966 	 * first dump_scan invocation.
8967 	 */
8968 	if (start == 0)
8969 		cfg80211_bss_expire(rdev);
8970 
8971 	cb->seq = rdev->bss_generation;
8972 
8973 	list_for_each_entry(scan, &rdev->bss_list, list) {
8974 		if (++idx <= start)
8975 			continue;
8976 		if (nl80211_send_bss(skb, cb,
8977 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
8978 				rdev, wdev, scan) < 0) {
8979 			idx--;
8980 			break;
8981 		}
8982 	}
8983 
8984 	spin_unlock_bh(&rdev->bss_lock);
8985 	wdev_unlock(wdev);
8986 
8987 	cb->args[2] = idx;
8988 	rtnl_unlock();
8989 
8990 	return skb->len;
8991 }
8992 
8993 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8994 			       int flags, struct net_device *dev,
8995 			       bool allow_radio_stats,
8996 			       struct survey_info *survey)
8997 {
8998 	void *hdr;
8999 	struct nlattr *infoattr;
9000 
9001 	/* skip radio stats if userspace didn't request them */
9002 	if (!survey->channel && !allow_radio_stats)
9003 		return 0;
9004 
9005 	hdr = nl80211hdr_put(msg, portid, seq, flags,
9006 			     NL80211_CMD_NEW_SURVEY_RESULTS);
9007 	if (!hdr)
9008 		return -ENOMEM;
9009 
9010 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9011 		goto nla_put_failure;
9012 
9013 	infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9014 	if (!infoattr)
9015 		goto nla_put_failure;
9016 
9017 	if (survey->channel &&
9018 	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9019 			survey->channel->center_freq))
9020 		goto nla_put_failure;
9021 
9022 	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9023 	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9024 		goto nla_put_failure;
9025 	if ((survey->filled & SURVEY_INFO_IN_USE) &&
9026 	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9027 		goto nla_put_failure;
9028 	if ((survey->filled & SURVEY_INFO_TIME) &&
9029 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9030 			survey->time, NL80211_SURVEY_INFO_PAD))
9031 		goto nla_put_failure;
9032 	if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9033 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9034 			      survey->time_busy, NL80211_SURVEY_INFO_PAD))
9035 		goto nla_put_failure;
9036 	if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9037 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9038 			      survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9039 		goto nla_put_failure;
9040 	if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9041 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9042 			      survey->time_rx, NL80211_SURVEY_INFO_PAD))
9043 		goto nla_put_failure;
9044 	if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9045 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9046 			      survey->time_tx, NL80211_SURVEY_INFO_PAD))
9047 		goto nla_put_failure;
9048 	if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9049 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9050 			      survey->time_scan, NL80211_SURVEY_INFO_PAD))
9051 		goto nla_put_failure;
9052 	if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9053 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9054 			      survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9055 		goto nla_put_failure;
9056 
9057 	nla_nest_end(msg, infoattr);
9058 
9059 	genlmsg_end(msg, hdr);
9060 	return 0;
9061 
9062  nla_put_failure:
9063 	genlmsg_cancel(msg, hdr);
9064 	return -EMSGSIZE;
9065 }
9066 
9067 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9068 {
9069 	struct nlattr **attrbuf;
9070 	struct survey_info survey;
9071 	struct cfg80211_registered_device *rdev;
9072 	struct wireless_dev *wdev;
9073 	int survey_idx = cb->args[2];
9074 	int res;
9075 	bool radio_stats;
9076 
9077 	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9078 	if (!attrbuf)
9079 		return -ENOMEM;
9080 
9081 	rtnl_lock();
9082 	res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9083 	if (res)
9084 		goto out_err;
9085 
9086 	/* prepare_wdev_dump parsed the attributes */
9087 	radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9088 
9089 	if (!wdev->netdev) {
9090 		res = -EINVAL;
9091 		goto out_err;
9092 	}
9093 
9094 	if (!rdev->ops->dump_survey) {
9095 		res = -EOPNOTSUPP;
9096 		goto out_err;
9097 	}
9098 
9099 	while (1) {
9100 		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9101 		if (res == -ENOENT)
9102 			break;
9103 		if (res)
9104 			goto out_err;
9105 
9106 		/* don't send disabled channels, but do send non-channel data */
9107 		if (survey.channel &&
9108 		    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9109 			survey_idx++;
9110 			continue;
9111 		}
9112 
9113 		if (nl80211_send_survey(skb,
9114 				NETLINK_CB(cb->skb).portid,
9115 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
9116 				wdev->netdev, radio_stats, &survey) < 0)
9117 			goto out;
9118 		survey_idx++;
9119 	}
9120 
9121  out:
9122 	cb->args[2] = survey_idx;
9123 	res = skb->len;
9124  out_err:
9125 	kfree(attrbuf);
9126 	rtnl_unlock();
9127 	return res;
9128 }
9129 
9130 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9131 {
9132 	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9133 				  NL80211_WPA_VERSION_2 |
9134 				  NL80211_WPA_VERSION_3));
9135 }
9136 
9137 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9138 {
9139 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9140 	struct net_device *dev = info->user_ptr[1];
9141 	struct ieee80211_channel *chan;
9142 	const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9143 	int err, ssid_len, ie_len = 0, auth_data_len = 0;
9144 	enum nl80211_auth_type auth_type;
9145 	struct key_parse key;
9146 	bool local_state_change;
9147 
9148 	if (!info->attrs[NL80211_ATTR_MAC])
9149 		return -EINVAL;
9150 
9151 	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9152 		return -EINVAL;
9153 
9154 	if (!info->attrs[NL80211_ATTR_SSID])
9155 		return -EINVAL;
9156 
9157 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9158 		return -EINVAL;
9159 
9160 	err = nl80211_parse_key(info, &key);
9161 	if (err)
9162 		return err;
9163 
9164 	if (key.idx >= 0) {
9165 		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9166 			return -EINVAL;
9167 		if (!key.p.key || !key.p.key_len)
9168 			return -EINVAL;
9169 		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9170 		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9171 		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9172 		     key.p.key_len != WLAN_KEY_LEN_WEP104))
9173 			return -EINVAL;
9174 		if (key.idx > 3)
9175 			return -EINVAL;
9176 	} else {
9177 		key.p.key_len = 0;
9178 		key.p.key = NULL;
9179 	}
9180 
9181 	if (key.idx >= 0) {
9182 		int i;
9183 		bool ok = false;
9184 
9185 		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9186 			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9187 				ok = true;
9188 				break;
9189 			}
9190 		}
9191 		if (!ok)
9192 			return -EINVAL;
9193 	}
9194 
9195 	if (!rdev->ops->auth)
9196 		return -EOPNOTSUPP;
9197 
9198 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9199 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9200 		return -EOPNOTSUPP;
9201 
9202 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9203 	chan = nl80211_get_valid_chan(&rdev->wiphy,
9204 				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9205 	if (!chan)
9206 		return -EINVAL;
9207 
9208 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9209 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9210 
9211 	if (info->attrs[NL80211_ATTR_IE]) {
9212 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9213 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9214 	}
9215 
9216 	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9217 	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9218 		return -EINVAL;
9219 
9220 	if ((auth_type == NL80211_AUTHTYPE_SAE ||
9221 	     auth_type == NL80211_AUTHTYPE_FILS_SK ||
9222 	     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9223 	     auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9224 	    !info->attrs[NL80211_ATTR_AUTH_DATA])
9225 		return -EINVAL;
9226 
9227 	if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9228 		if (auth_type != NL80211_AUTHTYPE_SAE &&
9229 		    auth_type != NL80211_AUTHTYPE_FILS_SK &&
9230 		    auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9231 		    auth_type != NL80211_AUTHTYPE_FILS_PK)
9232 			return -EINVAL;
9233 		auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9234 		auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9235 		/* need to include at least Auth Transaction and Status Code */
9236 		if (auth_data_len < 4)
9237 			return -EINVAL;
9238 	}
9239 
9240 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9241 
9242 	/*
9243 	 * Since we no longer track auth state, ignore
9244 	 * requests to only change local state.
9245 	 */
9246 	if (local_state_change)
9247 		return 0;
9248 
9249 	wdev_lock(dev->ieee80211_ptr);
9250 	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9251 				 ssid, ssid_len, ie, ie_len,
9252 				 key.p.key, key.p.key_len, key.idx,
9253 				 auth_data, auth_data_len);
9254 	wdev_unlock(dev->ieee80211_ptr);
9255 	return err;
9256 }
9257 
9258 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9259 				     struct genl_info *info)
9260 {
9261 	if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9262 		GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9263 		return -EINVAL;
9264 	}
9265 
9266 	if (!rdev->ops->tx_control_port ||
9267 	    !wiphy_ext_feature_isset(&rdev->wiphy,
9268 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9269 		return -EOPNOTSUPP;
9270 
9271 	return 0;
9272 }
9273 
9274 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9275 				   struct genl_info *info,
9276 				   struct cfg80211_crypto_settings *settings,
9277 				   int cipher_limit)
9278 {
9279 	memset(settings, 0, sizeof(*settings));
9280 
9281 	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9282 
9283 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9284 		u16 proto;
9285 
9286 		proto = nla_get_u16(
9287 			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9288 		settings->control_port_ethertype = cpu_to_be16(proto);
9289 		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9290 		    proto != ETH_P_PAE)
9291 			return -EINVAL;
9292 		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9293 			settings->control_port_no_encrypt = true;
9294 	} else
9295 		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9296 
9297 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9298 		int r = validate_pae_over_nl80211(rdev, info);
9299 
9300 		if (r < 0)
9301 			return r;
9302 
9303 		settings->control_port_over_nl80211 = true;
9304 	}
9305 
9306 	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9307 		void *data;
9308 		int len, i;
9309 
9310 		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9311 		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9312 		settings->n_ciphers_pairwise = len / sizeof(u32);
9313 
9314 		if (len % sizeof(u32))
9315 			return -EINVAL;
9316 
9317 		if (settings->n_ciphers_pairwise > cipher_limit)
9318 			return -EINVAL;
9319 
9320 		memcpy(settings->ciphers_pairwise, data, len);
9321 
9322 		for (i = 0; i < settings->n_ciphers_pairwise; i++)
9323 			if (!cfg80211_supported_cipher_suite(
9324 					&rdev->wiphy,
9325 					settings->ciphers_pairwise[i]))
9326 				return -EINVAL;
9327 	}
9328 
9329 	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9330 		settings->cipher_group =
9331 			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9332 		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9333 						     settings->cipher_group))
9334 			return -EINVAL;
9335 	}
9336 
9337 	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9338 		settings->wpa_versions =
9339 			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9340 		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9341 			return -EINVAL;
9342 	}
9343 
9344 	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9345 		void *data;
9346 		int len;
9347 
9348 		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9349 		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9350 		settings->n_akm_suites = len / sizeof(u32);
9351 
9352 		if (len % sizeof(u32))
9353 			return -EINVAL;
9354 
9355 		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9356 			return -EINVAL;
9357 
9358 		memcpy(settings->akm_suites, data, len);
9359 	}
9360 
9361 	if (info->attrs[NL80211_ATTR_PMK]) {
9362 		if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9363 			return -EINVAL;
9364 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
9365 					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
9366 			return -EINVAL;
9367 		settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9368 	}
9369 
9370 	if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9371 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
9372 					     NL80211_EXT_FEATURE_SAE_OFFLOAD))
9373 			return -EINVAL;
9374 		settings->sae_pwd =
9375 			nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9376 		settings->sae_pwd_len =
9377 			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9378 	}
9379 
9380 	return 0;
9381 }
9382 
9383 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9384 {
9385 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9386 	struct net_device *dev = info->user_ptr[1];
9387 	struct ieee80211_channel *chan;
9388 	struct cfg80211_assoc_request req = {};
9389 	const u8 *bssid, *ssid;
9390 	int err, ssid_len = 0;
9391 
9392 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
9393 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9394 		return -EPERM;
9395 
9396 	if (!info->attrs[NL80211_ATTR_MAC] ||
9397 	    !info->attrs[NL80211_ATTR_SSID] ||
9398 	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9399 		return -EINVAL;
9400 
9401 	if (!rdev->ops->assoc)
9402 		return -EOPNOTSUPP;
9403 
9404 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9405 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9406 		return -EOPNOTSUPP;
9407 
9408 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9409 
9410 	chan = nl80211_get_valid_chan(&rdev->wiphy,
9411 				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9412 	if (!chan)
9413 		return -EINVAL;
9414 
9415 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9416 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9417 
9418 	if (info->attrs[NL80211_ATTR_IE]) {
9419 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9420 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9421 	}
9422 
9423 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
9424 		enum nl80211_mfp mfp =
9425 			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9426 		if (mfp == NL80211_MFP_REQUIRED)
9427 			req.use_mfp = true;
9428 		else if (mfp != NL80211_MFP_NO)
9429 			return -EINVAL;
9430 	}
9431 
9432 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
9433 		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9434 
9435 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9436 		req.flags |= ASSOC_REQ_DISABLE_HT;
9437 
9438 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9439 		memcpy(&req.ht_capa_mask,
9440 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9441 		       sizeof(req.ht_capa_mask));
9442 
9443 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9444 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9445 			return -EINVAL;
9446 		memcpy(&req.ht_capa,
9447 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9448 		       sizeof(req.ht_capa));
9449 	}
9450 
9451 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9452 		req.flags |= ASSOC_REQ_DISABLE_VHT;
9453 
9454 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9455 		memcpy(&req.vht_capa_mask,
9456 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9457 		       sizeof(req.vht_capa_mask));
9458 
9459 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9460 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9461 			return -EINVAL;
9462 		memcpy(&req.vht_capa,
9463 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9464 		       sizeof(req.vht_capa));
9465 	}
9466 
9467 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9468 		if (!((rdev->wiphy.features &
9469 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9470 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9471 		    !wiphy_ext_feature_isset(&rdev->wiphy,
9472 					     NL80211_EXT_FEATURE_RRM))
9473 			return -EINVAL;
9474 		req.flags |= ASSOC_REQ_USE_RRM;
9475 	}
9476 
9477 	if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9478 		req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9479 		req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9480 		if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9481 			return -EINVAL;
9482 		req.fils_nonces =
9483 			nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9484 	}
9485 
9486 	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9487 	if (!err) {
9488 		wdev_lock(dev->ieee80211_ptr);
9489 
9490 		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9491 					  ssid, ssid_len, &req);
9492 
9493 		if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9494 			dev->ieee80211_ptr->conn_owner_nlportid =
9495 				info->snd_portid;
9496 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
9497 			       bssid, ETH_ALEN);
9498 		}
9499 
9500 		wdev_unlock(dev->ieee80211_ptr);
9501 	}
9502 
9503 	return err;
9504 }
9505 
9506 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9507 {
9508 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9509 	struct net_device *dev = info->user_ptr[1];
9510 	const u8 *ie = NULL, *bssid;
9511 	int ie_len = 0, err;
9512 	u16 reason_code;
9513 	bool local_state_change;
9514 
9515 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
9516 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9517 		return -EPERM;
9518 
9519 	if (!info->attrs[NL80211_ATTR_MAC])
9520 		return -EINVAL;
9521 
9522 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
9523 		return -EINVAL;
9524 
9525 	if (!rdev->ops->deauth)
9526 		return -EOPNOTSUPP;
9527 
9528 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9529 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9530 		return -EOPNOTSUPP;
9531 
9532 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9533 
9534 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9535 	if (reason_code == 0) {
9536 		/* Reason Code 0 is reserved */
9537 		return -EINVAL;
9538 	}
9539 
9540 	if (info->attrs[NL80211_ATTR_IE]) {
9541 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9542 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9543 	}
9544 
9545 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9546 
9547 	wdev_lock(dev->ieee80211_ptr);
9548 	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9549 				   local_state_change);
9550 	wdev_unlock(dev->ieee80211_ptr);
9551 	return err;
9552 }
9553 
9554 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9555 {
9556 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9557 	struct net_device *dev = info->user_ptr[1];
9558 	const u8 *ie = NULL, *bssid;
9559 	int ie_len = 0, err;
9560 	u16 reason_code;
9561 	bool local_state_change;
9562 
9563 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
9564 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9565 		return -EPERM;
9566 
9567 	if (!info->attrs[NL80211_ATTR_MAC])
9568 		return -EINVAL;
9569 
9570 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
9571 		return -EINVAL;
9572 
9573 	if (!rdev->ops->disassoc)
9574 		return -EOPNOTSUPP;
9575 
9576 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9577 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9578 		return -EOPNOTSUPP;
9579 
9580 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9581 
9582 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9583 	if (reason_code == 0) {
9584 		/* Reason Code 0 is reserved */
9585 		return -EINVAL;
9586 	}
9587 
9588 	if (info->attrs[NL80211_ATTR_IE]) {
9589 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9590 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9591 	}
9592 
9593 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9594 
9595 	wdev_lock(dev->ieee80211_ptr);
9596 	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9597 				     local_state_change);
9598 	wdev_unlock(dev->ieee80211_ptr);
9599 	return err;
9600 }
9601 
9602 static bool
9603 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9604 			 int mcast_rate[NUM_NL80211_BANDS],
9605 			 int rateval)
9606 {
9607 	struct wiphy *wiphy = &rdev->wiphy;
9608 	bool found = false;
9609 	int band, i;
9610 
9611 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
9612 		struct ieee80211_supported_band *sband;
9613 
9614 		sband = wiphy->bands[band];
9615 		if (!sband)
9616 			continue;
9617 
9618 		for (i = 0; i < sband->n_bitrates; i++) {
9619 			if (sband->bitrates[i].bitrate == rateval) {
9620 				mcast_rate[band] = i + 1;
9621 				found = true;
9622 				break;
9623 			}
9624 		}
9625 	}
9626 
9627 	return found;
9628 }
9629 
9630 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9631 {
9632 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9633 	struct net_device *dev = info->user_ptr[1];
9634 	struct cfg80211_ibss_params ibss;
9635 	struct wiphy *wiphy;
9636 	struct cfg80211_cached_keys *connkeys = NULL;
9637 	int err;
9638 
9639 	memset(&ibss, 0, sizeof(ibss));
9640 
9641 	if (!info->attrs[NL80211_ATTR_SSID] ||
9642 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
9643 		return -EINVAL;
9644 
9645 	ibss.beacon_interval = 100;
9646 
9647 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9648 		ibss.beacon_interval =
9649 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9650 
9651 	err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9652 					   ibss.beacon_interval);
9653 	if (err)
9654 		return err;
9655 
9656 	if (!rdev->ops->join_ibss)
9657 		return -EOPNOTSUPP;
9658 
9659 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9660 		return -EOPNOTSUPP;
9661 
9662 	wiphy = &rdev->wiphy;
9663 
9664 	if (info->attrs[NL80211_ATTR_MAC]) {
9665 		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9666 
9667 		if (!is_valid_ether_addr(ibss.bssid))
9668 			return -EINVAL;
9669 	}
9670 	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9671 	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9672 
9673 	if (info->attrs[NL80211_ATTR_IE]) {
9674 		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9675 		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9676 	}
9677 
9678 	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9679 	if (err)
9680 		return err;
9681 
9682 	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9683 				     NL80211_IFTYPE_ADHOC))
9684 		return -EINVAL;
9685 
9686 	switch (ibss.chandef.width) {
9687 	case NL80211_CHAN_WIDTH_5:
9688 	case NL80211_CHAN_WIDTH_10:
9689 	case NL80211_CHAN_WIDTH_20_NOHT:
9690 		break;
9691 	case NL80211_CHAN_WIDTH_20:
9692 	case NL80211_CHAN_WIDTH_40:
9693 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9694 			return -EINVAL;
9695 		break;
9696 	case NL80211_CHAN_WIDTH_80:
9697 	case NL80211_CHAN_WIDTH_80P80:
9698 	case NL80211_CHAN_WIDTH_160:
9699 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9700 			return -EINVAL;
9701 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
9702 					     NL80211_EXT_FEATURE_VHT_IBSS))
9703 			return -EINVAL;
9704 		break;
9705 	default:
9706 		return -EINVAL;
9707 	}
9708 
9709 	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9710 	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9711 
9712 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9713 		u8 *rates =
9714 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9715 		int n_rates =
9716 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9717 		struct ieee80211_supported_band *sband =
9718 			wiphy->bands[ibss.chandef.chan->band];
9719 
9720 		err = ieee80211_get_ratemask(sband, rates, n_rates,
9721 					     &ibss.basic_rates);
9722 		if (err)
9723 			return err;
9724 	}
9725 
9726 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9727 		memcpy(&ibss.ht_capa_mask,
9728 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9729 		       sizeof(ibss.ht_capa_mask));
9730 
9731 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9732 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9733 			return -EINVAL;
9734 		memcpy(&ibss.ht_capa,
9735 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9736 		       sizeof(ibss.ht_capa));
9737 	}
9738 
9739 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9740 	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9741 			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9742 		return -EINVAL;
9743 
9744 	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9745 		bool no_ht = false;
9746 
9747 		connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9748 		if (IS_ERR(connkeys))
9749 			return PTR_ERR(connkeys);
9750 
9751 		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9752 		    no_ht) {
9753 			kzfree(connkeys);
9754 			return -EINVAL;
9755 		}
9756 	}
9757 
9758 	ibss.control_port =
9759 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9760 
9761 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9762 		int r = validate_pae_over_nl80211(rdev, info);
9763 
9764 		if (r < 0) {
9765 			kzfree(connkeys);
9766 			return r;
9767 		}
9768 
9769 		ibss.control_port_over_nl80211 = true;
9770 	}
9771 
9772 	ibss.userspace_handles_dfs =
9773 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9774 
9775 	wdev_lock(dev->ieee80211_ptr);
9776 	err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9777 	if (err)
9778 		kzfree(connkeys);
9779 	else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9780 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9781 	wdev_unlock(dev->ieee80211_ptr);
9782 
9783 	return err;
9784 }
9785 
9786 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9787 {
9788 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9789 	struct net_device *dev = info->user_ptr[1];
9790 
9791 	if (!rdev->ops->leave_ibss)
9792 		return -EOPNOTSUPP;
9793 
9794 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9795 		return -EOPNOTSUPP;
9796 
9797 	return cfg80211_leave_ibss(rdev, dev, false);
9798 }
9799 
9800 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9801 {
9802 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9803 	struct net_device *dev = info->user_ptr[1];
9804 	int mcast_rate[NUM_NL80211_BANDS];
9805 	u32 nla_rate;
9806 	int err;
9807 
9808 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9809 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9810 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9811 		return -EOPNOTSUPP;
9812 
9813 	if (!rdev->ops->set_mcast_rate)
9814 		return -EOPNOTSUPP;
9815 
9816 	memset(mcast_rate, 0, sizeof(mcast_rate));
9817 
9818 	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9819 		return -EINVAL;
9820 
9821 	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9822 	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9823 		return -EINVAL;
9824 
9825 	err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9826 
9827 	return err;
9828 }
9829 
9830 static struct sk_buff *
9831 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9832 			    struct wireless_dev *wdev, int approxlen,
9833 			    u32 portid, u32 seq, enum nl80211_commands cmd,
9834 			    enum nl80211_attrs attr,
9835 			    const struct nl80211_vendor_cmd_info *info,
9836 			    gfp_t gfp)
9837 {
9838 	struct sk_buff *skb;
9839 	void *hdr;
9840 	struct nlattr *data;
9841 
9842 	skb = nlmsg_new(approxlen + 100, gfp);
9843 	if (!skb)
9844 		return NULL;
9845 
9846 	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9847 	if (!hdr) {
9848 		kfree_skb(skb);
9849 		return NULL;
9850 	}
9851 
9852 	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9853 		goto nla_put_failure;
9854 
9855 	if (info) {
9856 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9857 				info->vendor_id))
9858 			goto nla_put_failure;
9859 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9860 				info->subcmd))
9861 			goto nla_put_failure;
9862 	}
9863 
9864 	if (wdev) {
9865 		if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9866 				      wdev_id(wdev), NL80211_ATTR_PAD))
9867 			goto nla_put_failure;
9868 		if (wdev->netdev &&
9869 		    nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9870 				wdev->netdev->ifindex))
9871 			goto nla_put_failure;
9872 	}
9873 
9874 	data = nla_nest_start_noflag(skb, attr);
9875 	if (!data)
9876 		goto nla_put_failure;
9877 
9878 	((void **)skb->cb)[0] = rdev;
9879 	((void **)skb->cb)[1] = hdr;
9880 	((void **)skb->cb)[2] = data;
9881 
9882 	return skb;
9883 
9884  nla_put_failure:
9885 	kfree_skb(skb);
9886 	return NULL;
9887 }
9888 
9889 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9890 					   struct wireless_dev *wdev,
9891 					   enum nl80211_commands cmd,
9892 					   enum nl80211_attrs attr,
9893 					   unsigned int portid,
9894 					   int vendor_event_idx,
9895 					   int approxlen, gfp_t gfp)
9896 {
9897 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9898 	const struct nl80211_vendor_cmd_info *info;
9899 
9900 	switch (cmd) {
9901 	case NL80211_CMD_TESTMODE:
9902 		if (WARN_ON(vendor_event_idx != -1))
9903 			return NULL;
9904 		info = NULL;
9905 		break;
9906 	case NL80211_CMD_VENDOR:
9907 		if (WARN_ON(vendor_event_idx < 0 ||
9908 			    vendor_event_idx >= wiphy->n_vendor_events))
9909 			return NULL;
9910 		info = &wiphy->vendor_events[vendor_event_idx];
9911 		break;
9912 	default:
9913 		WARN_ON(1);
9914 		return NULL;
9915 	}
9916 
9917 	return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9918 					   cmd, attr, info, gfp);
9919 }
9920 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9921 
9922 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9923 {
9924 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9925 	void *hdr = ((void **)skb->cb)[1];
9926 	struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9927 	struct nlattr *data = ((void **)skb->cb)[2];
9928 	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9929 
9930 	/* clear CB data for netlink core to own from now on */
9931 	memset(skb->cb, 0, sizeof(skb->cb));
9932 
9933 	nla_nest_end(skb, data);
9934 	genlmsg_end(skb, hdr);
9935 
9936 	if (nlhdr->nlmsg_pid) {
9937 		genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9938 				nlhdr->nlmsg_pid);
9939 	} else {
9940 		if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9941 			mcgrp = NL80211_MCGRP_VENDOR;
9942 
9943 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9944 					skb, 0, mcgrp, gfp);
9945 	}
9946 }
9947 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9948 
9949 #ifdef CONFIG_NL80211_TESTMODE
9950 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9951 {
9952 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9953 	struct wireless_dev *wdev =
9954 		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9955 	int err;
9956 
9957 	if (!rdev->ops->testmode_cmd)
9958 		return -EOPNOTSUPP;
9959 
9960 	if (IS_ERR(wdev)) {
9961 		err = PTR_ERR(wdev);
9962 		if (err != -EINVAL)
9963 			return err;
9964 		wdev = NULL;
9965 	} else if (wdev->wiphy != &rdev->wiphy) {
9966 		return -EINVAL;
9967 	}
9968 
9969 	if (!info->attrs[NL80211_ATTR_TESTDATA])
9970 		return -EINVAL;
9971 
9972 	rdev->cur_cmd_info = info;
9973 	err = rdev_testmode_cmd(rdev, wdev,
9974 				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9975 				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9976 	rdev->cur_cmd_info = NULL;
9977 
9978 	return err;
9979 }
9980 
9981 static int nl80211_testmode_dump(struct sk_buff *skb,
9982 				 struct netlink_callback *cb)
9983 {
9984 	struct cfg80211_registered_device *rdev;
9985 	struct nlattr **attrbuf = NULL;
9986 	int err;
9987 	long phy_idx;
9988 	void *data = NULL;
9989 	int data_len = 0;
9990 
9991 	rtnl_lock();
9992 
9993 	if (cb->args[0]) {
9994 		/*
9995 		 * 0 is a valid index, but not valid for args[0],
9996 		 * so we need to offset by 1.
