xref: /openbmc/linux/net/wireless/nl80211.c (revision 88e8c2ec)
1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3  * This is the new netlink-based wireless configuration interface.
4  *
5  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
6  * Copyright 2013-2014  Intel Mobile Communications GmbH
7  * Copyright 2015-2017	Intel Deutschland GmbH
8  * Copyright (C) 2018-2022 Intel Corporation
9  */
10 
11 #include <linux/if.h>
12 #include <linux/module.h>
13 #include <linux/err.h>
14 #include <linux/slab.h>
15 #include <linux/list.h>
16 #include <linux/if_ether.h>
17 #include <linux/ieee80211.h>
18 #include <linux/nl80211.h>
19 #include <linux/rtnetlink.h>
20 #include <linux/netlink.h>
21 #include <linux/nospec.h>
22 #include <linux/etherdevice.h>
23 #include <linux/if_vlan.h>
24 #include <net/net_namespace.h>
25 #include <net/genetlink.h>
26 #include <net/cfg80211.h>
27 #include <net/sock.h>
28 #include <net/inet_connection_sock.h>
29 #include "core.h"
30 #include "nl80211.h"
31 #include "reg.h"
32 #include "rdev-ops.h"
33 
34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
35 				   struct genl_info *info,
36 				   struct cfg80211_crypto_settings *settings,
37 				   int cipher_limit);
38 
39 /* the netlink family */
40 static struct genl_family nl80211_fam;
41 
42 /* multicast groups */
43 enum nl80211_multicast_groups {
44 	NL80211_MCGRP_CONFIG,
45 	NL80211_MCGRP_SCAN,
46 	NL80211_MCGRP_REGULATORY,
47 	NL80211_MCGRP_MLME,
48 	NL80211_MCGRP_VENDOR,
49 	NL80211_MCGRP_NAN,
50 	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
51 };
52 
53 static const struct genl_multicast_group nl80211_mcgrps[] = {
54 	[NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
55 	[NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
56 	[NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
57 	[NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
58 	[NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
59 	[NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
60 #ifdef CONFIG_NL80211_TESTMODE
61 	[NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
62 #endif
63 };
64 
65 /* returns ERR_PTR values */
66 static struct wireless_dev *
67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
68 			   struct net *netns, struct nlattr **attrs)
69 {
70 	struct wireless_dev *result = NULL;
71 	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
72 	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
73 	u64 wdev_id = 0;
74 	int wiphy_idx = -1;
75 	int ifidx = -1;
76 
77 	if (!have_ifidx && !have_wdev_id)
78 		return ERR_PTR(-EINVAL);
79 
80 	if (have_ifidx)
81 		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
82 	if (have_wdev_id) {
83 		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
84 		wiphy_idx = wdev_id >> 32;
85 	}
86 
87 	if (rdev) {
88 		struct wireless_dev *wdev;
89 
90 		lockdep_assert_held(&rdev->wiphy.mtx);
91 
92 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
93 			if (have_ifidx && wdev->netdev &&
94 			    wdev->netdev->ifindex == ifidx) {
95 				result = wdev;
96 				break;
97 			}
98 			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
99 				result = wdev;
100 				break;
101 			}
102 		}
103 
104 		return result ?: ERR_PTR(-ENODEV);
105 	}
106 
107 	ASSERT_RTNL();
108 
109 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
110 		struct wireless_dev *wdev;
111 
112 		if (wiphy_net(&rdev->wiphy) != netns)
113 			continue;
114 
115 		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
116 			continue;
117 
118 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
119 			if (have_ifidx && wdev->netdev &&
120 			    wdev->netdev->ifindex == ifidx) {
121 				result = wdev;
122 				break;
123 			}
124 			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
125 				result = wdev;
126 				break;
127 			}
128 		}
129 
130 		if (result)
131 			break;
132 	}
133 
134 	if (result)
135 		return result;
136 	return ERR_PTR(-ENODEV);
137 }
138 
139 static struct cfg80211_registered_device *
140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
141 {
142 	struct cfg80211_registered_device *rdev = NULL, *tmp;
143 	struct net_device *netdev;
144 
145 	ASSERT_RTNL();
146 
147 	if (!attrs[NL80211_ATTR_WIPHY] &&
148 	    !attrs[NL80211_ATTR_IFINDEX] &&
149 	    !attrs[NL80211_ATTR_WDEV])
150 		return ERR_PTR(-EINVAL);
151 
152 	if (attrs[NL80211_ATTR_WIPHY])
153 		rdev = cfg80211_rdev_by_wiphy_idx(
154 				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
155 
156 	if (attrs[NL80211_ATTR_WDEV]) {
157 		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
158 		struct wireless_dev *wdev;
159 		bool found = false;
160 
161 		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
162 		if (tmp) {
163 			/* make sure wdev exists */
164 			list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
165 				if (wdev->identifier != (u32)wdev_id)
166 					continue;
167 				found = true;
168 				break;
169 			}
170 
171 			if (!found)
172 				tmp = NULL;
173 
174 			if (rdev && tmp != rdev)
175 				return ERR_PTR(-EINVAL);
176 			rdev = tmp;
177 		}
178 	}
179 
180 	if (attrs[NL80211_ATTR_IFINDEX]) {
181 		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
182 
183 		netdev = __dev_get_by_index(netns, ifindex);
184 		if (netdev) {
185 			if (netdev->ieee80211_ptr)
186 				tmp = wiphy_to_rdev(
187 					netdev->ieee80211_ptr->wiphy);
188 			else
189 				tmp = NULL;
190 
191 			/* not wireless device -- return error */
192 			if (!tmp)
193 				return ERR_PTR(-EINVAL);
194 
195 			/* mismatch -- return error */
196 			if (rdev && tmp != rdev)
197 				return ERR_PTR(-EINVAL);
198 
199 			rdev = tmp;
200 		}
201 	}
202 
203 	if (!rdev)
204 		return ERR_PTR(-ENODEV);
205 
206 	if (netns != wiphy_net(&rdev->wiphy))
207 		return ERR_PTR(-ENODEV);
208 
209 	return rdev;
210 }
211 
212 /*
213  * This function returns a pointer to the driver
214  * that the genl_info item that is passed refers to.
215  *
216  * The result of this can be a PTR_ERR and hence must
217  * be checked with IS_ERR() for errors.
218  */
219 static struct cfg80211_registered_device *
220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
221 {
222 	return __cfg80211_rdev_from_attrs(netns, info->attrs);
223 }
224 
225 static int validate_beacon_head(const struct nlattr *attr,
226 				struct netlink_ext_ack *extack)
227 {
228 	const u8 *data = nla_data(attr);
229 	unsigned int len = nla_len(attr);
230 	const struct element *elem;
231 	const struct ieee80211_mgmt *mgmt = (void *)data;
232 	unsigned int fixedlen, hdrlen;
233 	bool s1g_bcn;
234 
235 	if (len < offsetofend(typeof(*mgmt), frame_control))
236 		goto err;
237 
238 	s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
239 	if (s1g_bcn) {
240 		fixedlen = offsetof(struct ieee80211_ext,
241 				    u.s1g_beacon.variable);
242 		hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
243 	} else {
244 		fixedlen = offsetof(struct ieee80211_mgmt,
245 				    u.beacon.variable);
246 		hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
247 	}
248 
249 	if (len < fixedlen)
250 		goto err;
251 
252 	if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
253 		goto err;
254 
255 	data += fixedlen;
256 	len -= fixedlen;
257 
258 	for_each_element(elem, data, len) {
259 		/* nothing */
260 	}
261 
262 	if (for_each_element_completed(elem, data, len))
263 		return 0;
264 
265 err:
266 	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
267 	return -EINVAL;
268 }
269 
270 static int validate_ie_attr(const struct nlattr *attr,
271 			    struct netlink_ext_ack *extack)
272 {
273 	const u8 *data = nla_data(attr);
274 	unsigned int len = nla_len(attr);
275 	const struct element *elem;
276 
277 	for_each_element(elem, data, len) {
278 		/* nothing */
279 	}
280 
281 	if (for_each_element_completed(elem, data, len))
282 		return 0;
283 
284 	NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
285 	return -EINVAL;
286 }
287 
288 static int validate_he_capa(const struct nlattr *attr,
289 			    struct netlink_ext_ack *extack)
290 {
291 	if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
292 		return -EINVAL;
293 
294 	return 0;
295 }
296 
297 /* policy for the attributes */
298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
299 
300 static const struct nla_policy
301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
302 	[NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
303 	[NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
304 					.len = U8_MAX },
305 	[NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
306 					     .len = U8_MAX },
307 };
308 
309 static const struct nla_policy
310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
311 	[NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
312 	[NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
313 	[NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
314 		NLA_POLICY_MAX(NLA_U8, 15),
315 	[NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
316 	[NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
317 		NLA_POLICY_MAX(NLA_U8, 15),
318 	[NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
319 		NLA_POLICY_MAX(NLA_U8, 31),
320 	[NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
321 	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
322 	[NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
323 	[NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
324 	[NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
325 	[NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
326 };
327 
328 static const struct nla_policy
329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
330 	[NL80211_PMSR_TYPE_FTM] =
331 		NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
332 };
333 
334 static const struct nla_policy
335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
336 	[NL80211_PMSR_REQ_ATTR_DATA] =
337 		NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
338 	[NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
339 };
340 
341 static const struct nla_policy
342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
343 	[NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
344 	[NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
345 	[NL80211_PMSR_PEER_ATTR_REQ] =
346 		NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
347 	[NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
348 };
349 
350 static const struct nla_policy
351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
352 	[NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
353 	[NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
354 	[NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
355 	[NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
356 	[NL80211_PMSR_ATTR_PEERS] =
357 		NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
358 };
359 
360 static const struct nla_policy
361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
362 	[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
363 		NLA_POLICY_RANGE(NLA_U8, 1, 20),
364 	[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
365 		NLA_POLICY_RANGE(NLA_U8, 1, 20),
366 	[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
367 		NLA_POLICY_RANGE(NLA_U8, 1, 20),
368 	[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
369 		NLA_POLICY_EXACT_LEN(8),
370 	[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
371 		NLA_POLICY_EXACT_LEN(8),
372 	[NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
373 };
374 
375 static const struct nla_policy
376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
377 	[NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
378 	[NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
379 	[NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
380 };
381 
382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
383 	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
384 				    .len = NL80211_MAX_SUPP_RATES },
385 	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
386 				.len = NL80211_MAX_SUPP_HT_RATES },
387 	[NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
388 	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
389 	[NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
390 	[NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
391 						   NL80211_RATE_INFO_HE_GI_0_8,
392 						   NL80211_RATE_INFO_HE_GI_3_2),
393 	[NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
394 						   NL80211_RATE_INFO_HE_1XLTF,
395 						   NL80211_RATE_INFO_HE_4XLTF),
396 };
397 
398 static const struct nla_policy
399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
400 	[NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
401 	[NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
402 	[NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
403 	[NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
404 	[NL80211_TID_CONFIG_ATTR_NOACK] =
405 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
406 	[NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
407 	[NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
408 	[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
409 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
410 	[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
411 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
412 	[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
413 			NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
414 	[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
415 			NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
416 	[NL80211_TID_CONFIG_ATTR_TX_RATE] =
417 			NLA_POLICY_NESTED(nl80211_txattr_policy),
418 };
419 
420 static const struct nla_policy
421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
422 	[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
423 	[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
424 	[NL80211_FILS_DISCOVERY_ATTR_TMPL] =
425 			NLA_POLICY_RANGE(NLA_BINARY,
426 					 NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
427 					 IEEE80211_MAX_DATA_LEN),
428 };
429 
430 static const struct nla_policy
431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
432 	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
433 	[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
434 						       .len = IEEE80211_MAX_DATA_LEN }
435 };
436 
437 static const struct nla_policy
438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
439 	[NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
440 	[NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
441 };
442 
443 static const struct nla_policy
444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
445 	[NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
446 	[NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
447 };
448 
449 static const struct nla_policy
450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
451 	[NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
452 	[NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
453 						NLA_POLICY_MIN(NLA_U8, 1),
454 	[NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
455 	[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
456 	[NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
457 };
458 
459 static const struct nla_policy
460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
461 	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
462 	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
463 };
464 
465 static struct netlink_range_validation nl80211_punct_bitmap_range = {
466 	.min = 0,
467 	.max = 0xffff,
468 };
469 
470 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
471 	[0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
472 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
473 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
474 				      .len = 20-1 },
475 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
476 
477 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
478 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
479 	[NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
480 						NL80211_EDMG_CHANNELS_MIN,
481 						NL80211_EDMG_CHANNELS_MAX),
482 	[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
483 						NL80211_EDMG_BW_CONFIG_MIN,
484 						NL80211_EDMG_BW_CONFIG_MAX),
485 
486 	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
487 	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
488 	[NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
489 	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
490 
491 	[NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
492 	[NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
493 	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
494 	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
495 	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
496 	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
497 
498 	[NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
499 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
500 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
501 
502 	[NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
503 	[NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
504 
505 	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
506 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
507 				    .len = WLAN_MAX_KEY_LEN },
508 	[NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
509 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
510 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
511 	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
512 	[NL80211_ATTR_KEY_TYPE] =
513 		NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
514 
515 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
516 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
517 	[NL80211_ATTR_BEACON_HEAD] =
518 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
519 				       IEEE80211_MAX_DATA_LEN),
520 	[NL80211_ATTR_BEACON_TAIL] =
521 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
522 				       IEEE80211_MAX_DATA_LEN),
523 	[NL80211_ATTR_STA_AID] =
524 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
525 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
526 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
527 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
528 					       .len = NL80211_MAX_SUPP_RATES },
529 	[NL80211_ATTR_STA_PLINK_ACTION] =
530 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
531 	[NL80211_ATTR_STA_TX_POWER_SETTING] =
532 		NLA_POLICY_RANGE(NLA_U8,
533 				 NL80211_TX_POWER_AUTOMATIC,
534 				 NL80211_TX_POWER_FIXED),
535 	[NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
536 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
537 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
538 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
539 				   .len = IEEE80211_MAX_MESH_ID_LEN },
540 	[NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
541 
542 	/* allow 3 for NUL-termination, we used to declare this NLA_STRING */
543 	[NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
544 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
545 
546 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
547 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
548 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
549 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
550 					   .len = NL80211_MAX_SUPP_RATES },
551 	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
552 
553 	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
554 	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
555 
556 	[NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
557 
558 	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
559 	[NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
560 						   validate_ie_attr,
561 						   IEEE80211_MAX_DATA_LEN),
562 	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
563 	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
564 
565 	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
566 				.len = IEEE80211_MAX_SSID_LEN },
567 	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
568 	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
569 	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
570 	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
571 	[NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
572 						  NL80211_MFP_NO,
573 						  NL80211_MFP_OPTIONAL),
574 	[NL80211_ATTR_STA_FLAGS2] =
575 		NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
576 	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
577 	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
578 	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
579 	[NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
580 	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
581 	[NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
582 	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
583 	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
584 	[NL80211_ATTR_PID] = { .type = NLA_U32 },
585 	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
586 	[NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
587 	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
588 	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
589 	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
590 	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
591 				 .len = IEEE80211_MAX_DATA_LEN },
592 	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
593 	[NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
594 						   NL80211_PS_DISABLED,
595 						   NL80211_PS_ENABLED),
596 	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
597 	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
598 	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
599 	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
600 	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
601 	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
602 	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
603 	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
604 	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
605 	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
606 	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
607 	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
608 	[NL80211_ATTR_STA_PLINK_STATE] =
609 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
610 	[NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
611 	[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
612 	[NL80211_ATTR_MESH_PEER_AID] =
613 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
614 	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
615 	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
616 	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
617 	[NL80211_ATTR_HIDDEN_SSID] =
618 		NLA_POLICY_RANGE(NLA_U32,
619 				 NL80211_HIDDEN_SSID_NOT_IN_USE,
620 				 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
621 	[NL80211_ATTR_IE_PROBE_RESP] =
622 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
623 				       IEEE80211_MAX_DATA_LEN),
624 	[NL80211_ATTR_IE_ASSOC_RESP] =
625 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
626 				       IEEE80211_MAX_DATA_LEN),
627 	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
628 	[NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
629 	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
630 	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
631 	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
632 	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
633 	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
634 	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
635 	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
636 	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
637 	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
638 	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
639 				      .len = IEEE80211_MAX_DATA_LEN },
640 	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
641 	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
642 	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
643 		.len = NL80211_HT_CAPABILITY_LEN
644 	},
645 	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
646 	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
647 	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
648 	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
649 	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
650 
651 	/* need to include at least Auth Transaction and Status Code */
652 	[NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
653 
654 	[NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
655 	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
656 	[NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
657 	[NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
658 	[NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
659 		NLA_POLICY_RANGE(NLA_U32,
660 				 NL80211_MESH_POWER_UNKNOWN + 1,
661 				 NL80211_MESH_POWER_MAX),
662 	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
663 	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
664 	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
665 	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
666 	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
667 	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
668 	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
669 		.len = NL80211_VHT_CAPABILITY_LEN,
670 	},
671 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
672 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
673 				  .len = IEEE80211_MAX_DATA_LEN },
674 	[NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
675 	[NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
676 		NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
677 	[NL80211_ATTR_PEER_AID] =
678 		NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
679 	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
680 	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
681 	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
682 	[NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
683 	[NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
684 	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
685 	/*
686 	 * The value of the Length field of the Supported Operating
687 	 * Classes element is between 2 and 253.
688 	 */
689 	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
690 		NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
691 	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
692 	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
693 	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
694 	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
695 	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
696 	[NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
697 						  IEEE80211_QOS_MAP_LEN_MIN,
698 						  IEEE80211_QOS_MAP_LEN_MAX),
699 	[NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
700 	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
701 	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
702 	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
703 	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
704 	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
705 	[NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
706 	[NL80211_ATTR_USER_PRIO] =
707 		NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
708 	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
709 	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
710 	[NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
711 	[NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
712 	[NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
713 	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
714 	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
715 	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
716 	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
717 	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
718 	[NL80211_ATTR_STA_SUPPORT_P2P_PS] =
719 		NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
720 	[NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
721 		.len = VHT_MUMIMO_GROUPS_DATA_LEN
722 	},
723 	[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
724 	[NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
725 	[NL80211_ATTR_BANDS] = { .type = NLA_U32 },
726 	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
727 	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
728 				    .len = FILS_MAX_KEK_LEN },
729 	[NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
730 	[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
731 	[NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
732 	[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
733 	[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
734 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
735 	},
736 	[NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
737 	[NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
738 					     .len = FILS_ERP_MAX_USERNAME_LEN },
739 	[NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
740 					  .len = FILS_ERP_MAX_REALM_LEN },
741 	[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
742 	[NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
743 					.len = FILS_ERP_MAX_RRK_LEN },
744 	[NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
745 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
746 	[NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
747 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
748 	[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
749 
750 	[NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
751 	[NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
752 	[NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
753 	[NL80211_ATTR_HE_CAPABILITY] =
754 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
755 				       NL80211_HE_MAX_CAPABILITY_LEN),
756 	[NL80211_ATTR_FTM_RESPONDER] =
757 		NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
758 	[NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
759 	[NL80211_ATTR_PEER_MEASUREMENTS] =
760 		NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
761 	[NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
762 	[NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
763 					.len = SAE_PASSWORD_MAX_LEN },
764 	[NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
765 	[NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
766 	[NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
767 	[NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
768 	[NL80211_ATTR_TID_CONFIG] =
769 		NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
770 	[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
771 	[NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
772 	[NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
773 	[NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
774 	[NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
775 	[NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
776 	[NL80211_ATTR_HE_6GHZ_CAPABILITY] =
777 		NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
778 	[NL80211_ATTR_FILS_DISCOVERY] =
779 		NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
780 	[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
781 		NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
782 	[NL80211_ATTR_S1G_CAPABILITY] =
783 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
784 	[NL80211_ATTR_S1G_CAPABILITY_MASK] =
785 		NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
786 	[NL80211_ATTR_SAE_PWE] =
787 		NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
788 				 NL80211_SAE_PWE_BOTH),
789 	[NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
790 	[NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
791 	[NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
792 	[NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
793 	[NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
794 	[NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
795 	[NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
796 	[NL80211_ATTR_MBSSID_CONFIG] =
797 			NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
798 	[NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
799 	[NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
800 	[NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
801 	[NL80211_ATTR_EHT_CAPABILITY] =
802 		NLA_POLICY_RANGE(NLA_BINARY,
803 				 NL80211_EHT_MIN_CAPABILITY_LEN,
804 				 NL80211_EHT_MAX_CAPABILITY_LEN),
805 	[NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
806 	[NL80211_ATTR_MLO_LINKS] =
807 		NLA_POLICY_NESTED_ARRAY(nl80211_policy),
808 	[NL80211_ATTR_MLO_LINK_ID] =
809 		NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
810 	[NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
811 	[NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
812 	[NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
813 	[NL80211_ATTR_PUNCT_BITMAP] =
814 		NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
815 };
816 
817 /* policy for the key attributes */
818 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
819 	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
820 	[NL80211_KEY_IDX] = { .type = NLA_U8 },
821 	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
822 	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
823 	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
824 	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
825 	[NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
826 	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
827 	[NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
828 };
829 
830 /* policy for the key default flags */
831 static const struct nla_policy
832 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
833 	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
834 	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
835 };
836 
837 #ifdef CONFIG_PM
838 /* policy for WoWLAN attributes */
839 static const struct nla_policy
840 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
841 	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
842 	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
843 	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
844 	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
845 	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
846 	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
847 	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
848 	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
849 	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
850 	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
851 };
852 
853 static const struct nla_policy
854 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
855 	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
856 	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
857 	[NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
858 	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
859 	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
860 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
861 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
862 		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
863 	},
864 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
865 		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
866 	},
867 	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
868 	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
869 	[NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
870 };
871 #endif /* CONFIG_PM */
872 
873 /* policy for coalesce rule attributes */
874 static const struct nla_policy
875 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
876 	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
877 	[NL80211_ATTR_COALESCE_RULE_CONDITION] =
878 		NLA_POLICY_RANGE(NLA_U32,
879 				 NL80211_COALESCE_CONDITION_MATCH,
880 				 NL80211_COALESCE_CONDITION_NO_MATCH),
881 	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
882 };
883 
884 /* policy for GTK rekey offload attributes */
885 static const struct nla_policy
886 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
887 	[NL80211_REKEY_DATA_KEK] = {
888 		.type = NLA_BINARY,
889 		.len = NL80211_KEK_EXT_LEN
890 	},
891 	[NL80211_REKEY_DATA_KCK] = {
892 		.type = NLA_BINARY,
893 		.len = NL80211_KCK_EXT_LEN_32
894 	},
895 	[NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
896 	[NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
897 };
898 
899 static const struct nla_policy
900 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
901 	[NL80211_BAND_2GHZ] = { .type = NLA_S32 },
902 	[NL80211_BAND_5GHZ] = { .type = NLA_S32 },
903 	[NL80211_BAND_6GHZ] = { .type = NLA_S32 },
904 	[NL80211_BAND_60GHZ] = { .type = NLA_S32 },
905 	[NL80211_BAND_LC]    = { .type = NLA_S32 },
906 };
907 
908 static const struct nla_policy
909 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
910 	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
911 						 .len = IEEE80211_MAX_SSID_LEN },
912 	[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
913 	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
914 	[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
915 		NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
916 };
917 
918 static const struct nla_policy
919 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
920 	[NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
921 	[NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
922 };
923 
924 static const struct nla_policy
925 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
926 	[NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
927 	[NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
928 	[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
929 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
930 	},
931 };
932 
933 /* policy for NAN function attributes */
934 static const struct nla_policy
935 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
936 	[NL80211_NAN_FUNC_TYPE] =
937 		NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
938 	[NL80211_NAN_FUNC_SERVICE_ID] = {
939 				    .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
940 	[NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
941 	[NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
942 	[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
943 	[NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
944 	[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
945 	[NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
946 	[NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
947 	[NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
948 	[NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
949 			.len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
950 	[NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
951 	[NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
952 	[NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
953 	[NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
954 	[NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
955 };
956 
957 /* policy for Service Response Filter attributes */
958 static const struct nla_policy
959 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
960 	[NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
961 	[NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
962 				 .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
963 	[NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
964 	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
965 };
966 
967 /* policy for packet pattern attributes */
968 static const struct nla_policy
969 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
970 	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
971 	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
972 	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
973 };
974 
975 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
976 				     struct cfg80211_registered_device **rdev,
977 				     struct wireless_dev **wdev,
978 				     struct nlattr **attrbuf)
979 {
980 	int err;
981 
982 	if (!cb->args[0]) {
983 		struct nlattr **attrbuf_free = NULL;
984 
985 		if (!attrbuf) {
986 			attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
987 					  GFP_KERNEL);
988 			if (!attrbuf)
989 				return -ENOMEM;
990 			attrbuf_free = attrbuf;
991 		}
992 
993 		err = nlmsg_parse_deprecated(cb->nlh,
994 					     GENL_HDRLEN + nl80211_fam.hdrsize,
995 					     attrbuf, nl80211_fam.maxattr,
996 					     nl80211_policy, NULL);
997 		if (err) {
998 			kfree(attrbuf_free);
999 			return err;
1000 		}
1001 
1002 		rtnl_lock();
1003 		*wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1004 						   attrbuf);
1005 		kfree(attrbuf_free);
1006 		if (IS_ERR(*wdev)) {
1007 			rtnl_unlock();
1008 			return PTR_ERR(*wdev);
1009 		}
1010 		*rdev = wiphy_to_rdev((*wdev)->wiphy);
1011 		mutex_lock(&(*rdev)->wiphy.mtx);
1012 		rtnl_unlock();
1013 		/* 0 is the first index - add 1 to parse only once */
1014 		cb->args[0] = (*rdev)->wiphy_idx + 1;
1015 		cb->args[1] = (*wdev)->identifier;
1016 	} else {
1017 		/* subtract the 1 again here */
1018 		struct wiphy *wiphy;
1019 		struct wireless_dev *tmp;
1020 
1021 		rtnl_lock();
1022 		wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1023 		if (!wiphy) {
1024 			rtnl_unlock();
1025 			return -ENODEV;
1026 		}
1027 		*rdev = wiphy_to_rdev(wiphy);
1028 		*wdev = NULL;
1029 
1030 		list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1031 			if (tmp->identifier == cb->args[1]) {
1032 				*wdev = tmp;
1033 				break;
1034 			}
1035 		}
1036 
1037 		if (!*wdev) {
1038 			rtnl_unlock();
1039 			return -ENODEV;
1040 		}
1041 		mutex_lock(&(*rdev)->wiphy.mtx);
1042 		rtnl_unlock();
1043 	}
1044 
1045 	return 0;
1046 }
1047 
1048 /* message building helper */
1049 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1050 		     int flags, u8 cmd)
1051 {
1052 	/* since there is no private header just add the generic one */
1053 	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1054 }
1055 
1056 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1057 				     const struct ieee80211_reg_rule *rule)
1058 {
1059 	int j;
1060 	struct nlattr *nl_wmm_rules =
1061 		nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1062 
1063 	if (!nl_wmm_rules)
1064 		goto nla_put_failure;
1065 
1066 	for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1067 		struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1068 
1069 		if (!nl_wmm_rule)
1070 			goto nla_put_failure;
1071 
1072 		if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1073 				rule->wmm_rule.client[j].cw_min) ||
1074 		    nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1075 				rule->wmm_rule.client[j].cw_max) ||
1076 		    nla_put_u8(msg, NL80211_WMMR_AIFSN,
1077 			       rule->wmm_rule.client[j].aifsn) ||
1078 		    nla_put_u16(msg, NL80211_WMMR_TXOP,
1079 			        rule->wmm_rule.client[j].cot))
1080 			goto nla_put_failure;
1081 
1082 		nla_nest_end(msg, nl_wmm_rule);
1083 	}
1084 	nla_nest_end(msg, nl_wmm_rules);
1085 
1086 	return 0;
1087 
1088 nla_put_failure:
1089 	return -ENOBUFS;
1090 }
1091 
1092 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1093 				   struct ieee80211_channel *chan,
1094 				   bool large)
1095 {
1096 	/* Some channels must be completely excluded from the
1097 	 * list to protect old user-space tools from breaking
1098 	 */
1099 	if (!large && chan->flags &
1100 	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1101 		return 0;
1102 	if (!large && chan->freq_offset)
1103 		return 0;
1104 
1105 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1106 			chan->center_freq))
1107 		goto nla_put_failure;
1108 
1109 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1110 		goto nla_put_failure;
1111 
1112 	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1113 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1114 		goto nla_put_failure;
1115 	if (chan->flags & IEEE80211_CHAN_NO_IR) {
1116 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1117 			goto nla_put_failure;
1118 		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1119 			goto nla_put_failure;
1120 	}
1121 	if (chan->flags & IEEE80211_CHAN_RADAR) {
1122 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1123 			goto nla_put_failure;
1124 		if (large) {
1125 			u32 time;
1126 
1127 			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1128 
1129 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1130 					chan->dfs_state))
1131 				goto nla_put_failure;
1132 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1133 					time))
1134 				goto nla_put_failure;
1135 			if (nla_put_u32(msg,
1136 					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1137 					chan->dfs_cac_ms))
1138 				goto nla_put_failure;
1139 		}
1140 	}
1141 
1142 	if (large) {
1143 		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1144 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1145 			goto nla_put_failure;
1146 		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1147 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1148 			goto nla_put_failure;
1149 		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1150 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1151 			goto nla_put_failure;
1152 		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1153 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1154 			goto nla_put_failure;
1155 		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1156 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1157 			goto nla_put_failure;
1158 		if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1159 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1160 			goto nla_put_failure;
1161 		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1162 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1163 			goto nla_put_failure;
1164 		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1165 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1166 			goto nla_put_failure;
1167 		if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1168 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1169 			goto nla_put_failure;
1170 		if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1171 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1172 			goto nla_put_failure;
1173 		if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1174 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1175 			goto nla_put_failure;
1176 		if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1177 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1178 			goto nla_put_failure;
1179 		if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1180 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1181 			goto nla_put_failure;
1182 		if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1183 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1184 			goto nla_put_failure;
1185 		if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1186 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1187 			goto nla_put_failure;
1188 		if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1189 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1190 			goto nla_put_failure;
1191 	}
1192 
1193 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1194 			DBM_TO_MBM(chan->max_power)))
1195 		goto nla_put_failure;
1196 
1197 	if (large) {
1198 		const struct ieee80211_reg_rule *rule =
1199 			freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1200 
1201 		if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1202 			if (nl80211_msg_put_wmm_rules(msg, rule))
1203 				goto nla_put_failure;
1204 		}
1205 	}
1206 
1207 	return 0;
1208 
1209  nla_put_failure:
1210 	return -ENOBUFS;
1211 }
1212 
1213 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1214 				  struct cfg80211_txq_stats *txqstats,
1215 				  int attrtype)
1216 {
1217 	struct nlattr *txqattr;
1218 
1219 #define PUT_TXQVAL_U32(attr, memb) do {					  \
1220 	if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&	  \
1221 	    nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1222 		return false;						  \
1223 	} while (0)
1224 
1225 	txqattr = nla_nest_start_noflag(msg, attrtype);
1226 	if (!txqattr)
1227 		return false;
1228 
1229 	PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1230 	PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1231 	PUT_TXQVAL_U32(FLOWS, flows);
1232 	PUT_TXQVAL_U32(DROPS, drops);
1233 	PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1234 	PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1235 	PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1236 	PUT_TXQVAL_U32(COLLISIONS, collisions);
1237 	PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1238 	PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1239 	PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1240 	nla_nest_end(msg, txqattr);
1241 
1242 #undef PUT_TXQVAL_U32
1243 	return true;
1244 }
1245 
1246 /* netlink command implementations */
1247 
1248 /**
1249  * nl80211_link_id - return link ID
1250  * @attrs: attributes to look at
1251  *
1252  * Returns: the link ID or 0 if not given
1253  *
1254  * Note this function doesn't do any validation of the link
1255  * ID validity wrt. links that were actually added, so it must
1256  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1257  * or if additional validation is done.