9997 		 */
9998 		phy_idx = cb->args[0] - 1;
9999 
10000 		rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10001 		if (!rdev) {
10002 			err = -ENOENT;
10003 			goto out_err;
10004 		}
10005 	} else {
10006 		attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10007 				  GFP_KERNEL);
10008 		if (!attrbuf) {
10009 			err = -ENOMEM;
10010 			goto out_err;
10011 		}
10012 
10013 		err = nlmsg_parse_deprecated(cb->nlh,
10014 					     GENL_HDRLEN + nl80211_fam.hdrsize,
10015 					     attrbuf, nl80211_fam.maxattr,
10016 					     nl80211_policy, NULL);
10017 		if (err)
10018 			goto out_err;
10019 
10020 		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10021 		if (IS_ERR(rdev)) {
10022 			err = PTR_ERR(rdev);
10023 			goto out_err;
10024 		}
10025 		phy_idx = rdev->wiphy_idx;
10026 
10027 		if (attrbuf[NL80211_ATTR_TESTDATA])
10028 			cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10029 	}
10030 
10031 	if (cb->args[1]) {
10032 		data = nla_data((void *)cb->args[1]);
10033 		data_len = nla_len((void *)cb->args[1]);
10034 	}
10035 
10036 	if (!rdev->ops->testmode_dump) {
10037 		err = -EOPNOTSUPP;
10038 		goto out_err;
10039 	}
10040 
10041 	while (1) {
10042 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10043 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
10044 					   NL80211_CMD_TESTMODE);
10045 		struct nlattr *tmdata;
10046 
10047 		if (!hdr)
10048 			break;
10049 
10050 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10051 			genlmsg_cancel(skb, hdr);
10052 			break;
10053 		}
10054 
10055 		tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10056 		if (!tmdata) {
10057 			genlmsg_cancel(skb, hdr);
10058 			break;
10059 		}
10060 		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10061 		nla_nest_end(skb, tmdata);
10062 
10063 		if (err == -ENOBUFS || err == -ENOENT) {
10064 			genlmsg_cancel(skb, hdr);
10065 			break;
10066 		} else if (err) {
10067 			genlmsg_cancel(skb, hdr);
10068 			goto out_err;
10069 		}
10070 
10071 		genlmsg_end(skb, hdr);
10072 	}
10073 
10074 	err = skb->len;
10075 	/* see above */
10076 	cb->args[0] = phy_idx + 1;
10077  out_err:
10078 	kfree(attrbuf);
10079 	rtnl_unlock();
10080 	return err;
10081 }
10082 #endif
10083 
10084 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10085 {
10086 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10087 	struct net_device *dev = info->user_ptr[1];
10088 	struct cfg80211_connect_params connect;
10089 	struct wiphy *wiphy;
10090 	struct cfg80211_cached_keys *connkeys = NULL;
10091 	int err;
10092 
10093 	memset(&connect, 0, sizeof(connect));
10094 
10095 	if (!info->attrs[NL80211_ATTR_SSID] ||
10096 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
10097 		return -EINVAL;
10098 
10099 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10100 		connect.auth_type =
10101 			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10102 		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10103 					     NL80211_CMD_CONNECT))
10104 			return -EINVAL;
10105 	} else
10106 		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10107 
10108 	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10109 
10110 	if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10111 	    !wiphy_ext_feature_isset(&rdev->wiphy,
10112 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10113 		return -EINVAL;
10114 	connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10115 
10116 	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10117 				      NL80211_MAX_NR_CIPHER_SUITES);
10118 	if (err)
10119 		return err;
10120 
10121 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10122 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10123 		return -EOPNOTSUPP;
10124 
10125 	wiphy = &rdev->wiphy;
10126 
10127 	connect.bg_scan_period = -1;
10128 	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10129 		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10130 		connect.bg_scan_period =
10131 			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10132 	}
10133 
10134 	if (info->attrs[NL80211_ATTR_MAC])
10135 		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10136 	else if (info->attrs[NL80211_ATTR_MAC_HINT])
10137 		connect.bssid_hint =
10138 			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10139 	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10140 	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10141 
10142 	if (info->attrs[NL80211_ATTR_IE]) {
10143 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10144 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10145 	}
10146 
10147 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
10148 		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10149 		if (connect.mfp == NL80211_MFP_OPTIONAL &&
10150 		    !wiphy_ext_feature_isset(&rdev->wiphy,
10151 					     NL80211_EXT_FEATURE_MFP_OPTIONAL))
10152 			return -EOPNOTSUPP;
10153 	} else {
10154 		connect.mfp = NL80211_MFP_NO;
10155 	}
10156 
10157 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
10158 		connect.prev_bssid =
10159 			nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10160 
10161 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10162 		connect.channel = nl80211_get_valid_chan(
10163 			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
10164 		if (!connect.channel)
10165 			return -EINVAL;
10166 	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10167 		connect.channel_hint = nl80211_get_valid_chan(
10168 			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10169 		if (!connect.channel_hint)
10170 			return -EINVAL;
10171 	}
10172 
10173 	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10174 		connect.edmg.channels =
10175 		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10176 
10177 		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10178 			connect.edmg.bw_config =
10179 				nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10180 	}
10181 
10182 	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10183 		connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10184 		if (IS_ERR(connkeys))
10185 			return PTR_ERR(connkeys);
10186 	}
10187 
10188 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10189 		connect.flags |= ASSOC_REQ_DISABLE_HT;
10190 
10191 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10192 		memcpy(&connect.ht_capa_mask,
10193 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10194 		       sizeof(connect.ht_capa_mask));
10195 
10196 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10197 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10198 			kzfree(connkeys);
10199 			return -EINVAL;
10200 		}
10201 		memcpy(&connect.ht_capa,
10202 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10203 		       sizeof(connect.ht_capa));
10204 	}
10205 
10206 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10207 		connect.flags |= ASSOC_REQ_DISABLE_VHT;
10208 
10209 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10210 		memcpy(&connect.vht_capa_mask,
10211 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10212 		       sizeof(connect.vht_capa_mask));
10213 
10214 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10215 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10216 			kzfree(connkeys);
10217 			return -EINVAL;
10218 		}
10219 		memcpy(&connect.vht_capa,
10220 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10221 		       sizeof(connect.vht_capa));
10222 	}
10223 
10224 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10225 		if (!((rdev->wiphy.features &
10226 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10227 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10228 		    !wiphy_ext_feature_isset(&rdev->wiphy,
10229 					     NL80211_EXT_FEATURE_RRM)) {
10230 			kzfree(connkeys);
10231 			return -EINVAL;
10232 		}
10233 		connect.flags |= ASSOC_REQ_USE_RRM;
10234 	}
10235 
10236 	connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10237 	if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10238 		kzfree(connkeys);
10239 		return -EOPNOTSUPP;
10240 	}
10241 
10242 	if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10243 		/* bss selection makes no sense if bssid is set */
10244 		if (connect.bssid) {
10245 			kzfree(connkeys);
10246 			return -EINVAL;
10247 		}
10248 
10249 		err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10250 				       wiphy, &connect.bss_select);
10251 		if (err) {
10252 			kzfree(connkeys);
10253 			return err;
10254 		}
10255 	}
10256 
10257 	if (wiphy_ext_feature_isset(&rdev->wiphy,
10258 				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10259 	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10260 	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10261 	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10262 	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10263 		connect.fils_erp_username =
10264 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10265 		connect.fils_erp_username_len =
10266 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10267 		connect.fils_erp_realm =
10268 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10269 		connect.fils_erp_realm_len =
10270 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10271 		connect.fils_erp_next_seq_num =
10272 			nla_get_u16(
10273 			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10274 		connect.fils_erp_rrk =
10275 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10276 		connect.fils_erp_rrk_len =
10277 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10278 	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10279 		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10280 		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10281 		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10282 		kzfree(connkeys);
10283 		return -EINVAL;
10284 	}
10285 
10286 	if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10287 		if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10288 			kzfree(connkeys);
10289 			GENL_SET_ERR_MSG(info,
10290 					 "external auth requires connection ownership");
10291 			return -EINVAL;
10292 		}
10293 		connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10294 	}
10295 
10296 	wdev_lock(dev->ieee80211_ptr);
10297 
10298 	err = cfg80211_connect(rdev, dev, &connect, connkeys,
10299 			       connect.prev_bssid);
10300 	if (err)
10301 		kzfree(connkeys);
10302 
10303 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10304 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10305 		if (connect.bssid)
10306 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
10307 			       connect.bssid, ETH_ALEN);
10308 		else
10309 			memset(dev->ieee80211_ptr->disconnect_bssid,
10310 			       0, ETH_ALEN);
10311 	}
10312 
10313 	wdev_unlock(dev->ieee80211_ptr);
10314 
10315 	return err;
10316 }
10317 
10318 static int nl80211_update_connect_params(struct sk_buff *skb,
10319 					 struct genl_info *info)
10320 {
10321 	struct cfg80211_connect_params connect = {};
10322 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10323 	struct net_device *dev = info->user_ptr[1];
10324 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10325 	bool fils_sk_offload;
10326 	u32 auth_type;
10327 	u32 changed = 0;
10328 	int ret;
10329 
10330 	if (!rdev->ops->update_connect_params)
10331 		return -EOPNOTSUPP;
10332 
10333 	if (info->attrs[NL80211_ATTR_IE]) {
10334 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10335 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10336 		changed |= UPDATE_ASSOC_IES;
10337 	}
10338 
10339 	fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10340 						  NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10341 
10342 	/*
10343 	 * when driver supports fils-sk offload all attributes must be
10344 	 * provided. So the else covers "fils-sk-not-all" and
10345 	 * "no-fils-sk-any".
10346 	 */
10347 	if (fils_sk_offload &&
10348 	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10349 	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10350 	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10351 	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10352 		connect.fils_erp_username =
10353 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10354 		connect.fils_erp_username_len =
10355 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10356 		connect.fils_erp_realm =
10357 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10358 		connect.fils_erp_realm_len =
10359 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10360 		connect.fils_erp_next_seq_num =
10361 			nla_get_u16(
10362 			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10363 		connect.fils_erp_rrk =
10364 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10365 		connect.fils_erp_rrk_len =
10366 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10367 		changed |= UPDATE_FILS_ERP_INFO;
10368 	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10369 		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10370 		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10371 		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10372 		return -EINVAL;
10373 	}
10374 
10375 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10376 		auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10377 		if (!nl80211_valid_auth_type(rdev, auth_type,
10378 					     NL80211_CMD_CONNECT))
10379 			return -EINVAL;
10380 
10381 		if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
10382 		    fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
10383 			return -EINVAL;
10384 
10385 		connect.auth_type = auth_type;
10386 		changed |= UPDATE_AUTH_TYPE;
10387 	}
10388 
10389 	wdev_lock(dev->ieee80211_ptr);
10390 	if (!wdev->current_bss)
10391 		ret = -ENOLINK;
10392 	else
10393 		ret = rdev_update_connect_params(rdev, dev, &connect, changed);
10394 	wdev_unlock(dev->ieee80211_ptr);
10395 
10396 	return ret;
10397 }
10398 
10399 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
10400 {
10401 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10402 	struct net_device *dev = info->user_ptr[1];
10403 	u16 reason;
10404 	int ret;
10405 
10406 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
10407 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10408 		return -EPERM;
10409 
10410 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
10411 		reason = WLAN_REASON_DEAUTH_LEAVING;
10412 	else
10413 		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10414 
10415 	if (reason == 0)
10416 		return -EINVAL;
10417 
10418 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10419 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10420 		return -EOPNOTSUPP;
10421 
10422 	wdev_lock(dev->ieee80211_ptr);
10423 	ret = cfg80211_disconnect(rdev, dev, reason, true);
10424 	wdev_unlock(dev->ieee80211_ptr);
10425 	return ret;
10426 }
10427 
10428 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
10429 {
10430 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10431 	struct net *net;
10432 	int err;
10433 
10434 	if (info->attrs[NL80211_ATTR_PID]) {
10435 		u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
10436 
10437 		net = get_net_ns_by_pid(pid);
10438 	} else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
10439 		u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
10440 
10441 		net = get_net_ns_by_fd(fd);
10442 	} else {
10443 		return -EINVAL;
10444 	}
10445 
10446 	if (IS_ERR(net))
10447 		return PTR_ERR(net);
10448 
10449 	err = 0;
10450 
10451 	/* check if anything to do */
10452 	if (!net_eq(wiphy_net(&rdev->wiphy), net))
10453 		err = cfg80211_switch_netns(rdev, net);
10454 
10455 	put_net(net);
10456 	return err;
10457 }
10458 
10459 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
10460 {
10461 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10462 	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
10463 			struct cfg80211_pmksa *pmksa) = NULL;
10464 	struct net_device *dev = info->user_ptr[1];
10465 	struct cfg80211_pmksa pmksa;
10466 
10467 	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
10468 
10469 	if (!info->attrs[NL80211_ATTR_PMKID])
10470 		return -EINVAL;
10471 
10472 	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
10473 
10474 	if (info->attrs[NL80211_ATTR_MAC]) {
10475 		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10476 	} else if (info->attrs[NL80211_ATTR_SSID] &&
10477 		   info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
10478 		   (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
10479 		    info->attrs[NL80211_ATTR_PMK])) {
10480 		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10481 		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10482 		pmksa.cache_id =
10483 			nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10484 	} else {
10485 		return -EINVAL;
10486 	}
10487 	if (info->attrs[NL80211_ATTR_PMK]) {
10488 		pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10489 		pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10490 	}
10491 
10492 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10493 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10494 	    !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10495 	      wiphy_ext_feature_isset(&rdev->wiphy,
10496 				      NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10497 		return -EOPNOTSUPP;
10498 
10499 	switch (info->genlhdr->cmd) {
10500 	case NL80211_CMD_SET_PMKSA:
10501 		rdev_ops = rdev->ops->set_pmksa;
10502 		break;
10503 	case NL80211_CMD_DEL_PMKSA:
10504 		rdev_ops = rdev->ops->del_pmksa;
10505 		break;
10506 	default:
10507 		WARN_ON(1);
10508 		break;
10509 	}
10510 
10511 	if (!rdev_ops)
10512 		return -EOPNOTSUPP;
10513 
10514 	return rdev_ops(&rdev->wiphy, dev, &pmksa);
10515 }
10516 
10517 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10518 {
10519 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10520 	struct net_device *dev = info->user_ptr[1];
10521 
10522 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10523 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10524 		return -EOPNOTSUPP;
10525 
10526 	if (!rdev->ops->flush_pmksa)
10527 		return -EOPNOTSUPP;
10528 
10529 	return rdev_flush_pmksa(rdev, dev);
10530 }
10531 
10532 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10533 {
10534 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10535 	struct net_device *dev = info->user_ptr[1];
10536 	u8 action_code, dialog_token;
10537 	u32 peer_capability = 0;
10538 	u16 status_code;
10539 	u8 *peer;
10540 	bool initiator;
10541 
10542 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10543 	    !rdev->ops->tdls_mgmt)
10544 		return -EOPNOTSUPP;
10545 
10546 	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10547 	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10548 	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10549 	    !info->attrs[NL80211_ATTR_IE] ||
10550 	    !info->attrs[NL80211_ATTR_MAC])
10551 		return -EINVAL;
10552 
10553 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10554 	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10555 	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10556 	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10557 	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10558 	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10559 		peer_capability =
10560 			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10561 
10562 	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10563 			      dialog_token, status_code, peer_capability,
10564 			      initiator,
10565 			      nla_data(info->attrs[NL80211_ATTR_IE]),
10566 			      nla_len(info->attrs[NL80211_ATTR_IE]));
10567 }
10568 
10569 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10570 {
10571 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10572 	struct net_device *dev = info->user_ptr[1];
10573 	enum nl80211_tdls_operation operation;
10574 	u8 *peer;
10575 
10576 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10577 	    !rdev->ops->tdls_oper)
10578 		return -EOPNOTSUPP;
10579 
10580 	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10581 	    !info->attrs[NL80211_ATTR_MAC])
10582 		return -EINVAL;
10583 
10584 	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10585 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10586 
10587 	return rdev_tdls_oper(rdev, dev, peer, operation);
10588 }
10589 
10590 static int nl80211_remain_on_channel(struct sk_buff *skb,
10591 				     struct genl_info *info)
10592 {
10593 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10594 	struct wireless_dev *wdev = info->user_ptr[1];
10595 	struct cfg80211_chan_def chandef;
10596 	const struct cfg80211_chan_def *compat_chandef;
10597 	struct sk_buff *msg;
10598 	void *hdr;
10599 	u64 cookie;
10600 	u32 duration;
10601 	int err;
10602 
10603 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10604 	    !info->attrs[NL80211_ATTR_DURATION])
10605 		return -EINVAL;
10606 
10607 	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10608 
10609 	if (!rdev->ops->remain_on_channel ||
10610 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10611 		return -EOPNOTSUPP;
10612 
10613 	/*
10614 	 * We should be on that channel for at least a minimum amount of
10615 	 * time (10ms) but no longer than the driver supports.
10616 	 */
10617 	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10618 	    duration > rdev->wiphy.max_remain_on_channel_duration)
10619 		return -EINVAL;
10620 
10621 	err = nl80211_parse_chandef(rdev, info, &chandef);
10622 	if (err)
10623 		return err;
10624 
10625 	wdev_lock(wdev);
10626 	if (!cfg80211_off_channel_oper_allowed(wdev) &&
10627 	    !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10628 		compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10629 							     &chandef);
10630 		if (compat_chandef != &chandef) {
10631 			wdev_unlock(wdev);
10632 			return -EBUSY;
10633 		}
10634 	}
10635 	wdev_unlock(wdev);
10636 
10637 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10638 	if (!msg)
10639 		return -ENOMEM;
10640 
10641 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10642 			     NL80211_CMD_REMAIN_ON_CHANNEL);
10643 	if (!hdr) {
10644 		err = -ENOBUFS;
10645 		goto free_msg;
10646 	}
10647 
10648 	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10649 				     duration, &cookie);
10650 
10651 	if (err)
10652 		goto free_msg;
10653 
10654 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10655 			      NL80211_ATTR_PAD))
10656 		goto nla_put_failure;
10657 
10658 	genlmsg_end(msg, hdr);
10659 
10660 	return genlmsg_reply(msg, info);
10661 
10662  nla_put_failure:
10663 	err = -ENOBUFS;
10664  free_msg:
10665 	nlmsg_free(msg);
10666 	return err;
10667 }
10668 
10669 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10670 					    struct genl_info *info)
10671 {
10672 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10673 	struct wireless_dev *wdev = info->user_ptr[1];
10674 	u64 cookie;
10675 
10676 	if (!info->attrs[NL80211_ATTR_COOKIE])
10677 		return -EINVAL;
10678 
10679 	if (!rdev->ops->cancel_remain_on_channel)
10680 		return -EOPNOTSUPP;
10681 
10682 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10683 
10684 	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10685 }
10686 
10687 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10688 				       struct genl_info *info)
10689 {
10690 	struct cfg80211_bitrate_mask mask;
10691 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10692 	struct net_device *dev = info->user_ptr[1];
10693 	int err;
10694 
10695 	if (!rdev->ops->set_bitrate_mask)
10696 		return -EOPNOTSUPP;
10697 
10698 	err = nl80211_parse_tx_bitrate_mask(info, &mask);
10699 	if (err)
10700 		return err;
10701 
10702 	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10703 }
10704 
10705 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10706 {
10707 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10708 	struct wireless_dev *wdev = info->user_ptr[1];
10709 	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10710 
10711 	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10712 		return -EINVAL;
10713 
10714 	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10715 		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10716 
10717 	switch (wdev->iftype) {
10718 	case NL80211_IFTYPE_STATION:
10719 	case NL80211_IFTYPE_ADHOC:
10720 	case NL80211_IFTYPE_P2P_CLIENT:
10721 	case NL80211_IFTYPE_AP:
10722 	case NL80211_IFTYPE_AP_VLAN:
10723 	case NL80211_IFTYPE_MESH_POINT:
10724 	case NL80211_IFTYPE_P2P_GO:
10725 	case NL80211_IFTYPE_P2P_DEVICE:
10726 		break;
10727 	case NL80211_IFTYPE_NAN:
10728 	default:
10729 		return -EOPNOTSUPP;
10730 	}
10731 
10732 	/* not much point in registering if we can't reply */
10733 	if (!rdev->ops->mgmt_tx)
10734 		return -EOPNOTSUPP;
10735 
10736 	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10737 					   nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10738 					   nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10739 					   info->extack);
10740 }
10741 
10742 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10743 {
10744 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10745 	struct wireless_dev *wdev = info->user_ptr[1];
10746 	struct cfg80211_chan_def chandef;
10747 	int err;
10748 	void *hdr = NULL;
10749 	u64 cookie;
10750 	struct sk_buff *msg = NULL;
10751 	struct cfg80211_mgmt_tx_params params = {
10752 		.dont_wait_for_ack =
10753 			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10754 	};
10755 
10756 	if (!info->attrs[NL80211_ATTR_FRAME])
10757 		return -EINVAL;
10758 
10759 	if (!rdev->ops->mgmt_tx)
10760 		return -EOPNOTSUPP;
10761 
10762 	switch (wdev->iftype) {
10763 	case NL80211_IFTYPE_P2P_DEVICE:
10764 		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10765 			return -EINVAL;
10766 	case NL80211_IFTYPE_STATION:
10767 	case NL80211_IFTYPE_ADHOC:
10768 	case NL80211_IFTYPE_P2P_CLIENT:
10769 	case NL80211_IFTYPE_AP:
10770 	case NL80211_IFTYPE_AP_VLAN:
10771 	case NL80211_IFTYPE_MESH_POINT:
10772 	case NL80211_IFTYPE_P2P_GO:
10773 		break;
10774 	case NL80211_IFTYPE_NAN:
10775 	default:
10776 		return -EOPNOTSUPP;
10777 	}
10778 
10779 	if (info->attrs[NL80211_ATTR_DURATION]) {
10780 		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10781 			return -EINVAL;
10782 		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10783 
10784 		/*
10785 		 * We should wait on the channel for at least a minimum amount
10786 		 * of time (10ms) but no longer than the driver supports.
10787 		 */
10788 		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10789 		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
10790 			return -EINVAL;
10791 	}
10792 
10793 	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10794 
10795 	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10796 		return -EINVAL;
10797 
10798 	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10799 
10800 	/* get the channel if any has been specified, otherwise pass NULL to
10801 	 * the driver. The latter will use the current one
10802 	 */
10803 	chandef.chan = NULL;
10804 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10805 		err = nl80211_parse_chandef(rdev, info, &chandef);
10806 		if (err)
10807 			return err;
10808 	}
10809 
10810 	if (!chandef.chan && params.offchan)
10811 		return -EINVAL;
10812 
10813 	wdev_lock(wdev);
10814 	if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10815 		wdev_unlock(wdev);
10816 		return -EBUSY;
10817 	}
10818 	wdev_unlock(wdev);
10819 
10820 	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10821 	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10822 
10823 	if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10824 		int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10825 		int i;
10826 
10827 		if (len % sizeof(u16))
10828 			return -EINVAL;
10829 
10830 		params.n_csa_offsets = len / sizeof(u16);
10831 		params.csa_offsets =
10832 			nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10833 
10834 		/* check that all the offsets fit the frame */
10835 		for (i = 0; i < params.n_csa_offsets; i++) {
10836 			if (params.csa_offsets[i] >= params.len)
10837 				return -EINVAL;
10838 		}
10839 	}
10840 
10841 	if (!params.dont_wait_for_ack) {
10842 		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10843 		if (!msg)
10844 			return -ENOMEM;
10845 
10846 		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10847 				     NL80211_CMD_FRAME);
10848 		if (!hdr) {
10849 			err = -ENOBUFS;
10850 			goto free_msg;
10851 		}
10852 	}
10853 
10854 	params.chan = chandef.chan;
10855 	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10856 	if (err)
10857 		goto free_msg;
10858 
10859 	if (msg) {
10860 		if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10861 				      NL80211_ATTR_PAD))
10862 			goto nla_put_failure;
10863 
10864 		genlmsg_end(msg, hdr);
10865 		return genlmsg_reply(msg, info);
10866 	}
10867 
10868 	return 0;
10869 
10870  nla_put_failure:
10871 	err = -ENOBUFS;
10872  free_msg:
10873 	nlmsg_free(msg);
10874 	return err;
10875 }
10876 
10877 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10878 {
10879 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10880 	struct wireless_dev *wdev = info->user_ptr[1];
10881 	u64 cookie;
10882 
10883 	if (!info->attrs[NL80211_ATTR_COOKIE])
10884 		return -EINVAL;
10885 
10886 	if (!rdev->ops->mgmt_tx_cancel_wait)
10887 		return -EOPNOTSUPP;
10888 
10889 	switch (wdev->iftype) {
10890 	case NL80211_IFTYPE_STATION:
10891 	case NL80211_IFTYPE_ADHOC:
10892 	case NL80211_IFTYPE_P2P_CLIENT:
10893 	case NL80211_IFTYPE_AP:
10894 	case NL80211_IFTYPE_AP_VLAN:
10895 	case NL80211_IFTYPE_P2P_GO:
10896 	case NL80211_IFTYPE_P2P_DEVICE:
10897 		break;
10898 	case NL80211_IFTYPE_NAN:
10899 	default:
10900 		return -EOPNOTSUPP;
10901 	}
10902 
10903 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10904 
10905 	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10906 }
10907 
10908 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10909 {
10910 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10911 	struct wireless_dev *wdev;
10912 	struct net_device *dev = info->user_ptr[1];
10913 	u8 ps_state;
10914 	bool state;
10915 	int err;
10916 
10917 	if (!info->attrs[NL80211_ATTR_PS_STATE])
10918 		return -EINVAL;
10919 
10920 	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10921 
10922 	wdev = dev->ieee80211_ptr;
10923 
10924 	if (!rdev->ops->set_power_mgmt)
10925 		return -EOPNOTSUPP;
10926 
10927 	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10928 
10929 	if (state == wdev->ps)
10930 		return 0;
10931 
10932 	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10933 	if (!err)
10934 		wdev->ps = state;
10935 	return err;
10936 }
10937 
10938 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10939 {
10940 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10941 	enum nl80211_ps_state ps_state;
10942 	struct wireless_dev *wdev;
10943 	struct net_device *dev = info->user_ptr[1];
10944 	struct sk_buff *msg;
10945 	void *hdr;
10946 	int err;
10947 
10948 	wdev = dev->ieee80211_ptr;
10949 
10950 	if (!rdev->ops->set_power_mgmt)
10951 		return -EOPNOTSUPP;
10952 
10953 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10954 	if (!msg)
10955 		return -ENOMEM;
10956 
10957 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10958 			     NL80211_CMD_GET_POWER_SAVE);
10959 	if (!hdr) {
10960 		err = -ENOBUFS;
10961 		goto free_msg;
10962 	}
10963 
10964 	if (wdev->ps)
10965 		ps_state = NL80211_PS_ENABLED;
10966 	else
10967 		ps_state = NL80211_PS_DISABLED;
10968 
10969 	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10970 		goto nla_put_failure;
10971 
10972 	genlmsg_end(msg, hdr);
10973 	return genlmsg_reply(msg, info);
10974 
10975  nla_put_failure:
10976 	err = -ENOBUFS;
10977  free_msg:
10978 	nlmsg_free(msg);
10979 	return err;
10980 }
10981 
10982 static const struct nla_policy
10983 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10984 	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10985 	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10986 	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10987 	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10988 	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10989 	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10990 	[NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10991 };
10992 
10993 static int nl80211_set_cqm_txe(struct genl_info *info,
10994 			       u32 rate, u32 pkts, u32 intvl)
10995 {
10996 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10997 	struct net_device *dev = info->user_ptr[1];
10998 	struct wireless_dev *wdev = dev->ieee80211_ptr;
10999 
11000 	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11001 		return -EINVAL;
11002 
11003 	if (!rdev->ops->set_cqm_txe_config)
11004 		return -EOPNOTSUPP;
11005 
11006 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
11007 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11008 		return -EOPNOTSUPP;
11009 
11010 	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11011 }
11012 
11013 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11014 				    struct net_device *dev)
11015 {
11016 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11017 	s32 last, low, high;
11018 	u32 hyst;
11019 	int i, n, low_index;
11020 	int err;
11021 
11022 	/* RSSI reporting disabled? */
11023 	if (!wdev->cqm_config)
11024 		return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11025 
11026 	/*
11027 	 * Obtain current RSSI value if possible, if not and no RSSI threshold
11028 	 * event has been received yet, we should receive an event after a
11029 	 * connection is established and enough beacons received to calculate
11030 	 * the average.