1258  */
1259 static unsigned int nl80211_link_id(struct nlattr **attrs)
1260 {
1261 	struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1262 
1263 	if (!linkid)
1264 		return 0;
1265 
1266 	return nla_get_u8(linkid);
1267 }
1268 
1269 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1270 {
1271 	struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1272 
1273 	if (!linkid)
1274 		return -1;
1275 
1276 	return nla_get_u8(linkid);
1277 }
1278 
1279 struct key_parse {
1280 	struct key_params p;
1281 	int idx;
1282 	int type;
1283 	bool def, defmgmt, defbeacon;
1284 	bool def_uni, def_multi;
1285 };
1286 
1287 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1288 				 struct key_parse *k)
1289 {
1290 	struct nlattr *tb[NL80211_KEY_MAX + 1];
1291 	int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1292 					      nl80211_key_policy,
1293 					      info->extack);
1294 	if (err)
1295 		return err;
1296 
1297 	k->def = !!tb[NL80211_KEY_DEFAULT];
1298 	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1299 	k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1300 
1301 	if (k->def) {
1302 		k->def_uni = true;
1303 		k->def_multi = true;
1304 	}
1305 	if (k->defmgmt || k->defbeacon)
1306 		k->def_multi = true;
1307 
1308 	if (tb[NL80211_KEY_IDX])
1309 		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1310 
1311 	if (tb[NL80211_KEY_DATA]) {
1312 		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1313 		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1314 	}
1315 
1316 	if (tb[NL80211_KEY_SEQ]) {
1317 		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1318 		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1319 	}
1320 
1321 	if (tb[NL80211_KEY_CIPHER])
1322 		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1323 
1324 	if (tb[NL80211_KEY_TYPE])
1325 		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1326 
1327 	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1328 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1329 
1330 		err = nla_parse_nested_deprecated(kdt,
1331 						  NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1332 						  tb[NL80211_KEY_DEFAULT_TYPES],
1333 						  nl80211_key_default_policy,
1334 						  info->extack);
1335 		if (err)
1336 			return err;
1337 
1338 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1339 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1340 	}
1341 
1342 	if (tb[NL80211_KEY_MODE])
1343 		k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1344 
1345 	return 0;
1346 }
1347 
1348 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1349 {
1350 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1351 		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1352 		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1353 	}
1354 
1355 	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1356 		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1357 		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1358 	}
1359 
1360 	if (info->attrs[NL80211_ATTR_KEY_IDX])
1361 		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1362 
1363 	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1364 		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1365 
1366 	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1367 	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1368 
1369 	if (k->def) {
1370 		k->def_uni = true;
1371 		k->def_multi = true;
1372 	}
1373 	if (k->defmgmt)
1374 		k->def_multi = true;
1375 
1376 	if (info->attrs[NL80211_ATTR_KEY_TYPE])
1377 		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1378 
1379 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1380 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1381 		int err = nla_parse_nested_deprecated(kdt,
1382 						      NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1383 						      info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1384 						      nl80211_key_default_policy,
1385 						      info->extack);
1386 		if (err)
1387 			return err;
1388 
1389 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1390 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1391 	}
1392 
1393 	return 0;
1394 }
1395 
1396 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1397 {
1398 	int err;
1399 
1400 	memset(k, 0, sizeof(*k));
1401 	k->idx = -1;
1402 	k->type = -1;
1403 
1404 	if (info->attrs[NL80211_ATTR_KEY])
1405 		err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1406 	else
1407 		err = nl80211_parse_key_old(info, k);
1408 
1409 	if (err)
1410 		return err;
1411 
1412 	if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1413 	    (k->defbeacon ? 1 : 0) > 1) {
1414 		GENL_SET_ERR_MSG(info,
1415 				 "key with multiple default flags is invalid");
1416 		return -EINVAL;
1417 	}
1418 
1419 	if (k->defmgmt || k->defbeacon) {
1420 		if (k->def_uni || !k->def_multi) {
1421 			GENL_SET_ERR_MSG(info,
1422 					 "defmgmt/defbeacon key must be mcast");
1423 			return -EINVAL;
1424 		}
1425 	}
1426 
1427 	if (k->idx != -1) {
1428 		if (k->defmgmt) {
1429 			if (k->idx < 4 || k->idx > 5) {
1430 				GENL_SET_ERR_MSG(info,
1431 						 "defmgmt key idx not 4 or 5");
1432 				return -EINVAL;
1433 			}
1434 		} else if (k->defbeacon) {
1435 			if (k->idx < 6 || k->idx > 7) {
1436 				GENL_SET_ERR_MSG(info,
1437 						 "defbeacon key idx not 6 or 7");
1438 				return -EINVAL;
1439 			}
1440 		} else if (k->def) {
1441 			if (k->idx < 0 || k->idx > 3) {
1442 				GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1443 				return -EINVAL;
1444 			}
1445 		} else {
1446 			if (k->idx < 0 || k->idx > 7) {
1447 				GENL_SET_ERR_MSG(info, "key idx not 0-7");
1448 				return -EINVAL;
1449 			}
1450 		}
1451 	}
1452 
1453 	return 0;
1454 }
1455 
1456 static struct cfg80211_cached_keys *
1457 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1458 		       struct genl_info *info, bool *no_ht)
1459 {
1460 	struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1461 	struct key_parse parse;
1462 	struct nlattr *key;
1463 	struct cfg80211_cached_keys *result;
1464 	int rem, err, def = 0;
1465 	bool have_key = false;
1466 
1467 	nla_for_each_nested(key, keys, rem) {
1468 		have_key = true;
1469 		break;
1470 	}
1471 
1472 	if (!have_key)
1473 		return NULL;
1474 
1475 	result = kzalloc(sizeof(*result), GFP_KERNEL);
1476 	if (!result)
1477 		return ERR_PTR(-ENOMEM);
1478 
1479 	result->def = -1;
1480 
1481 	nla_for_each_nested(key, keys, rem) {
1482 		memset(&parse, 0, sizeof(parse));
1483 		parse.idx = -1;
1484 
1485 		err = nl80211_parse_key_new(info, key, &parse);
1486 		if (err)
1487 			goto error;
1488 		err = -EINVAL;
1489 		if (!parse.p.key)
1490 			goto error;
1491 		if (parse.idx < 0 || parse.idx > 3) {
1492 			GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1493 			goto error;
1494 		}
1495 		if (parse.def) {
1496 			if (def) {
1497 				GENL_SET_ERR_MSG(info,
1498 						 "only one key can be default");
1499 				goto error;
1500 			}
1501 			def = 1;
1502 			result->def = parse.idx;
1503 			if (!parse.def_uni || !parse.def_multi)
1504 				goto error;
1505 		} else if (parse.defmgmt)
1506 			goto error;
1507 		err = cfg80211_validate_key_settings(rdev, &parse.p,
1508 						     parse.idx, false, NULL);
1509 		if (err)
1510 			goto error;
1511 		if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1512 		    parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1513 			GENL_SET_ERR_MSG(info, "connect key must be WEP");
1514 			err = -EINVAL;
1515 			goto error;
1516 		}
1517 		result->params[parse.idx].cipher = parse.p.cipher;
1518 		result->params[parse.idx].key_len = parse.p.key_len;
1519 		result->params[parse.idx].key = result->data[parse.idx];
1520 		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1521 
1522 		/* must be WEP key if we got here */
1523 		if (no_ht)
1524 			*no_ht = true;
1525 	}
1526 
1527 	if (result->def < 0) {
1528 		err = -EINVAL;
1529 		GENL_SET_ERR_MSG(info, "need a default/TX key");
1530 		goto error;
1531 	}
1532 
1533 	return result;
1534  error:
1535 	kfree(result);
1536 	return ERR_PTR(err);
1537 }
1538 
1539 static int nl80211_key_allowed(struct wireless_dev *wdev)
1540 {
1541 	ASSERT_WDEV_LOCK(wdev);
1542 
1543 	switch (wdev->iftype) {
1544 	case NL80211_IFTYPE_AP:
1545 	case NL80211_IFTYPE_AP_VLAN:
1546 	case NL80211_IFTYPE_P2P_GO:
1547 	case NL80211_IFTYPE_MESH_POINT:
1548 		break;
1549 	case NL80211_IFTYPE_ADHOC:
1550 		if (wdev->u.ibss.current_bss)
1551 			return 0;
1552 		return -ENOLINK;
1553 	case NL80211_IFTYPE_STATION:
1554 	case NL80211_IFTYPE_P2P_CLIENT:
1555 		if (wdev->connected)
1556 			return 0;
1557 		return -ENOLINK;
1558 	case NL80211_IFTYPE_NAN:
1559 		if (wiphy_ext_feature_isset(wdev->wiphy,
1560 					    NL80211_EXT_FEATURE_SECURE_NAN))
1561 			return 0;
1562 		return -EINVAL;
1563 	case NL80211_IFTYPE_UNSPECIFIED:
1564 	case NL80211_IFTYPE_OCB:
1565 	case NL80211_IFTYPE_MONITOR:
1566 	case NL80211_IFTYPE_P2P_DEVICE:
1567 	case NL80211_IFTYPE_WDS:
1568 	case NUM_NL80211_IFTYPES:
1569 		return -EINVAL;
1570 	}
1571 
1572 	return 0;
1573 }
1574 
1575 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1576 							u32 freq)
1577 {
1578 	struct ieee80211_channel *chan;
1579 
1580 	chan = ieee80211_get_channel_khz(wiphy, freq);
1581 	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1582 		return NULL;
1583 	return chan;
1584 }
1585 
1586 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1587 {
1588 	struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1589 	int i;
1590 
1591 	if (!nl_modes)
1592 		goto nla_put_failure;
1593 
1594 	i = 0;
1595 	while (ifmodes) {
1596 		if ((ifmodes & 1) && nla_put_flag(msg, i))
1597 			goto nla_put_failure;
1598 		ifmodes >>= 1;
1599 		i++;
1600 	}
1601 
1602 	nla_nest_end(msg, nl_modes);
1603 	return 0;
1604 
1605 nla_put_failure:
1606 	return -ENOBUFS;
1607 }
1608 
1609 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1610 					  struct sk_buff *msg,
1611 					  bool large)
1612 {
1613 	struct nlattr *nl_combis;
1614 	int i, j;
1615 
1616 	nl_combis = nla_nest_start_noflag(msg,
1617 					  NL80211_ATTR_INTERFACE_COMBINATIONS);
1618 	if (!nl_combis)
1619 		goto nla_put_failure;
1620 
1621 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
1622 		const struct ieee80211_iface_combination *c;
1623 		struct nlattr *nl_combi, *nl_limits;
1624 
1625 		c = &wiphy->iface_combinations[i];
1626 
1627 		nl_combi = nla_nest_start_noflag(msg, i + 1);
1628 		if (!nl_combi)
1629 			goto nla_put_failure;
1630 
1631 		nl_limits = nla_nest_start_noflag(msg,
1632 						  NL80211_IFACE_COMB_LIMITS);
1633 		if (!nl_limits)
1634 			goto nla_put_failure;
1635 
1636 		for (j = 0; j < c->n_limits; j++) {
1637 			struct nlattr *nl_limit;
1638 
1639 			nl_limit = nla_nest_start_noflag(msg, j + 1);
1640 			if (!nl_limit)
1641 				goto nla_put_failure;
1642 			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1643 					c->limits[j].max))
1644 				goto nla_put_failure;
1645 			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1646 						c->limits[j].types))
1647 				goto nla_put_failure;
1648 			nla_nest_end(msg, nl_limit);
1649 		}
1650 
1651 		nla_nest_end(msg, nl_limits);
1652 
1653 		if (c->beacon_int_infra_match &&
1654 		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1655 			goto nla_put_failure;
1656 		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1657 				c->num_different_channels) ||
1658 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1659 				c->max_interfaces))
1660 			goto nla_put_failure;
1661 		if (large &&
1662 		    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1663 				c->radar_detect_widths) ||
1664 		     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1665 				c->radar_detect_regions)))
1666 			goto nla_put_failure;
1667 		if (c->beacon_int_min_gcd &&
1668 		    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1669 				c->beacon_int_min_gcd))
1670 			goto nla_put_failure;
1671 
1672 		nla_nest_end(msg, nl_combi);
1673 	}
1674 
1675 	nla_nest_end(msg, nl_combis);
1676 
1677 	return 0;
1678 nla_put_failure:
1679 	return -ENOBUFS;
1680 }
1681 
1682 #ifdef CONFIG_PM
1683 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1684 					struct sk_buff *msg)
1685 {
1686 	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1687 	struct nlattr *nl_tcp;
1688 
1689 	if (!tcp)
1690 		return 0;
1691 
1692 	nl_tcp = nla_nest_start_noflag(msg,
1693 				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1694 	if (!nl_tcp)
1695 		return -ENOBUFS;
1696 
1697 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1698 			tcp->data_payload_max))
1699 		return -ENOBUFS;
1700 
1701 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1702 			tcp->data_payload_max))
1703 		return -ENOBUFS;
1704 
1705 	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1706 		return -ENOBUFS;
1707 
1708 	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1709 				sizeof(*tcp->tok), tcp->tok))
1710 		return -ENOBUFS;
1711 
1712 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1713 			tcp->data_interval_max))
1714 		return -ENOBUFS;
1715 
1716 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1717 			tcp->wake_payload_max))
1718 		return -ENOBUFS;
1719 
1720 	nla_nest_end(msg, nl_tcp);
1721 	return 0;
1722 }
1723 
1724 static int nl80211_send_wowlan(struct sk_buff *msg,
1725 			       struct cfg80211_registered_device *rdev,
1726 			       bool large)
1727 {
1728 	struct nlattr *nl_wowlan;
1729 
1730 	if (!rdev->wiphy.wowlan)
1731 		return 0;
1732 
1733 	nl_wowlan = nla_nest_start_noflag(msg,
1734 					  NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1735 	if (!nl_wowlan)
1736 		return -ENOBUFS;
1737 
1738 	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1739 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1740 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1741 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1742 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1743 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1744 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1745 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1746 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1747 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1748 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1749 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1750 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1751 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1752 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1753 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1754 		return -ENOBUFS;
1755 
1756 	if (rdev->wiphy.wowlan->n_patterns) {
1757 		struct nl80211_pattern_support pat = {
1758 			.max_patterns = rdev->wiphy.wowlan->n_patterns,
1759 			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1760 			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1761 			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1762 		};
1763 
1764 		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1765 			    sizeof(pat), &pat))
1766 			return -ENOBUFS;
1767 	}
1768 
1769 	if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1770 	    nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1771 			rdev->wiphy.wowlan->max_nd_match_sets))
1772 		return -ENOBUFS;
1773 
1774 	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1775 		return -ENOBUFS;
1776 
1777 	nla_nest_end(msg, nl_wowlan);
1778 
1779 	return 0;
1780 }
1781 #endif
1782 
1783 static int nl80211_send_coalesce(struct sk_buff *msg,
1784 				 struct cfg80211_registered_device *rdev)
1785 {
1786 	struct nl80211_coalesce_rule_support rule;
1787 
1788 	if (!rdev->wiphy.coalesce)
1789 		return 0;
1790 
1791 	rule.max_rules = rdev->wiphy.coalesce->n_rules;
1792 	rule.max_delay = rdev->wiphy.coalesce->max_delay;
1793 	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1794 	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1795 	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1796 	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1797 
1798 	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1799 		return -ENOBUFS;
1800 
1801 	return 0;
1802 }
1803 
1804 static int
1805 nl80211_send_iftype_data(struct sk_buff *msg,
1806 			 const struct ieee80211_supported_band *sband,
1807 			 const struct ieee80211_sband_iftype_data *iftdata)
1808 {
1809 	const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1810 	const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1811 
1812 	if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1813 				iftdata->types_mask))
1814 		return -ENOBUFS;
1815 
1816 	if (he_cap->has_he) {
1817 		if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1818 			    sizeof(he_cap->he_cap_elem.mac_cap_info),
1819 			    he_cap->he_cap_elem.mac_cap_info) ||
1820 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1821 			    sizeof(he_cap->he_cap_elem.phy_cap_info),
1822 			    he_cap->he_cap_elem.phy_cap_info) ||
1823 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1824 			    sizeof(he_cap->he_mcs_nss_supp),
1825 			    &he_cap->he_mcs_nss_supp) ||
1826 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1827 			    sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1828 			return -ENOBUFS;
1829 	}
1830 
1831 	if (eht_cap->has_eht && he_cap->has_he) {
1832 		u8 mcs_nss_size, ppe_thresh_size;
1833 		u16 ppe_thres_hdr;
1834 		bool is_ap;
1835 
1836 		is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1837 			iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1838 
1839 		mcs_nss_size =
1840 			ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1841 						   &eht_cap->eht_cap_elem,
1842 						   is_ap);
1843 
1844 		ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1845 		ppe_thresh_size =
1846 			ieee80211_eht_ppe_size(ppe_thres_hdr,
1847 					       eht_cap->eht_cap_elem.phy_cap_info);
1848 
1849 		if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1850 			    sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1851 			    eht_cap->eht_cap_elem.mac_cap_info) ||
1852 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1853 			    sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1854 			    eht_cap->eht_cap_elem.phy_cap_info) ||
1855 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1856 			    mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1857 		    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1858 			    ppe_thresh_size, eht_cap->eht_ppe_thres))
1859 			return -ENOBUFS;
1860 	}
1861 
1862 	if (sband->band == NL80211_BAND_6GHZ &&
1863 	    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1864 		    sizeof(iftdata->he_6ghz_capa),
1865 		    &iftdata->he_6ghz_capa))
1866 		return -ENOBUFS;
1867 
1868 	if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1869 	    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1870 		    iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1871 		return -ENOBUFS;
1872 
1873 	return 0;
1874 }
1875 
1876 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1877 				      struct ieee80211_supported_band *sband,
1878 				      bool large)
1879 {
1880 	struct nlattr *nl_rates, *nl_rate;
1881 	struct ieee80211_rate *rate;
1882 	int i;
1883 
1884 	/* add HT info */
1885 	if (sband->ht_cap.ht_supported &&
1886 	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1887 		     sizeof(sband->ht_cap.mcs),
1888 		     &sband->ht_cap.mcs) ||
1889 	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1890 			 sband->ht_cap.cap) ||
1891 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1892 			sband->ht_cap.ampdu_factor) ||
1893 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1894 			sband->ht_cap.ampdu_density)))
1895 		return -ENOBUFS;
1896 
1897 	/* add VHT info */
1898 	if (sband->vht_cap.vht_supported &&
1899 	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1900 		     sizeof(sband->vht_cap.vht_mcs),
1901 		     &sband->vht_cap.vht_mcs) ||
1902 	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1903 			 sband->vht_cap.cap)))
1904 		return -ENOBUFS;
1905 
1906 	if (large && sband->n_iftype_data) {
1907 		struct nlattr *nl_iftype_data =
1908 			nla_nest_start_noflag(msg,
1909 					      NL80211_BAND_ATTR_IFTYPE_DATA);
1910 		int err;
1911 
1912 		if (!nl_iftype_data)
1913 			return -ENOBUFS;
1914 
1915 		for (i = 0; i < sband->n_iftype_data; i++) {
1916 			struct nlattr *iftdata;
1917 
1918 			iftdata = nla_nest_start_noflag(msg, i + 1);
1919 			if (!iftdata)
1920 				return -ENOBUFS;
1921 
1922 			err = nl80211_send_iftype_data(msg, sband,
1923 						       &sband->iftype_data[i]);
1924 			if (err)
1925 				return err;
1926 
1927 			nla_nest_end(msg, iftdata);
1928 		}
1929 
1930 		nla_nest_end(msg, nl_iftype_data);
1931 	}
1932 
1933 	/* add EDMG info */
1934 	if (large && sband->edmg_cap.channels &&
1935 	    (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1936 		       sband->edmg_cap.channels) ||
1937 	    nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1938 		       sband->edmg_cap.bw_config)))
1939 
1940 		return -ENOBUFS;
1941 
1942 	/* add bitrates */
1943 	nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1944 	if (!nl_rates)
1945 		return -ENOBUFS;
1946 
1947 	for (i = 0; i < sband->n_bitrates; i++) {
1948 		nl_rate = nla_nest_start_noflag(msg, i);
1949 		if (!nl_rate)
1950 			return -ENOBUFS;
1951 
1952 		rate = &sband->bitrates[i];
1953 		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1954 				rate->bitrate))
1955 			return -ENOBUFS;
1956 		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1957 		    nla_put_flag(msg,
1958 				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1959 			return -ENOBUFS;
1960 
1961 		nla_nest_end(msg, nl_rate);
1962 	}
1963 
1964 	nla_nest_end(msg, nl_rates);
1965 
1966 	return 0;
1967 }
1968 
1969 static int
1970 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1971 			 const struct ieee80211_txrx_stypes *mgmt_stypes)
1972 {
1973 	u16 stypes;
1974 	struct nlattr *nl_ftypes, *nl_ifs;
1975 	enum nl80211_iftype ift;
1976 	int i;
1977 
1978 	if (!mgmt_stypes)
1979 		return 0;
1980 
1981 	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1982 	if (!nl_ifs)
1983 		return -ENOBUFS;
1984 
1985 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1986 		nl_ftypes = nla_nest_start_noflag(msg, ift);
1987 		if (!nl_ftypes)
1988 			return -ENOBUFS;
1989 		i = 0;
1990 		stypes = mgmt_stypes[ift].tx;
1991 		while (stypes) {
1992 			if ((stypes & 1) &&
1993 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1994 					(i << 4) | IEEE80211_FTYPE_MGMT))
1995 				return -ENOBUFS;
1996 			stypes >>= 1;
1997 			i++;
1998 		}
1999 		nla_nest_end(msg, nl_ftypes);
2000 	}
2001 
2002 	nla_nest_end(msg, nl_ifs);
2003 
2004 	nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2005 	if (!nl_ifs)
2006 		return -ENOBUFS;
2007 
2008 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2009 		nl_ftypes = nla_nest_start_noflag(msg, ift);
2010 		if (!nl_ftypes)
2011 			return -ENOBUFS;
2012 		i = 0;
2013 		stypes = mgmt_stypes[ift].rx;
2014 		while (stypes) {
2015 			if ((stypes & 1) &&
2016 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2017 					(i << 4) | IEEE80211_FTYPE_MGMT))
2018 				return -ENOBUFS;
2019 			stypes >>= 1;
2020 			i++;
2021 		}
2022 		nla_nest_end(msg, nl_ftypes);
2023 	}
2024 	nla_nest_end(msg, nl_ifs);
2025 
2026 	return 0;
2027 }
2028 
2029 #define CMD(op, n)							\
2030 	 do {								\
2031 		if (rdev->ops->op) {					\
2032 			i++;						\
2033 			if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) 	\
2034 				goto nla_put_failure;			\
2035 		}							\
2036 	} while (0)
2037 
2038 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2039 					struct sk_buff *msg)
2040 {
2041 	int i = 0;
2042 
2043 	/*
2044 	 * do *NOT* add anything into this function, new things need to be
2045 	 * advertised only to new versions of userspace that can deal with
2046 	 * the split (and they can't possibly care about new features...