11031 	 */
11032 	if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11033 	    rdev->ops->get_station) {
11034 		struct station_info sinfo = {};
11035 		u8 *mac_addr;
11036 
11037 		mac_addr = wdev->current_bss->pub.bssid;
11038 
11039 		err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11040 		if (err)
11041 			return err;
11042 
11043 		cfg80211_sinfo_release_content(&sinfo);
11044 		if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11045 			wdev->cqm_config->last_rssi_event_value =
11046 				(s8) sinfo.rx_beacon_signal_avg;
11047 	}
11048 
11049 	last = wdev->cqm_config->last_rssi_event_value;
11050 	hyst = wdev->cqm_config->rssi_hyst;
11051 	n = wdev->cqm_config->n_rssi_thresholds;
11052 
11053 	for (i = 0; i < n; i++) {
11054 		i = array_index_nospec(i, n);
11055 		if (last < wdev->cqm_config->rssi_thresholds[i])
11056 			break;
11057 	}
11058 
11059 	low_index = i - 1;
11060 	if (low_index >= 0) {
11061 		low_index = array_index_nospec(low_index, n);
11062 		low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11063 	} else {
11064 		low = S32_MIN;
11065 	}
11066 	if (i < n) {
11067 		i = array_index_nospec(i, n);
11068 		high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11069 	} else {
11070 		high = S32_MAX;
11071 	}
11072 
11073 	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11074 }
11075 
11076 static int nl80211_set_cqm_rssi(struct genl_info *info,
11077 				const s32 *thresholds, int n_thresholds,
11078 				u32 hysteresis)
11079 {
11080 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11081 	struct net_device *dev = info->user_ptr[1];
11082 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11083 	int i, err;
11084 	s32 prev = S32_MIN;
11085 
11086 	/* Check all values negative and sorted */
11087 	for (i = 0; i < n_thresholds; i++) {
11088 		if (thresholds[i] > 0 || thresholds[i] <= prev)
11089 			return -EINVAL;
11090 
11091 		prev = thresholds[i];
11092 	}
11093 
11094 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
11095 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11096 		return -EOPNOTSUPP;
11097 
11098 	wdev_lock(wdev);
11099 	cfg80211_cqm_config_free(wdev);
11100 	wdev_unlock(wdev);
11101 
11102 	if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11103 		if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11104 			return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11105 
11106 		return rdev_set_cqm_rssi_config(rdev, dev,
11107 						thresholds[0], hysteresis);
11108 	}
11109 
11110 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
11111 				     NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11112 		return -EOPNOTSUPP;
11113 
11114 	if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11115 		n_thresholds = 0;
11116 
11117 	wdev_lock(wdev);
11118 	if (n_thresholds) {
11119 		struct cfg80211_cqm_config *cqm_config;
11120 
11121 		cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11122 				     n_thresholds * sizeof(s32), GFP_KERNEL);
11123 		if (!cqm_config) {
11124 			err = -ENOMEM;
11125 			goto unlock;
11126 		}
11127 
11128 		cqm_config->rssi_hyst = hysteresis;
11129 		cqm_config->n_rssi_thresholds = n_thresholds;
11130 		memcpy(cqm_config->rssi_thresholds, thresholds,
11131 		       n_thresholds * sizeof(s32));
11132 
11133 		wdev->cqm_config = cqm_config;
11134 	}
11135 
11136 	err = cfg80211_cqm_rssi_update(rdev, dev);
11137 
11138 unlock:
11139 	wdev_unlock(wdev);
11140 
11141 	return err;
11142 }
11143 
11144 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11145 {
11146 	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11147 	struct nlattr *cqm;
11148 	int err;
11149 
11150 	cqm = info->attrs[NL80211_ATTR_CQM];
11151 	if (!cqm)
11152 		return -EINVAL;
11153 
11154 	err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11155 					  nl80211_attr_cqm_policy,
11156 					  info->extack);
11157 	if (err)
11158 		return err;
11159 
11160 	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11161 	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11162 		const s32 *thresholds =
11163 			nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11164 		int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11165 		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11166 
11167 		if (len % 4)
11168 			return -EINVAL;
11169 
11170 		return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11171 					    hysteresis);
11172 	}
11173 
11174 	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11175 	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11176 	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11177 		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11178 		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11179 		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11180 
11181 		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11182 	}
11183 
11184 	return -EINVAL;
11185 }
11186 
11187 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11188 {
11189 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11190 	struct net_device *dev = info->user_ptr[1];
11191 	struct ocb_setup setup = {};
11192 	int err;
11193 
11194 	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11195 	if (err)
11196 		return err;
11197 
11198 	return cfg80211_join_ocb(rdev, dev, &setup);
11199 }
11200 
11201 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11202 {
11203 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11204 	struct net_device *dev = info->user_ptr[1];
11205 
11206 	return cfg80211_leave_ocb(rdev, dev);
11207 }
11208 
11209 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11210 {
11211 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11212 	struct net_device *dev = info->user_ptr[1];
11213 	struct mesh_config cfg;
11214 	struct mesh_setup setup;
11215 	int err;
11216 
11217 	/* start with default */
11218 	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11219 	memcpy(&setup, &default_mesh_setup, sizeof(setup));
11220 
11221 	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11222 		/* and parse parameters if given */
11223 		err = nl80211_parse_mesh_config(info, &cfg, NULL);
11224 		if (err)
11225 			return err;
11226 	}
11227 
11228 	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11229 	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11230 		return -EINVAL;
11231 
11232 	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11233 	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11234 
11235 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11236 	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11237 			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11238 			return -EINVAL;
11239 
11240 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11241 		setup.beacon_interval =
11242 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11243 
11244 		err = cfg80211_validate_beacon_int(rdev,
11245 						   NL80211_IFTYPE_MESH_POINT,
11246 						   setup.beacon_interval);
11247 		if (err)
11248 			return err;
11249 	}
11250 
11251 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11252 		setup.dtim_period =
11253 			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11254 		if (setup.dtim_period < 1 || setup.dtim_period > 100)
11255 			return -EINVAL;
11256 	}
11257 
11258 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11259 		/* parse additional setup parameters if given */
11260 		err = nl80211_parse_mesh_setup(info, &setup);
11261 		if (err)
11262 			return err;
11263 	}
11264 
11265 	if (setup.user_mpm)
11266 		cfg.auto_open_plinks = false;
11267 
11268 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11269 		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11270 		if (err)
11271 			return err;
11272 	} else {
11273 		/* __cfg80211_join_mesh() will sort it out */
11274 		setup.chandef.chan = NULL;
11275 	}
11276 
11277 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11278 		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11279 		int n_rates =
11280 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11281 		struct ieee80211_supported_band *sband;
11282 
11283 		if (!setup.chandef.chan)
11284 			return -EINVAL;
11285 
11286 		sband = rdev->wiphy.bands[setup.chandef.chan->band];
11287 
11288 		err = ieee80211_get_ratemask(sband, rates, n_rates,
11289 					     &setup.basic_rates);
11290 		if (err)
11291 			return err;
11292 	}
11293 
11294 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
11295 		err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
11296 		if (err)
11297 			return err;
11298 
11299 		if (!setup.chandef.chan)
11300 			return -EINVAL;
11301 
11302 		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11303 					      &setup.beacon_rate);
11304 		if (err)
11305 			return err;
11306 	}
11307 
11308 	setup.userspace_handles_dfs =
11309 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11310 
11311 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11312 		int r = validate_pae_over_nl80211(rdev, info);
11313 
11314 		if (r < 0)
11315 			return r;
11316 
11317 		setup.control_port_over_nl80211 = true;
11318 	}
11319 
11320 	wdev_lock(dev->ieee80211_ptr);
11321 	err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11322 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11323 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11324 	wdev_unlock(dev->ieee80211_ptr);
11325 
11326 	return err;
11327 }
11328 
11329 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11330 {
11331 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11332 	struct net_device *dev = info->user_ptr[1];
11333 
11334 	return cfg80211_leave_mesh(rdev, dev);
11335 }
11336 
11337 #ifdef CONFIG_PM
11338 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11339 					struct cfg80211_registered_device *rdev)
11340 {
11341 	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11342 	struct nlattr *nl_pats, *nl_pat;
11343 	int i, pat_len;
11344 
11345 	if (!wowlan->n_patterns)
11346 		return 0;
11347 
11348 	nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11349 	if (!nl_pats)
11350 		return -ENOBUFS;
11351 
11352 	for (i = 0; i < wowlan->n_patterns; i++) {
11353 		nl_pat = nla_nest_start_noflag(msg, i + 1);
11354 		if (!nl_pat)
11355 			return -ENOBUFS;
11356 		pat_len = wowlan->patterns[i].pattern_len;
11357 		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
11358 			    wowlan->patterns[i].mask) ||
11359 		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11360 			    wowlan->patterns[i].pattern) ||
11361 		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11362 				wowlan->patterns[i].pkt_offset))
11363 			return -ENOBUFS;
11364 		nla_nest_end(msg, nl_pat);
11365 	}
11366 	nla_nest_end(msg, nl_pats);
11367 
11368 	return 0;
11369 }
11370 
11371 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
11372 				   struct cfg80211_wowlan_tcp *tcp)
11373 {
11374 	struct nlattr *nl_tcp;
11375 
11376 	if (!tcp)
11377 		return 0;
11378 
11379 	nl_tcp = nla_nest_start_noflag(msg,
11380 				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
11381 	if (!nl_tcp)
11382 		return -ENOBUFS;
11383 
11384 	if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
11385 	    nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
11386 	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
11387 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
11388 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
11389 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
11390 		    tcp->payload_len, tcp->payload) ||
11391 	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
11392 			tcp->data_interval) ||
11393 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
11394 		    tcp->wake_len, tcp->wake_data) ||
11395 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
11396 		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
11397 		return -ENOBUFS;
11398 
11399 	if (tcp->payload_seq.len &&
11400 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
11401 		    sizeof(tcp->payload_seq), &tcp->payload_seq))
11402 		return -ENOBUFS;
11403 
11404 	if (tcp->payload_tok.len &&
11405 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
11406 		    sizeof(tcp->payload_tok) + tcp->tokens_size,
11407 		    &tcp->payload_tok))
11408 		return -ENOBUFS;
11409 
11410 	nla_nest_end(msg, nl_tcp);
11411 
11412 	return 0;
11413 }
11414 
11415 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
11416 				  struct cfg80211_sched_scan_request *req)
11417 {
11418 	struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
11419 	int i;
11420 
11421 	if (!req)
11422 		return 0;
11423 
11424 	nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
11425 	if (!nd)
11426 		return -ENOBUFS;
11427 
11428 	if (req->n_scan_plans == 1 &&
11429 	    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
11430 			req->scan_plans[0].interval * 1000))
11431 		return -ENOBUFS;
11432 
11433 	if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
11434 		return -ENOBUFS;
11435 
11436 	if (req->relative_rssi_set) {
11437 		struct nl80211_bss_select_rssi_adjust rssi_adjust;
11438 
11439 		if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
11440 			       req->relative_rssi))
11441 			return -ENOBUFS;
11442 
11443 		rssi_adjust.band = req->rssi_adjust.band;
11444 		rssi_adjust.delta = req->rssi_adjust.delta;
11445 		if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
11446 			    sizeof(rssi_adjust), &rssi_adjust))
11447 			return -ENOBUFS;
11448 	}
11449 
11450 	freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
11451 	if (!freqs)
11452 		return -ENOBUFS;
11453 
11454 	for (i = 0; i < req->n_channels; i++) {
11455 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
11456 			return -ENOBUFS;
11457 	}
11458 
11459 	nla_nest_end(msg, freqs);
11460 
11461 	if (req->n_match_sets) {
11462 		matches = nla_nest_start_noflag(msg,
11463 						NL80211_ATTR_SCHED_SCAN_MATCH);
11464 		if (!matches)
11465 			return -ENOBUFS;
11466 
11467 		for (i = 0; i < req->n_match_sets; i++) {
11468 			match = nla_nest_start_noflag(msg, i);
11469 			if (!match)
11470 				return -ENOBUFS;
11471 
11472 			if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
11473 				    req->match_sets[i].ssid.ssid_len,
11474 				    req->match_sets[i].ssid.ssid))
11475 				return -ENOBUFS;
11476 			nla_nest_end(msg, match);
11477 		}
11478 		nla_nest_end(msg, matches);
11479 	}
11480 
11481 	scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
11482 	if (!scan_plans)
11483 		return -ENOBUFS;
11484 
11485 	for (i = 0; i < req->n_scan_plans; i++) {
11486 		scan_plan = nla_nest_start_noflag(msg, i + 1);
11487 		if (!scan_plan)
11488 			return -ENOBUFS;
11489 
11490 		if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11491 				req->scan_plans[i].interval) ||
11492 		    (req->scan_plans[i].iterations &&
11493 		     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11494 				 req->scan_plans[i].iterations)))
11495 			return -ENOBUFS;
11496 		nla_nest_end(msg, scan_plan);
11497 	}
11498 	nla_nest_end(msg, scan_plans);
11499 
11500 	nla_nest_end(msg, nd);
11501 
11502 	return 0;
11503 }
11504 
11505 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11506 {
11507 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11508 	struct sk_buff *msg;
11509 	void *hdr;
11510 	u32 size = NLMSG_DEFAULT_SIZE;
11511 
11512 	if (!rdev->wiphy.wowlan)
11513 		return -EOPNOTSUPP;
11514 
11515 	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11516 		/* adjust size to have room for all the data */
11517 		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11518 			rdev->wiphy.wowlan_config->tcp->payload_len +
11519 			rdev->wiphy.wowlan_config->tcp->wake_len +
11520 			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11521 	}
11522 
11523 	msg = nlmsg_new(size, GFP_KERNEL);
11524 	if (!msg)
11525 		return -ENOMEM;
11526 
11527 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11528 			     NL80211_CMD_GET_WOWLAN);
11529 	if (!hdr)
11530 		goto nla_put_failure;
11531 
11532 	if (rdev->wiphy.wowlan_config) {
11533 		struct nlattr *nl_wowlan;
11534 
11535 		nl_wowlan = nla_nest_start_noflag(msg,
11536 						  NL80211_ATTR_WOWLAN_TRIGGERS);
11537 		if (!nl_wowlan)
11538 			goto nla_put_failure;
11539 
11540 		if ((rdev->wiphy.wowlan_config->any &&
11541 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11542 		    (rdev->wiphy.wowlan_config->disconnect &&
11543 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11544 		    (rdev->wiphy.wowlan_config->magic_pkt &&
11545 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11546 		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11547 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11548 		    (rdev->wiphy.wowlan_config->eap_identity_req &&
11549 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11550 		    (rdev->wiphy.wowlan_config->four_way_handshake &&
11551 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11552 		    (rdev->wiphy.wowlan_config->rfkill_release &&
11553 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11554 			goto nla_put_failure;
11555 
11556 		if (nl80211_send_wowlan_patterns(msg, rdev))
11557 			goto nla_put_failure;
11558 
11559 		if (nl80211_send_wowlan_tcp(msg,
11560 					    rdev->wiphy.wowlan_config->tcp))
11561 			goto nla_put_failure;
11562 
11563 		if (nl80211_send_wowlan_nd(
11564 			    msg,
11565 			    rdev->wiphy.wowlan_config->nd_config))
11566 			goto nla_put_failure;
11567 
11568 		nla_nest_end(msg, nl_wowlan);
11569 	}
11570 
11571 	genlmsg_end(msg, hdr);
11572 	return genlmsg_reply(msg, info);
11573 
11574 nla_put_failure:
11575 	nlmsg_free(msg);
11576 	return -ENOBUFS;
11577 }
11578 
11579 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11580 				    struct nlattr *attr,
11581 				    struct cfg80211_wowlan *trig)
11582 {
11583 	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11584 	struct cfg80211_wowlan_tcp *cfg;
11585 	struct nl80211_wowlan_tcp_data_token *tok = NULL;
11586 	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11587 	u32 size;
11588 	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11589 	int err, port;
11590 
11591 	if (!rdev->wiphy.wowlan->tcp)
11592 		return -EINVAL;
11593 
11594 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
11595 					  nl80211_wowlan_tcp_policy, NULL);
11596 	if (err)
11597 		return err;
11598 
11599 	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11600 	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11601 	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11602 	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11603 	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11604 	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11605 	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11606 	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11607 		return -EINVAL;
11608 
11609 	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11610 	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11611 		return -EINVAL;
11612 
11613 	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11614 			rdev->wiphy.wowlan->tcp->data_interval_max ||
11615 	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11616 		return -EINVAL;
11617 
11618 	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11619 	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11620 		return -EINVAL;
11621 
11622 	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11623 	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11624 		return -EINVAL;
11625 
11626 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11627 		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11628 
11629 		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11630 		tokens_size = tokln - sizeof(*tok);
11631 
11632 		if (!tok->len || tokens_size % tok->len)
11633 			return -EINVAL;
11634 		if (!rdev->wiphy.wowlan->tcp->tok)
11635 			return -EINVAL;
11636 		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11637 			return -EINVAL;
11638 		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11639 			return -EINVAL;
11640 		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11641 			return -EINVAL;
11642 		if (tok->offset + tok->len > data_size)
11643 			return -EINVAL;
11644 	}
11645 
11646 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11647 		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11648 		if (!rdev->wiphy.wowlan->tcp->seq)
11649 			return -EINVAL;
11650 		if (seq->len == 0 || seq->len > 4)
11651 			return -EINVAL;
11652 		if (seq->len + seq->offset > data_size)
11653 			return -EINVAL;
11654 	}
11655 
11656 	size = sizeof(*cfg);
11657 	size += data_size;
11658 	size += wake_size + wake_mask_size;
11659 	size += tokens_size;
11660 
11661 	cfg = kzalloc(size, GFP_KERNEL);
11662 	if (!cfg)
11663 		return -ENOMEM;
11664 	cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11665 	cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11666 	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11667 	       ETH_ALEN);
11668 	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11669 		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11670 	else
11671 		port = 0;
11672 #ifdef CONFIG_INET
11673 	/* allocate a socket and port for it and use it */
11674 	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11675 			    IPPROTO_TCP, &cfg->sock, 1);
11676 	if (err) {
11677 		kfree(cfg);
11678 		return err;
11679 	}
11680 	if (inet_csk_get_port(cfg->sock->sk, port)) {
11681 		sock_release(cfg->sock);
11682 		kfree(cfg);
11683 		return -EADDRINUSE;
11684 	}
11685 	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11686 #else
11687 	if (!port) {
11688 		kfree(cfg);
11689 		return -EINVAL;
11690 	}
11691 	cfg->src_port = port;
11692 #endif
11693 
11694 	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11695 	cfg->payload_len = data_size;
11696 	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11697 	memcpy((void *)cfg->payload,
11698 	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11699 	       data_size);
11700 	if (seq)
11701 		cfg->payload_seq = *seq;
11702 	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11703 	cfg->wake_len = wake_size;
11704 	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11705 	memcpy((void *)cfg->wake_data,
11706 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11707 	       wake_size);
11708 	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11709 			 data_size + wake_size;
11710 	memcpy((void *)cfg->wake_mask,
11711 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11712 	       wake_mask_size);
11713 	if (tok) {
11714 		cfg->tokens_size = tokens_size;
11715 		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11716 	}
11717 
11718 	trig->tcp = cfg;
11719 
11720 	return 0;
11721 }
11722 
11723 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11724 				   const struct wiphy_wowlan_support *wowlan,
11725 				   struct nlattr *attr,
11726 				   struct cfg80211_wowlan *trig)
11727 {
11728 	struct nlattr **tb;
11729 	int err;
11730 
11731 	tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11732 	if (!tb)
11733 		return -ENOMEM;
11734 
11735 	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11736 		err = -EOPNOTSUPP;
11737 		goto out;
11738 	}
11739 
11740 	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
11741 					  nl80211_policy, NULL);
11742 	if (err)
11743 		goto out;
11744 
11745 	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11746 						   wowlan->max_nd_match_sets);
11747 	err = PTR_ERR_OR_ZERO(trig->nd_config);
11748 	if (err)
11749 		trig->nd_config = NULL;
11750 
11751 out:
11752 	kfree(tb);
11753 	return err;
11754 }
11755 
11756 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11757 {
11758 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11759 	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11760 	struct cfg80211_wowlan new_triggers = {};
11761 	struct cfg80211_wowlan *ntrig;
11762 	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11763 	int err, i;
11764 	bool prev_enabled = rdev->wiphy.wowlan_config;
11765 	bool regular = false;
11766 
11767 	if (!wowlan)
11768 		return -EOPNOTSUPP;
11769 
11770 	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11771 		cfg80211_rdev_free_wowlan(rdev);
11772 		rdev->wiphy.wowlan_config = NULL;
11773 		goto set_wakeup;
11774 	}
11775 
11776 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
11777 					  info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11778 					  nl80211_wowlan_policy, info->extack);
11779 	if (err)
11780 		return err;
11781 
11782 	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11783 		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11784 			return -EINVAL;
11785 		new_triggers.any = true;
11786 	}
11787 
11788 	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11789 		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11790 			return -EINVAL;
11791 		new_triggers.disconnect = true;
11792 		regular = true;
11793 	}
11794 
11795 	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11796 		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11797 			return -EINVAL;
11798 		new_triggers.magic_pkt = true;
11799 		regular = true;
11800 	}
11801 
11802 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11803 		return -EINVAL;
11804 
11805 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11806 		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11807 			return -EINVAL;
11808 		new_triggers.gtk_rekey_failure = true;
11809 		regular = true;
11810 	}
11811 
11812 	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11813 		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11814 			return -EINVAL;
11815 		new_triggers.eap_identity_req = true;
11816 		regular = true;
11817 	}
11818 
11819 	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11820 		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11821 			return -EINVAL;
11822 		new_triggers.four_way_handshake = true;
11823 		regular = true;
11824 	}
11825 
11826 	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11827 		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11828 			return -EINVAL;
11829 		new_triggers.rfkill_release = true;
11830 		regular = true;
11831 	}
11832 
11833 	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11834 		struct nlattr *pat;
11835 		int n_patterns = 0;
11836 		int rem, pat_len, mask_len, pkt_offset;
11837 		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11838 
11839 		regular = true;
11840 
11841 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11842 				    rem)
11843 			n_patterns++;
11844 		if (n_patterns > wowlan->n_patterns)
11845 			return -EINVAL;
11846 
11847 		new_triggers.patterns = kcalloc(n_patterns,
11848 						sizeof(new_triggers.patterns[0]),
11849 						GFP_KERNEL);
11850 		if (!new_triggers.patterns)
11851 			return -ENOMEM;
11852 
11853 		new_triggers.n_patterns = n_patterns;
11854 		i = 0;
11855 
11856 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11857 				    rem) {
11858 			u8 *mask_pat;
11859 
11860 			err = nla_parse_nested_deprecated(pat_tb,
11861 							  MAX_NL80211_PKTPAT,
11862 							  pat,
11863 							  nl80211_packet_pattern_policy,
11864 							  info->extack);
11865 			if (err)
11866 				goto error;
11867 
11868 			err = -EINVAL;
11869 			if (!pat_tb[NL80211_PKTPAT_MASK] ||
11870 			    !pat_tb[NL80211_PKTPAT_PATTERN])
11871 				goto error;
11872 			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11873 			mask_len = DIV_ROUND_UP(pat_len, 8);
11874 			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11875 				goto error;
11876 			if (pat_len > wowlan->pattern_max_len ||
11877 			    pat_len < wowlan->pattern_min_len)
11878 				goto error;
11879 
11880 			if (!pat_tb[NL80211_PKTPAT_OFFSET])
11881 				pkt_offset = 0;
11882 			else
11883 				pkt_offset = nla_get_u32(
11884 					pat_tb[NL80211_PKTPAT_OFFSET]);
11885 			if (pkt_offset > wowlan->max_pkt_offset)
11886 				goto error;
11887 			new_triggers.patterns[i].pkt_offset = pkt_offset;
11888 
11889 			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11890 			if (!mask_pat) {
11891 				err = -ENOMEM;
11892 				goto error;
11893 			}
11894 			new_triggers.patterns[i].mask = mask_pat;
11895 			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11896 			       mask_len);
11897 			mask_pat += mask_len;
11898 			new_triggers.patterns[i].pattern = mask_pat;
11899 			new_triggers.patterns[i].pattern_len = pat_len;
11900 			memcpy(mask_pat,
11901 			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11902 			       pat_len);
11903 			i++;
11904 		}
11905 	}
11906 
11907 	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11908 		regular = true;
11909 		err = nl80211_parse_wowlan_tcp(
11910 			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11911 			&new_triggers);
11912 		if (err)
11913 			goto error;
11914 	}
11915 
11916 	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11917 		regular = true;
11918 		err = nl80211_parse_wowlan_nd(
11919 			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11920 			&new_triggers);
11921 		if (err)
11922 			goto error;
11923 	}
11924 
11925 	/* The 'any' trigger means the device continues operating more or less
11926 	 * as in its normal operation mode and wakes up the host on most of the
11927 	 * normal interrupts (like packet RX, ...)
11928 	 * It therefore makes little sense to combine with the more constrained
11929 	 * wakeup trigger modes.