2047 	 */
2048 	CMD(add_virtual_intf, NEW_INTERFACE);
2049 	CMD(change_virtual_intf, SET_INTERFACE);
2050 	CMD(add_key, NEW_KEY);
2051 	CMD(start_ap, START_AP);
2052 	CMD(add_station, NEW_STATION);
2053 	CMD(add_mpath, NEW_MPATH);
2054 	CMD(update_mesh_config, SET_MESH_CONFIG);
2055 	CMD(change_bss, SET_BSS);
2056 	CMD(auth, AUTHENTICATE);
2057 	CMD(assoc, ASSOCIATE);
2058 	CMD(deauth, DEAUTHENTICATE);
2059 	CMD(disassoc, DISASSOCIATE);
2060 	CMD(join_ibss, JOIN_IBSS);
2061 	CMD(join_mesh, JOIN_MESH);
2062 	CMD(set_pmksa, SET_PMKSA);
2063 	CMD(del_pmksa, DEL_PMKSA);
2064 	CMD(flush_pmksa, FLUSH_PMKSA);
2065 	if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2066 		CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2067 	CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2068 	CMD(mgmt_tx, FRAME);
2069 	CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2070 	if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2071 		i++;
2072 		if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2073 			goto nla_put_failure;
2074 	}
2075 	if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2076 	    rdev->ops->join_mesh) {
2077 		i++;
2078 		if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2079 			goto nla_put_failure;
2080 	}
2081 	if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2082 		CMD(tdls_mgmt, TDLS_MGMT);
2083 		CMD(tdls_oper, TDLS_OPER);
2084 	}
2085 	if (rdev->wiphy.max_sched_scan_reqs)
2086 		CMD(sched_scan_start, START_SCHED_SCAN);
2087 	CMD(probe_client, PROBE_CLIENT);
2088 	CMD(set_noack_map, SET_NOACK_MAP);
2089 	if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2090 		i++;
2091 		if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2092 			goto nla_put_failure;
2093 	}
2094 	CMD(start_p2p_device, START_P2P_DEVICE);
2095 	CMD(set_mcast_rate, SET_MCAST_RATE);
2096 #ifdef CONFIG_NL80211_TESTMODE
2097 	CMD(testmode_cmd, TESTMODE);
2098 #endif
2099 
2100 	if (rdev->ops->connect || rdev->ops->auth) {
2101 		i++;
2102 		if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2103 			goto nla_put_failure;
2104 	}
2105 
2106 	if (rdev->ops->disconnect || rdev->ops->deauth) {
2107 		i++;
2108 		if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2109 			goto nla_put_failure;
2110 	}
2111 
2112 	return i;
2113  nla_put_failure:
2114 	return -ENOBUFS;
2115 }
2116 
2117 static int
2118 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2119 			   struct sk_buff *msg)
2120 {
2121 	struct nlattr *ftm;
2122 
2123 	if (!cap->ftm.supported)
2124 		return 0;
2125 
2126 	ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2127 	if (!ftm)
2128 		return -ENOBUFS;
2129 
2130 	if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2131 		return -ENOBUFS;
2132 	if (cap->ftm.non_asap &&
2133 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2134 		return -ENOBUFS;
2135 	if (cap->ftm.request_lci &&
2136 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2137 		return -ENOBUFS;
2138 	if (cap->ftm.request_civicloc &&
2139 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2140 		return -ENOBUFS;
2141 	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2142 			cap->ftm.preambles))
2143 		return -ENOBUFS;
2144 	if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2145 			cap->ftm.bandwidths))
2146 		return -ENOBUFS;
2147 	if (cap->ftm.max_bursts_exponent >= 0 &&
2148 	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2149 			cap->ftm.max_bursts_exponent))
2150 		return -ENOBUFS;
2151 	if (cap->ftm.max_ftms_per_burst &&
2152 	    nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2153 			cap->ftm.max_ftms_per_burst))
2154 		return -ENOBUFS;
2155 	if (cap->ftm.trigger_based &&
2156 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2157 		return -ENOBUFS;
2158 	if (cap->ftm.non_trigger_based &&
2159 	    nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2160 		return -ENOBUFS;
2161 
2162 	nla_nest_end(msg, ftm);
2163 	return 0;
2164 }
2165 
2166 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2167 				  struct sk_buff *msg)
2168 {
2169 	const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2170 	struct nlattr *pmsr, *caps;
2171 
2172 	if (!cap)
2173 		return 0;
2174 
2175 	/*
2176 	 * we don't need to clean up anything here since the caller
2177 	 * will genlmsg_cancel() if we fail
2178 	 */
2179 
2180 	pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2181 	if (!pmsr)
2182 		return -ENOBUFS;
2183 
2184 	if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2185 		return -ENOBUFS;
2186 
2187 	if (cap->report_ap_tsf &&
2188 	    nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2189 		return -ENOBUFS;
2190 
2191 	if (cap->randomize_mac_addr &&
2192 	    nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2193 		return -ENOBUFS;
2194 
2195 	caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2196 	if (!caps)
2197 		return -ENOBUFS;
2198 
2199 	if (nl80211_send_pmsr_ftm_capa(cap, msg))
2200 		return -ENOBUFS;
2201 
2202 	nla_nest_end(msg, caps);
2203 	nla_nest_end(msg, pmsr);
2204 
2205 	return 0;
2206 }
2207 
2208 static int
2209 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2210 			      struct sk_buff *msg)
2211 {
2212 	int i;
2213 	struct nlattr *nested, *nested_akms;
2214 	const struct wiphy_iftype_akm_suites *iftype_akms;
2215 
2216 	if (!rdev->wiphy.num_iftype_akm_suites ||
2217 	    !rdev->wiphy.iftype_akm_suites)
2218 		return 0;
2219 
2220 	nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2221 	if (!nested)
2222 		return -ENOBUFS;
2223 
2224 	for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2225 		nested_akms = nla_nest_start(msg, i + 1);
2226 		if (!nested_akms)
2227 			return -ENOBUFS;
2228 
2229 		iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2230 
2231 		if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2232 					iftype_akms->iftypes_mask))
2233 			return -ENOBUFS;
2234 
2235 		if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2236 			    sizeof(u32) * iftype_akms->n_akm_suites,
2237 			    iftype_akms->akm_suites)) {
2238 			return -ENOBUFS;
2239 		}
2240 		nla_nest_end(msg, nested_akms);
2241 	}
2242 
2243 	nla_nest_end(msg, nested);
2244 
2245 	return 0;
2246 }
2247 
2248 static int
2249 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2250 			       struct sk_buff *msg)
2251 {
2252 	struct nlattr *supp;
2253 
2254 	if (!rdev->wiphy.tid_config_support.vif &&
2255 	    !rdev->wiphy.tid_config_support.peer)
2256 		return 0;
2257 
2258 	supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2259 	if (!supp)
2260 		return -ENOSPC;
2261 
2262 	if (rdev->wiphy.tid_config_support.vif &&
2263 	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2264 			      rdev->wiphy.tid_config_support.vif,
2265 			      NL80211_TID_CONFIG_ATTR_PAD))
2266 		goto fail;
2267 
2268 	if (rdev->wiphy.tid_config_support.peer &&
2269 	    nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2270 			      rdev->wiphy.tid_config_support.peer,
2271 			      NL80211_TID_CONFIG_ATTR_PAD))
2272 		goto fail;
2273 
2274 	/* for now we just use the same value ... makes more sense */
2275 	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2276 		       rdev->wiphy.tid_config_support.max_retry))
2277 		goto fail;
2278 	if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2279 		       rdev->wiphy.tid_config_support.max_retry))
2280 		goto fail;
2281 
2282 	nla_nest_end(msg, supp);
2283 
2284 	return 0;
2285 fail:
2286 	nla_nest_cancel(msg, supp);
2287 	return -ENOBUFS;
2288 }
2289 
2290 static int
2291 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2292 		      struct sk_buff *msg)
2293 {
2294 	struct nlattr *sar_capa, *specs, *sub_freq_range;
2295 	u8 num_freq_ranges;
2296 	int i;
2297 
2298 	if (!rdev->wiphy.sar_capa)
2299 		return 0;
2300 
2301 	num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2302 
2303 	sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2304 	if (!sar_capa)
2305 		return -ENOSPC;
2306 
2307 	if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2308 		goto fail;
2309 
2310 	specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2311 	if (!specs)
2312 		goto fail;
2313 
2314 	/* report supported freq_ranges */
2315 	for (i = 0; i < num_freq_ranges; i++) {
2316 		sub_freq_range = nla_nest_start(msg, i + 1);
2317 		if (!sub_freq_range)
2318 			goto fail;
2319 
2320 		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2321 				rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2322 			goto fail;
2323 
2324 		if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2325 				rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2326 			goto fail;
2327 
2328 		nla_nest_end(msg, sub_freq_range);
2329 	}
2330 
2331 	nla_nest_end(msg, specs);
2332 	nla_nest_end(msg, sar_capa);
2333 
2334 	return 0;
2335 fail:
2336 	nla_nest_cancel(msg, sar_capa);
2337 	return -ENOBUFS;
2338 }
2339 
2340 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2341 {
2342 	struct nlattr *config;
2343 
2344 	if (!wiphy->mbssid_max_interfaces)
2345 		return 0;
2346 
2347 	config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2348 	if (!config)
2349 		return -ENOBUFS;
2350 
2351 	if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2352 		       wiphy->mbssid_max_interfaces))
2353 		goto fail;
2354 
2355 	if (wiphy->ema_max_profile_periodicity &&
2356 	    nla_put_u8(msg,
2357 		       NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2358 		       wiphy->ema_max_profile_periodicity))
2359 		goto fail;
2360 
2361 	nla_nest_end(msg, config);
2362 	return 0;
2363 
2364 fail:
2365 	nla_nest_cancel(msg, config);
2366 	return -ENOBUFS;
2367 }
2368 
2369 struct nl80211_dump_wiphy_state {
2370 	s64 filter_wiphy;
2371 	long start;
2372 	long split_start, band_start, chan_start, capa_start;
2373 	bool split;
2374 };
2375 
2376 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2377 			      enum nl80211_commands cmd,
2378 			      struct sk_buff *msg, u32 portid, u32 seq,
2379 			      int flags, struct nl80211_dump_wiphy_state *state)
2380 {
2381 	void *hdr;
2382 	struct nlattr *nl_bands, *nl_band;
2383 	struct nlattr *nl_freqs, *nl_freq;
2384 	struct nlattr *nl_cmds;
2385 	enum nl80211_band band;
2386 	struct ieee80211_channel *chan;
2387 	int i;
2388 	const struct ieee80211_txrx_stypes *mgmt_stypes =
2389 				rdev->wiphy.mgmt_stypes;
2390 	u32 features;
2391 
2392 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2393 	if (!hdr)
2394 		return -ENOBUFS;
2395 
2396 	if (WARN_ON(!state))
2397 		return -EINVAL;
2398 
2399 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2400 	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2401 			   wiphy_name(&rdev->wiphy)) ||
2402 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
2403 			cfg80211_rdev_list_generation))
2404 		goto nla_put_failure;
2405 
2406 	if (cmd != NL80211_CMD_NEW_WIPHY)
2407 		goto finish;
2408 
2409 	switch (state->split_start) {
2410 	case 0:
2411 		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2412 			       rdev->wiphy.retry_short) ||
2413 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2414 			       rdev->wiphy.retry_long) ||
2415 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2416 				rdev->wiphy.frag_threshold) ||
2417 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2418 				rdev->wiphy.rts_threshold) ||
2419 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2420 			       rdev->wiphy.coverage_class) ||
2421 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2422 			       rdev->wiphy.max_scan_ssids) ||
2423 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2424 			       rdev->wiphy.max_sched_scan_ssids) ||
2425 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2426 				rdev->wiphy.max_scan_ie_len) ||
2427 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2428 				rdev->wiphy.max_sched_scan_ie_len) ||
2429 		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2430 			       rdev->wiphy.max_match_sets))
2431 			goto nla_put_failure;
2432 
2433 		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2434 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2435 			goto nla_put_failure;
2436 		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2437 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2438 			goto nla_put_failure;
2439 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2440 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2441 			goto nla_put_failure;
2442 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2443 		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2444 			goto nla_put_failure;
2445 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2446 		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2447 			goto nla_put_failure;
2448 		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2449 		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2450 			goto nla_put_failure;
2451 		state->split_start++;
2452 		if (state->split)
2453 			break;
2454 		fallthrough;
2455 	case 1:
2456 		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2457 			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
2458 			    rdev->wiphy.cipher_suites))
2459 			goto nla_put_failure;
2460 
2461 		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2462 			       rdev->wiphy.max_num_pmkids))
2463 			goto nla_put_failure;
2464 
2465 		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2466 		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2467 			goto nla_put_failure;
2468 
2469 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2470 				rdev->wiphy.available_antennas_tx) ||
2471 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2472 				rdev->wiphy.available_antennas_rx))
2473 			goto nla_put_failure;
2474 
2475 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2476 		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2477 				rdev->wiphy.probe_resp_offload))
2478 			goto nla_put_failure;
2479 
2480 		if ((rdev->wiphy.available_antennas_tx ||
2481 		     rdev->wiphy.available_antennas_rx) &&
2482 		    rdev->ops->get_antenna) {
2483 			u32 tx_ant = 0, rx_ant = 0;
2484 			int res;
2485 
2486 			res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2487 			if (!res) {
2488 				if (nla_put_u32(msg,
2489 						NL80211_ATTR_WIPHY_ANTENNA_TX,
2490 						tx_ant) ||
2491 				    nla_put_u32(msg,
2492 						NL80211_ATTR_WIPHY_ANTENNA_RX,
2493 						rx_ant))
2494 					goto nla_put_failure;
2495 			}
2496 		}
2497 
2498 		state->split_start++;
2499 		if (state->split)
2500 			break;
2501 		fallthrough;
2502 	case 2:
2503 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2504 					rdev->wiphy.interface_modes))
2505 				goto nla_put_failure;
2506 		state->split_start++;
2507 		if (state->split)
2508 			break;
2509 		fallthrough;
2510 	case 3:
2511 		nl_bands = nla_nest_start_noflag(msg,
2512 						 NL80211_ATTR_WIPHY_BANDS);
2513 		if (!nl_bands)
2514 			goto nla_put_failure;
2515 
2516 		for (band = state->band_start;
2517 		     band < (state->split ?