11930 	 */
11931 	if (new_triggers.any && regular) {
11932 		err = -EINVAL;
11933 		goto error;
11934 	}
11935 
11936 	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11937 	if (!ntrig) {
11938 		err = -ENOMEM;
11939 		goto error;
11940 	}
11941 	cfg80211_rdev_free_wowlan(rdev);
11942 	rdev->wiphy.wowlan_config = ntrig;
11943 
11944  set_wakeup:
11945 	if (rdev->ops->set_wakeup &&
11946 	    prev_enabled != !!rdev->wiphy.wowlan_config)
11947 		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11948 
11949 	return 0;
11950  error:
11951 	for (i = 0; i < new_triggers.n_patterns; i++)
11952 		kfree(new_triggers.patterns[i].mask);
11953 	kfree(new_triggers.patterns);
11954 	if (new_triggers.tcp && new_triggers.tcp->sock)
11955 		sock_release(new_triggers.tcp->sock);
11956 	kfree(new_triggers.tcp);
11957 	kfree(new_triggers.nd_config);
11958 	return err;
11959 }
11960 #endif
11961 
11962 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11963 				       struct cfg80211_registered_device *rdev)
11964 {
11965 	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11966 	int i, j, pat_len;
11967 	struct cfg80211_coalesce_rules *rule;
11968 
11969 	if (!rdev->coalesce->n_rules)
11970 		return 0;
11971 
11972 	nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
11973 	if (!nl_rules)
11974 		return -ENOBUFS;
11975 
11976 	for (i = 0; i < rdev->coalesce->n_rules; i++) {
11977 		nl_rule = nla_nest_start_noflag(msg, i + 1);
11978 		if (!nl_rule)
11979 			return -ENOBUFS;
11980 
11981 		rule = &rdev->coalesce->rules[i];
11982 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11983 				rule->delay))
11984 			return -ENOBUFS;
11985 
11986 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11987 				rule->condition))
11988 			return -ENOBUFS;
11989 
11990 		nl_pats = nla_nest_start_noflag(msg,
11991 						NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11992 		if (!nl_pats)
11993 			return -ENOBUFS;
11994 
11995 		for (j = 0; j < rule->n_patterns; j++) {
11996 			nl_pat = nla_nest_start_noflag(msg, j + 1);
11997 			if (!nl_pat)
11998 				return -ENOBUFS;
11999 			pat_len = rule->patterns[j].pattern_len;
12000 			if (nla_put(msg, NL80211_PKTPAT_MASK,
12001 				    DIV_ROUND_UP(pat_len, 8),
12002 				    rule->patterns[j].mask) ||
12003 			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12004 				    rule->patterns[j].pattern) ||
12005 			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12006 					rule->patterns[j].pkt_offset))
12007 				return -ENOBUFS;
12008 			nla_nest_end(msg, nl_pat);
12009 		}
12010 		nla_nest_end(msg, nl_pats);
12011 		nla_nest_end(msg, nl_rule);
12012 	}
12013 	nla_nest_end(msg, nl_rules);
12014 
12015 	return 0;
12016 }
12017 
12018 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12019 {
12020 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12021 	struct sk_buff *msg;
12022 	void *hdr;
12023 
12024 	if (!rdev->wiphy.coalesce)
12025 		return -EOPNOTSUPP;
12026 
12027 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12028 	if (!msg)
12029 		return -ENOMEM;
12030 
12031 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12032 			     NL80211_CMD_GET_COALESCE);
12033 	if (!hdr)
12034 		goto nla_put_failure;
12035 
12036 	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12037 		goto nla_put_failure;
12038 
12039 	genlmsg_end(msg, hdr);
12040 	return genlmsg_reply(msg, info);
12041 
12042 nla_put_failure:
12043 	nlmsg_free(msg);
12044 	return -ENOBUFS;
12045 }
12046 
12047 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12048 {
12049 	struct cfg80211_coalesce *coalesce = rdev->coalesce;
12050 	int i, j;
12051 	struct cfg80211_coalesce_rules *rule;
12052 
12053 	if (!coalesce)
12054 		return;
12055 
12056 	for (i = 0; i < coalesce->n_rules; i++) {
12057 		rule = &coalesce->rules[i];
12058 		for (j = 0; j < rule->n_patterns; j++)
12059 			kfree(rule->patterns[j].mask);
12060 		kfree(rule->patterns);
12061 	}
12062 	kfree(coalesce->rules);
12063 	kfree(coalesce);
12064 	rdev->coalesce = NULL;
12065 }
12066 
12067 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12068 				       struct nlattr *rule,
12069 				       struct cfg80211_coalesce_rules *new_rule)
12070 {
12071 	int err, i;
12072 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12073 	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12074 	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12075 	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12076 
12077 	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12078 					  rule, nl80211_coalesce_policy, NULL);
12079 	if (err)
12080 		return err;
12081 
12082 	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12083 		new_rule->delay =
12084 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12085 	if (new_rule->delay > coalesce->max_delay)
12086 		return -EINVAL;
12087 
12088 	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12089 		new_rule->condition =
12090 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12091 
12092 	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12093 		return -EINVAL;
12094 
12095 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12096 			    rem)
12097 		n_patterns++;
12098 	if (n_patterns > coalesce->n_patterns)
12099 		return -EINVAL;
12100 
12101 	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12102 				     GFP_KERNEL);
12103 	if (!new_rule->patterns)
12104 		return -ENOMEM;
12105 
12106 	new_rule->n_patterns = n_patterns;
12107 	i = 0;
12108 
12109 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12110 			    rem) {
12111 		u8 *mask_pat;
12112 
12113 		err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12114 						  pat,
12115 						  nl80211_packet_pattern_policy,
12116 						  NULL);
12117 		if (err)
12118 			return err;
12119 
12120 		if (!pat_tb[NL80211_PKTPAT_MASK] ||
12121 		    !pat_tb[NL80211_PKTPAT_PATTERN])
12122 			return -EINVAL;
12123 		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12124 		mask_len = DIV_ROUND_UP(pat_len, 8);
12125 		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12126 			return -EINVAL;
12127 		if (pat_len > coalesce->pattern_max_len ||
12128 		    pat_len < coalesce->pattern_min_len)
12129 			return -EINVAL;
12130 
12131 		if (!pat_tb[NL80211_PKTPAT_OFFSET])
12132 			pkt_offset = 0;
12133 		else
12134 			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12135 		if (pkt_offset > coalesce->max_pkt_offset)
12136 			return -EINVAL;
12137 		new_rule->patterns[i].pkt_offset = pkt_offset;
12138 
12139 		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12140 		if (!mask_pat)
12141 			return -ENOMEM;
12142 
12143 		new_rule->patterns[i].mask = mask_pat;
12144 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12145 		       mask_len);
12146 
12147 		mask_pat += mask_len;
12148 		new_rule->patterns[i].pattern = mask_pat;
12149 		new_rule->patterns[i].pattern_len = pat_len;
12150 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12151 		       pat_len);
12152 		i++;
12153 	}
12154 
12155 	return 0;
12156 }
12157 
12158 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12159 {
12160 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12161 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12162 	struct cfg80211_coalesce new_coalesce = {};
12163 	struct cfg80211_coalesce *n_coalesce;
12164 	int err, rem_rule, n_rules = 0, i, j;
12165 	struct nlattr *rule;
12166 	struct cfg80211_coalesce_rules *tmp_rule;
12167 
12168 	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12169 		return -EOPNOTSUPP;
12170 
12171 	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12172 		cfg80211_rdev_free_coalesce(rdev);
12173 		rdev_set_coalesce(rdev, NULL);
12174 		return 0;
12175 	}
12176 
12177 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12178 			    rem_rule)
12179 		n_rules++;
12180 	if (n_rules > coalesce->n_rules)
12181 		return -EINVAL;
12182 
12183 	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12184 				     GFP_KERNEL);
12185 	if (!new_coalesce.rules)
12186 		return -ENOMEM;
12187 
12188 	new_coalesce.n_rules = n_rules;
12189 	i = 0;
12190 
12191 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12192 			    rem_rule) {
12193 		err = nl80211_parse_coalesce_rule(rdev, rule,
12194 						  &new_coalesce.rules[i]);
12195 		if (err)
12196 			goto error;
12197 
12198 		i++;
12199 	}
12200 
12201 	err = rdev_set_coalesce(rdev, &new_coalesce);
12202 	if (err)
12203 		goto error;
12204 
12205 	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12206 	if (!n_coalesce) {
12207 		err = -ENOMEM;
12208 		goto error;
12209 	}
12210 	cfg80211_rdev_free_coalesce(rdev);
12211 	rdev->coalesce = n_coalesce;
12212 
12213 	return 0;
12214 error:
12215 	for (i = 0; i < new_coalesce.n_rules; i++) {
12216 		tmp_rule = &new_coalesce.rules[i];
12217 		for (j = 0; j < tmp_rule->n_patterns; j++)
12218 			kfree(tmp_rule->patterns[j].mask);
12219 		kfree(tmp_rule->patterns);
12220 	}
12221 	kfree(new_coalesce.rules);
12222 
12223 	return err;
12224 }
12225 
12226 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12227 {
12228 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12229 	struct net_device *dev = info->user_ptr[1];
12230 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12231 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12232 	struct cfg80211_gtk_rekey_data rekey_data;
12233 	int err;
12234 
12235 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12236 		return -EINVAL;
12237 
12238 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12239 					  info->attrs[NL80211_ATTR_REKEY_DATA],
12240 					  nl80211_rekey_policy, info->extack);
12241 	if (err)
12242 		return err;
12243 
12244 	if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12245 	    !tb[NL80211_REKEY_DATA_KCK])
12246 		return -EINVAL;
12247 	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
12248 		return -ERANGE;
12249 	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
12250 		return -ERANGE;
12251 	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
12252 		return -ERANGE;
12253 
12254 	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12255 	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12256 	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12257 
12258 	wdev_lock(wdev);
12259 	if (!wdev->current_bss) {
12260 		err = -ENOTCONN;
12261 		goto out;
12262 	}
12263 
12264 	if (!rdev->ops->set_rekey_data) {
12265 		err = -EOPNOTSUPP;
12266 		goto out;
12267 	}
12268 
12269 	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12270  out:
12271 	wdev_unlock(wdev);
12272 	return err;
12273 }
12274 
12275 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12276 					     struct genl_info *info)
12277 {
12278 	struct net_device *dev = info->user_ptr[1];
12279 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12280 
12281 	if (wdev->iftype != NL80211_IFTYPE_AP &&
12282 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
12283 		return -EINVAL;
12284 
12285 	if (wdev->ap_unexpected_nlportid)
12286 		return -EBUSY;
12287 
12288 	wdev->ap_unexpected_nlportid = info->snd_portid;
12289 	return 0;
12290 }
12291 
12292 static int nl80211_probe_client(struct sk_buff *skb,
12293 				struct genl_info *info)
12294 {
12295 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12296 	struct net_device *dev = info->user_ptr[1];
12297 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12298 	struct sk_buff *msg;
12299 	void *hdr;
12300 	const u8 *addr;
12301 	u64 cookie;
12302 	int err;
12303 
12304 	if (wdev->iftype != NL80211_IFTYPE_AP &&
12305 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
12306 		return -EOPNOTSUPP;
12307 
12308 	if (!info->attrs[NL80211_ATTR_MAC])
12309 		return -EINVAL;
12310 
12311 	if (!rdev->ops->probe_client)
12312 		return -EOPNOTSUPP;
12313 
12314 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12315 	if (!msg)
12316 		return -ENOMEM;
12317 
12318 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12319 			     NL80211_CMD_PROBE_CLIENT);
12320 	if (!hdr) {
12321 		err = -ENOBUFS;
12322 		goto free_msg;
12323 	}
12324 
12325 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12326 
12327 	err = rdev_probe_client(rdev, dev, addr, &cookie);
12328 	if (err)
12329 		goto free_msg;
12330 
12331 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12332 			      NL80211_ATTR_PAD))
12333 		goto nla_put_failure;
12334 
12335 	genlmsg_end(msg, hdr);
12336 
12337 	return genlmsg_reply(msg, info);
12338 
12339  nla_put_failure:
12340 	err = -ENOBUFS;
12341  free_msg:
12342 	nlmsg_free(msg);
12343 	return err;
12344 }
12345 
12346 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12347 {
12348 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12349 	struct cfg80211_beacon_registration *reg, *nreg;
12350 	int rv;
12351 
12352 	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
12353 		return -EOPNOTSUPP;
12354 
12355 	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
12356 	if (!nreg)
12357 		return -ENOMEM;
12358 
12359 	/* First, check if already registered. */
12360 	spin_lock_bh(&rdev->beacon_registrations_lock);
12361 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
12362 		if (reg->nlportid == info->snd_portid) {
12363 			rv = -EALREADY;
12364 			goto out_err;
12365 		}
12366 	}
12367 	/* Add it to the list */
12368 	nreg->nlportid = info->snd_portid;
12369 	list_add(&nreg->list, &rdev->beacon_registrations);
12370 
12371 	spin_unlock_bh(&rdev->beacon_registrations_lock);
12372 
12373 	return 0;
12374 out_err:
12375 	spin_unlock_bh(&rdev->beacon_registrations_lock);
12376 	kfree(nreg);
12377 	return rv;
12378 }
12379 
12380 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
12381 {
12382 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12383 	struct wireless_dev *wdev = info->user_ptr[1];
12384 	int err;
12385 
12386 	if (!rdev->ops->start_p2p_device)
12387 		return -EOPNOTSUPP;
12388 
12389 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12390 		return -EOPNOTSUPP;
12391 
12392 	if (wdev_running(wdev))
12393 		return 0;
12394 
12395 	if (rfkill_blocked(rdev->rfkill))
12396 		return -ERFKILL;
12397 
12398 	err = rdev_start_p2p_device(rdev, wdev);
12399 	if (err)
12400 		return err;
12401 
12402 	wdev->is_running = true;
12403 	rdev->opencount++;
12404 
12405 	return 0;
12406 }
12407 
12408 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
12409 {
12410 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12411 	struct wireless_dev *wdev = info->user_ptr[1];
12412 
12413 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
12414 		return -EOPNOTSUPP;
12415 
12416 	if (!rdev->ops->stop_p2p_device)
12417 		return -EOPNOTSUPP;
12418 
12419 	cfg80211_stop_p2p_device(rdev, wdev);
12420 
12421 	return 0;
12422 }
12423 
12424 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
12425 {
12426 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12427 	struct wireless_dev *wdev = info->user_ptr[1];
12428 	struct cfg80211_nan_conf conf = {};
12429 	int err;
12430 
12431 	if (wdev->iftype != NL80211_IFTYPE_NAN)
12432 		return -EOPNOTSUPP;
12433 
12434 	if (wdev_running(wdev))
12435 		return -EEXIST;
12436 
12437 	if (rfkill_blocked(rdev->rfkill))
12438 		return -ERFKILL;
12439 
12440 	if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
12441 		return -EINVAL;
12442 
12443 	conf.master_pref =
12444 		nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12445 
12446 	if (info->attrs[NL80211_ATTR_BANDS]) {
12447 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12448 
12449 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12450 			return -EOPNOTSUPP;
12451 
12452 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12453 			return -EINVAL;
12454 
12455 		conf.bands = bands;
12456 	}
12457 
12458 	err = rdev_start_nan(rdev, wdev, &conf);
12459 	if (err)
12460 		return err;
12461 
12462 	wdev->is_running = true;
12463 	rdev->opencount++;
12464 
12465 	return 0;
12466 }
12467 
12468 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
12469 {
12470 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12471 	struct wireless_dev *wdev = info->user_ptr[1];
12472 
12473 	if (wdev->iftype != NL80211_IFTYPE_NAN)
12474 		return -EOPNOTSUPP;
12475 
12476 	cfg80211_stop_nan(rdev, wdev);
12477 
12478 	return 0;
12479 }
12480 
12481 static int validate_nan_filter(struct nlattr *filter_attr)
12482 {
12483 	struct nlattr *attr;
12484 	int len = 0, n_entries = 0, rem;
12485 
12486 	nla_for_each_nested(attr, filter_attr, rem) {
12487 		len += nla_len(attr);
12488 		n_entries++;
12489 	}
12490 
12491 	if (len >= U8_MAX)
12492 		return -EINVAL;
12493 
12494 	return n_entries;
12495 }
12496 
12497 static int handle_nan_filter(struct nlattr *attr_filter,
12498 			     struct cfg80211_nan_func *func,
12499 			     bool tx)
12500 {
12501 	struct nlattr *attr;
12502 	int n_entries, rem, i;
12503 	struct cfg80211_nan_func_filter *filter;
12504 
12505 	n_entries = validate_nan_filter(attr_filter);
12506 	if (n_entries < 0)
12507 		return n_entries;
12508 
12509 	BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12510 
12511 	filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12512 	if (!filter)
12513 		return -ENOMEM;
12514 
12515 	i = 0;
12516 	nla_for_each_nested(attr, attr_filter, rem) {
12517 		filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12518 		filter[i].len = nla_len(attr);
12519 		i++;
12520 	}
12521 	if (tx) {
12522 		func->num_tx_filters = n_entries;
12523 		func->tx_filters = filter;
12524 	} else {
12525 		func->num_rx_filters = n_entries;
12526 		func->rx_filters = filter;
12527 	}
12528 
12529 	return 0;
12530 }
12531 
12532 static int nl80211_nan_add_func(struct sk_buff *skb,
12533 				struct genl_info *info)
12534 {
12535 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12536 	struct wireless_dev *wdev = info->user_ptr[1];
12537 	struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12538 	struct cfg80211_nan_func *func;
12539 	struct sk_buff *msg = NULL;
12540 	void *hdr = NULL;
12541 	int err = 0;
12542 
12543 	if (wdev->iftype != NL80211_IFTYPE_NAN)
12544 		return -EOPNOTSUPP;
12545 
12546 	if (!wdev_running(wdev))
12547 		return -ENOTCONN;
12548 
12549 	if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12550 		return -EINVAL;
12551 
12552 	err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
12553 					  info->attrs[NL80211_ATTR_NAN_FUNC],
12554 					  nl80211_nan_func_policy,
12555 					  info->extack);
12556 	if (err)
12557 		return err;
12558 
12559 	func = kzalloc(sizeof(*func), GFP_KERNEL);
12560 	if (!func)
12561 		return -ENOMEM;
12562 
12563 	func->cookie = cfg80211_assign_cookie(rdev);
12564 
12565 	if (!tb[NL80211_NAN_FUNC_TYPE] ||
12566 	    nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12567 		err = -EINVAL;
12568 		goto out;
12569 	}
12570 
12571 
12572 	func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12573 
12574 	if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12575 		err = -EINVAL;
12576 		goto out;
12577 	}
12578 
12579 	memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12580 	       sizeof(func->service_id));
12581 
12582 	func->close_range =
12583 		nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12584 
12585 	if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12586 		func->serv_spec_info_len =
12587 			nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12588 		func->serv_spec_info =
12589 			kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12590 				func->serv_spec_info_len,
12591 				GFP_KERNEL);
12592 		if (!func->serv_spec_info) {
12593 			err = -ENOMEM;
12594 			goto out;
12595 		}
12596 	}
12597 
12598 	if (tb[NL80211_NAN_FUNC_TTL])
12599 		func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12600 
12601 	switch (func->type) {
12602 	case NL80211_NAN_FUNC_PUBLISH:
12603 		if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12604 			err = -EINVAL;
12605 			goto out;
12606 		}
12607 
12608 		func->publish_type =
12609 			nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12610 		func->publish_bcast =
12611 			nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12612 
12613 		if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12614 			func->publish_bcast) {
12615 			err = -EINVAL;
12616 			goto out;
12617 		}
12618 		break;
12619 	case NL80211_NAN_FUNC_SUBSCRIBE:
12620 		func->subscribe_active =
12621 			nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12622 		break;
12623 	case NL80211_NAN_FUNC_FOLLOW_UP:
12624 		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12625 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12626 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12627 			err = -EINVAL;
12628 			goto out;
12629 		}
12630 
12631 		func->followup_id =
12632 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12633 		func->followup_reqid =
12634 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12635 		memcpy(func->followup_dest.addr,
12636 		       nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12637 		       sizeof(func->followup_dest.addr));
12638 		if (func->ttl) {
12639 			err = -EINVAL;
12640 			goto out;
12641 		}
12642 		break;
12643 	default:
12644 		err = -EINVAL;
12645 		goto out;
12646 	}
12647 
12648 	if (tb[NL80211_NAN_FUNC_SRF]) {
12649 		struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12650 
12651 		err = nla_parse_nested_deprecated(srf_tb,
12652 						  NL80211_NAN_SRF_ATTR_MAX,
12653 						  tb[NL80211_NAN_FUNC_SRF],
12654 						  nl80211_nan_srf_policy,
12655 						  info->extack);
12656 		if (err)
12657 			goto out;
12658 
12659 		func->srf_include =
12660 			nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12661 
12662 		if (srf_tb[NL80211_NAN_SRF_BF]) {
12663 			if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12664 			    !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12665 				err = -EINVAL;
12666 				goto out;
12667 			}
12668 
12669 			func->srf_bf_len =
12670 				nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12671 			func->srf_bf =
12672 				kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12673 					func->srf_bf_len, GFP_KERNEL);
12674 			if (!func->srf_bf) {
12675 				err = -ENOMEM;
12676 				goto out;
12677 			}
12678 
12679 			func->srf_bf_idx =
12680 				nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12681 		} else {
12682 			struct nlattr *attr, *mac_attr =
12683 				srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12684 			int n_entries, rem, i = 0;
12685 
12686 			if (!mac_attr) {
12687 				err = -EINVAL;
12688 				goto out;
12689 			}
12690 
12691 			n_entries = validate_acl_mac_addrs(mac_attr);
12692 			if (n_entries <= 0) {
12693 				err = -EINVAL;
12694 				goto out;
12695 			}
12696 
12697 			func->srf_num_macs = n_entries;
12698 			func->srf_macs =
12699 				kcalloc(n_entries, sizeof(*func->srf_macs),
12700 					GFP_KERNEL);
12701 			if (!func->srf_macs) {
12702 				err = -ENOMEM;
12703 				goto out;
12704 			}
12705 
12706 			nla_for_each_nested(attr, mac_attr, rem)
12707 				memcpy(func->srf_macs[i++].addr, nla_data(attr),
12708 				       sizeof(*func->srf_macs));
12709 		}
12710 	}
12711 
12712 	if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12713 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12714 					func, true);
12715 		if (err)
12716 			goto out;
12717 	}
12718 
12719 	if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12720 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12721 					func, false);
12722 		if (err)
12723 			goto out;
12724 	}
12725 
12726 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12727 	if (!msg) {
12728 		err = -ENOMEM;
12729 		goto out;
12730 	}
12731 
12732 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12733 			     NL80211_CMD_ADD_NAN_FUNCTION);
12734 	/* This can't really happen - we just allocated 4KB */
12735 	if (WARN_ON(!hdr)) {
12736 		err = -ENOMEM;
12737 		goto out;
12738 	}
12739 
12740 	err = rdev_add_nan_func(rdev, wdev, func);
12741 out:
12742 	if (err < 0) {
12743 		cfg80211_free_nan_func(func);
12744 		nlmsg_free(msg);
12745 		return err;
12746 	}
12747 
12748 	/* propagate the instance id and cookie to userspace  */
12749 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12750 			      NL80211_ATTR_PAD))
12751 		goto nla_put_failure;
12752 
12753 	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12754 	if (!func_attr)
12755 		goto nla_put_failure;
12756 
12757 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12758 		       func->instance_id))
12759 		goto nla_put_failure;
12760 
12761 	nla_nest_end(msg, func_attr);
12762 
12763 	genlmsg_end(msg, hdr);
12764 	return genlmsg_reply(msg, info);
12765 
12766 nla_put_failure:
12767 	nlmsg_free(msg);
12768 	return -ENOBUFS;
12769 }
12770 
12771 static int nl80211_nan_del_func(struct sk_buff *skb,
12772 			       struct genl_info *info)
12773 {
12774 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12775 	struct wireless_dev *wdev = info->user_ptr[1];
12776 	u64 cookie;
12777 
12778 	if (wdev->iftype != NL80211_IFTYPE_NAN)
12779 		return -EOPNOTSUPP;
12780 
12781 	if (!wdev_running(wdev))
12782 		return -ENOTCONN;
12783 
12784 	if (!info->attrs[NL80211_ATTR_COOKIE])
12785 		return -EINVAL;
12786 
12787 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12788 
12789 	rdev_del_nan_func(rdev, wdev, cookie);
12790 
12791 	return 0;
12792 }
12793 
12794 static int nl80211_nan_change_config(struct sk_buff *skb,
12795 				     struct genl_info *info)
12796 {
12797 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12798 	struct wireless_dev *wdev = info->user_ptr[1];
12799 	struct cfg80211_nan_conf conf = {};
12800 	u32 changed = 0;
12801 
12802 	if (wdev->iftype != NL80211_IFTYPE_NAN)
12803 		return -EOPNOTSUPP;
12804 
12805 	if (!wdev_running(wdev))
12806 		return -ENOTCONN;
12807 
12808 	if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12809 		conf.master_pref =
12810 			nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12811 		if (conf.master_pref <= 1 || conf.master_pref == 255)
12812 			return -EINVAL;
12813 
12814 		changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12815 	}
12816 
12817 	if (info->attrs[NL80211_ATTR_BANDS]) {
12818 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12819 
12820 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12821 			return -EOPNOTSUPP;
12822 
12823 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12824 			return -EINVAL;
12825 
12826 		conf.bands = bands;
12827 		changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12828 	}
12829 
12830 	if (!changed)
12831 		return -EINVAL;
12832 
12833 	return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12834 }
12835 
12836 void cfg80211_nan_match(struct wireless_dev *wdev,
12837 			struct cfg80211_nan_match_params *match, gfp_t gfp)
12838 {
12839 	struct wiphy *wiphy = wdev->wiphy;
12840 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12841 	struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12842 	struct sk_buff *msg;
12843 	void *hdr;
12844 
12845 	if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12846 		return;
12847 
12848 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12849 	if (!msg)
12850 		return;
12851 
12852 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12853 	if (!hdr) {
12854 		nlmsg_free(msg);
12855 		return;
12856 	}
12857 
12858 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12859 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12860 					 wdev->netdev->ifindex)) ||
12861 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12862 			      NL80211_ATTR_PAD))
12863 		goto nla_put_failure;
12864 
12865 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12866 			      NL80211_ATTR_PAD) ||
12867 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12868 		goto nla_put_failure;
12869 
12870 	match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
12871 	if (!match_attr)
12872 		goto nla_put_failure;
12873 
12874 	local_func_attr = nla_nest_start_noflag(msg,
12875 						NL80211_NAN_MATCH_FUNC_LOCAL);
12876 	if (!local_func_attr)
12877 		goto nla_put_failure;
12878 
12879 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12880 		goto nla_put_failure;
12881 
12882 	nla_nest_end(msg, local_func_attr);
12883 
12884 	peer_func_attr = nla_nest_start_noflag(msg,
12885 					       NL80211_NAN_MATCH_FUNC_PEER);
12886 	if (!peer_func_attr)
12887 		goto nla_put_failure;
12888 
12889 	if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12890 	    nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12891 		goto nla_put_failure;
12892 
12893 	if (match->info && match->info_len &&
12894 	    nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12895 		    match->info))
12896 		goto nla_put_failure;
12897 
12898 	nla_nest_end(msg, peer_func_attr);
12899 	nla_nest_end(msg, match_attr);
12900 	genlmsg_end(msg, hdr);
12901 
12902 	if (!wdev->owner_nlportid)
12903 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12904 					msg, 0, NL80211_MCGRP_NAN, gfp);
12905 	else
12906 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12907 				wdev->owner_nlportid);
12908 
12909 	return;
12910 
12911 nla_put_failure:
12912 	nlmsg_free(msg);
12913 }
12914 EXPORT_SYMBOL(cfg80211_nan_match);
12915 
12916 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12917 				  u8 inst_id,
12918 				  enum nl80211_nan_func_term_reason reason,
12919 				  u64 cookie, gfp_t gfp)
12920 {
12921 	struct wiphy *wiphy = wdev->wiphy;
12922 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12923 	struct sk_buff *msg;
12924 	struct nlattr *func_attr;
12925 	void *hdr;
12926 
12927 	if (WARN_ON(!inst_id))
12928 		return;
12929 
12930 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12931 	if (!msg)
12932 		return;
12933 
12934 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12935 	if (!hdr) {
12936 		nlmsg_free(msg);
12937 		return;
12938 	}
12939 
12940 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12941 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12942 					 wdev->netdev->ifindex)) ||
12943 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12944 			      NL80211_ATTR_PAD))
12945 		goto nla_put_failure;
12946 
12947 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12948 			      NL80211_ATTR_PAD))
12949 		goto nla_put_failure;
12950 
12951 	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
12952 	if (!func_attr)
12953 		goto nla_put_failure;
12954 
12955 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12956 	    nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12957 		goto nla_put_failure;
12958 
12959 	nla_nest_end(msg, func_attr);
12960 	genlmsg_end(msg, hdr);
12961 
12962 	if (!wdev->owner_nlportid)
12963 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12964 					msg, 0, NL80211_MCGRP_NAN, gfp);
12965 	else
12966 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12967 				wdev->owner_nlportid);
12968 
12969 	return;
12970 
12971 nla_put_failure:
12972 	nlmsg_free(msg);
12973 }
12974 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12975 
12976 static int nl80211_get_protocol_features(struct sk_buff *skb,
12977 					 struct genl_info *info)
12978 {
12979 	void *hdr;
12980 	struct sk_buff *msg;
12981 
12982 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12983 	if (!msg)
12984 		return -ENOMEM;
12985 
12986 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12987 			     NL80211_CMD_GET_PROTOCOL_FEATURES);
12988 	if (!hdr)
12989 		goto nla_put_failure;
12990 
12991 	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12992 			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12993 		goto nla_put_failure;
12994 
12995 	genlmsg_end(msg, hdr);
12996 	return genlmsg_reply(msg, info);
12997 
12998  nla_put_failure:
12999 	kfree_skb(msg);
13000 	return -ENOBUFS;
13001 }
13002 
13003 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13004 {
13005 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13006 	struct cfg80211_update_ft_ies_params ft_params;
13007 	struct net_device *dev = info->user_ptr[1];
13008 
13009 	if (!rdev->ops->update_ft_ies)
13010 		return -EOPNOTSUPP;
13011 
13012 	if (!info->attrs[NL80211_ATTR_MDID] ||
13013 	    !info->attrs[NL80211_ATTR_IE])
13014 		return -EINVAL;
13015 
13016 	memset(&ft_params, 0, sizeof(ft_params));
13017 	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13018 	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13019 	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13020 
13021 	return rdev_update_ft_ies(rdev, dev, &ft_params);
13022 }
13023 
13024 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13025 				       struct genl_info *info)
13026 {
13027 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13028 	struct wireless_dev *wdev = info->user_ptr[1];
13029 	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13030 	u16 duration;
13031 	int ret;
13032 
13033 	if (!rdev->ops->crit_proto_start)
13034 		return -EOPNOTSUPP;
13035 
13036 	if (WARN_ON(!rdev->ops->crit_proto_stop))
13037 		return -EINVAL;
13038 
13039 	if (rdev->crit_proto_nlportid)
13040 		return -EBUSY;
13041 
13042 	/* determine protocol if provided */
13043 	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13044 		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13045 
13046 	if (proto >= NUM_NL80211_CRIT_PROTO)
13047 		return -EINVAL;
13048 
13049 	/* timeout must be provided */
13050 	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13051 		return -EINVAL;
13052 
13053 	duration =
13054 		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13055 
13056 	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
13057 		return -ERANGE;
13058 
13059 	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13060 	if (!ret)
13061 		rdev->crit_proto_nlportid = info->snd_portid;
13062 
13063 	return ret;
13064 }
13065 
13066 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13067 				      struct genl_info *info)
13068 {
13069 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13070 	struct wireless_dev *wdev = info->user_ptr[1];
13071 
13072 	if (!rdev->ops->crit_proto_stop)
13073 		return -EOPNOTSUPP;
13074 
13075 	if (rdev->crit_proto_nlportid) {
13076 		rdev->crit_proto_nlportid = 0;
13077 		rdev_crit_proto_stop(rdev, wdev);
13078 	}
13079 	return 0;
13080 }
13081 
13082 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13083 				       struct nlattr *attr,
13084 				       struct netlink_ext_ack *extack)
13085 {
13086 	if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13087 		if (attr->nla_type & NLA_F_NESTED) {
13088 			NL_SET_ERR_MSG_ATTR(extack, attr,
13089 					    "unexpected nested data");
13090 			return -EINVAL;
13091 		}
13092 
13093 		return 0;
13094 	}
13095 
13096 	if (!(attr->nla_type & NLA_F_NESTED)) {
13097 		NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13098 		return -EINVAL;
13099 	}
13100 
13101 	return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13102 }
13103 
13104 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13105 {