2518 				NUM_NL80211_BANDS :
2519 				NL80211_BAND_60GHZ + 1);
2520 		     band++) {
2521 			struct ieee80211_supported_band *sband;
2522 
2523 			/* omit higher bands for ancient software */
2524 			if (band > NL80211_BAND_5GHZ && !state->split)
2525 				break;
2526 
2527 			sband = rdev->wiphy.bands[band];
2528 
2529 			if (!sband)
2530 				continue;
2531 
2532 			nl_band = nla_nest_start_noflag(msg, band);
2533 			if (!nl_band)
2534 				goto nla_put_failure;
2535 
2536 			switch (state->chan_start) {
2537 			case 0:
2538 				if (nl80211_send_band_rateinfo(msg, sband,
2539 							       state->split))
2540 					goto nla_put_failure;
2541 				state->chan_start++;
2542 				if (state->split)
2543 					break;
2544 				fallthrough;
2545 			default:
2546 				/* add frequencies */
2547 				nl_freqs = nla_nest_start_noflag(msg,
2548 								 NL80211_BAND_ATTR_FREQS);
2549 				if (!nl_freqs)
2550 					goto nla_put_failure;
2551 
2552 				for (i = state->chan_start - 1;
2553 				     i < sband->n_channels;
2554 				     i++) {
2555 					nl_freq = nla_nest_start_noflag(msg,
2556 									i);
2557 					if (!nl_freq)
2558 						goto nla_put_failure;
2559 
2560 					chan = &sband->channels[i];
2561 
2562 					if (nl80211_msg_put_channel(
2563 							msg, &rdev->wiphy, chan,
2564 							state->split))
2565 						goto nla_put_failure;
2566 
2567 					nla_nest_end(msg, nl_freq);
2568 					if (state->split)
2569 						break;
2570 				}
2571 				if (i < sband->n_channels)
2572 					state->chan_start = i + 2;
2573 				else
2574 					state->chan_start = 0;
2575 				nla_nest_end(msg, nl_freqs);
2576 			}
2577 
2578 			nla_nest_end(msg, nl_band);
2579 
2580 			if (state->split) {
2581 				/* start again here */
2582 				if (state->chan_start)
2583 					band--;
2584 				break;
2585 			}
2586 		}
2587 		nla_nest_end(msg, nl_bands);
2588 
2589 		if (band < NUM_NL80211_BANDS)
2590 			state->band_start = band + 1;
2591 		else
2592 			state->band_start = 0;
2593 
2594 		/* if bands & channels are done, continue outside */
2595 		if (state->band_start == 0 && state->chan_start == 0)
2596 			state->split_start++;
2597 		if (state->split)
2598 			break;
2599 		fallthrough;
2600 	case 4:
2601 		nl_cmds = nla_nest_start_noflag(msg,
2602 						NL80211_ATTR_SUPPORTED_COMMANDS);
2603 		if (!nl_cmds)
2604 			goto nla_put_failure;
2605 
2606 		i = nl80211_add_commands_unsplit(rdev, msg);
2607 		if (i < 0)
2608 			goto nla_put_failure;
2609 		if (state->split) {
2610 			CMD(crit_proto_start, CRIT_PROTOCOL_START);
2611 			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2612 			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2613 				CMD(channel_switch, CHANNEL_SWITCH);
2614 			CMD(set_qos_map, SET_QOS_MAP);
2615 			if (rdev->wiphy.features &
2616 					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2617 				CMD(add_tx_ts, ADD_TX_TS);
2618 			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2619 			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2620 			CMD(update_ft_ies, UPDATE_FT_IES);
2621 			if (rdev->wiphy.sar_capa)
2622 				CMD(set_sar_specs, SET_SAR_SPECS);
2623 		}
2624 #undef CMD
2625 
2626 		nla_nest_end(msg, nl_cmds);
2627 		state->split_start++;
2628 		if (state->split)
2629 			break;
2630 		fallthrough;
2631 	case 5:
2632 		if (rdev->ops->remain_on_channel &&
2633 		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2634 		    nla_put_u32(msg,
2635 				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2636 				rdev->wiphy.max_remain_on_channel_duration))
2637 			goto nla_put_failure;
2638 
2639 		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2640 		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2641 			goto nla_put_failure;
2642 
2643 		state->split_start++;
2644 		if (state->split)
2645 			break;
2646 		fallthrough;
2647 	case 6:
2648 #ifdef CONFIG_PM
2649 		if (nl80211_send_wowlan(msg, rdev, state->split))
2650 			goto nla_put_failure;
2651 		state->split_start++;
2652 		if (state->split)
2653 			break;
2654 #else
2655 		state->split_start++;
2656 #endif
2657 		fallthrough;
2658 	case 7:
2659 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2660 					rdev->wiphy.software_iftypes))
2661 			goto nla_put_failure;
2662 
2663 		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2664 						   state->split))
2665 			goto nla_put_failure;
2666 
2667 		state->split_start++;
2668 		if (state->split)
2669 			break;
2670 		fallthrough;
2671 	case 8:
2672 		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2673 		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2674 				rdev->wiphy.ap_sme_capa))
2675 			goto nla_put_failure;
2676 
2677 		features = rdev->wiphy.features;
2678 		/*
2679 		 * We can only add the per-channel limit information if the
2680 		 * dump is split, otherwise it makes it too big. Therefore
2681 		 * only advertise it in that case.
2682 		 */
2683 		if (state->split)
2684 			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2685 		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2686 			goto nla_put_failure;
2687 
2688 		if (rdev->wiphy.ht_capa_mod_mask &&
2689 		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2690 			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
2691 			    rdev->wiphy.ht_capa_mod_mask))
2692 			goto nla_put_failure;
2693 
2694 		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2695 		    rdev->wiphy.max_acl_mac_addrs &&
2696 		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2697 				rdev->wiphy.max_acl_mac_addrs))
2698 			goto nla_put_failure;
2699 
2700 		/*
2701 		 * Any information below this point is only available to
2702 		 * applications that can deal with it being split. This
2703 		 * helps ensure that newly added capabilities don't break
2704 		 * older tools by overrunning their buffers.
2705 		 *
2706 		 * We still increment split_start so that in the split
2707 		 * case we'll continue with more data in the next round,
2708 		 * but break unconditionally so unsplit data stops here.
2709 		 */
2710 		if (state->split)
2711 			state->split_start++;
2712 		else
2713 			state->split_start = 0;
2714 		break;
2715 	case 9:
2716 		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2717 			goto nla_put_failure;
2718 
2719 		if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2720 				rdev->wiphy.max_sched_scan_plans) ||
2721 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2722 				rdev->wiphy.max_sched_scan_plan_interval) ||
2723 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2724 				rdev->wiphy.max_sched_scan_plan_iterations))
2725 			goto nla_put_failure;
2726 
2727 		if (rdev->wiphy.extended_capabilities &&
2728 		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2729 			     rdev->wiphy.extended_capabilities_len,
2730 			     rdev->wiphy.extended_capabilities) ||
2731 		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2732 			     rdev->wiphy.extended_capabilities_len,
2733 			     rdev->wiphy.extended_capabilities_mask)))
2734 			goto nla_put_failure;
2735 
2736 		if (rdev->wiphy.vht_capa_mod_mask &&
2737 		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2738 			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
2739 			    rdev->wiphy.vht_capa_mod_mask))
2740 			goto nla_put_failure;
2741 
2742 		if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2743 			    rdev->wiphy.perm_addr))
2744 			goto nla_put_failure;
2745 
2746 		if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2747 		    nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2748 			    rdev->wiphy.addr_mask))
2749 			goto nla_put_failure;
2750 
2751 		if (rdev->wiphy.n_addresses > 1) {
2752 			void *attr;
2753 
2754 			attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2755 			if (!attr)
2756 				goto nla_put_failure;
2757 
2758 			for (i = 0; i < rdev->wiphy.n_addresses; i++)
2759 				if (nla_put(msg, i + 1, ETH_ALEN,
2760 					    rdev->wiphy.addresses[i].addr))
2761 					goto nla_put_failure;
2762 
2763 			nla_nest_end(msg, attr);
2764 		}
2765 
2766 		state->split_start++;
2767 		break;
2768 	case 10:
2769 		if (nl80211_send_coalesce(msg, rdev))
2770 			goto nla_put_failure;
2771 
2772 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2773 		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2774 		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2775 			goto nla_put_failure;
2776 
2777 		if (rdev->wiphy.max_ap_assoc_sta &&
2778 		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2779 				rdev->wiphy.max_ap_assoc_sta))
2780 			goto nla_put_failure;
2781 
2782 		state->split_start++;
2783 		break;
2784 	case 11:
2785 		if (rdev->wiphy.n_vendor_commands) {
2786 			const struct nl80211_vendor_cmd_info *info;
2787 			struct nlattr *nested;
2788 
2789 			nested = nla_nest_start_noflag(msg,
2790 						       NL80211_ATTR_VENDOR_DATA);
2791 			if (!nested)
2792 				goto nla_put_failure;
2793 
2794 			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2795 				info = &rdev->wiphy.vendor_commands[i].info;
2796 				if (nla_put(msg, i + 1, sizeof(*info), info))
2797 					goto nla_put_failure;
2798 			}
2799 			nla_nest_end(msg, nested);
2800 		}
2801 
2802 		if (rdev->wiphy.n_vendor_events) {
2803 			const struct nl80211_vendor_cmd_info *info;
2804 			struct nlattr *nested;
2805 
2806 			nested = nla_nest_start_noflag(msg,
2807 						       NL80211_ATTR_VENDOR_EVENTS);
2808 			if (!nested)
2809 				goto nla_put_failure;
2810 
2811 			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2812 				info = &rdev->wiphy.vendor_events[i];
2813 				if (nla_put(msg, i + 1, sizeof(*info), info))
2814 					goto nla_put_failure;
2815 			}
2816 			nla_nest_end(msg, nested);
2817 		}
2818 		state->split_start++;
2819 		break;
2820 	case 12:
2821 		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2822 		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2823 			       rdev->wiphy.max_num_csa_counters))
2824 			goto nla_put_failure;
2825 
2826 		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2827 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2828 			goto nla_put_failure;
2829 
2830 		if (rdev->wiphy.max_sched_scan_reqs &&
2831 		    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2832 				rdev->wiphy.max_sched_scan_reqs))
2833 			goto nla_put_failure;
2834 
2835 		if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2836 			    sizeof(rdev->wiphy.ext_features),
2837 			    rdev->wiphy.ext_features))
2838 			goto nla_put_failure;
2839 
2840 		if (rdev->wiphy.bss_select_support) {
2841 			struct nlattr *nested;
2842 			u32 bss_select_support = rdev->wiphy.bss_select_support;
2843 
2844 			nested = nla_nest_start_noflag(msg,
2845 						       NL80211_ATTR_BSS_SELECT);
2846 			if (!nested)
2847 				goto nla_put_failure;
2848 
2849 			i = 0;
2850 			while (bss_select_support) {
2851 				if ((bss_select_support & 1) &&
2852 				    nla_put_flag(msg, i))
2853 					goto nla_put_failure;
2854 				i++;
2855 				bss_select_support >>= 1;
2856 			}
2857 			nla_nest_end(msg, nested);
2858 		}
2859 
2860 		state->split_start++;
2861 		break;
2862 	case 13:
2863 		if (rdev->wiphy.num_iftype_ext_capab &&
2864 		    rdev->wiphy.iftype_ext_capab) {
2865 			struct nlattr *nested_ext_capab, *nested;
2866 
2867 			nested = nla_nest_start_noflag(msg,
2868 						       NL80211_ATTR_IFTYPE_EXT_CAPA);
2869 			if (!nested)
2870 				goto nla_put_failure;
2871 
2872 			for (i = state->capa_start;
2873 			     i < rdev->wiphy.num_iftype_ext_capab; i++) {
2874 				const struct wiphy_iftype_ext_capab *capab;
2875 
2876 				capab = &rdev->wiphy.iftype_ext_capab[i];
2877 
2878 				nested_ext_capab = nla_nest_start_noflag(msg,
2879 									 i);
2880 				if (!nested_ext_capab ||
2881 				    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2882 						capab->iftype) ||
2883 				    nla_put(msg, NL80211_ATTR_EXT_CAPA,
2884 					    capab->extended_capabilities_len,
2885 					    capab->extended_capabilities) ||
2886 				    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2887 					    capab->extended_capabilities_len,
2888 					    capab->extended_capabilities_mask))
2889 					goto nla_put_failure;
2890 
2891 				if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2892 				    (nla_put_u16(msg,
2893 						 NL80211_ATTR_EML_CAPABILITY,
2894 						 capab->eml_capabilities) ||
2895 				     nla_put_u16(msg,
2896 						 NL80211_ATTR_MLD_CAPA_AND_OPS,
2897 						 capab->mld_capa_and_ops)))
2898 					goto nla_put_failure;
2899 
2900 				nla_nest_end(msg, nested_ext_capab);
2901 				if (state->split)
2902 					break;
2903 			}
2904 			nla_nest_end(msg, nested);
2905 			if (i < rdev->wiphy.num_iftype_ext_capab) {
2906 				state->capa_start = i + 1;
2907 				break;
2908 			}
2909 		}
2910 
2911 		if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2912 				rdev->wiphy.nan_supported_bands))
2913 			goto nla_put_failure;
2914 
2915 		if (wiphy_ext_feature_isset(&rdev->wiphy,
2916 					    NL80211_EXT_FEATURE_TXQS)) {
2917 			struct cfg80211_txq_stats txqstats = {};
2918 			int res;
2919 
2920 			res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2921 			if (!res &&
2922 			    !nl80211_put_txq_stats(msg, &txqstats,
2923 						   NL80211_ATTR_TXQ_STATS))
2924 				goto nla_put_failure;
2925 
2926 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2927 					rdev->wiphy.txq_limit))
2928 				goto nla_put_failure;
2929 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2930 					rdev->wiphy.txq_memory_limit))
2931 				goto nla_put_failure;
2932 			if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2933 					rdev->wiphy.txq_quantum))
2934 				goto nla_put_failure;
2935 		}
2936 
2937 		state->split_start++;
2938 		break;
2939 	case 14:
2940 		if (nl80211_send_pmsr_capa(rdev, msg))
2941 			goto nla_put_failure;
2942 
2943 		state->split_start++;
2944 		break;
2945 	case 15:
2946 		if (rdev->wiphy.akm_suites &&
2947 		    nla_put(msg, NL80211_ATTR_AKM_SUITES,
2948 			    sizeof(u32) * rdev->wiphy.n_akm_suites,
2949 			    rdev->wiphy.akm_suites))
2950 			goto nla_put_failure;
2951 
2952 		if (nl80211_put_iftype_akm_suites(rdev, msg))
2953 			goto nla_put_failure;
2954 
2955 		if (nl80211_put_tid_config_support(rdev, msg))
2956 			goto nla_put_failure;
2957 		state->split_start++;
2958 		break;
2959 	case 16:
2960 		if (nl80211_put_sar_specs(rdev, msg))
2961 			goto nla_put_failure;
2962 
2963 		if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2964 			goto nla_put_failure;
2965 
2966 		if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2967 				rdev->wiphy.max_num_akm_suites))
2968 			goto nla_put_failure;
2969 
2970 		if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2971 			nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2972 
2973 		/* done */
2974 		state->split_start = 0;
2975 		break;
2976 	}
2977  finish:
2978 	genlmsg_end(msg, hdr);
2979 	return 0;
2980 
2981  nla_put_failure:
2982 	genlmsg_cancel(msg, hdr);
2983 	return -EMSGSIZE;
2984 }
2985 
2986 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2987 				    struct netlink_callback *cb,
2988 				    struct nl80211_dump_wiphy_state *state)
2989 {
2990 	struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2991 	int ret;
2992 
2993 	if (!tb)
2994 		return -ENOMEM;
2995 
2996 	ret = nlmsg_parse_deprecated(cb->nlh,
2997 				     GENL_HDRLEN + nl80211_fam.hdrsize,
2998 				     tb, nl80211_fam.maxattr,
2999 				     nl80211_policy, NULL);
3000 	/* ignore parse errors for backward compatibility */
3001 	if (ret) {
3002 		ret = 0;
3003 		goto out;
3004 	}
3005 
3006 	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3007 	if (tb[NL80211_ATTR_WIPHY])
3008 		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3009 	if (tb[NL80211_ATTR_WDEV])
3010 		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3011 	if (tb[NL80211_ATTR_IFINDEX]) {
3012 		struct net_device *netdev;
3013 		struct cfg80211_registered_device *rdev;
3014 		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3015 
3016 		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3017 		if (!netdev) {
3018 			ret = -ENODEV;
3019 			goto out;
3020 		}
3021 		if (netdev->ieee80211_ptr) {
3022 			rdev = wiphy_to_rdev(
3023 				netdev->ieee80211_ptr->wiphy);
3024 			state->filter_wiphy = rdev->wiphy_idx;
3025 		}
3026 	}
3027 
3028 	ret = 0;
3029 out:
3030 	kfree(tb);
3031 	return ret;
3032 }
3033 
3034 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3035 {
3036 	int idx = 0, ret;
3037 	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3038 	struct cfg80211_registered_device *rdev;
3039 
3040 	rtnl_lock();
3041 	if (!state) {
3042 		state = kzalloc(sizeof(*state), GFP_KERNEL);
3043 		if (!state) {
3044 			rtnl_unlock();
3045 			return -ENOMEM;
3046 		}
3047 		state->filter_wiphy = -1;
3048 		ret = nl80211_dump_wiphy_parse(skb, cb, state);
3049 		if (ret) {
3050 			kfree(state);
3051 			rtnl_unlock();
3052 			return ret;
3053 		}
3054 		cb->args[0] = (long)state;
3055 	}
3056 
3057 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3058 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3059 			continue;
3060 		if (++idx <= state->start)
3061 			continue;
3062 		if (state->filter_wiphy != -1 &&
3063 		    state->filter_wiphy != rdev->wiphy_idx)
3064 			continue;
3065 		/* attempt to fit multiple wiphy data chunks into the skb */
3066 		do {
3067 			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3068 						 skb,
3069 						 NETLINK_CB(cb->skb).portid,
3070 						 cb->nlh->nlmsg_seq,
3071 						 NLM_F_MULTI, state);
3072 			if (ret < 0) {
3073 				/*
3074 				 * If sending the wiphy data didn't fit (ENOBUFS
3075 				 * or EMSGSIZE returned), this SKB is still
3076 				 * empty (so it's not too big because another
3077 				 * wiphy dataset is already in the skb) and
3078 				 * we've not tried to adjust the dump allocation
3079 				 * yet ... then adjust the alloc size to be
3080 				 * bigger, and return 1 but with the empty skb.
3081 				 * This results in an empty message being RX'ed
3082 				 * in userspace, but that is ignored.
3083 				 *
3084 				 * We can then retry with the larger buffer.