13106 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13107 	struct wireless_dev *wdev =
13108 		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
13109 	int i, err;
13110 	u32 vid, subcmd;
13111 
13112 	if (!rdev->wiphy.vendor_commands)
13113 		return -EOPNOTSUPP;
13114 
13115 	if (IS_ERR(wdev)) {
13116 		err = PTR_ERR(wdev);
13117 		if (err != -EINVAL)
13118 			return err;
13119 		wdev = NULL;
13120 	} else if (wdev->wiphy != &rdev->wiphy) {
13121 		return -EINVAL;
13122 	}
13123 
13124 	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13125 	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13126 		return -EINVAL;
13127 
13128 	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13129 	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13130 	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13131 		const struct wiphy_vendor_command *vcmd;
13132 		void *data = NULL;
13133 		int len = 0;
13134 
13135 		vcmd = &rdev->wiphy.vendor_commands[i];
13136 
13137 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13138 			continue;
13139 
13140 		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13141 				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13142 			if (!wdev)
13143 				return -EINVAL;
13144 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13145 			    !wdev->netdev)
13146 				return -EINVAL;
13147 
13148 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13149 				if (!wdev_running(wdev))
13150 					return -ENETDOWN;
13151 			}
13152 
13153 			if (!vcmd->doit)
13154 				return -EOPNOTSUPP;
13155 		} else {
13156 			wdev = NULL;
13157 		}
13158 
13159 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13160 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13161 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13162 
13163 			err = nl80211_vendor_check_policy(vcmd,
13164 					info->attrs[NL80211_ATTR_VENDOR_DATA],
13165 					info->extack);
13166 			if (err)
13167 				return err;
13168 		}
13169 
13170 		rdev->cur_cmd_info = info;
13171 		err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13172 		rdev->cur_cmd_info = NULL;
13173 		return err;
13174 	}
13175 
13176 	return -EOPNOTSUPP;
13177 }
13178 
13179 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13180 				       struct netlink_callback *cb,
13181 				       struct cfg80211_registered_device **rdev,
13182 				       struct wireless_dev **wdev)
13183 {
13184 	struct nlattr **attrbuf;
13185 	u32 vid, subcmd;
13186 	unsigned int i;
13187 	int vcmd_idx = -1;
13188 	int err;
13189 	void *data = NULL;
13190 	unsigned int data_len = 0;
13191 
13192 	if (cb->args[0]) {
13193 		/* subtract the 1 again here */
13194 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13195 		struct wireless_dev *tmp;
13196 
13197 		if (!wiphy)
13198 			return -ENODEV;
13199 		*rdev = wiphy_to_rdev(wiphy);
13200 		*wdev = NULL;
13201 
13202 		if (cb->args[1]) {
13203 			list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13204 				if (tmp->identifier == cb->args[1] - 1) {
13205 					*wdev = tmp;
13206 					break;
13207 				}
13208 			}
13209 		}
13210 
13211 		/* keep rtnl locked in successful case */
13212 		return 0;
13213 	}
13214 
13215 	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13216 	if (!attrbuf)
13217 		return -ENOMEM;
13218 
13219 	err = nlmsg_parse_deprecated(cb->nlh,
13220 				     GENL_HDRLEN + nl80211_fam.hdrsize,
13221 				     attrbuf, nl80211_fam.maxattr,
13222 				     nl80211_policy, NULL);
13223 	if (err)
13224 		goto out;
13225 
13226 	if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13227 	    !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13228 		err = -EINVAL;
13229 		goto out;
13230 	}
13231 
13232 	*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
13233 	if (IS_ERR(*wdev))
13234 		*wdev = NULL;
13235 
13236 	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13237 	if (IS_ERR(*rdev)) {
13238 		err = PTR_ERR(*rdev);
13239 		goto out;
13240 	}
13241 
13242 	vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13243 	subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13244 
13245 	for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13246 		const struct wiphy_vendor_command *vcmd;
13247 
13248 		vcmd = &(*rdev)->wiphy.vendor_commands[i];
13249 
13250 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13251 			continue;
13252 
13253 		if (!vcmd->dumpit) {
13254 			err = -EOPNOTSUPP;
13255 			goto out;
13256 		}
13257 
13258 		vcmd_idx = i;
13259 		break;
13260 	}
13261 
13262 	if (vcmd_idx < 0) {
13263 		err = -EOPNOTSUPP;
13264 		goto out;
13265 	}
13266 
13267 	if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13268 		data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13269 		data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13270 
13271 		err = nl80211_vendor_check_policy(
13272 				&(*rdev)->wiphy.vendor_commands[vcmd_idx],
13273 				attrbuf[NL80211_ATTR_VENDOR_DATA],
13274 				cb->extack);
13275 		if (err)
13276 			goto out;
13277 	}
13278 
13279 	/* 0 is the first index - add 1 to parse only once */
13280 	cb->args[0] = (*rdev)->wiphy_idx + 1;
13281 	/* add 1 to know if it was NULL */
13282 	cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13283 	cb->args[2] = vcmd_idx;
13284 	cb->args[3] = (unsigned long)data;
13285 	cb->args[4] = data_len;
13286 
13287 	/* keep rtnl locked in successful case */
13288 	err = 0;
13289 out:
13290 	kfree(attrbuf);
13291 	return err;
13292 }
13293 
13294 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13295 				   struct netlink_callback *cb)
13296 {
13297 	struct cfg80211_registered_device *rdev;
13298 	struct wireless_dev *wdev;
13299 	unsigned int vcmd_idx;
13300 	const struct wiphy_vendor_command *vcmd;
13301 	void *data;
13302 	int data_len;
13303 	int err;
13304 	struct nlattr *vendor_data;
13305 
13306 	rtnl_lock();
13307 	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13308 	if (err)
13309 		goto out;
13310 
13311 	vcmd_idx = cb->args[2];
13312 	data = (void *)cb->args[3];
13313 	data_len = cb->args[4];
13314 	vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13315 
13316 	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13317 			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13318 		if (!wdev) {
13319 			err = -EINVAL;
13320 			goto out;
13321 		}
13322 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13323 		    !wdev->netdev) {
13324 			err = -EINVAL;
13325 			goto out;
13326 		}
13327 
13328 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13329 			if (!wdev_running(wdev)) {
13330 				err = -ENETDOWN;
13331 				goto out;
13332 			}
13333 		}
13334 	}
13335 
13336 	while (1) {
13337 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13338 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
13339 					   NL80211_CMD_VENDOR);
13340 		if (!hdr)
13341 			break;
13342 
13343 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13344 		    (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13345 					       wdev_id(wdev),
13346 					       NL80211_ATTR_PAD))) {
13347 			genlmsg_cancel(skb, hdr);
13348 			break;
13349 		}
13350 
13351 		vendor_data = nla_nest_start_noflag(skb,
13352 						    NL80211_ATTR_VENDOR_DATA);
13353 		if (!vendor_data) {
13354 			genlmsg_cancel(skb, hdr);
13355 			break;
13356 		}
13357 
13358 		err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
13359 				   (unsigned long *)&cb->args[5]);
13360 		nla_nest_end(skb, vendor_data);
13361 
13362 		if (err == -ENOBUFS || err == -ENOENT) {
13363 			genlmsg_cancel(skb, hdr);
13364 			break;
13365 		} else if (err) {
13366 			genlmsg_cancel(skb, hdr);
13367 			goto out;
13368 		}
13369 
13370 		genlmsg_end(skb, hdr);
13371 	}
13372 
13373 	err = skb->len;
13374  out:
13375 	rtnl_unlock();
13376 	return err;
13377 }
13378 
13379 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
13380 					   enum nl80211_commands cmd,
13381 					   enum nl80211_attrs attr,
13382 					   int approxlen)
13383 {
13384 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13385 
13386 	if (WARN_ON(!rdev->cur_cmd_info))
13387 		return NULL;
13388 
13389 	return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
13390 					   rdev->cur_cmd_info->snd_portid,
13391 					   rdev->cur_cmd_info->snd_seq,
13392 					   cmd, attr, NULL, GFP_KERNEL);
13393 }
13394 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
13395 
13396 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
13397 {
13398 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
13399 	void *hdr = ((void **)skb->cb)[1];
13400 	struct nlattr *data = ((void **)skb->cb)[2];
13401 
13402 	/* clear CB data for netlink core to own from now on */
13403 	memset(skb->cb, 0, sizeof(skb->cb));
13404 
13405 	if (WARN_ON(!rdev->cur_cmd_info)) {
13406 		kfree_skb(skb);
13407 		return -EINVAL;
13408 	}
13409 
13410 	nla_nest_end(skb, data);
13411 	genlmsg_end(skb, hdr);
13412 	return genlmsg_reply(skb, rdev->cur_cmd_info);
13413 }
13414 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
13415 
13416 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
13417 {
13418 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13419 
13420 	if (WARN_ON(!rdev->cur_cmd_info))
13421 		return 0;
13422 
13423 	return rdev->cur_cmd_info->snd_portid;
13424 }
13425 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
13426 
13427 static int nl80211_set_qos_map(struct sk_buff *skb,
13428 			       struct genl_info *info)
13429 {
13430 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13431 	struct cfg80211_qos_map *qos_map = NULL;
13432 	struct net_device *dev = info->user_ptr[1];
13433 	u8 *pos, len, num_des, des_len, des;
13434 	int ret;
13435 
13436 	if (!rdev->ops->set_qos_map)
13437 		return -EOPNOTSUPP;
13438 
13439 	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
13440 		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
13441 		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
13442 
13443 		if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
13444 		    len > IEEE80211_QOS_MAP_LEN_MAX)
13445 			return -EINVAL;
13446 
13447 		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
13448 		if (!qos_map)
13449 			return -ENOMEM;
13450 
13451 		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
13452 		if (num_des) {
13453 			des_len = num_des *
13454 				sizeof(struct cfg80211_dscp_exception);
13455 			memcpy(qos_map->dscp_exception, pos, des_len);
13456 			qos_map->num_des = num_des;
13457 			for (des = 0; des < num_des; des++) {
13458 				if (qos_map->dscp_exception[des].up > 7) {
13459 					kfree(qos_map);
13460 					return -EINVAL;
13461 				}
13462 			}
13463 			pos += des_len;
13464 		}
13465 		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
13466 	}
13467 
13468 	wdev_lock(dev->ieee80211_ptr);
13469 	ret = nl80211_key_allowed(dev->ieee80211_ptr);
13470 	if (!ret)
13471 		ret = rdev_set_qos_map(rdev, dev, qos_map);
13472 	wdev_unlock(dev->ieee80211_ptr);
13473 
13474 	kfree(qos_map);
13475 	return ret;
13476 }
13477 
13478 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
13479 {
13480 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13481 	struct net_device *dev = info->user_ptr[1];
13482 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13483 	const u8 *peer;
13484 	u8 tsid, up;
13485 	u16 admitted_time = 0;
13486 	int err;
13487 
13488 	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
13489 		return -EOPNOTSUPP;
13490 
13491 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
13492 	    !info->attrs[NL80211_ATTR_USER_PRIO])
13493 		return -EINVAL;
13494 
13495 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13496 	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
13497 
13498 	/* WMM uses TIDs 0-7 even for TSPEC */
13499 	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
13500 		/* TODO: handle 802.11 TSPEC/admission control
13501 		 * need more attributes for that (e.g. BA session requirement);
13502 		 * change the WMM adminssion test above to allow both then
13503 		 */
13504 		return -EINVAL;
13505 	}
13506 
13507 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13508 
13509 	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
13510 		admitted_time =
13511 			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
13512 		if (!admitted_time)
13513 			return -EINVAL;
13514 	}
13515 
13516 	wdev_lock(wdev);
13517 	switch (wdev->iftype) {
13518 	case NL80211_IFTYPE_STATION:
13519 	case NL80211_IFTYPE_P2P_CLIENT:
13520 		if (wdev->current_bss)
13521 			break;
13522 		err = -ENOTCONN;
13523 		goto out;
13524 	default:
13525 		err = -EOPNOTSUPP;
13526 		goto out;
13527 	}
13528 
13529 	err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
13530 
13531  out:
13532 	wdev_unlock(wdev);
13533 	return err;
13534 }
13535 
13536 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
13537 {
13538 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13539 	struct net_device *dev = info->user_ptr[1];
13540 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13541 	const u8 *peer;
13542 	u8 tsid;
13543 	int err;
13544 
13545 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
13546 		return -EINVAL;
13547 
13548 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
13549 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13550 
13551 	wdev_lock(wdev);
13552 	err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13553 	wdev_unlock(wdev);
13554 
13555 	return err;
13556 }
13557 
13558 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13559 				       struct genl_info *info)
13560 {
13561 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13562 	struct net_device *dev = info->user_ptr[1];
13563 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13564 	struct cfg80211_chan_def chandef = {};
13565 	const u8 *addr;
13566 	u8 oper_class;
13567 	int err;
13568 
13569 	if (!rdev->ops->tdls_channel_switch ||
13570 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13571 		return -EOPNOTSUPP;
13572 
13573 	switch (dev->ieee80211_ptr->iftype) {
13574 	case NL80211_IFTYPE_STATION:
13575 	case NL80211_IFTYPE_P2P_CLIENT:
13576 		break;
13577 	default:
13578 		return -EOPNOTSUPP;
13579 	}
13580 
13581 	if (!info->attrs[NL80211_ATTR_MAC] ||
13582 	    !info->attrs[NL80211_ATTR_OPER_CLASS])
13583 		return -EINVAL;
13584 
13585 	err = nl80211_parse_chandef(rdev, info, &chandef);
13586 	if (err)
13587 		return err;
13588 
13589 	/*
13590 	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13591 	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13592 	 * specification is not defined for them.
13593 	 */
13594 	if (chandef.chan->band == NL80211_BAND_2GHZ &&
13595 	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13596 	    chandef.width != NL80211_CHAN_WIDTH_20)
13597 		return -EINVAL;
13598 
13599 	/* we will be active on the TDLS link */
13600 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13601 					   wdev->iftype))
13602 		return -EINVAL;
13603 
13604 	/* don't allow switching to DFS channels */
13605 	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13606 		return -EINVAL;
13607 
13608 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13609 	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13610 
13611 	wdev_lock(wdev);
13612 	err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13613 	wdev_unlock(wdev);
13614 
13615 	return err;
13616 }
13617 
13618 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13619 					      struct genl_info *info)
13620 {
13621 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13622 	struct net_device *dev = info->user_ptr[1];
13623 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13624 	const u8 *addr;
13625 
13626 	if (!rdev->ops->tdls_channel_switch ||
13627 	    !rdev->ops->tdls_cancel_channel_switch ||
13628 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13629 		return -EOPNOTSUPP;
13630 
13631 	switch (dev->ieee80211_ptr->iftype) {
13632 	case NL80211_IFTYPE_STATION:
13633 	case NL80211_IFTYPE_P2P_CLIENT:
13634 		break;
13635 	default:
13636 		return -EOPNOTSUPP;
13637 	}
13638 
13639 	if (!info->attrs[NL80211_ATTR_MAC])
13640 		return -EINVAL;
13641 
13642 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13643 
13644 	wdev_lock(wdev);
13645 	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13646 	wdev_unlock(wdev);
13647 
13648 	return 0;
13649 }
13650 
13651 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13652 					    struct genl_info *info)
13653 {
13654 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13655 	struct net_device *dev = info->user_ptr[1];
13656 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13657 	const struct nlattr *nla;
13658 	bool enabled;
13659 
13660 	if (!rdev->ops->set_multicast_to_unicast)
13661 		return -EOPNOTSUPP;
13662 
13663 	if (wdev->iftype != NL80211_IFTYPE_AP &&
13664 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
13665 		return -EOPNOTSUPP;
13666 
13667 	nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13668 	enabled = nla_get_flag(nla);
13669 
13670 	return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13671 }
13672 
13673 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13674 {
13675 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13676 	struct net_device *dev = info->user_ptr[1];
13677 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13678 	struct cfg80211_pmk_conf pmk_conf = {};
13679 	int ret;
13680 
13681 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
13682 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13683 		return -EOPNOTSUPP;
13684 
13685 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
13686 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13687 		return -EOPNOTSUPP;
13688 
13689 	if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13690 		return -EINVAL;
13691 
13692 	wdev_lock(wdev);
13693 	if (!wdev->current_bss) {
13694 		ret = -ENOTCONN;
13695 		goto out;
13696 	}
13697 
13698 	pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13699 	if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13700 		ret = -EINVAL;
13701 		goto out;
13702 	}
13703 
13704 	pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13705 	pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13706 	if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13707 	    pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13708 		ret = -EINVAL;
13709 		goto out;
13710 	}
13711 
13712 	if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13713 		int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13714 
13715 		if (r0_name_len != WLAN_PMK_NAME_LEN) {
13716 			ret = -EINVAL;
13717 			goto out;
13718 		}
13719 
13720 		pmk_conf.pmk_r0_name =
13721 			nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13722 	}
13723 
13724 	ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13725 out:
13726 	wdev_unlock(wdev);
13727 	return ret;
13728 }
13729 
13730 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13731 {
13732 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13733 	struct net_device *dev = info->user_ptr[1];
13734 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13735 	const u8 *aa;
13736 	int ret;
13737 
13738 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
13739 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13740 		return -EOPNOTSUPP;
13741 
13742 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
13743 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13744 		return -EOPNOTSUPP;
13745 
13746 	if (!info->attrs[NL80211_ATTR_MAC])
13747 		return -EINVAL;
13748 
13749 	wdev_lock(wdev);
13750 	aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13751 	ret = rdev_del_pmk(rdev, dev, aa);
13752 	wdev_unlock(wdev);
13753 
13754 	return ret;
13755 }
13756 
13757 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13758 {
13759 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13760 	struct net_device *dev = info->user_ptr[1];
13761 	struct cfg80211_external_auth_params params;
13762 
13763 	if (!rdev->ops->external_auth)
13764 		return -EOPNOTSUPP;
13765 
13766 	if (!info->attrs[NL80211_ATTR_SSID] &&
13767 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13768 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13769 		return -EINVAL;
13770 
13771 	if (!info->attrs[NL80211_ATTR_BSSID])
13772 		return -EINVAL;
13773 
13774 	if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13775 		return -EINVAL;
13776 
13777 	memset(&params, 0, sizeof(params));
13778 
13779 	if (info->attrs[NL80211_ATTR_SSID]) {
13780 		params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13781 		if (params.ssid.ssid_len == 0 ||
13782 		    params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13783 			return -EINVAL;
13784 		memcpy(params.ssid.ssid,
13785 		       nla_data(info->attrs[NL80211_ATTR_SSID]),
13786 		       params.ssid.ssid_len);
13787 	}
13788 
13789 	memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13790 	       ETH_ALEN);
13791 
13792 	params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13793 
13794 	if (info->attrs[NL80211_ATTR_PMKID])
13795 		params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13796 
13797 	return rdev_external_auth(rdev, dev, &params);
13798 }
13799 
13800 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13801 {
13802 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13803 	struct net_device *dev = info->user_ptr[1];
13804 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13805 	const u8 *buf;
13806 	size_t len;
13807 	u8 *dest;
13808 	u16 proto;
13809 	bool noencrypt;
13810 	int err;
13811 
13812 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
13813 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13814 		return -EOPNOTSUPP;
13815 
13816 	if (!rdev->ops->tx_control_port)
13817 		return -EOPNOTSUPP;
13818 
13819 	if (!info->attrs[NL80211_ATTR_FRAME] ||
13820 	    !info->attrs[NL80211_ATTR_MAC] ||
13821 	    !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13822 		GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13823 		return -EINVAL;
13824 	}
13825 
13826 	wdev_lock(wdev);
13827 
13828 	switch (wdev->iftype) {
13829 	case NL80211_IFTYPE_AP:
13830 	case NL80211_IFTYPE_P2P_GO:
13831 	case NL80211_IFTYPE_MESH_POINT:
13832 		break;
13833 	case NL80211_IFTYPE_ADHOC:
13834 	case NL80211_IFTYPE_STATION:
13835 	case NL80211_IFTYPE_P2P_CLIENT:
13836 		if (wdev->current_bss)
13837 			break;
13838 		err = -ENOTCONN;
13839 		goto out;
13840 	default:
13841 		err = -EOPNOTSUPP;
13842 		goto out;
13843 	}
13844 
13845 	wdev_unlock(wdev);
13846 
13847 	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13848 	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13849 	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13850 	proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13851 	noencrypt =
13852 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13853 
13854 	return rdev_tx_control_port(rdev, dev, buf, len,
13855 				    dest, cpu_to_be16(proto), noencrypt);
13856 
13857  out:
13858 	wdev_unlock(wdev);
13859 	return err;
13860 }
13861 
13862 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13863 					   struct genl_info *info)
13864 {
13865 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13866 	struct net_device *dev = info->user_ptr[1];
13867 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13868 	struct cfg80211_ftm_responder_stats ftm_stats = {};
13869 	struct sk_buff *msg;
13870 	void *hdr;
13871 	struct nlattr *ftm_stats_attr;
13872 	int err;
13873 
13874 	if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13875 		return -EOPNOTSUPP;
13876 
13877 	err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13878 	if (err)
13879 		return err;
13880 
13881 	if (!ftm_stats.filled)
13882 		return -ENODATA;
13883 
13884 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13885 	if (!msg)
13886 		return -ENOMEM;
13887 
13888 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13889 			     NL80211_CMD_GET_FTM_RESPONDER_STATS);
13890 	if (!hdr)
13891 		goto nla_put_failure;
13892 
13893 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13894 		goto nla_put_failure;
13895 
13896 	ftm_stats_attr = nla_nest_start_noflag(msg,
13897 					       NL80211_ATTR_FTM_RESPONDER_STATS);
13898 	if (!ftm_stats_attr)
13899 		goto nla_put_failure;
13900 
13901 #define SET_FTM(field, name, type)					 \
13902 	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13903 	    nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,		 \
13904 			     ftm_stats.field))				 \
13905 		goto nla_put_failure; } while (0)
13906 #define SET_FTM_U64(field, name)					 \
13907 	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13908 	    nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,		 \
13909 			      ftm_stats.field, NL80211_FTM_STATS_PAD))	 \
13910 		goto nla_put_failure; } while (0)
13911 
13912 	SET_FTM(success_num, SUCCESS_NUM, u32);
13913 	SET_FTM(partial_num, PARTIAL_NUM, u32);
13914 	SET_FTM(failed_num, FAILED_NUM, u32);
13915 	SET_FTM(asap_num, ASAP_NUM, u32);
13916 	SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13917 	SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13918 	SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13919 	SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13920 	SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13921 #undef SET_FTM
13922 
13923 	nla_nest_end(msg, ftm_stats_attr);
13924 
13925 	genlmsg_end(msg, hdr);
13926 	return genlmsg_reply(msg, info);
13927 
13928 nla_put_failure:
13929 	nlmsg_free(msg);
13930 	return -ENOBUFS;
13931 }
13932 
13933 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13934 {
13935 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13936 	struct cfg80211_update_owe_info owe_info;
13937 	struct net_device *dev = info->user_ptr[1];
13938 
13939 	if (!rdev->ops->update_owe_info)
13940 		return -EOPNOTSUPP;
13941 
13942 	if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13943 	    !info->attrs[NL80211_ATTR_MAC])
13944 		return -EINVAL;
13945 
13946 	memset(&owe_info, 0, sizeof(owe_info));
13947 	owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13948 	nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13949 
13950 	if (info->attrs[NL80211_ATTR_IE]) {
13951 		owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13952 		owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13953 	}
13954 
13955 	return rdev_update_owe_info(rdev, dev, &owe_info);
13956 }
13957 
13958 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
13959 {
13960 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13961 	struct net_device *dev = info->user_ptr[1];
13962 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13963 	struct station_info sinfo = {};
13964 	const u8 *buf;
13965 	size_t len;
13966 	u8 *dest;
13967 	int err;
13968 
13969 	if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
13970 		return -EOPNOTSUPP;
13971 
13972 	if (!info->attrs[NL80211_ATTR_MAC] ||
13973 	    !info->attrs[NL80211_ATTR_FRAME]) {
13974 		GENL_SET_ERR_MSG(info, "Frame or MAC missing");
13975 		return -EINVAL;
13976 	}
13977 
13978 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
13979 		return -EOPNOTSUPP;
13980 
13981 	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13982 	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13983 	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13984 
13985 	if (len < sizeof(struct ethhdr))
13986 		return -EINVAL;
13987 
13988 	if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
13989 	    !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
13990 		return -EINVAL;
13991 
13992 	err = rdev_get_station(rdev, dev, dest, &sinfo);
13993 	if (err)
13994 		return err;
13995 
13996 	cfg80211_sinfo_release_content(&sinfo);
13997 
13998 	return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
13999 }
14000 
14001 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14002 			  struct nlattr *attrs[], struct net_device *dev,
14003 			  struct cfg80211_tid_cfg *tid_conf,
14004 			  struct genl_info *info, const u8 *peer)
14005 {
14006 	struct netlink_ext_ack *extack = info->extack;
14007 	u64 mask;
14008 	int err;
14009 
14010 	if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14011 		return -EINVAL;
14012 
14013 	tid_conf->config_override =
14014 			nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14015 	tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14016 
14017 	if (tid_conf->config_override) {
14018 		if (rdev->ops->reset_tid_config) {
14019 			err = rdev_reset_tid_config(rdev, dev, peer,
14020 						    tid_conf->tids);
14021 			/* If peer is there no other configuration will be
14022 			 * allowed
14023 			 */
14024 			if (err || peer)
14025 				return err;
14026 		} else {
14027 			return -EINVAL;
14028 		}
14029 	}
14030 
14031 	if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14032 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14033 		tid_conf->noack =
14034 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14035 	}
14036 
14037 	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14038 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14039 		tid_conf->retry_short =
14040 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14041 
14042 		if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14043 			return -EINVAL;
14044 	}
14045 
14046 	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14047 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14048 		tid_conf->retry_long =
14049 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14050 
14051 		if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14052 			return -EINVAL;
14053 	}
14054 
14055 	if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14056 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14057 		tid_conf->ampdu =
14058 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14059 	}
14060 
14061 	if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14062 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14063 		tid_conf->rtscts =
14064 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14065 	}
14066 
14067 	if (peer)
14068 		mask = rdev->wiphy.tid_config_support.peer;
14069 	else
14070 		mask = rdev->wiphy.tid_config_support.vif;
14071 
14072 	if (tid_conf->mask & ~mask) {
14073 		NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14074 		return -ENOTSUPP;
14075 	}
14076 
14077 	return 0;
14078 }
14079 
14080 static int nl80211_set_tid_config(struct sk_buff *skb,
14081 				  struct genl_info *info)
14082 {
14083 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14084 	struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14085 	struct net_device *dev = info->user_ptr[1];
14086 	struct cfg80211_tid_config *tid_config;
14087 	struct nlattr *tid;
14088 	int conf_idx = 0, rem_conf;
14089 	int ret = -EINVAL;
14090 	u32 num_conf = 0;
14091 
14092 	if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14093 		return -EINVAL;
14094 
14095 	if (!rdev->ops->set_tid_config)
14096 		return -EOPNOTSUPP;
14097 
14098 	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14099 			    rem_conf)
14100 		num_conf++;
14101 
14102 	tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14103 			     GFP_KERNEL);
14104 	if (!tid_config)
14105 		return -ENOMEM;
14106 
14107 	tid_config->n_tid_conf = num_conf;
14108 
14109 	if (info->attrs[NL80211_ATTR_MAC])
14110 		tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14111 
14112 	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14113 			    rem_conf) {
14114 		ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14115 				       tid, NULL, NULL);
14116 
14117 		if (ret)
14118 			goto bad_tid_conf;
14119 
14120 		ret = parse_tid_conf(rdev, attrs, dev,
14121 				     &tid_config->tid_conf[conf_idx],
14122 				     info, tid_config->peer);
14123 		if (ret)
14124 			goto bad_tid_conf;
14125 
14126 		conf_idx++;
14127 	}
14128 
14129 	ret = rdev_set_tid_config(rdev, dev, tid_config);
14130 
14131 bad_tid_conf:
14132 	kfree(tid_config);
14133 	return ret;
14134 }
14135 
14136 #define NL80211_FLAG_NEED_WIPHY		0x01
14137 #define NL80211_FLAG_NEED_NETDEV	0x02
14138 #define NL80211_FLAG_NEED_RTNL		0x04
14139 #define NL80211_FLAG_CHECK_NETDEV_UP	0x08
14140 #define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
14141 					 NL80211_FLAG_CHECK_NETDEV_UP)
14142 #define NL80211_FLAG_NEED_WDEV		0x10
14143 /* If a netdev is associated, it must be UP, P2P must be started */
14144 #define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
14145 					 NL80211_FLAG_CHECK_NETDEV_UP)
14146 #define NL80211_FLAG_CLEAR_SKB		0x20
14147 
14148 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14149 			    struct genl_info *info)
14150 {
14151 	struct cfg80211_registered_device *rdev;
14152 	struct wireless_dev *wdev;
14153 	struct net_device *dev;
14154 	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
14155 
14156 	if (rtnl)
14157 		rtnl_lock();
14158 
14159 	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14160 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14161 		if (IS_ERR(rdev)) {
14162 			if (rtnl)
14163 				rtnl_unlock();
14164 			return PTR_ERR(rdev);
14165 		}
14166 		info->user_ptr[0] = rdev;
14167 	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14168 		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14169 		ASSERT_RTNL();
14170 
14171 		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
14172 						  info->attrs);
14173 		if (IS_ERR(wdev)) {
14174 			if (rtnl)
14175 				rtnl_unlock();
14176 			return PTR_ERR(wdev);
14177 		}
14178 
14179 		dev = wdev->netdev;
14180 		rdev = wiphy_to_rdev(wdev->wiphy);
14181 
14182 		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14183 			if (!dev) {
14184 				if (rtnl)
14185 					rtnl_unlock();
14186 				return -EINVAL;
14187 			}
14188 
14189 			info->user_ptr[1] = dev;
14190 		} else {
14191 			info->user_ptr[1] = wdev;
14192 		}
14193 
14194 		if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14195 		    !wdev_running(wdev)) {
14196 			if (rtnl)
14197 				rtnl_unlock();
14198 			return -ENETDOWN;
14199 		}
14200 
14201 		if (dev)
14202 			dev_hold(dev);
14203 
14204 		info->user_ptr[0] = rdev;
14205 	}
14206 
14207 	return 0;
14208 }
14209 
14210 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
14211 			      struct genl_info *info)
14212 {
14213 	if (info->user_ptr[1]) {
14214 		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14215 			struct wireless_dev *wdev = info->user_ptr[1];
14216 
14217 			if (wdev->netdev)
14218 				dev_put(wdev->netdev);
14219 		} else {
14220 			dev_put(info->user_ptr[1]);
14221 		}
14222 	}
14223 
14224 	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
14225 		rtnl_unlock();
14226 
14227 	/* If needed, clear the netlink message payload from the SKB
14228 	 * as it might contain key data that shouldn't stick around on
14229 	 * the heap after the SKB is freed. The netlink message header
14230 	 * is still needed for further processing, so leave it intact.
14231 	 */
14232 	if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
14233 		struct nlmsghdr *nlh = nlmsg_hdr(skb);
14234 
14235 		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
14236 	}
14237 }
14238 
14239 static const struct genl_ops nl80211_ops[] = {
14240 	{
14241 		.cmd = NL80211_CMD_GET_WIPHY,
14242 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14243 		.doit = nl80211_get_wiphy,
14244 		.dumpit = nl80211_dump_wiphy,
14245 		.done = nl80211_dump_wiphy_done,
14246 		/* can be retrieved by unprivileged users */
14247 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14248 				  NL80211_FLAG_NEED_RTNL,
14249 	},
14250 	{
14251 		.cmd = NL80211_CMD_SET_WIPHY,
14252 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14253 		.doit = nl80211_set_wiphy,
14254 		.flags = GENL_UNS_ADMIN_PERM,
14255 		.internal_flags = NL80211_FLAG_NEED_RTNL,
14256 	},
14257 	{
14258 		.cmd = NL80211_CMD_GET_INTERFACE,
14259 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14260 		.doit = nl80211_get_interface,
14261 		.dumpit = nl80211_dump_interface,
14262 		/* can be retrieved by unprivileged users */
14263 		.internal_flags = NL80211_FLAG_NEED_WDEV |
14264 				  NL80211_FLAG_NEED_RTNL,
14265 	},
14266 	{
14267 		.cmd = NL80211_CMD_SET_INTERFACE,
14268 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14269 		.doit = nl80211_set_interface,
14270 		.flags = GENL_UNS_ADMIN_PERM,
14271 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14272 				  NL80211_FLAG_NEED_RTNL,
14273 	},
14274 	{
14275 		.cmd = NL80211_CMD_NEW_INTERFACE,
14276 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14277 		.doit = nl80211_new_interface,
14278 		.flags = GENL_UNS_ADMIN_PERM,
14279 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14280 				  NL80211_FLAG_NEED_RTNL,
14281 	},
14282 	{
14283 		.cmd = NL80211_CMD_DEL_INTERFACE,
14284 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14285 		.doit = nl80211_del_interface,
14286 		.flags = GENL_UNS_ADMIN_PERM,
14287 		.internal_flags = NL80211_FLAG_NEED_WDEV |
14288 				  NL80211_FLAG_NEED_RTNL,
14289 	},
14290 	{
14291 		.cmd = NL80211_CMD_GET_KEY,
14292 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14293 		.doit = nl80211_get_key,
14294 		.flags = GENL_UNS_ADMIN_PERM,
14295 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14296 				  NL80211_FLAG_NEED_RTNL,
14297 	},
14298 	{
14299 		.cmd = NL80211_CMD_SET_KEY,
14300 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14301 		.doit = nl80211_set_key,
14302 		.flags = GENL_UNS_ADMIN_PERM,
14303 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14304 				  NL80211_FLAG_NEED_RTNL |
14305 				  NL80211_FLAG_CLEAR_SKB,
14306 	},
14307 	{
14308 		.cmd = NL80211_CMD_NEW_KEY,
14309 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14310 		.doit = nl80211_new_key,
14311 		.flags = GENL_UNS_ADMIN_PERM,
14312 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14313 				  NL80211_FLAG_NEED_RTNL |
14314 				  NL80211_FLAG_CLEAR_SKB,
14315 	},
14316 	{
14317 		.cmd = NL80211_CMD_DEL_KEY,
14318 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14319 		.doit = nl80211_del_key,
14320 		.flags = GENL_UNS_ADMIN_PERM,
14321 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14322 				  NL80211_FLAG_NEED_RTNL,
14323 	},
14324 	{
14325 		.cmd = NL80211_CMD_SET_BEACON,
14326 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14327 		.flags = GENL_UNS_ADMIN_PERM,
14328 		.doit = nl80211_set_beacon,
14329 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14330 				  NL80211_FLAG_NEED_RTNL,
14331 	},
14332 	{
14333 		.cmd = NL80211_CMD_START_AP,
14334 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14335 		.flags = GENL_UNS_ADMIN_PERM,
14336 		.doit = nl80211_start_ap,
14337 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14338 				  NL80211_FLAG_NEED_RTNL,
14339 	},
14340 	{
14341 		.cmd = NL80211_CMD_STOP_AP,
14342 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14343 		.flags = GENL_UNS_ADMIN_PERM,
14344 		.doit = nl80211_stop_ap,
14345 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14346 				  NL80211_FLAG_NEED_RTNL,
14347 	},
14348 	{
14349 		.cmd = NL80211_CMD_GET_STATION,
14350 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14351 		.doit = nl80211_get_station,
14352 		.dumpit = nl80211_dump_station,
14353 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14354 				  NL80211_FLAG_NEED_RTNL,
14355 	},
14356 	{
14357 		.cmd = NL80211_CMD_SET_STATION,
14358 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14359 		.doit = nl80211_set_station,
14360 		.flags = GENL_UNS_ADMIN_PERM,
14361 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14362 				  NL80211_FLAG_NEED_RTNL,
14363 	},
14364 	{
14365 		.cmd = NL80211_CMD_NEW_STATION,
14366 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14367 		.doit = nl80211_new_station,
14368 		.flags = GENL_UNS_ADMIN_PERM,
14369 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14370 				  NL80211_FLAG_NEED_RTNL,
14371 	},
14372 	{
14373 		.cmd = NL80211_CMD_DEL_STATION,
14374 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14375 		.doit = nl80211_del_station,
14376 		.flags = GENL_UNS_ADMIN_PERM,
14377 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14378 				  NL80211_FLAG_NEED_RTNL,
14379 	},
14380 	{
14381 		.cmd = NL80211_CMD_GET_MPATH,
14382 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14383 		.doit = nl80211_get_mpath,
14384 		.dumpit = nl80211_dump_mpath,
14385 		.flags = GENL_UNS_ADMIN_PERM,
14386 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14387 				  NL80211_FLAG_NEED_RTNL,
14388 	},
14389 	{
14390 		.cmd = NL80211_CMD_GET_MPP,
14391 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14392 		.doit = nl80211_get_mpp,
14393 		.dumpit = nl80211_dump_mpp,
14394 		.flags = GENL_UNS_ADMIN_PERM,
14395 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14396 				  NL80211_FLAG_NEED_RTNL,
14397 	},
14398 	{
14399 		.cmd = NL80211_CMD_SET_MPATH,
14400 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14401 		.doit = nl80211_set_mpath,
14402 		.flags = GENL_UNS_ADMIN_PERM,
14403 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14404 				  NL80211_FLAG_NEED_RTNL,
14405 	},
14406 	{
14407 		.cmd = NL80211_CMD_NEW_MPATH,
14408 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14409 		.doit = nl80211_new_mpath,
14410 		.flags = GENL_UNS_ADMIN_PERM,
14411 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14412 				  NL80211_FLAG_NEED_RTNL,
14413 	},
14414 	{
14415 		.cmd = NL80211_CMD_DEL_MPATH,
14416 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14417 		.doit = nl80211_del_mpath,
14418 		.flags = GENL_UNS_ADMIN_PERM,
14419 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14420 				  NL80211_FLAG_NEED_RTNL,
14421 	},
14422 	{
14423 		.cmd = NL80211_CMD_SET_BSS,
14424 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14425 		.doit = nl80211_set_bss,
14426 		.flags = GENL_UNS_ADMIN_PERM,
14427 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14428 				  NL80211_FLAG_NEED_RTNL,
14429 	},
14430 	{
14431 		.cmd = NL80211_CMD_GET_REG,
14432 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14433 		.doit = nl80211_get_reg_do,
14434 		.dumpit = nl80211_get_reg_dump,
14435 		.internal_flags = NL80211_FLAG_NEED_RTNL,
14436 		/* can be retrieved by unprivileged users */
14437 	},
14438 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
14439 	{
14440 		.cmd = NL80211_CMD_SET_REG,
14441 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14442 		.doit = nl80211_set_reg,
14443 		.flags = GENL_ADMIN_PERM,
14444 		.internal_flags = NL80211_FLAG_NEED_RTNL,
14445 	},
14446 #endif
14447 	{
14448 		.cmd = NL80211_CMD_REQ_SET_REG,
14449 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14450 		.doit = nl80211_req_set_reg,
14451 		.flags = GENL_ADMIN_PERM,
14452 	},
14453 	{
14454 		.cmd = NL80211_CMD_RELOAD_REGDB,
14455 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14456 		.doit = nl80211_reload_regdb,
14457 		.flags = GENL_ADMIN_PERM,
14458 	},
14459 	{
14460 		.cmd = NL80211_CMD_GET_MESH_CONFIG,
14461 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14462 		.doit = nl80211_get_mesh_config,
14463 		/* can be retrieved by unprivileged users */
14464 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14465 				  NL80211_FLAG_NEED_RTNL,
14466 	},
14467 	{
14468 		.cmd = NL80211_CMD_SET_MESH_CONFIG,
14469 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14470 		.doit = nl80211_update_mesh_config,
14471 		.flags = GENL_UNS_ADMIN_PERM,
14472 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14473 				  NL80211_FLAG_NEED_RTNL,
14474 	},
14475 	{
14476 		.cmd = NL80211_CMD_TRIGGER_SCAN,
14477 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14478 		.doit = nl80211_trigger_scan,
14479 		.flags = GENL_UNS_ADMIN_PERM,
14480 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14481 				  NL80211_FLAG_NEED_RTNL,
14482 	},
14483 	{
14484 		.cmd = NL80211_CMD_ABORT_SCAN,
14485 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14486 		.doit = nl80211_abort_scan,
14487 		.flags = GENL_UNS_ADMIN_PERM,
14488 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14489 				  NL80211_FLAG_NEED_RTNL,
14490 	},
14491 	{
14492 		.cmd = NL80211_CMD_GET_SCAN,
14493 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14494 		.dumpit = nl80211_dump_scan,
14495 	},
14496 	{
14497 		.cmd = NL80211_CMD_START_SCHED_SCAN,
14498 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14499 		.doit = nl80211_start_sched_scan,
14500 		.flags = GENL_UNS_ADMIN_PERM,
14501 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14502 				  NL80211_FLAG_NEED_RTNL,
14503 	},
14504 	{
14505 		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
14506 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14507 		.doit = nl80211_stop_sched_scan,
14508 		.flags = GENL_UNS_ADMIN_PERM,
14509 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14510 				  NL80211_FLAG_NEED_RTNL,
14511 	},
14512 	{
14513 		.cmd = NL80211_CMD_AUTHENTICATE,
14514 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14515 		.doit = nl80211_authenticate,
14516 		.flags = GENL_UNS_ADMIN_PERM,
14517 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14518 				  NL80211_FLAG_NEED_RTNL |
14519 				  NL80211_FLAG_CLEAR_SKB,
14520 	},
14521 	{
14522 		.cmd = NL80211_CMD_ASSOCIATE,
14523 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14524 		.doit = nl80211_associate,
14525 		.flags = GENL_UNS_ADMIN_PERM,
14526 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14527 				  NL80211_FLAG_NEED_RTNL |
14528 				  NL80211_FLAG_CLEAR_SKB,
14529 	},
14530 	{
14531 		.cmd = NL80211_CMD_DEAUTHENTICATE,
14532 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14533 		.doit = nl80211_deauthenticate,
14534 		.flags = GENL_UNS_ADMIN_PERM,
14535 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14536 				  NL80211_FLAG_NEED_RTNL,
14537 	},
14538 	{
14539 		.cmd = NL80211_CMD_DISASSOCIATE,
14540 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14541 		.doit = nl80211_disassociate,
14542 		.flags = GENL_UNS_ADMIN_PERM,
14543 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14544 				  NL80211_FLAG_NEED_RTNL,
14545 	},
14546 	{
14547 		.cmd = NL80211_CMD_JOIN_IBSS,
14548 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14549 		.doit = nl80211_join_ibss,
14550 		.flags = GENL_UNS_ADMIN_PERM,
14551 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14552 				  NL80211_FLAG_NEED_RTNL,
14553 	},
14554 	{
14555 		.cmd = NL80211_CMD_LEAVE_IBSS,
14556 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14557 		.doit = nl80211_leave_ibss,
14558 		.flags = GENL_UNS_ADMIN_PERM,
14559 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14560 				  NL80211_FLAG_NEED_RTNL,
14561 	},
14562 #ifdef CONFIG_NL80211_TESTMODE
14563 	{
14564 		.cmd = NL80211_CMD_TESTMODE,
14565 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14566 		.doit = nl80211_testmode_do,
14567 		.dumpit = nl80211_testmode_dump,
14568 		.flags = GENL_UNS_ADMIN_PERM,
14569 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14570 				  NL80211_FLAG_NEED_RTNL,
14571 	},
14572 #endif
14573 	{
14574 		.cmd = NL80211_CMD_CONNECT,
14575 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14576 		.doit = nl80211_connect,
14577 		.flags = GENL_UNS_ADMIN_PERM,
14578 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14579 				  NL80211_FLAG_NEED_RTNL |
14580 				  NL80211_FLAG_CLEAR_SKB,
14581 	},
14582 	{
14583 		.cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
14584 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14585 		.doit = nl80211_update_connect_params,
14586 		.flags = GENL_ADMIN_PERM,
14587 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14588 				  NL80211_FLAG_NEED_RTNL |
14589 				  NL80211_FLAG_CLEAR_SKB,
14590 	},
14591 	{
14592 		.cmd = NL80211_CMD_DISCONNECT,
14593 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14594 		.doit = nl80211_disconnect,
14595 		.flags = GENL_UNS_ADMIN_PERM,
14596 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14597 				  NL80211_FLAG_NEED_RTNL,
14598 	},
14599 	{
14600 		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
14601 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14602 		.doit = nl80211_wiphy_netns,
14603 		.flags = GENL_UNS_ADMIN_PERM,
14604 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14605 				  NL80211_FLAG_NEED_RTNL,
14606 	},
14607 	{
14608 		.cmd = NL80211_CMD_GET_SURVEY,
14609 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14610 		.dumpit = nl80211_dump_survey,
14611 	},
14612 	{
14613 		.cmd = NL80211_CMD_SET_PMKSA,
14614 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14615 		.doit = nl80211_setdel_pmksa,
14616 		.flags = GENL_UNS_ADMIN_PERM,
14617 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14618 				  NL80211_FLAG_NEED_RTNL |
14619 				  NL80211_FLAG_CLEAR_SKB,
14620 	},
14621 	{
14622 		.cmd = NL80211_CMD_DEL_PMKSA,
14623 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14624 		.doit = nl80211_setdel_pmksa,
14625 		.flags = GENL_UNS_ADMIN_PERM,
14626 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14627 				  NL80211_FLAG_NEED_RTNL,
14628 	},
14629 	{
14630 		.cmd = NL80211_CMD_FLUSH_PMKSA,
14631 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14632 		.doit = nl80211_flush_pmksa,
14633 		.flags = GENL_UNS_ADMIN_PERM,
14634 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14635 				  NL80211_FLAG_NEED_RTNL,
14636 	},
14637 	{
14638 		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
14639 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14640 		.doit = nl80211_remain_on_channel,
14641 		.flags = GENL_UNS_ADMIN_PERM,
14642 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14643 				  NL80211_FLAG_NEED_RTNL,
14644 	},
14645 	{
14646 		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14647 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14648 		.doit = nl80211_cancel_remain_on_channel,
14649 		.flags = GENL_UNS_ADMIN_PERM,
14650 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14651 				  NL80211_FLAG_NEED_RTNL,
14652 	},
14653 	{
14654 		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
14655 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14656 		.doit = nl80211_set_tx_bitrate_mask,
14657 		.flags = GENL_UNS_ADMIN_PERM,
14658 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14659 				  NL80211_FLAG_NEED_RTNL,
14660 	},
14661 	{
14662 		.cmd = NL80211_CMD_REGISTER_FRAME,
14663 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14664 		.doit = nl80211_register_mgmt,
14665 		.flags = GENL_UNS_ADMIN_PERM,
14666 		.internal_flags = NL80211_FLAG_NEED_WDEV |
14667 				  NL80211_FLAG_NEED_RTNL,
14668 	},
14669 	{
14670 		.cmd = NL80211_CMD_FRAME,
14671 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14672 		.doit = nl80211_tx_mgmt,
14673 		.flags = GENL_UNS_ADMIN_PERM,
14674 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14675 				  NL80211_FLAG_NEED_RTNL,
14676 	},
14677 	{
14678 		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
14679 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14680 		.doit = nl80211_tx_mgmt_cancel_wait,
14681 		.flags = GENL_UNS_ADMIN_PERM,
14682 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14683 				  NL80211_FLAG_NEED_RTNL,
14684 	},
14685 	{
14686 		.cmd = NL80211_CMD_SET_POWER_SAVE,
14687 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14688 		.doit = nl80211_set_power_save,
14689 		.flags = GENL_UNS_ADMIN_PERM,
14690 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14691 				  NL80211_FLAG_NEED_RTNL,
14692 	},
14693 	{
14694 		.cmd = NL80211_CMD_GET_POWER_SAVE,
14695 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14696 		.doit = nl80211_get_power_save,
14697 		/* can be retrieved by unprivileged users */
14698 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14699 				  NL80211_FLAG_NEED_RTNL,
14700 	},
14701 	{
14702 		.cmd = NL80211_CMD_SET_CQM,
14703 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14704 		.doit = nl80211_set_cqm,
14705 		.flags = GENL_UNS_ADMIN_PERM,
14706 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14707 				  NL80211_FLAG_NEED_RTNL,
14708 	},
14709 	{
14710 		.cmd = NL80211_CMD_SET_CHANNEL,
14711 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14712 		.doit = nl80211_set_channel,
14713 		.flags = GENL_UNS_ADMIN_PERM,
14714 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14715 				  NL80211_FLAG_NEED_RTNL,
14716 	},
14717 	{
14718 		.cmd = NL80211_CMD_SET_WDS_PEER,
14719 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14720 		.doit = nl80211_set_wds_peer,
14721 		.flags = GENL_UNS_ADMIN_PERM,
14722 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14723 				  NL80211_FLAG_NEED_RTNL,
14724 	},
14725 	{
14726 		.cmd = NL80211_CMD_JOIN_MESH,
14727 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14728 		.doit = nl80211_join_mesh,
14729 		.flags = GENL_UNS_ADMIN_PERM,
14730 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14731 				  NL80211_FLAG_NEED_RTNL,
14732 	},
14733 	{
14734 		.cmd = NL80211_CMD_LEAVE_MESH,
14735 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14736 		.doit = nl80211_leave_mesh,
14737 		.flags = GENL_UNS_ADMIN_PERM,
14738 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14739 				  NL80211_FLAG_NEED_RTNL,
14740 	},
14741 	{
14742 		.cmd = NL80211_CMD_JOIN_OCB,
14743 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14744 		.doit = nl80211_join_ocb,
14745 		.flags = GENL_UNS_ADMIN_PERM,
14746 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14747 				  NL80211_FLAG_NEED_RTNL,
14748 	},
14749 	{
14750 		.cmd = NL80211_CMD_LEAVE_OCB,
14751 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14752 		.doit = nl80211_leave_ocb,
14753 		.flags = GENL_UNS_ADMIN_PERM,
14754 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14755 				  NL80211_FLAG_NEED_RTNL,
14756 	},
14757 #ifdef CONFIG_PM
14758 	{
14759 		.cmd = NL80211_CMD_GET_WOWLAN,
14760 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14761 		.doit = nl80211_get_wowlan,
14762 		/* can be retrieved by unprivileged users */
14763 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14764 				  NL80211_FLAG_NEED_RTNL,
14765 	},
14766 	{
14767 		.cmd = NL80211_CMD_SET_WOWLAN,
14768 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14769 		.doit = nl80211_set_wowlan,
14770 		.flags = GENL_UNS_ADMIN_PERM,
14771 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14772 				  NL80211_FLAG_NEED_RTNL,
14773 	},
14774 #endif
14775 	{
14776 		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
14777 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14778 		.doit = nl80211_set_rekey_data,
14779 		.flags = GENL_UNS_ADMIN_PERM,
14780 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14781 				  NL80211_FLAG_NEED_RTNL |
14782 				  NL80211_FLAG_CLEAR_SKB,
14783 	},
14784 	{
14785 		.cmd = NL80211_CMD_TDLS_MGMT,
14786 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14787 		.doit = nl80211_tdls_mgmt,
14788 		.flags = GENL_UNS_ADMIN_PERM,
14789 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14790 				  NL80211_FLAG_NEED_RTNL,
14791 	},
14792 	{
14793 		.cmd = NL80211_CMD_TDLS_OPER,
14794 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14795 		.doit = nl80211_tdls_oper,
14796 		.flags = GENL_UNS_ADMIN_PERM,
14797 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14798 				  NL80211_FLAG_NEED_RTNL,
14799 	},
14800 	{
14801 		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
14802 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14803 		.doit = nl80211_register_unexpected_frame,
14804 		.flags = GENL_UNS_ADMIN_PERM,
14805 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14806 				  NL80211_FLAG_NEED_RTNL,
14807 	},
14808 	{
14809 		.cmd = NL80211_CMD_PROBE_CLIENT,
14810 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14811 		.doit = nl80211_probe_client,
14812 		.flags = GENL_UNS_ADMIN_PERM,
14813 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14814 				  NL80211_FLAG_NEED_RTNL,
14815 	},
14816 	{
14817 		.cmd = NL80211_CMD_REGISTER_BEACONS,
14818 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14819 		.doit = nl80211_register_beacons,
14820 		.flags = GENL_UNS_ADMIN_PERM,
14821 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14822 				  NL80211_FLAG_NEED_RTNL,
14823 	},
14824 	{
14825 		.cmd = NL80211_CMD_SET_NOACK_MAP,
14826 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14827 		.doit = nl80211_set_noack_map,
14828 		.flags = GENL_UNS_ADMIN_PERM,
14829 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14830 				  NL80211_FLAG_NEED_RTNL,
14831 	},
14832 	{
14833 		.cmd = NL80211_CMD_START_P2P_DEVICE,
14834 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14835 		.doit = nl80211_start_p2p_device,
14836 		.flags = GENL_UNS_ADMIN_PERM,
14837 		.internal_flags = NL80211_FLAG_NEED_WDEV |
14838 				  NL80211_FLAG_NEED_RTNL,
14839 	},
14840 	{
14841 		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
14842 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14843 		.doit = nl80211_stop_p2p_device,
14844 		.flags = GENL_UNS_ADMIN_PERM,
14845 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14846 				  NL80211_FLAG_NEED_RTNL,
14847 	},
14848 	{
14849 		.cmd = NL80211_CMD_START_NAN,
14850 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14851 		.doit = nl80211_start_nan,
14852 		.flags = GENL_ADMIN_PERM,
14853 		.internal_flags = NL80211_FLAG_NEED_WDEV |
14854 				  NL80211_FLAG_NEED_RTNL,
14855 	},
14856 	{
14857 		.cmd = NL80211_CMD_STOP_NAN,
14858 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14859 		.doit = nl80211_stop_nan,
14860 		.flags = GENL_ADMIN_PERM,
14861 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14862 				  NL80211_FLAG_NEED_RTNL,
14863 	},
14864 	{
14865 		.cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14866 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14867 		.doit = nl80211_nan_add_func,
14868 		.flags = GENL_ADMIN_PERM,
14869 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14870 				  NL80211_FLAG_NEED_RTNL,
14871 	},
14872 	{
14873 		.cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14874 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14875 		.doit = nl80211_nan_del_func,
14876 		.flags = GENL_ADMIN_PERM,
14877 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14878 				  NL80211_FLAG_NEED_RTNL,
14879 	},
14880 	{
14881 		.cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14882 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14883 		.doit = nl80211_nan_change_config,
14884 		.flags = GENL_ADMIN_PERM,
14885 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14886 				  NL80211_FLAG_NEED_RTNL,
14887 	},
14888 	{
14889 		.cmd = NL80211_CMD_SET_MCAST_RATE,
14890 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14891 		.doit = nl80211_set_mcast_rate,
14892 		.flags = GENL_UNS_ADMIN_PERM,
14893 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14894 				  NL80211_FLAG_NEED_RTNL,
14895 	},
14896 	{
14897 		.cmd = NL80211_CMD_SET_MAC_ACL,
14898 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14899 		.doit = nl80211_set_mac_acl,
14900 		.flags = GENL_UNS_ADMIN_PERM,
14901 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
14902 				  NL80211_FLAG_NEED_RTNL,
14903 	},
14904 	{
14905 		.cmd = NL80211_CMD_RADAR_DETECT,
14906 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14907 		.doit = nl80211_start_radar_detection,
14908 		.flags = GENL_UNS_ADMIN_PERM,
14909 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14910 				  NL80211_FLAG_NEED_RTNL,
14911 	},
14912 	{
14913 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14914 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14915 		.doit = nl80211_get_protocol_features,
14916 	},
14917 	{
14918 		.cmd = NL80211_CMD_UPDATE_FT_IES,
14919 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14920 		.doit = nl80211_update_ft_ies,
14921 		.flags = GENL_UNS_ADMIN_PERM,
14922 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14923 				  NL80211_FLAG_NEED_RTNL,
14924 	},
14925 	{
14926 		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14927 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14928 		.doit = nl80211_crit_protocol_start,
14929 		.flags = GENL_UNS_ADMIN_PERM,
14930 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14931 				  NL80211_FLAG_NEED_RTNL,
14932 	},
14933 	{
14934 		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14935 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14936 		.doit = nl80211_crit_protocol_stop,
14937 		.flags = GENL_UNS_ADMIN_PERM,
14938 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14939 				  NL80211_FLAG_NEED_RTNL,
14940 	},
14941 	{
14942 		.cmd = NL80211_CMD_GET_COALESCE,
14943 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14944 		.doit = nl80211_get_coalesce,
14945 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14946 				  NL80211_FLAG_NEED_RTNL,
14947 	},
14948 	{
14949 		.cmd = NL80211_CMD_SET_COALESCE,
14950 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14951 		.doit = nl80211_set_coalesce,
14952 		.flags = GENL_UNS_ADMIN_PERM,
14953 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14954 				  NL80211_FLAG_NEED_RTNL,
14955 	},
14956 	{
14957 		.cmd = NL80211_CMD_CHANNEL_SWITCH,
14958 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14959 		.doit = nl80211_channel_switch,
14960 		.flags = GENL_UNS_ADMIN_PERM,
14961 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14962 				  NL80211_FLAG_NEED_RTNL,
14963 	},
14964 	{
14965 		.cmd = NL80211_CMD_VENDOR,
14966 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14967 		.doit = nl80211_vendor_cmd,
14968 		.dumpit = nl80211_vendor_cmd_dump,
14969 		.flags = GENL_UNS_ADMIN_PERM,
14970 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
14971 				  NL80211_FLAG_NEED_RTNL |
14972 				  NL80211_FLAG_CLEAR_SKB,
14973 	},
14974 	{
14975 		.cmd = NL80211_CMD_SET_QOS_MAP,
14976 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14977 		.doit = nl80211_set_qos_map,
14978 		.flags = GENL_UNS_ADMIN_PERM,
14979 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14980 				  NL80211_FLAG_NEED_RTNL,
14981 	},
14982 	{
14983 		.cmd = NL80211_CMD_ADD_TX_TS,
14984 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14985 		.doit = nl80211_add_tx_ts,
14986 		.flags = GENL_UNS_ADMIN_PERM,
14987 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14988 				  NL80211_FLAG_NEED_RTNL,
14989 	},
14990 	{
14991 		.cmd = NL80211_CMD_DEL_TX_TS,
14992 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
14993 		.doit = nl80211_del_tx_ts,
14994 		.flags = GENL_UNS_ADMIN_PERM,
14995 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14996 				  NL80211_FLAG_NEED_RTNL,
14997 	},
14998 	{
14999 		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15000 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15001 		.doit = nl80211_tdls_channel_switch,
15002 		.flags = GENL_UNS_ADMIN_PERM,
15003 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15004 				  NL80211_FLAG_NEED_RTNL,
15005 	},
15006 	{
15007 		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15008 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15009 		.doit = nl80211_tdls_cancel_channel_switch,
15010 		.flags = GENL_UNS_ADMIN_PERM,
15011 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15012 				  NL80211_FLAG_NEED_RTNL,
15013 	},
15014 	{
15015 		.cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15016 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15017 		.doit = nl80211_set_multicast_to_unicast,
15018 		.flags = GENL_UNS_ADMIN_PERM,
15019 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
15020 				  NL80211_FLAG_NEED_RTNL,
15021 	},
15022 	{
15023 		.cmd = NL80211_CMD_SET_PMK,
15024 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15025 		.doit = nl80211_set_pmk,
15026 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15027 				  NL80211_FLAG_NEED_RTNL |
15028 				  NL80211_FLAG_CLEAR_SKB,
15029 	},
15030 	{
15031 		.cmd = NL80211_CMD_DEL_PMK,
15032 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15033 		.doit = nl80211_del_pmk,
15034 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15035 				  NL80211_FLAG_NEED_RTNL,
15036 	},
15037 	{
15038 		.cmd = NL80211_CMD_EXTERNAL_AUTH,
15039 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15040 		.doit = nl80211_external_auth,
15041 		.flags = GENL_ADMIN_PERM,
15042 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15043 				  NL80211_FLAG_NEED_RTNL,
15044 	},
15045 	{
15046 		.cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15047 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15048 		.doit = nl80211_tx_control_port,
15049 		.flags = GENL_UNS_ADMIN_PERM,
15050 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15051 				  NL80211_FLAG_NEED_RTNL,
15052 	},
15053 	{
15054 		.cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15055 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15056 		.doit = nl80211_get_ftm_responder_stats,
15057 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
15058 				  NL80211_FLAG_NEED_RTNL,
15059 	},
15060 	{
15061 		.cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15062 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15063 		.doit = nl80211_pmsr_start,
15064 		.flags = GENL_UNS_ADMIN_PERM,
15065 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15066 				  NL80211_FLAG_NEED_RTNL,
15067 	},
15068 	{
15069 		.cmd = NL80211_CMD_NOTIFY_RADAR,
15070 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15071 		.doit = nl80211_notify_radar_detection,
15072 		.flags = GENL_UNS_ADMIN_PERM,
15073 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15074 				  NL80211_FLAG_NEED_RTNL,
15075 	},
15076 	{
15077 		.cmd = NL80211_CMD_UPDATE_OWE_INFO,
15078 		.doit = nl80211_update_owe_info,
15079 		.flags = GENL_ADMIN_PERM,
15080 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15081 				  NL80211_FLAG_NEED_RTNL,
15082 	},
15083 	{
15084 		.cmd = NL80211_CMD_PROBE_MESH_LINK,
15085 		.doit = nl80211_probe_mesh_link,
15086 		.flags = GENL_UNS_ADMIN_PERM,
15087 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15088 				  NL80211_FLAG_NEED_RTNL,
15089 	},
15090 	{
15091 		.cmd = NL80211_CMD_SET_TID_CONFIG,
15092 		.doit = nl80211_set_tid_config,
15093 		.flags = GENL_UNS_ADMIN_PERM,
15094 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
15095 				  NL80211_FLAG_NEED_RTNL,
15096 	},
15097 };
15098 
15099 static struct genl_family nl80211_fam __ro_after_init = {
15100 	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
15101 	.hdrsize = 0,			/* no private header */
15102 	.version = 1,			/* no particular meaning now */
15103 	.maxattr = NL80211_ATTR_MAX,
15104 	.policy = nl80211_policy,
15105 	.netnsok = true,
15106 	.pre_doit = nl80211_pre_doit,
15107 	.post_doit = nl80211_post_doit,
15108 	.module = THIS_MODULE,
15109 	.ops = nl80211_ops,
15110 	.n_ops = ARRAY_SIZE(nl80211_ops),
15111 	.mcgrps = nl80211_mcgrps,
15112 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15113 	.parallel_ops = true,
15114 };
15115 
15116 /* notification functions */
15117 
15118 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15119 			  enum nl80211_commands cmd)
15120 {
15121 	struct sk_buff *msg;
15122 	struct nl80211_dump_wiphy_state state = {};
15123 
15124 	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15125 		cmd != NL80211_CMD_DEL_WIPHY);
15126 
15127 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15128 	if (!msg)
15129 		return;
15130 
15131 	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15132 		nlmsg_free(msg);
15133 		return;
15134 	}
15135 
15136 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15137 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
15138 }
15139 
15140 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15141 				struct wireless_dev *wdev,
15142 				enum nl80211_commands cmd)
15143 {
15144 	struct sk_buff *msg;
15145 
15146 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15147 	if (!msg)
15148 		return;
15149 
15150 	if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15151 		nlmsg_free(msg);
15152 		return;
15153 	}
15154 
15155 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15156 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
15157 }
15158 
15159 static int nl80211_add_scan_req(struct sk_buff *msg,
15160 				struct cfg80211_registered_device *rdev)
15161 {
15162 	struct cfg80211_scan_request *req = rdev->scan_req;
15163 	struct nlattr *nest;
15164 	int i;
15165 
15166 	if (WARN_ON(!req))
15167 		return 0;
15168 
15169 	nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
15170 	if (!nest)
15171 		goto nla_put_failure;
15172 	for (i = 0; i < req->n_ssids; i++) {
15173 		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
15174 			goto nla_put_failure;
15175 	}
15176 	nla_nest_end(msg, nest);
15177 
15178 	nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
15179 	if (!nest)
15180 		goto nla_put_failure;
15181 	for (i = 0; i < req->n_channels; i++) {
15182 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
15183 			goto nla_put_failure;
15184 	}
15185 	nla_nest_end(msg, nest);
15186 
15187 	if (req->ie &&
15188 	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
15189 		goto nla_put_failure;
15190 
15191 	if (req->flags &&
15192 	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
15193 		goto nla_put_failure;
15194 
15195 	if (req->info.scan_start_tsf &&
15196 	    (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
15197 			       req->info.scan_start_tsf, NL80211_BSS_PAD) ||
15198 	     nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
15199 		     req->info.tsf_bssid)))
15200 		goto nla_put_failure;
15201 
15202 	return 0;
15203  nla_put_failure:
15204 	return -ENOBUFS;
15205 }
15206 
15207 static int nl80211_prep_scan_msg(struct sk_buff *msg,
15208 				 struct cfg80211_registered_device *rdev,
15209 				 struct wireless_dev *wdev,
15210 				 u32 portid, u32 seq, int flags,
15211 				 u32 cmd)
15212 {
15213 	void *hdr;
15214 
15215 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
15216 	if (!hdr)
15217 		return -1;
15218 
15219 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15220 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15221 					 wdev->netdev->ifindex)) ||
15222 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15223 			      NL80211_ATTR_PAD))
15224 		goto nla_put_failure;
15225 
15226 	/* ignore errors and send incomplete event anyway */
15227 	nl80211_add_scan_req(msg, rdev);
15228 
15229 	genlmsg_end(msg, hdr);
15230 	return 0;
15231 
15232  nla_put_failure:
15233 	genlmsg_cancel(msg, hdr);
15234 	return -EMSGSIZE;
15235 }
15236 
15237 static int
15238 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
15239 			    struct cfg80211_sched_scan_request *req, u32 cmd)
15240 {
15241 	void *hdr;
15242 
15243 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15244 	if (!hdr)
15245 		return -1;
15246 
15247 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
15248 			wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
15249 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
15250 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
15251 			      NL80211_ATTR_PAD))
15252 		goto nla_put_failure;
15253 
15254 	genlmsg_end(msg, hdr);
15255 	return 0;
15256 
15257  nla_put_failure:
15258 	genlmsg_cancel(msg, hdr);
15259 	return -EMSGSIZE;
15260 }
15261 
15262 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
15263 			     struct wireless_dev *wdev)
15264 {
15265 	struct sk_buff *msg;
15266 
15267 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15268 	if (!msg)
15269 		return;
15270 
15271 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15272 				  NL80211_CMD_TRIGGER_SCAN) < 0) {
15273 		nlmsg_free(msg);
15274 		return;
15275 	}
15276 
15277 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15278 				NL80211_MCGRP_SCAN, GFP_KERNEL);
15279 }
15280 
15281 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
15282 				       struct wireless_dev *wdev, bool aborted)
15283 {
15284 	struct sk_buff *msg;
15285 
15286 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15287 	if (!msg)
15288 		return NULL;
15289 
15290 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15291 				  aborted ? NL80211_CMD_SCAN_ABORTED :
15292 					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
15293 		nlmsg_free(msg);
15294 		return NULL;
15295 	}
15296 
15297 	return msg;
15298 }
15299 
15300 /* send message created by nl80211_build_scan_msg() */
15301 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
15302 			   struct sk_buff *msg)
15303 {
15304 	if (!msg)
15305 		return;
15306 
15307 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15308 				NL80211_MCGRP_SCAN, GFP_KERNEL);
15309 }
15310 
15311 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
15312 {
15313 	struct sk_buff *msg;
15314 
15315 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15316 	if (!msg)
15317 		return;
15318 
15319 	if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
15320 		nlmsg_free(msg);
15321 		return;
15322 	}
15323 
15324 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
15325 				NL80211_MCGRP_SCAN, GFP_KERNEL);
15326 }
15327 
15328 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
15329 					  struct regulatory_request *request)
15330 {
15331 	/* Userspace can always count this one always being set */
15332 	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
15333 		goto nla_put_failure;
15334 
15335 	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
15336 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15337 			       NL80211_REGDOM_TYPE_WORLD))
15338 			goto nla_put_failure;
15339 	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
15340 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15341 			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
15342 			goto nla_put_failure;
15343 	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
15344 		   request->intersect) {
15345 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15346 			       NL80211_REGDOM_TYPE_INTERSECTION))
15347 			goto nla_put_failure;
15348 	} else {
15349 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
15350 			       NL80211_REGDOM_TYPE_COUNTRY) ||
15351 		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
15352 				   request->alpha2))
15353 			goto nla_put_failure;
15354 	}
15355 
15356 	if (request->wiphy_idx != WIPHY_IDX_INVALID) {
15357 		struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
15358 
15359 		if (wiphy &&
15360 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
15361 			goto nla_put_failure;
15362 
15363 		if (wiphy &&
15364 		    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
15365 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
15366 			goto nla_put_failure;
15367 	}
15368 
15369 	return true;
15370 
15371 nla_put_failure:
15372 	return false;
15373 }
15374 
15375 /*
15376  * This can happen on global regulatory changes or device specific settings
15377  * based on custom regulatory domains.