3085 				 */
3086 				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3087 				    !skb->len && !state->split &&
3088 				    cb->min_dump_alloc < 4096) {
3089 					cb->min_dump_alloc = 4096;
3090 					state->split_start = 0;
3091 					rtnl_unlock();
3092 					return 1;
3093 				}
3094 				idx--;
3095 				break;
3096 			}
3097 		} while (state->split_start > 0);
3098 		break;
3099 	}
3100 	rtnl_unlock();
3101 
3102 	state->start = idx;
3103 
3104 	return skb->len;
3105 }
3106 
3107 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3108 {
3109 	kfree((void *)cb->args[0]);
3110 	return 0;
3111 }
3112 
3113 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3114 {
3115 	struct sk_buff *msg;
3116 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3117 	struct nl80211_dump_wiphy_state state = {};
3118 
3119 	msg = nlmsg_new(4096, GFP_KERNEL);
3120 	if (!msg)
3121 		return -ENOMEM;
3122 
3123 	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3124 			       info->snd_portid, info->snd_seq, 0,
3125 			       &state) < 0) {
3126 		nlmsg_free(msg);
3127 		return -ENOBUFS;
3128 	}
3129 
3130 	return genlmsg_reply(msg, info);
3131 }
3132 
3133 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3134 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
3135 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
3136 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
3137 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
3138 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
3139 };
3140 
3141 static int parse_txq_params(struct nlattr *tb[],
3142 			    struct ieee80211_txq_params *txq_params)
3143 {
3144 	u8 ac;
3145 
3146 	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3147 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3148 	    !tb[NL80211_TXQ_ATTR_AIFS])
3149 		return -EINVAL;
3150 
3151 	ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3152 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3153 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3154 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3155 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3156 
3157 	if (ac >= NL80211_NUM_ACS)
3158 		return -EINVAL;
3159 	txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3160 	return 0;
3161 }
3162 
3163 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3164 {
3165 	/*
3166 	 * You can only set the channel explicitly for some interfaces,
3167 	 * most have their channel managed via their respective
3168 	 * "establish a connection" command (connect, join, ...)
3169 	 *
3170 	 * For AP/GO and mesh mode, the channel can be set with the
3171 	 * channel userspace API, but is only stored and passed to the
3172 	 * low-level driver when the AP starts or the mesh is joined.
3173 	 * This is for backward compatibility, userspace can also give
3174 	 * the channel in the start-ap or join-mesh commands instead.
3175 	 *
3176 	 * Monitors are special as they are normally slaved to
3177 	 * whatever else is going on, so they have their own special
3178 	 * operation to set the monitor channel if possible.
3179 	 */
3180 	return !wdev ||
3181 		wdev->iftype == NL80211_IFTYPE_AP ||
3182 		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3183 		wdev->iftype == NL80211_IFTYPE_MONITOR ||
3184 		wdev->iftype == NL80211_IFTYPE_P2P_GO;
3185 }
3186 
3187 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3188 				      struct genl_info *info,
3189 				      const struct cfg80211_chan_def *chandef,
3190 				      u16 *punct_bitmap)
3191 {
3192 	if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3193 		return -EINVAL;
3194 
3195 	*punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3196 	if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3197 		return -EINVAL;
3198 
3199 	return 0;
3200 }
3201 
3202 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3203 			  struct genl_info *info,
3204 			  struct cfg80211_chan_def *chandef)
3205 {
3206 	struct netlink_ext_ack *extack = info->extack;
3207 	struct nlattr **attrs = info->attrs;
3208 	u32 control_freq;
3209 
3210 	if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3211 		NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3212 				    "Frequency is missing");
3213 		return -EINVAL;
3214 	}
3215 
3216 	control_freq = MHZ_TO_KHZ(
3217 			nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3218 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3219 		control_freq +=
3220 		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3221 
3222 	memset(chandef, 0, sizeof(*chandef));
3223 	chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3224 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3225 	chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3226 	chandef->freq1_offset = control_freq % 1000;
3227 	chandef->center_freq2 = 0;
3228 
3229 	/* Primary channel not allowed */
3230 	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3231 		NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3232 				    "Channel is disabled");
3233 		return -EINVAL;
3234 	}
3235 
3236 	if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3237 		enum nl80211_channel_type chantype;
3238 
3239 		chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3240 
3241 		switch (chantype) {
3242 		case NL80211_CHAN_NO_HT:
3243 		case NL80211_CHAN_HT20:
3244 		case NL80211_CHAN_HT40PLUS:
3245 		case NL80211_CHAN_HT40MINUS:
3246 			cfg80211_chandef_create(chandef, chandef->chan,
3247 						chantype);
3248 			/* user input for center_freq is incorrect */
3249 			if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3250 			    chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3251 				NL_SET_ERR_MSG_ATTR(extack,
3252 						    attrs[NL80211_ATTR_CENTER_FREQ1],
3253 						    "bad center frequency 1");
3254 				return -EINVAL;
3255 			}
3256 			/* center_freq2 must be zero */
3257 			if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3258 			    nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3259 				NL_SET_ERR_MSG_ATTR(extack,
3260 						    attrs[NL80211_ATTR_CENTER_FREQ2],
3261 						    "center frequency 2 can't be used");
3262 				return -EINVAL;
3263 			}
3264 			break;
3265 		default:
3266 			NL_SET_ERR_MSG_ATTR(extack,
3267 					    attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3268 					    "invalid channel type");
3269 			return -EINVAL;
3270 		}
3271 	} else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3272 		chandef->width =
3273 			nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3274 		if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3275 			/* User input error for channel width doesn't match channel  */
3276 			if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3277 				NL_SET_ERR_MSG_ATTR(extack,
3278 						    attrs[NL80211_ATTR_CHANNEL_WIDTH],
3279 						    "bad channel width");
3280 				return -EINVAL;
3281 			}
3282 		}
3283 		if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3284 			chandef->center_freq1 =
3285 				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3286 			if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3287 				chandef->freq1_offset = nla_get_u32(
3288 				      attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3289 			else
3290 				chandef->freq1_offset = 0;
3291 		}
3292 		if (attrs[NL80211_ATTR_CENTER_FREQ2])
3293 			chandef->center_freq2 =
3294 				nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3295 	}
3296 
3297 	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3298 		chandef->edmg.channels =
3299 		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3300 
3301 		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3302 			chandef->edmg.bw_config =
3303 		     nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3304 	} else {
3305 		chandef->edmg.bw_config = 0;
3306 		chandef->edmg.channels = 0;
3307 	}
3308 
3309 	if (!cfg80211_chandef_valid(chandef)) {
3310 		NL_SET_ERR_MSG(extack, "invalid channel definition");
3311 		return -EINVAL;
3312 	}
3313 
3314 	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3315 				     IEEE80211_CHAN_DISABLED)) {
3316 		NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3317 		return -EINVAL;
3318 	}
3319 
3320 	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3321 	     chandef->width == NL80211_CHAN_WIDTH_10) &&
3322 	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3323 		NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3324 		return -EINVAL;
3325 	}
3326 
3327 	return 0;
3328 }
3329 
3330 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3331 				 struct net_device *dev,
3332 				 struct genl_info *info,
3333 				 int _link_id)
3334 {
3335 	struct cfg80211_chan_def chandef;
3336 	int result;
3337 	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3338 	struct wireless_dev *wdev = NULL;
3339 	int link_id = _link_id;
3340 
3341 	if (dev)
3342 		wdev = dev->ieee80211_ptr;
3343 	if (!nl80211_can_set_dev_channel(wdev))
3344 		return -EOPNOTSUPP;
3345 	if (wdev)
3346 		iftype = wdev->iftype;
3347 
3348 	if (link_id < 0) {
3349 		if (wdev && wdev->valid_links)
3350 			return -EINVAL;
3351 		link_id = 0;
3352 	}
3353 
3354 	result = nl80211_parse_chandef(rdev, info, &chandef);
3355 	if (result)
3356 		return result;
3357 
3358 	switch (iftype) {
3359 	case NL80211_IFTYPE_AP:
3360 	case NL80211_IFTYPE_P2P_GO:
3361 		if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3362 						   iftype))
3363 			return -EINVAL;
3364 		if (wdev->links[link_id].ap.beacon_interval) {
3365 			struct ieee80211_channel *cur_chan;
3366 
3367 			if (!dev || !rdev->ops->set_ap_chanwidth ||
3368 			    !(rdev->wiphy.features &
3369 			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3370 				return -EBUSY;
3371 
3372 			/* Only allow dynamic channel width changes */
3373 			cur_chan = wdev->links[link_id].ap.chandef.chan;
3374 			if (chandef.chan != cur_chan)
3375 				return -EBUSY;
3376 
3377 			result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3378 						       &chandef);
3379 			if (result)
3380 				return result;
3381 			wdev->links[link_id].ap.chandef = chandef;
3382 		} else {
3383 			wdev->u.ap.preset_chandef = chandef;
3384 		}
3385 		return 0;
3386 	case NL80211_IFTYPE_MESH_POINT:
3387 		return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3388 	case NL80211_IFTYPE_MONITOR:
3389 		return cfg80211_set_monitor_channel(rdev, &chandef);
3390 	default:
3391 		break;
3392 	}
3393 
3394 	return -EINVAL;
3395 }
3396 
3397 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3398 {
3399 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3400 	int link_id = nl80211_link_id_or_invalid(info->attrs);
3401 	struct net_device *netdev = info->user_ptr[1];
3402 	int ret;
3403 
3404 	wdev_lock(netdev->ieee80211_ptr);
3405 	ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3406 	wdev_unlock(netdev->ieee80211_ptr);
3407 
3408 	return ret;
3409 }
3410 
3411 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3412 {
3413 	struct cfg80211_registered_device *rdev = NULL;
3414 	struct net_device *netdev = NULL;
3415 	struct wireless_dev *wdev;
3416 	int result = 0, rem_txq_params = 0;
3417 	struct nlattr *nl_txq_params;
3418 	u32 changed;
3419 	u8 retry_short = 0, retry_long = 0;
3420 	u32 frag_threshold = 0, rts_threshold = 0;
3421 	u8 coverage_class = 0;
3422 	u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3423 
3424 	rtnl_lock();
3425 	/*
3426 	 * Try to find the wiphy and netdev. Normally this
3427 	 * function shouldn't need the netdev, but this is
3428 	 * done for backward compatibility -- previously
3429 	 * setting the channel was done per wiphy, but now
3430 	 * it is per netdev. Previous userland like hostapd
3431 	 * also passed a netdev to set_wiphy, so that it is
3432 	 * possible to let that go to the right netdev!
3433 	 */
3434 
3435 	if (info->attrs[NL80211_ATTR_IFINDEX]) {
3436 		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3437 
3438 		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3439 		if (netdev && netdev->ieee80211_ptr)
3440 			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3441 		else
3442 			netdev = NULL;
3443 	}
3444 
3445 	if (!netdev) {
3446 		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3447 						  info->attrs);
3448 		if (IS_ERR(rdev)) {
3449 			rtnl_unlock();
3450 			return PTR_ERR(rdev);
3451 		}
3452 		wdev = NULL;
3453 		netdev = NULL;
3454 		result = 0;
3455 	} else
3456 		wdev = netdev->ieee80211_ptr;
3457 
3458 	wiphy_lock(&rdev->wiphy);
3459 
3460 	/*
3461 	 * end workaround code, by now the rdev is available
3462 	 * and locked, and wdev may or may not be NULL.
3463 	 */
3464 
3465 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3466 		result = cfg80211_dev_rename(
3467 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3468 	rtnl_unlock();
3469 
3470 	if (result)
3471 		goto out;
3472 
3473 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3474 		struct ieee80211_txq_params txq_params;
3475 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3476 
3477 		if (!rdev->ops->set_txq_params) {
3478 			result = -EOPNOTSUPP;
3479 			goto out;
3480 		}
3481 
3482 		if (!netdev) {
3483 			result = -EINVAL;
3484 			goto out;
3485 		}
3486 
3487 		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3488 		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3489 			result = -EINVAL;
3490 			goto out;
3491 		}
3492 
3493 		if (!netif_running(netdev)) {
3494 			result = -ENETDOWN;
3495 			goto out;
3496 		}
3497 
3498 		nla_for_each_nested(nl_txq_params,
3499 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3500 				    rem_txq_params) {
3501 			result = nla_parse_nested_deprecated(tb,
3502 							     NL80211_TXQ_ATTR_MAX,
3503 							     nl_txq_params,
3504 							     txq_params_policy,
3505 							     info->extack);
3506 			if (result)
3507 				goto out;
3508 			result = parse_txq_params(tb, &txq_params);
3509 			if (result)
3510 				goto out;
3511 
3512 			txq_params.link_id =
3513 				nl80211_link_id_or_invalid(info->attrs);
3514 
3515 			wdev_lock(netdev->ieee80211_ptr);
3516 			if (txq_params.link_id >= 0 &&
3517 			    !(netdev->ieee80211_ptr->valid_links &
3518 			      BIT(txq_params.link_id)))
3519 				result = -ENOLINK;
3520 			else if (txq_params.link_id >= 0 &&
3521 				 !netdev->ieee80211_ptr->valid_links)
3522 				result = -EINVAL;
3523 			else
3524 				result = rdev_set_txq_params(rdev, netdev,
3525 							     &txq_params);
3526 			wdev_unlock(netdev->ieee80211_ptr);
3527 			if (result)
3528 				goto out;
3529 		}
3530 	}
3531 
3532 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3533 		int link_id = nl80211_link_id_or_invalid(info->attrs);
3534 
3535 		if (wdev) {
3536 			wdev_lock(wdev);
3537 			result = __nl80211_set_channel(
3538 				rdev,
3539 				nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3540 				info, link_id);
3541 			wdev_unlock(wdev);
3542 		} else {
3543 			result = __nl80211_set_channel(rdev, netdev, info, link_id);
3544 		}
3545 
3546 		if (result)
3547 			goto out;
3548 	}
3549 
3550 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3551 		struct wireless_dev *txp_wdev = wdev;
3552 		enum nl80211_tx_power_setting type;
3553 		int idx, mbm = 0;
3554 
3555 		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3556 			txp_wdev = NULL;
3557 
3558 		if (!rdev->ops->set_tx_power) {
3559 			result = -EOPNOTSUPP;
3560 			goto out;
3561 		}
3562 
3563 		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3564 		type = nla_get_u32(info->attrs[idx]);
3565 
3566 		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3567 		    (type != NL80211_TX_POWER_AUTOMATIC)) {
3568 			result = -EINVAL;
3569 			goto out;
3570 		}
3571 
3572 		if (type != NL80211_TX_POWER_AUTOMATIC) {
3573 			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3574 			mbm = nla_get_u32(info->attrs[idx]);
3575 		}
3576 
3577 		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3578 		if (result)
3579 			goto out;
3580 	}
3581 
3582 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3583 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3584 		u32 tx_ant, rx_ant;
3585 
3586 		if ((!rdev->wiphy.available_antennas_tx &&
3587 		     !rdev->wiphy.available_antennas_rx) ||
3588 		    !rdev->ops->set_antenna) {
3589 			result = -EOPNOTSUPP;
3590 			goto out;
3591 		}
3592 
3593 		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3594 		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3595 
3596 		/* reject antenna configurations which don't match the
3597 		 * available antenna masks, except for the "all" mask */
3598 		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3599 		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3600 			result = -EINVAL;
3601 			goto out;
3602 		}
3603 
3604 		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3605 		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3606 
3607 		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3608 		if (result)
3609 			goto out;
3610 	}
3611 
3612 	changed = 0;
3613 
3614 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3615 		retry_short = nla_get_u8(
3616 			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3617 
3618 		changed |= WIPHY_PARAM_RETRY_SHORT;
3619 	}
3620 
3621 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3622 		retry_long = nla_get_u8(
3623 			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3624 
3625 		changed |= WIPHY_PARAM_RETRY_LONG;
3626 	}
3627 
3628 	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3629 		frag_threshold = nla_get_u32(
3630 			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3631 		if (frag_threshold < 256) {
3632 			result = -EINVAL;
3633 			goto out;
3634 		}
3635 
3636 		if (frag_threshold != (u32) -1) {
3637 			/*
3638 			 * Fragments (apart from the last one) are required to
3639 			 * have even length. Make the fragmentation code
3640 			 * simpler by stripping LSB should someone try to use
3641 			 * odd threshold value.
3642 			 */
3643 			frag_threshold &= ~0x1;
3644 		}
3645 		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3646 	}
3647 
3648 	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3649 		rts_threshold = nla_get_u32(
3650 			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3651 		changed |= WIPHY_PARAM_RTS_THRESHOLD;
3652 	}
3653 
3654 	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3655 		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3656 			result = -EINVAL;
3657 			goto out;
3658 		}
3659 
3660 		coverage_class = nla_get_u8(
3661 			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3662 		changed |= WIPHY_PARAM_COVERAGE_CLASS;
3663 	}
3664 
3665 	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3666 		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3667 			result = -EOPNOTSUPP;
3668 			goto out;
3669 		}
3670 
3671 		changed |= WIPHY_PARAM_DYN_ACK;
3672 	}
3673 
3674 	if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3675 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3676 					     NL80211_EXT_FEATURE_TXQS)) {
3677 			result = -EOPNOTSUPP;
3678 			goto out;
3679 		}
3680 		txq_limit = nla_get_u32(
3681 			info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3682 		changed |= WIPHY_PARAM_TXQ_LIMIT;
3683 	}
3684 
3685 	if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3686 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3687 					     NL80211_EXT_FEATURE_TXQS)) {
3688 			result = -EOPNOTSUPP;
3689 			goto out;
3690 		}
3691 		txq_memory_limit = nla_get_u32(
3692 			info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3693 		changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3694 	}
3695 
3696 	if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3697 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3698 					     NL80211_EXT_FEATURE_TXQS)) {
3699 			result = -EOPNOTSUPP;
3700 			goto out;
3701 		}
3702 		txq_quantum = nla_get_u32(
3703 			info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3704 		changed |= WIPHY_PARAM_TXQ_QUANTUM;
3705 	}
3706 
3707 	if (changed) {
3708 		u8 old_retry_short, old_retry_long;
3709 		u32 old_frag_threshold, old_rts_threshold;
3710 		u8 old_coverage_class;
3711 		u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3712 
3713 		if (!rdev->ops->set_wiphy_params) {
3714 			result = -EOPNOTSUPP;
3715 			goto out;
3716 		}
3717 
3718 		old_retry_short = rdev->wiphy.retry_short;
3719 		old_retry_long = rdev->wiphy.retry_long;
3720 		old_frag_threshold = rdev->wiphy.frag_threshold;
3721 		old_rts_threshold = rdev->wiphy.rts_threshold;
3722 		old_coverage_class = rdev->wiphy.coverage_class;
3723 		old_txq_limit = rdev->wiphy.txq_limit;
3724 		old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3725 		old_txq_quantum = rdev->wiphy.txq_quantum;
3726 
3727 		if (changed & WIPHY_PARAM_RETRY_SHORT)
3728 			rdev->wiphy.retry_short = retry_short;
3729 		if (changed & WIPHY_PARAM_RETRY_LONG)
3730 			rdev->wiphy.retry_long = retry_long;
3731 		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3732 			rdev->wiphy.frag_threshold = frag_threshold;
3733 		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3734 			rdev->wiphy.rts_threshold = rts_threshold;
3735 		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3736 			rdev->wiphy.coverage_class = coverage_class;
3737 		if (changed & WIPHY_PARAM_TXQ_LIMIT)
3738 			rdev->wiphy.txq_limit = txq_limit;
3739 		if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3740 			rdev->wiphy.txq_memory_limit = txq_memory_limit;
3741 		if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3742 			rdev->wiphy.txq_quantum = txq_quantum;
3743 
3744 		result = rdev_set_wiphy_params(rdev, changed);
3745 		if (result) {
3746 			rdev->wiphy.retry_short = old_retry_short;
3747 			rdev->wiphy.retry_long = old_retry_long;
3748 			rdev->wiphy.frag_threshold = old_frag_threshold;
3749 			rdev->wiphy.rts_threshold = old_rts_threshold;
3750 			rdev->wiphy.coverage_class = old_coverage_class;
3751 			rdev->wiphy.txq_limit = old_txq_limit;
3752 			rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3753 			rdev->wiphy.txq_quantum = old_txq_quantum;
3754 			goto out;
3755 		}
3756 	}
3757 
3758 	result = 0;
3759 
3760 out:
3761 	wiphy_unlock(&rdev->wiphy);
3762 	return result;
3763 }
3764 
3765 static int nl80211_send_chandef(struct sk_buff *msg,
3766 				const struct cfg80211_chan_def *chandef)
3767 {
3768 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3769 		return -EINVAL;
3770 
3771 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3772 			chandef->chan->center_freq))
3773 		return -ENOBUFS;
3774 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3775 			chandef->chan->freq_offset))
3776 		return -ENOBUFS;
3777 	switch (chandef->width) {
3778 	case NL80211_CHAN_WIDTH_20_NOHT:
3779 	case NL80211_CHAN_WIDTH_20:
3780 	case NL80211_CHAN_WIDTH_40:
3781 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3782 				cfg80211_get_chandef_type(chandef)))
3783 			return -ENOBUFS;
3784 		break;
3785 	default:
3786 		break;
3787 	}
3788 	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3789 		return -ENOBUFS;
3790 	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3791 		return -ENOBUFS;
3792 	if (chandef->center_freq2 &&
3793 	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3794 		return -ENOBUFS;
3795 	return 0;
3796 }
3797 
3798 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3799 			      struct cfg80211_registered_device *rdev,
3800 			      struct wireless_dev *wdev,
3801 			      enum nl80211_commands cmd)
3802 {
3803 	struct net_device *dev = wdev->netdev;
3804 	void *hdr;
3805 
3806 	WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3807 		cmd != NL80211_CMD_DEL_INTERFACE &&
3808 		cmd != NL80211_CMD_SET_INTERFACE);
3809 
3810 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3811 	if (!hdr)
3812 		return -1;
3813 
3814 	if (dev &&
3815 	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3816 	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3817 		goto nla_put_failure;
3818 
3819 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3820 	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3821 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3822 			      NL80211_ATTR_PAD) ||
3823 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3824 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
3825 			rdev->devlist_generation ^
3826 			(cfg80211_rdev_list_generation << 2)) ||
3827 	    nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3828 		goto nla_put_failure;
3829 
3830 	if (rdev->ops->get_channel && !wdev->valid_links) {
3831 		struct cfg80211_chan_def chandef = {};
3832 		int ret;
3833 
3834 		ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3835 		if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3836 			goto nla_put_failure;
3837 	}
3838 
3839 	if (rdev->ops->get_tx_power) {
3840 		int dbm, ret;
3841 
3842 		ret = rdev_get_tx_power(rdev, wdev, &dbm);
3843 		if (ret == 0 &&
3844 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3845 				DBM_TO_MBM(dbm)))
3846 			goto nla_put_failure;
3847 	}
3848 
3849 	wdev_lock(wdev);
3850 	switch (wdev->iftype) {
3851 	case NL80211_IFTYPE_AP:
3852 	case NL80211_IFTYPE_P2P_GO:
3853 		if (wdev->u.ap.ssid_len &&
3854 		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3855 			    wdev->u.ap.ssid))
3856 			goto nla_put_failure_locked;
3857 		break;
3858 	case NL80211_IFTYPE_STATION:
3859 	case NL80211_IFTYPE_P2P_CLIENT:
3860 		if (wdev->u.client.ssid_len &&
3861 		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3862 			    wdev->u.client.ssid))
3863 			goto nla_put_failure_locked;
3864 		break;
3865 	case NL80211_IFTYPE_ADHOC:
3866 		if (wdev->u.ibss.ssid_len &&
3867 		    nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3868 			    wdev->u.ibss.ssid))
3869 			goto nla_put_failure_locked;
3870 		break;
3871 	default:
3872 		/* nothing */
3873 		break;
3874 	}
3875 	wdev_unlock(wdev);
3876 
3877 	if (rdev->ops->get_txq_stats) {
3878 		struct cfg80211_txq_stats txqstats = {};
3879 		int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3880 
3881 		if (ret == 0 &&
3882 		    !nl80211_put_txq_stats(msg, &txqstats,
3883 					   NL80211_ATTR_TXQ_STATS))
3884 			goto nla_put_failure;
3885 	}
3886 
3887 	if (wdev->valid_links) {
3888 		unsigned int link_id;
3889 		struct nlattr *links = nla_nest_start(msg,
3890 						      NL80211_ATTR_MLO_LINKS);
3891 
3892 		if (!links)
3893 			goto nla_put_failure;
3894 
3895 		for_each_valid_link(wdev, link_id) {
3896 			struct nlattr *link = nla_nest_start(msg, link_id + 1);
3897 			struct cfg80211_chan_def chandef = {};
3898 			int ret;
3899 
3900 			if (!link)
3901 				goto nla_put_failure;
3902 
3903 			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3904 				goto nla_put_failure;
3905 			if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3906 				    wdev->links[link_id].addr))
3907 				goto nla_put_failure;
3908 
3909 			ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3910 			if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3911 				goto nla_put_failure;
3912 
3913 			nla_nest_end(msg, link);
3914 		}
3915 
3916 		nla_nest_end(msg, links);
3917 	}
3918 
3919 	genlmsg_end(msg, hdr);
3920 	return 0;
3921 
3922  nla_put_failure_locked:
3923 	wdev_unlock(wdev);
3924  nla_put_failure:
3925 	genlmsg_cancel(msg, hdr);
3926 	return -EMSGSIZE;
3927 }
3928 
3929 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3930 {
3931 	int wp_idx = 0;
3932 	int if_idx = 0;
3933 	int wp_start = cb->args[0];
3934 	int if_start = cb->args[1];
3935 	int filter_wiphy = -1;
3936 	struct cfg80211_registered_device *rdev;
3937 	struct wireless_dev *wdev;
3938 	int ret;
3939 
3940 	rtnl_lock();
3941 	if (!cb->args[2]) {
3942 		struct nl80211_dump_wiphy_state state = {
3943 			.filter_wiphy = -1,
3944 		};
3945 
3946 		ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3947 		if (ret)
3948 			goto out_unlock;
3949 
3950 		filter_wiphy = state.filter_wiphy;
3951 
3952 		/*
3953 		 * if filtering, set cb->args[2] to +1 since 0 is the default
3954 		 * value needed to determine that parsing is necessary.
3955 		 */
3956 		if (filter_wiphy >= 0)
3957 			cb->args[2] = filter_wiphy + 1;
3958 		else
3959 			cb->args[2] = -1;
3960 	} else if (cb->args[2] > 0) {
3961 		filter_wiphy = cb->args[2] - 1;
3962 	}
3963 
3964 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3965 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3966 			continue;
3967 		if (wp_idx < wp_start) {
3968 			wp_idx++;
3969 			continue;
3970 		}
3971 
3972 		if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3973 			continue;
3974 
3975 		if_idx = 0;
3976 
3977 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3978 			if (if_idx < if_start) {
3979 				if_idx++;
3980 				continue;
3981 			}
3982 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3983 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
3984 					       rdev, wdev,
3985 					       NL80211_CMD_NEW_INTERFACE) < 0) {
3986 				goto out;
3987 			}
3988 			if_idx++;
3989 		}
3990 
3991 		wp_idx++;
3992 	}
3993  out:
3994 	cb->args[0] = wp_idx;
3995 	cb->args[1] = if_idx;
3996 
3997 	ret = skb->len;
3998  out_unlock:
3999 	rtnl_unlock();
4000 
4001 	return ret;
4002 }
4003 
4004 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4005 {
4006 	struct sk_buff *msg;
4007 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4008 	struct wireless_dev *wdev = info->user_ptr[1];
4009 
4010 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4011 	if (!msg)
4012 		return -ENOMEM;
4013 
4014 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4015 			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4016 		nlmsg_free(msg);
4017 		return -ENOBUFS;
4018 	}
4019 
4020 	return genlmsg_reply(msg, info);
4021 }
4022 
4023 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4024 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4025 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4026 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4027 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4028 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4029 	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4030 };
4031 
4032 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4033 {
4034 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4035 	int flag;
4036 
4037 	*mntrflags = 0;
4038 
4039 	if (!nla)
4040 		return -EINVAL;
4041 
4042 	if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4043 		return -EINVAL;
4044 
4045 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4046 		if (flags[flag])
4047 			*mntrflags |= (1<<flag);
4048 
4049 	*mntrflags |= MONITOR_FLAG_CHANGED;
4050 
4051 	return 0;
4052 }
4053 
4054 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4055 				     enum nl80211_iftype type,
4056 				     struct genl_info *info,
4057 				     struct vif_params *params)
4058 {
4059 	bool change = false;
4060 	int err;
4061 
4062 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4063 		if (type != NL80211_IFTYPE_MONITOR)
4064 			return -EINVAL;
4065 
4066 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4067 					  &params->flags);
4068 		if (err)
4069 			return err;
4070 
4071 		change = true;
4072 	}
4073 
4074 	if (params->flags & MONITOR_FLAG_ACTIVE &&
4075 	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4076 		return -EOPNOTSUPP;
4077 
4078 	if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4079 		const u8 *mumimo_groups;
4080 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4081 
4082 		if (type != NL80211_IFTYPE_MONITOR)
4083 			return -EINVAL;
4084 
4085 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4086 			return -EOPNOTSUPP;
4087 
4088 		mumimo_groups =
4089 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4090 
4091 		/* bits 0 and 63 are reserved and must be zero */
4092 		if ((mumimo_groups[0] & BIT(0)) ||
4093 		    (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4094 			return -EINVAL;
4095 
4096 		params->vht_mumimo_groups = mumimo_groups;
4097 		change = true;
4098 	}
4099 
4100 	if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4101 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4102 
4103 		if (type != NL80211_IFTYPE_MONITOR)
4104 			return -EINVAL;
4105 
4106 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4107 			return -EOPNOTSUPP;
4108 
4109 		params->vht_mumimo_follow_addr =
4110 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4111 		change = true;
4112 	}
4113 
4114 	return change ? 1 : 0;
4115 }
4116 
4117 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4118 			       struct net_device *netdev, u8 use_4addr,
4119 			       enum nl80211_iftype iftype)
4120 {
4121 	if (!use_4addr) {
4122 		if (netdev && netif_is_bridge_port(netdev))
4123 			return -EBUSY;
4124 		return 0;
4125 	}
4126 
4127 	switch (iftype) {
4128 	case NL80211_IFTYPE_AP_VLAN:
4129 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4130 			return 0;
4131 		break;
4132 	case NL80211_IFTYPE_STATION:
4133 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4134 			return 0;
4135 		break;
4136 	default:
4137 		break;
4138 	}
4139 
4140 	return -EOPNOTSUPP;
4141 }
4142 
4143 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4144 {
4145 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4146 	struct vif_params params;
4147 	int err;
4148 	enum nl80211_iftype otype, ntype;
4149 	struct net_device *dev = info->user_ptr[1];
4150 	bool change = false;
4151 
4152 	memset(&params, 0, sizeof(params));
4153 
4154 	otype = ntype = dev->ieee80211_ptr->iftype;
4155 
4156 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
4157 		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4158 		if (otype != ntype)
4159 			change = true;
4160 	}
4161 
4162 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
4163 		struct wireless_dev *wdev = dev->ieee80211_ptr;
4164 
4165 		if (ntype != NL80211_IFTYPE_MESH_POINT)
4166 			return -EINVAL;
4167 		if (netif_running(dev))
4168 			return -EBUSY;
4169 
4170 		wdev_lock(wdev);
4171 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4172 			     IEEE80211_MAX_MESH_ID_LEN);
4173 		wdev->u.mesh.id_up_len =
4174 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4175 		memcpy(wdev->u.mesh.id,
4176 		       nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4177 		       wdev->u.mesh.id_up_len);
4178 		wdev_unlock(wdev);
4179 	}
4180 
4181 	if (info->attrs[NL80211_ATTR_4ADDR]) {
4182 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4183 		change = true;
4184 		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4185 		if (err)
4186 			return err;
4187 	} else {
4188 		params.use_4addr = -1;
4189 	}
4190 
4191 	err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4192 	if (err < 0)
4193 		return err;
4194 	if (err > 0)
4195 		change = true;
4196 
4197 	if (change)
4198 		err = cfg80211_change_iface(rdev, dev, ntype, &params);
4199 	else
4200 		err = 0;
4201 
4202 	if (!err && params.use_4addr != -1)
4203 		dev->ieee80211_ptr->use_4addr = params.use_4addr;
4204 
4205 	if (change && !err) {
4206 		struct wireless_dev *wdev = dev->ieee80211_ptr;
4207 
4208 		nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4209 	}
4210 
4211 	return err;
4212 }
4213 
4214 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4215 {
4216 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4217 	struct vif_params params;
4218 	struct wireless_dev *wdev;
4219 	struct sk_buff *msg;
4220 	int err;
4221 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4222 
4223 	memset(&params, 0, sizeof(params));
4224 
4225 	if (!info->attrs[NL80211_ATTR_IFNAME])
4226 		return -EINVAL;
4227 
4228 	if (info->attrs[NL80211_ATTR_IFTYPE])
4229 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4230 
4231 	if (!rdev->ops->add_virtual_intf)
4232 		return -EOPNOTSUPP;
4233 
4234 	if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4235 	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4236 	    info->attrs[NL80211_ATTR_MAC]) {
4237 		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4238 			   ETH_ALEN);
4239 		if (!is_valid_ether_addr(params.macaddr))
4240 			return -EADDRNOTAVAIL;
4241 	}
4242 
4243 	if (info->attrs[NL80211_ATTR_4ADDR]) {
4244 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4245 		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4246 		if (err)
4247 			return err;
4248 	}
4249 
4250 	if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4251 		return -EOPNOTSUPP;
4252 
4253 	err = nl80211_parse_mon_options(rdev, type, info, &params);
4254 	if (err < 0)
4255 		return err;
4256 
4257 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4258 	if (!msg)
4259 		return -ENOMEM;
4260 
4261 	wdev = rdev_add_virtual_intf(rdev,
4262 				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4263 				NET_NAME_USER, type, &params);
4264 	if (WARN_ON(!wdev)) {
4265 		nlmsg_free(msg);
4266 		return -EPROTO;
4267 	} else if (IS_ERR(wdev)) {
4268 		nlmsg_free(msg);
4269 		return PTR_ERR(wdev);
4270 	}
4271 
4272 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4273 		wdev->owner_nlportid = info->snd_portid;
4274 
4275 	switch (type) {
4276 	case NL80211_IFTYPE_MESH_POINT:
4277 		if (!info->attrs[NL80211_ATTR_MESH_ID])
4278 			break;
4279 		wdev_lock(wdev);
4280 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4281 			     IEEE80211_MAX_MESH_ID_LEN);
4282 		wdev->u.mesh.id_up_len =
4283 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4284 		memcpy(wdev->u.mesh.id,
4285 		       nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4286 		       wdev->u.mesh.id_up_len);
4287 		wdev_unlock(wdev);
4288 		break;
4289 	case NL80211_IFTYPE_NAN:
4290 	case NL80211_IFTYPE_P2P_DEVICE:
4291 		/*
4292 		 * P2P Device and NAN do not have a netdev, so don't go
4293 		 * through the netdev notifier and must be added here
4294 		 */
4295 		cfg80211_init_wdev(wdev);
4296 		cfg80211_register_wdev(rdev, wdev);
4297 		break;
4298 	default:
4299 		break;
4300 	}
4301 
4302 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4303 			       rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4304 		nlmsg_free(msg);
4305 		return -ENOBUFS;
4306 	}
4307 
4308 	return genlmsg_reply(msg, info);
4309 }
4310 
4311 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4312 {
4313 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4314 	int ret;
4315 
4316 	/* to avoid failing a new interface creation due to pending removal */
4317 	cfg80211_destroy_ifaces(rdev);
4318 
4319 	wiphy_lock(&rdev->wiphy);
4320 	ret = _nl80211_new_interface(skb, info);
4321 	wiphy_unlock(&rdev->wiphy);
4322 
4323 	return ret;
4324 }
4325 
4326 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4327 {
4328 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4329 	struct wireless_dev *wdev = info->user_ptr[1];
4330 
4331 	if (!rdev->ops->del_virtual_intf)
4332 		return -EOPNOTSUPP;
4333 
4334 	/*
4335 	 * We hold RTNL, so this is safe, without RTNL opencount cannot
4336 	 * reach 0, and thus the rdev cannot be deleted.