15378  */
15379 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
15380 				     struct regulatory_request *request)
15381 {
15382 	struct sk_buff *msg;
15383 	void *hdr;
15384 
15385 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15386 	if (!msg)
15387 		return;
15388 
15389 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
15390 	if (!hdr)
15391 		goto nla_put_failure;
15392 
15393 	if (!nl80211_reg_change_event_fill(msg, request))
15394 		goto nla_put_failure;
15395 
15396 	genlmsg_end(msg, hdr);
15397 
15398 	rcu_read_lock();
15399 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15400 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15401 	rcu_read_unlock();
15402 
15403 	return;
15404 
15405 nla_put_failure:
15406 	nlmsg_free(msg);
15407 }
15408 
15409 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
15410 				    struct net_device *netdev,
15411 				    const u8 *buf, size_t len,
15412 				    enum nl80211_commands cmd, gfp_t gfp,
15413 				    int uapsd_queues, const u8 *req_ies,
15414 				    size_t req_ies_len)
15415 {
15416 	struct sk_buff *msg;
15417 	void *hdr;
15418 
15419 	msg = nlmsg_new(100 + len + req_ies_len, gfp);
15420 	if (!msg)
15421 		return;
15422 
15423 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15424 	if (!hdr) {
15425 		nlmsg_free(msg);
15426 		return;
15427 	}
15428 
15429 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15430 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15431 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15432 	    (req_ies &&
15433 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
15434 		goto nla_put_failure;
15435 
15436 	if (uapsd_queues >= 0) {
15437 		struct nlattr *nla_wmm =
15438 			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
15439 		if (!nla_wmm)
15440 			goto nla_put_failure;
15441 
15442 		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
15443 			       uapsd_queues))
15444 			goto nla_put_failure;
15445 
15446 		nla_nest_end(msg, nla_wmm);
15447 	}
15448 
15449 	genlmsg_end(msg, hdr);
15450 
15451 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15452 				NL80211_MCGRP_MLME, gfp);
15453 	return;
15454 
15455  nla_put_failure:
15456 	nlmsg_free(msg);
15457 }
15458 
15459 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
15460 			  struct net_device *netdev, const u8 *buf,
15461 			  size_t len, gfp_t gfp)
15462 {
15463 	nl80211_send_mlme_event(rdev, netdev, buf, len,
15464 				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
15465 }
15466 
15467 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
15468 			   struct net_device *netdev, const u8 *buf,
15469 			   size_t len, gfp_t gfp, int uapsd_queues,
15470 			   const u8 *req_ies, size_t req_ies_len)
15471 {
15472 	nl80211_send_mlme_event(rdev, netdev, buf, len,
15473 				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
15474 				req_ies, req_ies_len);
15475 }
15476 
15477 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
15478 			 struct net_device *netdev, const u8 *buf,
15479 			 size_t len, gfp_t gfp)
15480 {
15481 	nl80211_send_mlme_event(rdev, netdev, buf, len,
15482 				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
15483 }
15484 
15485 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
15486 			   struct net_device *netdev, const u8 *buf,
15487 			   size_t len, gfp_t gfp)
15488 {
15489 	nl80211_send_mlme_event(rdev, netdev, buf, len,
15490 				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
15491 }
15492 
15493 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
15494 				  size_t len)
15495 {
15496 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15497 	struct wiphy *wiphy = wdev->wiphy;
15498 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15499 	const struct ieee80211_mgmt *mgmt = (void *)buf;
15500 	u32 cmd;
15501 
15502 	if (WARN_ON(len < 2))
15503 		return;
15504 
15505 	if (ieee80211_is_deauth(mgmt->frame_control))
15506 		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
15507 	else
15508 		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
15509 
15510 	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
15511 	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
15512 				NULL, 0);
15513 }
15514 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
15515 
15516 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
15517 				      struct net_device *netdev, int cmd,
15518 				      const u8 *addr, gfp_t gfp)
15519 {
15520 	struct sk_buff *msg;
15521 	void *hdr;
15522 
15523 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15524 	if (!msg)
15525 		return;
15526 
15527 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15528 	if (!hdr) {
15529 		nlmsg_free(msg);
15530 		return;
15531 	}
15532 
15533 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15534 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15535 	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15536 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15537 		goto nla_put_failure;
15538 
15539 	genlmsg_end(msg, hdr);
15540 
15541 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15542 				NL80211_MCGRP_MLME, gfp);
15543 	return;
15544 
15545  nla_put_failure:
15546 	nlmsg_free(msg);
15547 }
15548 
15549 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
15550 			       struct net_device *netdev, const u8 *addr,
15551 			       gfp_t gfp)
15552 {
15553 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
15554 				  addr, gfp);
15555 }
15556 
15557 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
15558 				struct net_device *netdev, const u8 *addr,
15559 				gfp_t gfp)
15560 {
15561 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
15562 				  addr, gfp);
15563 }
15564 
15565 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
15566 				 struct net_device *netdev,
15567 				 struct cfg80211_connect_resp_params *cr,
15568 				 gfp_t gfp)
15569 {
15570 	struct sk_buff *msg;
15571 	void *hdr;
15572 
15573 	msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
15574 			cr->fils.kek_len + cr->fils.pmk_len +
15575 			(cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15576 	if (!msg)
15577 		return;
15578 
15579 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
15580 	if (!hdr) {
15581 		nlmsg_free(msg);
15582 		return;
15583 	}
15584 
15585 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15586 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15587 	    (cr->bssid &&
15588 	     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
15589 	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
15590 			cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
15591 			cr->status) ||
15592 	    (cr->status < 0 &&
15593 	     (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
15594 	      nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
15595 			  cr->timeout_reason))) ||
15596 	    (cr->req_ie &&
15597 	     nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
15598 	    (cr->resp_ie &&
15599 	     nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
15600 		     cr->resp_ie)) ||
15601 	    (cr->fils.update_erp_next_seq_num &&
15602 	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15603 			 cr->fils.erp_next_seq_num)) ||
15604 	    (cr->status == WLAN_STATUS_SUCCESS &&
15605 	     ((cr->fils.kek &&
15606 	       nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
15607 		       cr->fils.kek)) ||
15608 	      (cr->fils.pmk &&
15609 	       nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
15610 	      (cr->fils.pmkid &&
15611 	       nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
15612 		goto nla_put_failure;
15613 
15614 	genlmsg_end(msg, hdr);
15615 
15616 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15617 				NL80211_MCGRP_MLME, gfp);
15618 	return;
15619 
15620  nla_put_failure:
15621 	nlmsg_free(msg);
15622 }
15623 
15624 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
15625 			 struct net_device *netdev,
15626 			 struct cfg80211_roam_info *info, gfp_t gfp)
15627 {
15628 	struct sk_buff *msg;
15629 	void *hdr;
15630 	const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
15631 
15632 	msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
15633 			info->fils.kek_len + info->fils.pmk_len +
15634 			(info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
15635 	if (!msg)
15636 		return;
15637 
15638 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
15639 	if (!hdr) {
15640 		nlmsg_free(msg);
15641 		return;
15642 	}
15643 
15644 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15645 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15646 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
15647 	    (info->req_ie &&
15648 	     nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
15649 		     info->req_ie)) ||
15650 	    (info->resp_ie &&
15651 	     nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
15652 		     info->resp_ie)) ||
15653 	    (info->fils.update_erp_next_seq_num &&
15654 	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
15655 			 info->fils.erp_next_seq_num)) ||
15656 	    (info->fils.kek &&
15657 	     nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
15658 		     info->fils.kek)) ||
15659 	    (info->fils.pmk &&
15660 	     nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
15661 	    (info->fils.pmkid &&
15662 	     nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
15663 		goto nla_put_failure;
15664 
15665 	genlmsg_end(msg, hdr);
15666 
15667 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15668 				NL80211_MCGRP_MLME, gfp);
15669 	return;
15670 
15671  nla_put_failure:
15672 	nlmsg_free(msg);
15673 }
15674 
15675 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
15676 				  struct net_device *netdev, const u8 *bssid)
15677 {
15678 	struct sk_buff *msg;
15679 	void *hdr;
15680 
15681 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15682 	if (!msg)
15683 		return;
15684 
15685 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
15686 	if (!hdr) {
15687 		nlmsg_free(msg);
15688 		return;
15689 	}
15690 
15691 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15692 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15693 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15694 		goto nla_put_failure;
15695 
15696 	genlmsg_end(msg, hdr);
15697 
15698 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15699 				NL80211_MCGRP_MLME, GFP_KERNEL);
15700 	return;
15701 
15702  nla_put_failure:
15703 	nlmsg_free(msg);
15704 }
15705 
15706 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
15707 			       struct net_device *netdev, u16 reason,
15708 			       const u8 *ie, size_t ie_len, bool from_ap)
15709 {
15710 	struct sk_buff *msg;
15711 	void *hdr;
15712 
15713 	msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
15714 	if (!msg)
15715 		return;
15716 
15717 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
15718 	if (!hdr) {
15719 		nlmsg_free(msg);
15720 		return;
15721 	}
15722 
15723 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15724 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15725 	    (reason &&
15726 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
15727 	    (from_ap &&
15728 	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
15729 	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
15730 		goto nla_put_failure;
15731 
15732 	genlmsg_end(msg, hdr);
15733 
15734 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15735 				NL80211_MCGRP_MLME, GFP_KERNEL);
15736 	return;
15737 
15738  nla_put_failure:
15739 	nlmsg_free(msg);
15740 }
15741 
15742 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
15743 			     struct net_device *netdev, const u8 *bssid,
15744 			     gfp_t gfp)
15745 {
15746 	struct sk_buff *msg;
15747 	void *hdr;
15748 
15749 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15750 	if (!msg)
15751 		return;
15752 
15753 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
15754 	if (!hdr) {
15755 		nlmsg_free(msg);
15756 		return;
15757 	}
15758 
15759 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15760 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15761 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15762 		goto nla_put_failure;
15763 
15764 	genlmsg_end(msg, hdr);
15765 
15766 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15767 				NL80211_MCGRP_MLME, gfp);
15768 	return;
15769 
15770  nla_put_failure:
15771 	nlmsg_free(msg);
15772 }
15773 
15774 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
15775 					const u8 *ie, u8 ie_len,
15776 					int sig_dbm, gfp_t gfp)
15777 {
15778 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15779 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15780 	struct sk_buff *msg;
15781 	void *hdr;
15782 
15783 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
15784 		return;
15785 
15786 	trace_cfg80211_notify_new_peer_candidate(dev, addr);
15787 
15788 	msg = nlmsg_new(100 + ie_len, gfp);
15789 	if (!msg)
15790 		return;
15791 
15792 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
15793 	if (!hdr) {
15794 		nlmsg_free(msg);
15795 		return;
15796 	}
15797 
15798 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15799 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15800 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15801 	    (ie_len && ie &&
15802 	     nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
15803 	    (sig_dbm &&
15804 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
15805 		goto nla_put_failure;
15806 
15807 	genlmsg_end(msg, hdr);
15808 
15809 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15810 				NL80211_MCGRP_MLME, gfp);
15811 	return;
15812 
15813  nla_put_failure:
15814 	nlmsg_free(msg);
15815 }
15816 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
15817 
15818 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
15819 				 struct net_device *netdev, const u8 *addr,
15820 				 enum nl80211_key_type key_type, int key_id,
15821 				 const u8 *tsc, gfp_t gfp)
15822 {
15823 	struct sk_buff *msg;
15824 	void *hdr;
15825 
15826 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15827 	if (!msg)
15828 		return;
15829 
15830 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
15831 	if (!hdr) {
15832 		nlmsg_free(msg);
15833 		return;
15834 	}
15835 
15836 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15837 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15838 	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
15839 	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
15840 	    (key_id != -1 &&
15841 	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
15842 	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
15843 		goto nla_put_failure;
15844 
15845 	genlmsg_end(msg, hdr);
15846 
15847 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15848 				NL80211_MCGRP_MLME, gfp);
15849 	return;
15850 
15851  nla_put_failure:
15852 	nlmsg_free(msg);
15853 }
15854 
15855 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
15856 				    struct ieee80211_channel *channel_before,
15857 				    struct ieee80211_channel *channel_after)
15858 {
15859 	struct sk_buff *msg;
15860 	void *hdr;
15861 	struct nlattr *nl_freq;
15862 
15863 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
15864 	if (!msg)
15865 		return;
15866 
15867 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
15868 	if (!hdr) {
15869 		nlmsg_free(msg);
15870 		return;
15871 	}
15872 
15873 	/*
15874 	 * Since we are applying the beacon hint to a wiphy we know its
15875 	 * wiphy_idx is valid
15876 	 */
15877 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
15878 		goto nla_put_failure;
15879 
15880 	/* Before */
15881 	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
15882 	if (!nl_freq)
15883 		goto nla_put_failure;
15884 
15885 	if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
15886 		goto nla_put_failure;
15887 	nla_nest_end(msg, nl_freq);
15888 
15889 	/* After */
15890 	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
15891 	if (!nl_freq)
15892 		goto nla_put_failure;
15893 
15894 	if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15895 		goto nla_put_failure;
15896 	nla_nest_end(msg, nl_freq);
15897 
15898 	genlmsg_end(msg, hdr);
15899 
15900 	rcu_read_lock();
15901 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15902 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15903 	rcu_read_unlock();
15904 
15905 	return;
15906 
15907 nla_put_failure:
15908 	nlmsg_free(msg);
15909 }
15910 
15911 static void nl80211_send_remain_on_chan_event(
15912 	int cmd, struct cfg80211_registered_device *rdev,
15913 	struct wireless_dev *wdev, u64 cookie,
15914 	struct ieee80211_channel *chan,
15915 	unsigned int duration, gfp_t gfp)
15916 {
15917 	struct sk_buff *msg;
15918 	void *hdr;
15919 
15920 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15921 	if (!msg)
15922 		return;
15923 
15924 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15925 	if (!hdr) {
15926 		nlmsg_free(msg);
15927 		return;
15928 	}
15929 
15930 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15931 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15932 					 wdev->netdev->ifindex)) ||
15933 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15934 			      NL80211_ATTR_PAD) ||
15935 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15936 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15937 			NL80211_CHAN_NO_HT) ||
15938 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15939 			      NL80211_ATTR_PAD))
15940 		goto nla_put_failure;
15941 
15942 	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15943 	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15944 		goto nla_put_failure;
15945 
15946 	genlmsg_end(msg, hdr);
15947 
15948 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15949 				NL80211_MCGRP_MLME, gfp);
15950 	return;
15951 
15952  nla_put_failure:
15953 	nlmsg_free(msg);
15954 }
15955 
15956 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15957 			       struct ieee80211_channel *chan,
15958 			       unsigned int duration, gfp_t gfp)
15959 {
15960 	struct wiphy *wiphy = wdev->wiphy;
15961 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15962 
15963 	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15964 	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15965 					  rdev, wdev, cookie, chan,
15966 					  duration, gfp);
15967 }
15968 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15969 
15970 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15971 					struct ieee80211_channel *chan,
15972 					gfp_t gfp)
15973 {
15974 	struct wiphy *wiphy = wdev->wiphy;
15975 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15976 
15977 	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15978 	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15979 					  rdev, wdev, cookie, chan, 0, gfp);
15980 }
15981 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15982 
15983 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
15984 					struct ieee80211_channel *chan,
15985 					gfp_t gfp)
15986 {
15987 	struct wiphy *wiphy = wdev->wiphy;
15988 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15989 
15990 	trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
15991 	nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
15992 					  rdev, wdev, cookie, chan, 0, gfp);
15993 }
15994 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
15995 
15996 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15997 		      struct station_info *sinfo, gfp_t gfp)
15998 {
15999 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16000 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16001 	struct sk_buff *msg;
16002 
16003 	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16004 
16005 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16006 	if (!msg)
16007 		return;
16008 
16009 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16010 				 rdev, dev, mac_addr, sinfo) < 0) {
16011 		nlmsg_free(msg);
16012 		return;
16013 	}
16014 
16015 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16016 				NL80211_MCGRP_MLME, gfp);
16017 }
16018 EXPORT_SYMBOL(cfg80211_new_sta);
16019 
16020 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16021 			    struct station_info *sinfo, gfp_t gfp)
16022 {
16023 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16024 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16025 	struct sk_buff *msg;
16026 	struct station_info empty_sinfo = {};
16027 
16028 	if (!sinfo)
16029 		sinfo = &empty_sinfo;
16030 
16031 	trace_cfg80211_del_sta(dev, mac_addr);
16032 
16033 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16034 	if (!msg) {
16035 		cfg80211_sinfo_release_content(sinfo);
16036 		return;
16037 	}
16038 
16039 	if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16040 				 rdev, dev, mac_addr, sinfo) < 0) {
16041 		nlmsg_free(msg);
16042 		return;
16043 	}
16044 
16045 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16046 				NL80211_MCGRP_MLME, gfp);
16047 }
16048 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16049 
16050 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16051 			  enum nl80211_connect_failed_reason reason,
16052 			  gfp_t gfp)
16053 {
16054 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16055 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16056 	struct sk_buff *msg;
16057 	void *hdr;
16058 
16059 	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16060 	if (!msg)
16061 		return;
16062 
16063 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16064 	if (!hdr) {
16065 		nlmsg_free(msg);
16066 		return;
16067 	}
16068 
16069 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16070 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16071 	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16072 		goto nla_put_failure;
16073 
16074 	genlmsg_end(msg, hdr);
16075 
16076 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16077 				NL80211_MCGRP_MLME, gfp);
16078 	return;
16079 
16080  nla_put_failure:
16081 	nlmsg_free(msg);
16082 }
16083 EXPORT_SYMBOL(cfg80211_conn_failed);
16084 
16085 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16086 				       const u8 *addr, gfp_t gfp)
16087 {
16088 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16089 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16090 	struct sk_buff *msg;
16091 	void *hdr;
16092 	u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16093 
16094 	if (!nlportid)
16095 		return false;
16096 
16097 	msg = nlmsg_new(100, gfp);
16098 	if (!msg)
16099 		return true;
16100 
16101 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16102 	if (!hdr) {
16103 		nlmsg_free(msg);
16104 		return true;
16105 	}
16106 
16107 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16108 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16109 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16110 		goto nla_put_failure;
16111 
16112 	genlmsg_end(msg, hdr);
16113 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16114 	return true;
16115 
16116  nla_put_failure:
16117 	nlmsg_free(msg);
16118 	return true;
16119 }
16120 
16121 bool cfg80211_rx_spurious_frame(struct net_device *dev,
16122 				const u8 *addr, gfp_t gfp)
16123 {
16124 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16125 	bool ret;
16126 
16127 	trace_cfg80211_rx_spurious_frame(dev, addr);
16128 
16129 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16130 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
16131 		trace_cfg80211_return_bool(false);
16132 		return false;
16133 	}
16134 	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
16135 					 addr, gfp);
16136 	trace_cfg80211_return_bool(ret);
16137 	return ret;
16138 }
16139 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
16140 
16141 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
16142 					const u8 *addr, gfp_t gfp)
16143 {
16144 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16145 	bool ret;
16146 
16147 	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
16148 
16149 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16150 		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
16151 		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
16152 		trace_cfg80211_return_bool(false);
16153 		return false;
16154 	}
16155 	ret = __nl80211_unexpected_frame(dev,
16156 					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
16157 					 addr, gfp);
16158 	trace_cfg80211_return_bool(ret);
16159 	return ret;
16160 }
16161 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
16162 
16163 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
16164 		      struct wireless_dev *wdev, u32 nlportid,
16165 		      int freq, int sig_dbm,
16166 		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
16167 {
16168 	struct net_device *netdev = wdev->netdev;
16169 	struct sk_buff *msg;
16170 	void *hdr;
16171 
16172 	msg = nlmsg_new(100 + len, gfp);
16173 	if (!msg)
16174 		return -ENOMEM;
16175 
16176 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16177 	if (!hdr) {
16178 		nlmsg_free(msg);
16179 		return -ENOMEM;
16180 	}
16181 
16182 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16183 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16184 					netdev->ifindex)) ||
16185 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16186 			      NL80211_ATTR_PAD) ||
16187 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
16188 	    (sig_dbm &&
16189 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16190 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16191 	    (flags &&
16192 	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
16193 		goto nla_put_failure;
16194 
16195 	genlmsg_end(msg, hdr);
16196 
16197 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16198 
16199  nla_put_failure:
16200 	nlmsg_free(msg);
16201 	return -ENOBUFS;
16202 }
16203 
16204 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
16205 			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
16206 {
16207 	struct wiphy *wiphy = wdev->wiphy;
16208 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16209 	struct net_device *netdev = wdev->netdev;
16210 	struct sk_buff *msg;
16211 	void *hdr;
16212 
16213 	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
16214 
16215 	msg = nlmsg_new(100 + len, gfp);
16216 	if (!msg)
16217 		return;
16218 
16219 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
16220 	if (!hdr) {
16221 		nlmsg_free(msg);
16222 		return;
16223 	}
16224 
16225 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16226 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16227 				   netdev->ifindex)) ||
16228 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16229 			      NL80211_ATTR_PAD) ||
16230 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16231 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16232 			      NL80211_ATTR_PAD) ||
16233 	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
16234 		goto nla_put_failure;
16235 
16236 	genlmsg_end(msg, hdr);
16237 
16238 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16239 				NL80211_MCGRP_MLME, gfp);
16240 	return;
16241 
16242  nla_put_failure:
16243 	nlmsg_free(msg);
16244 }
16245 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
16246 
16247 static int __nl80211_rx_control_port(struct net_device *dev,
16248 				     struct sk_buff *skb,
16249 				     bool unencrypted, gfp_t gfp)
16250 {
16251 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16252 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16253 	struct ethhdr *ehdr = eth_hdr(skb);
16254 	const u8 *addr = ehdr->h_source;
16255 	u16 proto = be16_to_cpu(skb->protocol);
16256 	struct sk_buff *msg;
16257 	void *hdr;
16258 	struct nlattr *frame;
16259 
16260 	u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
16261 
16262 	if (!nlportid)
16263 		return -ENOENT;
16264 
16265 	msg = nlmsg_new(100 + skb->len, gfp);
16266 	if (!msg)
16267 		return -ENOMEM;
16268 
16269 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
16270 	if (!hdr) {
16271 		nlmsg_free(msg);
16272 		return -ENOBUFS;
16273 	}
16274 
16275 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16276 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16277 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16278 			      NL80211_ATTR_PAD) ||
16279 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16280 	    nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
16281 	    (unencrypted && nla_put_flag(msg,
16282 					 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
16283 		goto nla_put_failure;
16284 
16285 	frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
16286 	if (!frame)
16287 		goto nla_put_failure;
16288 
16289 	skb_copy_bits(skb, 0, nla_data(frame), skb->len);
16290 	genlmsg_end(msg, hdr);
16291 
16292 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16293 
16294  nla_put_failure:
16295 	nlmsg_free(msg);
16296 	return -ENOBUFS;
16297 }
16298 
16299 bool cfg80211_rx_control_port(struct net_device *dev,
16300 			      struct sk_buff *skb, bool unencrypted)
16301 {
16302 	int ret;
16303 
16304 	trace_cfg80211_rx_control_port(dev, skb, unencrypted);
16305 	ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
16306 	trace_cfg80211_return_bool(ret == 0);
16307 	return ret == 0;
16308 }
16309 EXPORT_SYMBOL(cfg80211_rx_control_port);
16310 
16311 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
16312 					    const char *mac, gfp_t gfp)
16313 {
16314 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16315 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16316 	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16317 	void **cb;
16318 
16319 	if (!msg)
16320 		return NULL;
16321 
16322 	cb = (void **)msg->cb;
16323 
16324 	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
16325 	if (!cb[0]) {
16326 		nlmsg_free(msg);
16327 		return NULL;
16328 	}
16329 
16330 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16331 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16332 		goto nla_put_failure;
16333 
16334 	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16335 		goto nla_put_failure;
16336 
16337 	cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
16338 	if (!cb[1])
16339 		goto nla_put_failure;
16340 
16341 	cb[2] = rdev;
16342 
16343 	return msg;
16344  nla_put_failure:
16345 	nlmsg_free(msg);
16346 	return NULL;
16347 }
16348 
16349 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
16350 {
16351 	void **cb = (void **)msg->cb;
16352 	struct cfg80211_registered_device *rdev = cb[2];
16353 
16354 	nla_nest_end(msg, cb[1]);
16355 	genlmsg_end(msg, cb[0]);
16356 
16357 	memset(msg->cb, 0, sizeof(msg->cb));
16358 
16359 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16360 				NL80211_MCGRP_MLME, gfp);
16361 }
16362 
16363 void cfg80211_cqm_rssi_notify(struct net_device *dev,
16364 			      enum nl80211_cqm_rssi_threshold_event rssi_event,
16365 			      s32 rssi_level, gfp_t gfp)
16366 {
16367 	struct sk_buff *msg;
16368 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16369 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16370 
16371 	trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
16372 
16373 	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
16374 		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
16375 		return;
16376 
16377 	if (wdev->cqm_config) {
16378 		wdev->cqm_config->last_rssi_event_value = rssi_level;
16379 
16380 		cfg80211_cqm_rssi_update(rdev, dev);
16381 
16382 		if (rssi_level == 0)
16383 			rssi_level = wdev->cqm_config->last_rssi_event_value;
16384 	}
16385 
16386 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16387 	if (!msg)
16388 		return;
16389 
16390 	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
16391 			rssi_event))
16392 		goto nla_put_failure;
16393 
16394 	if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
16395 				      rssi_level))
16396 		goto nla_put_failure;
16397 
16398 	cfg80211_send_cqm(msg, gfp);
16399 
16400 	return;
16401 
16402  nla_put_failure:
16403 	nlmsg_free(msg);
16404 }
16405 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
16406 
16407 void cfg80211_cqm_txe_notify(struct net_device *dev,
16408 			     const u8 *peer, u32 num_packets,
16409 			     u32 rate, u32 intvl, gfp_t gfp)
16410 {
16411 	struct sk_buff *msg;
16412 
16413 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
16414 	if (!msg)
16415 		return;
16416 
16417 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
16418 		goto nla_put_failure;
16419 
16420 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
16421 		goto nla_put_failure;
16422 
16423 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
16424 		goto nla_put_failure;
16425 
16426 	cfg80211_send_cqm(msg, gfp);
16427 	return;
16428 
16429  nla_put_failure:
16430 	nlmsg_free(msg);
16431 }
16432 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
16433 
16434 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
16435 				 const u8 *peer, u32 num_packets, gfp_t gfp)
16436 {
16437 	struct sk_buff *msg;
16438 
16439 	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
16440 
16441 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
16442 	if (!msg)
16443 		return;
16444 
16445 	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
16446 		goto nla_put_failure;
16447 
16448 	cfg80211_send_cqm(msg, gfp);
16449 	return;
16450 
16451  nla_put_failure:
16452 	nlmsg_free(msg);
16453 }
16454 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
16455 
16456 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
16457 {
16458 	struct sk_buff *msg;
16459 
16460 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
16461 	if (!msg)
16462 		return;
16463 
16464 	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
16465 		goto nla_put_failure;
16466 
16467 	cfg80211_send_cqm(msg, gfp);
16468 	return;
16469 
16470  nla_put_failure:
16471 	nlmsg_free(msg);
16472 }
16473 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
16474 
16475 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
16476 				     struct net_device *netdev, const u8 *bssid,
16477 				     const u8 *replay_ctr, gfp_t gfp)
16478 {
16479 	struct sk_buff *msg;
16480 	struct nlattr *rekey_attr;
16481 	void *hdr;
16482 
16483 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16484 	if (!msg)
16485 		return;
16486 
16487 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
16488 	if (!hdr) {
16489 		nlmsg_free(msg);
16490 		return;
16491 	}
16492 
16493 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16494 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16495 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16496 		goto nla_put_failure;
16497 
16498 	rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
16499 	if (!rekey_attr)
16500 		goto nla_put_failure;
16501 
16502 	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
16503 		    NL80211_REPLAY_CTR_LEN, replay_ctr))
16504 		goto nla_put_failure;
16505 
16506 	nla_nest_end(msg, rekey_attr);
16507 
16508 	genlmsg_end(msg, hdr);
16509 
16510 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16511 				NL80211_MCGRP_MLME, gfp);
16512 	return;
16513 
16514  nla_put_failure:
16515 	nlmsg_free(msg);
16516 }
16517 
16518 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
16519 			       const u8 *replay_ctr, gfp_t gfp)
16520 {
16521 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16522 	struct wiphy *wiphy = wdev->wiphy;
16523 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16524 
16525 	trace_cfg80211_gtk_rekey_notify(dev, bssid);
16526 	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
16527 }
16528 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
16529 
16530 static void
16531 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
16532 			       struct net_device *netdev, int index,
16533 			       const u8 *bssid, bool preauth, gfp_t gfp)
16534 {
16535 	struct sk_buff *msg;
16536 	struct nlattr *attr;
16537 	void *hdr;
16538 
16539 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16540 	if (!msg)
16541 		return;
16542 
16543 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
16544 	if (!hdr) {
16545 		nlmsg_free(msg);
16546 		return;
16547 	}
16548 
16549 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16550 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16551 		goto nla_put_failure;
16552 
16553 	attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
16554 	if (!attr)
16555 		goto nla_put_failure;
16556 
16557 	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
16558 	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
16559 	    (preauth &&
16560 	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
16561 		goto nla_put_failure;
16562 
16563 	nla_nest_end(msg, attr);
16564 
16565 	genlmsg_end(msg, hdr);
16566 
16567 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16568 				NL80211_MCGRP_MLME, gfp);
16569 	return;
16570 
16571  nla_put_failure:
16572 	nlmsg_free(msg);
16573 }
16574 
16575 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
16576 				     const u8 *bssid, bool preauth, gfp_t gfp)
16577 {
16578 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16579 	struct wiphy *wiphy = wdev->wiphy;
16580 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16581 
16582 	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
16583 	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
16584 }
16585 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
16586 
16587 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
16588 				     struct net_device *netdev,
16589 				     struct cfg80211_chan_def *chandef,
16590 				     gfp_t gfp,
16591 				     enum nl80211_commands notif,
16592 				     u8 count)
16593 {
16594 	struct sk_buff *msg;
16595 	void *hdr;
16596 
16597 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16598 	if (!msg)
16599 		return;
16600 
16601 	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
16602 	if (!hdr) {
16603 		nlmsg_free(msg);
16604 		return;
16605 	}
16606 
16607 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
16608 		goto nla_put_failure;
16609 
16610 	if (nl80211_send_chandef(msg, chandef))
16611 		goto nla_put_failure;
16612 
16613 	if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
16614 	    (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
16615 			goto nla_put_failure;
16616 
16617 	genlmsg_end(msg, hdr);
16618 
16619 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16620 				NL80211_MCGRP_MLME, gfp);
16621 	return;
16622 
16623  nla_put_failure:
16624 	nlmsg_free(msg);
16625 }
16626 
16627 void cfg80211_ch_switch_notify(struct net_device *dev,
16628 			       struct cfg80211_chan_def *chandef)
16629 {
16630 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16631 	struct wiphy *wiphy = wdev->wiphy;
16632 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16633 
16634 	ASSERT_WDEV_LOCK(wdev);
16635 
16636 	trace_cfg80211_ch_switch_notify(dev, chandef);
16637 
16638 	wdev->chandef = *chandef;
16639 	wdev->preset_chandef = *chandef;
16640 
16641 	if (wdev->iftype == NL80211_IFTYPE_STATION &&
16642 	    !WARN_ON(!wdev->current_bss))
16643 		cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
16644 
16645 	cfg80211_sched_dfs_chan_update(rdev);
16646 
16647 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16648 				 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
16649 }
16650 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
16651 
16652 void cfg80211_ch_switch_started_notify(struct net_device *dev,
16653 				       struct cfg80211_chan_def *chandef,
16654 				       u8 count)
16655 {
16656 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16657 	struct wiphy *wiphy = wdev->wiphy;
16658 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16659 
16660 	trace_cfg80211_ch_switch_started_notify(dev, chandef);
16661 
16662 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
16663 				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
16664 }
16665 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
16666 
16667 void
16668 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
16669 		     const struct cfg80211_chan_def *chandef,
16670 		     enum nl80211_radar_event event,
16671 		     struct net_device *netdev, gfp_t gfp)
16672 {
16673 	struct sk_buff *msg;
16674 	void *hdr;
16675 
16676 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16677 	if (!msg)
16678 		return;
16679 
16680 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
16681 	if (!hdr) {
16682 		nlmsg_free(msg);
16683 		return;
16684 	}
16685 
16686 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16687 		goto nla_put_failure;
16688 
16689 	/* NOP and radar events don't need a netdev parameter */
16690 	if (netdev) {
16691 		struct wireless_dev *wdev = netdev->ieee80211_ptr;
16692 
16693 		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16694 		    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16695 				      NL80211_ATTR_PAD))
16696 			goto nla_put_failure;
16697 	}
16698 
16699 	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
16700 		goto nla_put_failure;
16701 
16702 	if (nl80211_send_chandef(msg, chandef))
16703 		goto nla_put_failure;
16704 
16705 	genlmsg_end(msg, hdr);
16706 
16707 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16708 				NL80211_MCGRP_MLME, gfp);
16709 	return;
16710 
16711  nla_put_failure:
16712 	nlmsg_free(msg);
16713 }
16714 
16715 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
16716 				       struct sta_opmode_info *sta_opmode,
16717 				       gfp_t gfp)
16718 {
16719 	struct sk_buff *msg;
16720 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16721 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16722 	void *hdr;
16723 
16724 	if (WARN_ON(!mac))
16725 		return;
16726 
16727 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16728 	if (!msg)
16729 		return;
16730 
16731 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
16732 	if (!hdr) {
16733 		nlmsg_free(msg);
16734 		return;
16735 	}
16736 
16737 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
16738 		goto nla_put_failure;
16739 
16740 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
16741 		goto nla_put_failure;
16742 
16743 	if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
16744 		goto nla_put_failure;
16745 
16746 	if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
16747 	    nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
16748 		goto nla_put_failure;
16749 
16750 	if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
16751 	    nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
16752 		goto nla_put_failure;
16753 
16754 	if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
16755 	    nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
16756 		goto nla_put_failure;
16757 
16758 	genlmsg_end(msg, hdr);
16759 
16760 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16761 				NL80211_MCGRP_MLME, gfp);
16762 
16763 	return;
16764 
16765 nla_put_failure:
16766 	nlmsg_free(msg);
16767 }
16768 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
16769 
16770 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
16771 			   u64 cookie, bool acked, s32 ack_signal,
16772 			   bool is_valid_ack_signal, gfp_t gfp)
16773 {
16774 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16775 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16776 	struct sk_buff *msg;
16777 	void *hdr;
16778 
16779 	trace_cfg80211_probe_status(dev, addr, cookie, acked);
16780 
16781 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16782 
16783 	if (!msg)
16784 		return;
16785 
16786 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
16787 	if (!hdr) {
16788 		nlmsg_free(msg);
16789 		return;
16790 	}
16791 
16792 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16793 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16794 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16795 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16796 			      NL80211_ATTR_PAD) ||
16797 	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
16798 	    (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
16799 						ack_signal)))
16800 		goto nla_put_failure;
16801 
16802 	genlmsg_end(msg, hdr);
16803 
16804 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16805 				NL80211_MCGRP_MLME, gfp);
16806 	return;
16807 
16808  nla_put_failure:
16809 	nlmsg_free(msg);
16810 }
16811 EXPORT_SYMBOL(cfg80211_probe_status);
16812 
16813 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
16814 				 const u8 *frame, size_t len,
16815 				 int freq, int sig_dbm)
16816 {
16817 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16818 	struct sk_buff *msg;
16819 	void *hdr;
16820 	struct cfg80211_beacon_registration *reg;
16821 
16822 	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
16823 
16824 	spin_lock_bh(&rdev->beacon_registrations_lock);
16825 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
16826 		msg = nlmsg_new(len + 100, GFP_ATOMIC);
16827 		if (!msg) {
16828 			spin_unlock_bh(&rdev->beacon_registrations_lock);
16829 			return;
16830 		}
16831 
16832 		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16833 		if (!hdr)
16834 			goto nla_put_failure;
16835 
16836 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16837 		    (freq &&
16838 		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
16839 		    (sig_dbm &&
16840 		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16841 		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
16842 			goto nla_put_failure;
16843 
16844 		genlmsg_end(msg, hdr);
16845 
16846 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
16847 	}
16848 	spin_unlock_bh(&rdev->beacon_registrations_lock);
16849 	return;
16850 
16851  nla_put_failure:
16852 	spin_unlock_bh(&rdev->beacon_registrations_lock);
16853 	nlmsg_free(msg);
16854 }
16855 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
16856 
16857 #ifdef CONFIG_PM
16858 static int cfg80211_net_detect_results(struct sk_buff *msg,
16859 				       struct cfg80211_wowlan_wakeup *wakeup)
16860 {
16861 	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
16862 	struct nlattr *nl_results, *nl_match, *nl_freqs;
16863 	int i, j;
16864 
16865 	nl_results = nla_nest_start_noflag(msg,
16866 					   NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
16867 	if (!nl_results)
16868 		return -EMSGSIZE;
16869 
16870 	for (i = 0; i < nd->n_matches; i++) {
16871 		struct cfg80211_wowlan_nd_match *match = nd->matches[i];
16872 
16873 		nl_match = nla_nest_start_noflag(msg, i);
16874 		if (!nl_match)
16875 			break;
16876 
16877 		/* The SSID attribute is optional in nl80211, but for
16878 		 * simplicity reasons it's always present in the
16879 		 * cfg80211 structure.  If a driver can't pass the
16880 		 * SSID, that needs to be changed.  A zero length SSID
16881 		 * is still a valid SSID (wildcard), so it cannot be
16882 		 * used for this purpose.
16883 		 */
16884 		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
16885 			    match->ssid.ssid)) {
16886 			nla_nest_cancel(msg, nl_match);
16887 			goto out;
16888 		}
16889 
16890 		if (match->n_channels) {
16891 			nl_freqs = nla_nest_start_noflag(msg,
16892 							 NL80211_ATTR_SCAN_FREQUENCIES);
16893 			if (!nl_freqs) {
16894 				nla_nest_cancel(msg, nl_match);
16895 				goto out;
16896 			}
16897 
16898 			for (j = 0; j < match->n_channels; j++) {
16899 				if (nla_put_u32(msg, j, match->channels[j])) {
16900 					nla_nest_cancel(msg, nl_freqs);
16901 					nla_nest_cancel(msg, nl_match);
16902 					goto out;
16903 				}
16904 			}
16905 
16906 			nla_nest_end(msg, nl_freqs);
16907 		}
16908 
16909 		nla_nest_end(msg, nl_match);
16910 	}
16911 
16912 out:
16913 	nla_nest_end(msg, nl_results);
16914 	return 0;
16915 }
16916 
16917 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16918 				   struct cfg80211_wowlan_wakeup *wakeup,
16919 				   gfp_t gfp)
16920 {
16921 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16922 	struct sk_buff *msg;
16923 	void *hdr;
16924 	int size = 200;
16925 
16926 	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16927 
16928 	if (wakeup)
16929 		size += wakeup->packet_present_len;
16930 
16931 	msg = nlmsg_new(size, gfp);
16932 	if (!msg)
16933 		return;
16934 
16935 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16936 	if (!hdr)
16937 		goto free_msg;
16938 
16939 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16940 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16941 			      NL80211_ATTR_PAD))
16942 		goto free_msg;
16943 
16944 	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16945 					wdev->netdev->ifindex))
16946 		goto free_msg;
16947 
16948 	if (wakeup) {
16949 		struct nlattr *reasons;
16950 
16951 		reasons = nla_nest_start_noflag(msg,
16952 						NL80211_ATTR_WOWLAN_TRIGGERS);
16953 		if (!reasons)
16954 			goto free_msg;
16955 
16956 		if (wakeup->disconnect &&
16957 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16958 			goto free_msg;
16959 		if (wakeup->magic_pkt &&
16960 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16961 			goto free_msg;
16962 		if (wakeup->gtk_rekey_failure &&
16963 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16964 			goto free_msg;
16965 		if (wakeup->eap_identity_req &&
16966 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16967 			goto free_msg;
16968 		if (wakeup->four_way_handshake &&
16969 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16970 			goto free_msg;
16971 		if (wakeup->rfkill_release &&
16972 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16973 			goto free_msg;
16974 
16975 		if (wakeup->pattern_idx >= 0 &&
16976 		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16977 				wakeup->pattern_idx))
16978 			goto free_msg;
16979 
16980 		if (wakeup->tcp_match &&
16981 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16982 			goto free_msg;
16983 
16984 		if (wakeup->tcp_connlost &&
16985 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16986 			goto free_msg;
16987 
16988 		if (wakeup->tcp_nomoretokens &&
16989 		    nla_put_flag(msg,
16990 				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16991 			goto free_msg;
16992 
16993 		if (wakeup->packet) {
16994 			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16995 			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16996 
16997 			if (!wakeup->packet_80211) {
16998 				pkt_attr =
16999 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17000 				len_attr =
17001 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17002 			}
17003 
17004 			if (wakeup->packet_len &&
17005 			    nla_put_u32(msg, len_attr, wakeup->packet_len))
17006 				goto free_msg;
17007 
17008 			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17009 				    wakeup->packet))
17010 				goto free_msg;
17011 		}
17012 
17013 		if (wakeup->net_detect &&
17014 		    cfg80211_net_detect_results(msg, wakeup))
17015 				goto free_msg;
17016 
17017 		nla_nest_end(msg, reasons);
17018 	}
17019 
17020 	genlmsg_end(msg, hdr);
17021 
17022 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17023 				NL80211_MCGRP_MLME, gfp);
17024 	return;
17025 
17026  free_msg:
17027 	nlmsg_free(msg);
17028 }
17029 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17030 #endif
17031 
17032 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17033 				enum nl80211_tdls_operation oper,
17034 				u16 reason_code, gfp_t gfp)
17035 {
17036 	struct wireless_dev *wdev = dev->ieee80211_ptr;
17037 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17038 	struct sk_buff *msg;
17039 	void *hdr;
17040 
17041 	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17042 					 reason_code);
17043 
17044 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17045 	if (!msg)
17046 		return;
17047 
17048 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
17049 	if (!hdr) {
17050 		nlmsg_free(msg);
17051 		return;
17052 	}
17053 
17054 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17055 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17056 	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
17057 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
17058 	    (reason_code > 0 &&
17059 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
17060 		goto nla_put_failure;
17061 
17062 	genlmsg_end(msg, hdr);
17063 
17064 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17065 				NL80211_MCGRP_MLME, gfp);
17066 	return;
17067 
17068  nla_put_failure:
17069 	nlmsg_free(msg);
17070 }
17071 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
17072 
17073 static int nl80211_netlink_notify(struct notifier_block * nb,
17074 				  unsigned long state,
17075 				  void *_notify)
17076 {
17077 	struct netlink_notify *notify = _notify;
17078 	struct cfg80211_registered_device *rdev;
17079 	struct wireless_dev *wdev;
17080 	struct cfg80211_beacon_registration *reg, *tmp;
17081 
17082 	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
17083 		return NOTIFY_DONE;
17084 
17085 	rcu_read_lock();
17086 
17087 	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
17088 		struct cfg80211_sched_scan_request *sched_scan_req;
17089 
17090 		list_for_each_entry_rcu(sched_scan_req,
17091 					&rdev->sched_scan_req_list,
17092 					list) {
17093 			if (sched_scan_req->owner_nlportid == notify->portid) {
17094 				sched_scan_req->nl_owner_dead = true;
17095 				schedule_work(&rdev->sched_scan_stop_wk);
17096 			}
17097 		}
17098 
17099 		list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
17100 			cfg80211_mlme_unregister_socket(wdev, notify->portid);
17101 
17102 			if (wdev->owner_nlportid == notify->portid) {
17103 				wdev->nl_owner_dead = true;
17104 				schedule_work(&rdev->destroy_work);
17105 			} else if (wdev->conn_owner_nlportid == notify->portid) {
17106 				schedule_work(&wdev->disconnect_wk);
17107 			}
17108 
17109 			cfg80211_release_pmsr(wdev, notify->portid);
17110 		}
17111 
17112 		spin_lock_bh(&rdev->beacon_registrations_lock);
17113 		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
17114 					 list) {
17115 			if (reg->nlportid == notify->portid) {
17116 				list_del(&reg->list);
17117 				kfree(reg);
17118 				break;
17119 			}
17120 		}
17121 		spin_unlock_bh(&rdev->beacon_registrations_lock);
17122 	}
17123 
17124 	rcu_read_unlock();
17125 
17126 	/*
17127 	 * It is possible that the user space process that is controlling the
17128 	 * indoor setting disappeared, so notify the regulatory core.
17129 	 */
17130 	regulatory_netlink_notify(notify->portid);
17131 	return NOTIFY_OK;
17132 }
17133 
17134 static struct notifier_block nl80211_netlink_notifier = {
17135 	.notifier_call = nl80211_netlink_notify,
17136 };
17137 
17138 void cfg80211_ft_event(struct net_device *netdev,
17139 		       struct cfg80211_ft_event_params *ft_event)
17140 {
17141 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17142 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17143 	struct sk_buff *msg;
17144 	void *hdr;
17145 
17146 	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
17147 
17148 	if (!ft_event->target_ap)
17149 		return;
17150 
17151 	msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
17152 			GFP_KERNEL);
17153 	if (!msg)
17154 		return;
17155 
17156 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
17157 	if (!hdr)
17158 		goto out;
17159 
17160 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17161 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17162 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
17163 		goto out;
17164 
17165 	if (ft_event->ies &&
17166 	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
17167 		goto out;
17168 	if (ft_event->ric_ies &&
17169 	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
17170 		    ft_event->ric_ies))
17171 		goto out;
17172 
17173 	genlmsg_end(msg, hdr);
17174 
17175 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17176 				NL80211_MCGRP_MLME, GFP_KERNEL);
17177 	return;
17178  out:
17179 	nlmsg_free(msg);
17180 }
17181 EXPORT_SYMBOL(cfg80211_ft_event);
17182 
17183 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
17184 {
17185 	struct cfg80211_registered_device *rdev;
17186 	struct sk_buff *msg;
17187 	void *hdr;
17188 	u32 nlportid;
17189 
17190 	rdev = wiphy_to_rdev(wdev->wiphy);
17191 	if (!rdev->crit_proto_nlportid)
17192 		return;
17193 
17194 	nlportid = rdev->crit_proto_nlportid;
17195 	rdev->crit_proto_nlportid = 0;
17196 
17197 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17198 	if (!msg)
17199 		return;
17200 
17201 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
17202 	if (!hdr)
17203 		goto nla_put_failure;
17204 
17205 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17206 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17207 			      NL80211_ATTR_PAD))
17208 		goto nla_put_failure;
17209 
17210 	genlmsg_end(msg, hdr);
17211 
17212 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17213 	return;
17214 
17215  nla_put_failure:
17216 	nlmsg_free(msg);
17217 }
17218 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
17219 
17220 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
17221 {
17222 	struct wiphy *wiphy = wdev->wiphy;
17223 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17224 	struct sk_buff *msg;
17225 	void *hdr;
17226 
17227 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17228 	if (!msg)
17229 		return;
17230 
17231 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
17232 	if (!hdr)
17233 		goto out;
17234 
17235 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17236 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
17237 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17238 			      NL80211_ATTR_PAD))
17239 		goto out;
17240 
17241 	genlmsg_end(msg, hdr);
17242 
17243 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
17244 				NL80211_MCGRP_MLME, GFP_KERNEL);
17245 	return;
17246  out:
17247 	nlmsg_free(msg);
17248 }
17249 
17250 int cfg80211_external_auth_request(struct net_device *dev,
17251 				   struct cfg80211_external_auth_params *params,
17252 				   gfp_t gfp)
17253 {
17254 	struct wireless_dev *wdev = dev->ieee80211_ptr;
17255 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17256 	struct sk_buff *msg;
17257 	void *hdr;
17258 
17259 	if (!wdev->conn_owner_nlportid)
17260 		return -EINVAL;
17261 
17262 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17263 	if (!msg)
17264 		return -ENOMEM;
17265 
17266 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
17267 	if (!hdr)
17268 		goto nla_put_failure;
17269 
17270 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17271 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17272 	    nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
17273 	    nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
17274 			params->action) ||
17275 	    nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
17276 	    nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
17277 		    params->ssid.ssid))
17278 		goto nla_put_failure;
17279 
17280 	genlmsg_end(msg, hdr);
17281 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
17282 			wdev->conn_owner_nlportid);
17283 	return 0;
17284 
17285  nla_put_failure:
17286 	nlmsg_free(msg);
17287 	return -ENOBUFS;
17288 }
17289 EXPORT_SYMBOL(cfg80211_external_auth_request);
17290 
17291 void cfg80211_update_owe_info_event(struct net_device *netdev,
17292 				    struct cfg80211_update_owe_info *owe_info,
17293 				    gfp_t gfp)
17294 {
17295 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17296 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17297 	struct sk_buff *msg;
17298 	void *hdr;
17299 
17300 	trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
17301 
17302 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17303 	if (!msg)
17304 		return;
17305 
17306 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
17307 	if (!hdr)
17308 		goto nla_put_failure;
17309 
17310 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17311 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17312 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
17313 		goto nla_put_failure;
17314 
17315 	if (!owe_info->ie_len ||
17316 	    nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
17317 		goto nla_put_failure;
17318 
17319 	genlmsg_end(msg, hdr);
17320 
17321 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17322 				NL80211_MCGRP_MLME, gfp);
17323 	return;
17324 
17325 nla_put_failure:
17326 	genlmsg_cancel(msg, hdr);
17327 	nlmsg_free(msg);
17328 }
17329 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
17330 
17331 /* initialisation/exit functions */
17332 
17333 int __init nl80211_init(void)
17334 {
17335 	int err;
17336 
17337 	err = genl_register_family(&nl80211_fam);
17338 	if (err)
17339 		return err;
17340 
17341 	err = netlink_register_notifier(&nl80211_netlink_notifier);
17342 	if (err)
17343 		goto err_out;
17344 
17345 	return 0;
17346  err_out:
17347 	genl_unregister_family(&nl80211_fam);
17348 	return err;
17349 }
17350 
17351 void nl80211_exit(void)
17352 {
17353 	netlink_unregister_notifier(&nl80211_netlink_notifier);
17354 	genl_unregister_family(&nl80211_fam);
17355 }
17356