4337 	 *
4338 	 * We need to do it for the dev_close(), since that will call
4339 	 * the netdev notifiers, and we need to acquire the mutex there
4340 	 * but don't know if we get there from here or from some other
4341 	 * place (e.g. "ip link set ... down").
4342 	 */
4343 	mutex_unlock(&rdev->wiphy.mtx);
4344 
4345 	/*
4346 	 * If we remove a wireless device without a netdev then clear
4347 	 * user_ptr[1] so that nl80211_post_doit won't dereference it
4348 	 * to check if it needs to do dev_put(). Otherwise it crashes
4349 	 * since the wdev has been freed, unlike with a netdev where
4350 	 * we need the dev_put() for the netdev to really be freed.
4351 	 */
4352 	if (!wdev->netdev)
4353 		info->user_ptr[1] = NULL;
4354 	else
4355 		dev_close(wdev->netdev);
4356 
4357 	mutex_lock(&rdev->wiphy.mtx);
4358 
4359 	return cfg80211_remove_virtual_intf(rdev, wdev);
4360 }
4361 
4362 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4363 {
4364 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4365 	struct net_device *dev = info->user_ptr[1];
4366 	u16 noack_map;
4367 
4368 	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4369 		return -EINVAL;
4370 
4371 	if (!rdev->ops->set_noack_map)
4372 		return -EOPNOTSUPP;
4373 
4374 	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4375 
4376 	return rdev_set_noack_map(rdev, dev, noack_map);
4377 }
4378 
4379 static int nl80211_validate_key_link_id(struct genl_info *info,
4380 					struct wireless_dev *wdev,
4381 					int link_id, bool pairwise)
4382 {
4383 	if (pairwise) {
4384 		if (link_id != -1) {
4385 			GENL_SET_ERR_MSG(info,
4386 					 "link ID not allowed for pairwise key");
4387 			return -EINVAL;
4388 		}
4389 
4390 		return 0;
4391 	}
4392 
4393 	if (wdev->valid_links) {
4394 		if (link_id == -1) {
4395 			GENL_SET_ERR_MSG(info,
4396 					 "link ID must for MLO group key");
4397 			return -EINVAL;
4398 		}
4399 		if (!(wdev->valid_links & BIT(link_id))) {
4400 			GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4401 			return -EINVAL;
4402 		}
4403 	} else if (link_id != -1) {
4404 		GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4405 		return -EINVAL;
4406 	}
4407 
4408 	return 0;
4409 }
4410 
4411 struct get_key_cookie {
4412 	struct sk_buff *msg;
4413 	int error;
4414 	int idx;
4415 };
4416 
4417 static void get_key_callback(void *c, struct key_params *params)
4418 {
4419 	struct nlattr *key;
4420 	struct get_key_cookie *cookie = c;
4421 
4422 	if ((params->key &&
4423 	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4424 		     params->key_len, params->key)) ||
4425 	    (params->seq &&
4426 	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4427 		     params->seq_len, params->seq)) ||
4428 	    (params->cipher &&
4429 	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4430 			 params->cipher)))
4431 		goto nla_put_failure;
4432 
4433 	key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4434 	if (!key)
4435 		goto nla_put_failure;
4436 
4437 	if ((params->key &&
4438 	     nla_put(cookie->msg, NL80211_KEY_DATA,
4439 		     params->key_len, params->key)) ||
4440 	    (params->seq &&
4441 	     nla_put(cookie->msg, NL80211_KEY_SEQ,
4442 		     params->seq_len, params->seq)) ||
4443 	    (params->cipher &&
4444 	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4445 			 params->cipher)))
4446 		goto nla_put_failure;
4447 
4448 	if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4449 		goto nla_put_failure;
4450 
4451 	nla_nest_end(cookie->msg, key);
4452 
4453 	return;
4454  nla_put_failure:
4455 	cookie->error = 1;
4456 }
4457 
4458 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4459 {
4460 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4461 	int err;
4462 	struct net_device *dev = info->user_ptr[1];
4463 	u8 key_idx = 0;
4464 	const u8 *mac_addr = NULL;
4465 	bool pairwise;
4466 	struct get_key_cookie cookie = {
4467 		.error = 0,
4468 	};
4469 	void *hdr;
4470 	struct sk_buff *msg;
4471 	bool bigtk_support = false;
4472 	int link_id = nl80211_link_id_or_invalid(info->attrs);
4473 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4474 
4475 	if (wiphy_ext_feature_isset(&rdev->wiphy,
4476 				    NL80211_EXT_FEATURE_BEACON_PROTECTION))
4477 		bigtk_support = true;
4478 
4479 	if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4480 	     wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4481 	    wiphy_ext_feature_isset(&rdev->wiphy,
4482 				    NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4483 		bigtk_support = true;
4484 
4485 	if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4486 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4487 
4488 		if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4489 			GENL_SET_ERR_MSG(info, "BIGTK not supported");
4490 			return -EINVAL;
4491 		}
4492 	}
4493 
4494 	if (info->attrs[NL80211_ATTR_MAC])
4495 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4496 
4497 	pairwise = !!mac_addr;
4498 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4499 		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4500 
4501 		if (kt != NL80211_KEYTYPE_GROUP &&
4502 		    kt != NL80211_KEYTYPE_PAIRWISE)
4503 			return -EINVAL;
4504 		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4505 	}
4506 
4507 	if (!rdev->ops->get_key)
4508 		return -EOPNOTSUPP;
4509 
4510 	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4511 		return -ENOENT;
4512 
4513 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4514 	if (!msg)
4515 		return -ENOMEM;
4516 
4517 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4518 			     NL80211_CMD_NEW_KEY);
4519 	if (!hdr)
4520 		goto nla_put_failure;
4521 
4522 	cookie.msg = msg;
4523 	cookie.idx = key_idx;
4524 
4525 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4526 	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4527 		goto nla_put_failure;
4528 	if (mac_addr &&
4529 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4530 		goto nla_put_failure;
4531 
4532 	err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4533 	if (err)
4534 		goto free_msg;
4535 
4536 	err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4537 			   &cookie, get_key_callback);
4538 
4539 	if (err)
4540 		goto free_msg;
4541 
4542 	if (cookie.error)
4543 		goto nla_put_failure;
4544 
4545 	genlmsg_end(msg, hdr);
4546 	return genlmsg_reply(msg, info);
4547 
4548  nla_put_failure:
4549 	err = -ENOBUFS;
4550  free_msg:
4551 	nlmsg_free(msg);
4552 	return err;
4553 }
4554 
4555 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4556 {
4557 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4558 	struct key_parse key;
4559 	int err;
4560 	struct net_device *dev = info->user_ptr[1];
4561 	int link_id = nl80211_link_id_or_invalid(info->attrs);
4562 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4563 
4564 	err = nl80211_parse_key(info, &key);
4565 	if (err)
4566 		return err;
4567 
4568 	if (key.idx < 0)
4569 		return -EINVAL;
4570 
4571 	/* Only support setting default key and
4572 	 * Extended Key ID action NL80211_KEY_SET_TX.
4573 	 */
4574 	if (!key.def && !key.defmgmt && !key.defbeacon &&
4575 	    !(key.p.mode == NL80211_KEY_SET_TX))
4576 		return -EINVAL;
4577 
4578 	wdev_lock(wdev);
4579 
4580 	if (key.def) {
4581 		if (!rdev->ops->set_default_key) {
4582 			err = -EOPNOTSUPP;
4583 			goto out;
4584 		}
4585 
4586 		err = nl80211_key_allowed(wdev);
4587 		if (err)
4588 			goto out;
4589 
4590 		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4591 		if (err)
4592 			goto out;
4593 
4594 		err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4595 					   key.def_uni, key.def_multi);
4596 
4597 		if (err)
4598 			goto out;
4599 
4600 #ifdef CONFIG_CFG80211_WEXT
4601 		wdev->wext.default_key = key.idx;
4602 #endif
4603 	} else if (key.defmgmt) {
4604 		if (key.def_uni || !key.def_multi) {
4605 			err = -EINVAL;
4606 			goto out;
4607 		}
4608 
4609 		if (!rdev->ops->set_default_mgmt_key) {
4610 			err = -EOPNOTSUPP;
4611 			goto out;
4612 		}
4613 
4614 		err = nl80211_key_allowed(wdev);
4615 		if (err)
4616 			goto out;
4617 
4618 		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4619 		if (err)
4620 			goto out;
4621 
4622 		err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4623 		if (err)
4624 			goto out;
4625 
4626 #ifdef CONFIG_CFG80211_WEXT
4627 		wdev->wext.default_mgmt_key = key.idx;
4628 #endif
4629 	} else if (key.defbeacon) {
4630 		if (key.def_uni || !key.def_multi) {
4631 			err = -EINVAL;
4632 			goto out;
4633 		}
4634 
4635 		if (!rdev->ops->set_default_beacon_key) {
4636 			err = -EOPNOTSUPP;
4637 			goto out;
4638 		}
4639 
4640 		err = nl80211_key_allowed(wdev);
4641 		if (err)
4642 			goto out;
4643 
4644 		err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4645 		if (err)
4646 			goto out;
4647 
4648 		err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4649 		if (err)
4650 			goto out;
4651 	} else if (key.p.mode == NL80211_KEY_SET_TX &&
4652 		   wiphy_ext_feature_isset(&rdev->wiphy,
4653 					   NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4654 		u8 *mac_addr = NULL;
4655 
4656 		if (info->attrs[NL80211_ATTR_MAC])
4657 			mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4658 
4659 		if (!mac_addr || key.idx < 0 || key.idx > 1) {
4660 			err = -EINVAL;
4661 			goto out;
4662 		}
4663 
4664 		err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4665 		if (err)
4666 			goto out;
4667 
4668 		err = rdev_add_key(rdev, dev, link_id, key.idx,
4669 				   NL80211_KEYTYPE_PAIRWISE,
4670 				   mac_addr, &key.p);
4671 	} else {
4672 		err = -EINVAL;
4673 	}
4674  out:
4675 	wdev_unlock(wdev);
4676 
4677 	return err;
4678 }
4679 
4680 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4681 {
4682 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4683 	int err;
4684 	struct net_device *dev = info->user_ptr[1];
4685 	struct key_parse key;
4686 	const u8 *mac_addr = NULL;
4687 	int link_id = nl80211_link_id_or_invalid(info->attrs);
4688 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4689 
4690 	err = nl80211_parse_key(info, &key);
4691 	if (err)
4692 		return err;
4693 
4694 	if (!key.p.key) {
4695 		GENL_SET_ERR_MSG(info, "no key");
4696 		return -EINVAL;
4697 	}
4698 
4699 	if (info->attrs[NL80211_ATTR_MAC])
4700 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4701 
4702 	if (key.type == -1) {
4703 		if (mac_addr)
4704 			key.type = NL80211_KEYTYPE_PAIRWISE;
4705 		else
4706 			key.type = NL80211_KEYTYPE_GROUP;
4707 	}
4708 
4709 	/* for now */
4710 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4711 	    key.type != NL80211_KEYTYPE_GROUP) {
4712 		GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4713 		return -EINVAL;
4714 	}
4715 
4716 	if (key.type == NL80211_KEYTYPE_GROUP &&
4717 	    info->attrs[NL80211_ATTR_VLAN_ID])
4718 		key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4719 
4720 	if (!rdev->ops->add_key)
4721 		return -EOPNOTSUPP;
4722 
4723 	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4724 					   key.type == NL80211_KEYTYPE_PAIRWISE,
4725 					   mac_addr)) {
4726 		GENL_SET_ERR_MSG(info, "key setting validation failed");
4727 		return -EINVAL;
4728 	}
4729 
4730 	wdev_lock(wdev);
4731 	err = nl80211_key_allowed(wdev);
4732 	if (err)
4733 		GENL_SET_ERR_MSG(info, "key not allowed");
4734 
4735 	if (!err)
4736 		err = nl80211_validate_key_link_id(info, wdev, link_id,
4737 				key.type == NL80211_KEYTYPE_PAIRWISE);
4738 
4739 	if (!err) {
4740 		err = rdev_add_key(rdev, dev, link_id, key.idx,
4741 				   key.type == NL80211_KEYTYPE_PAIRWISE,
4742 				    mac_addr, &key.p);
4743 		if (err)
4744 			GENL_SET_ERR_MSG(info, "key addition failed");
4745 	}
4746 	wdev_unlock(wdev);
4747 
4748 	return err;
4749 }
4750 
4751 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4752 {
4753 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4754 	int err;
4755 	struct net_device *dev = info->user_ptr[1];
4756 	u8 *mac_addr = NULL;
4757 	struct key_parse key;
4758 	int link_id = nl80211_link_id_or_invalid(info->attrs);
4759 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4760 
4761 	err = nl80211_parse_key(info, &key);
4762 	if (err)
4763 		return err;
4764 
4765 	if (info->attrs[NL80211_ATTR_MAC])
4766 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4767 
4768 	if (key.type == -1) {
4769 		if (mac_addr)
4770 			key.type = NL80211_KEYTYPE_PAIRWISE;
4771 		else
4772 			key.type = NL80211_KEYTYPE_GROUP;
4773 	}
4774 
4775 	/* for now */
4776 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4777 	    key.type != NL80211_KEYTYPE_GROUP)
4778 		return -EINVAL;
4779 
4780 	if (!cfg80211_valid_key_idx(rdev, key.idx,
4781 				    key.type == NL80211_KEYTYPE_PAIRWISE))
4782 		return -EINVAL;
4783 
4784 	if (!rdev->ops->del_key)
4785 		return -EOPNOTSUPP;
4786 
4787 	wdev_lock(wdev);
4788 	err = nl80211_key_allowed(wdev);
4789 
4790 	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4791 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4792 		err = -ENOENT;
4793 
4794 	if (!err)
4795 		err = nl80211_validate_key_link_id(info, wdev, link_id,
4796 				key.type == NL80211_KEYTYPE_PAIRWISE);
4797 
4798 	if (!err)
4799 		err = rdev_del_key(rdev, dev, link_id, key.idx,
4800 				   key.type == NL80211_KEYTYPE_PAIRWISE,
4801 				   mac_addr);
4802 
4803 #ifdef CONFIG_CFG80211_WEXT
4804 	if (!err) {
4805 		if (key.idx == wdev->wext.default_key)
4806 			wdev->wext.default_key = -1;
4807 		else if (key.idx == wdev->wext.default_mgmt_key)
4808 			wdev->wext.default_mgmt_key = -1;
4809 	}
4810 #endif
4811 	wdev_unlock(wdev);
4812 
4813 	return err;
4814 }
4815 
4816 /* This function returns an error or the number of nested attributes */
4817 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4818 {
4819 	struct nlattr *attr;
4820 	int n_entries = 0, tmp;
4821 
4822 	nla_for_each_nested(attr, nl_attr, tmp) {
4823 		if (nla_len(attr) != ETH_ALEN)
4824 			return -EINVAL;
4825 
4826 		n_entries++;
4827 	}
4828 
4829 	return n_entries;
4830 }
4831 
4832 /*
4833  * This function parses ACL information and allocates memory for ACL data.
4834  * On successful return, the calling function is responsible to free the
4835  * ACL buffer returned by this function.
4836  */
4837 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4838 						struct genl_info *info)
4839 {
4840 	enum nl80211_acl_policy acl_policy;
4841 	struct nlattr *attr;
4842 	struct cfg80211_acl_data *acl;
4843 	int i = 0, n_entries, tmp;
4844 
4845 	if (!wiphy->max_acl_mac_addrs)
4846 		return ERR_PTR(-EOPNOTSUPP);
4847 
4848 	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4849 		return ERR_PTR(-EINVAL);
4850 
4851 	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4852 	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4853 	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4854 		return ERR_PTR(-EINVAL);
4855 
4856 	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4857 		return ERR_PTR(-EINVAL);
4858 
4859 	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4860 	if (n_entries < 0)
4861 		return ERR_PTR(n_entries);
4862 
4863 	if (n_entries > wiphy->max_acl_mac_addrs)
4864 		return ERR_PTR(-ENOTSUPP);
4865 
4866 	acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4867 	if (!acl)
4868 		return ERR_PTR(-ENOMEM);
4869 
4870 	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4871 		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4872 		i++;
4873 	}
4874 
4875 	acl->n_acl_entries = n_entries;
4876 	acl->acl_policy = acl_policy;
4877 
4878 	return acl;
4879 }
4880 
4881 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4882 {
4883 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4884 	struct net_device *dev = info->user_ptr[1];
4885 	struct cfg80211_acl_data *acl;
4886 	int err;
4887 
4888 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4889 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4890 		return -EOPNOTSUPP;
4891 
4892 	if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4893 		return -EINVAL;
4894 
4895 	acl = parse_acl_data(&rdev->wiphy, info);
4896 	if (IS_ERR(acl))
4897 		return PTR_ERR(acl);
4898 
4899 	err = rdev_set_mac_acl(rdev, dev, acl);
4900 
4901 	kfree(acl);
4902 
4903 	return err;
4904 }
4905 
4906 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4907 			   u8 *rates, u8 rates_len)
4908 {
4909 	u8 i;
4910 	u32 mask = 0;
4911 
4912 	for (i = 0; i < rates_len; i++) {
4913 		int rate = (rates[i] & 0x7f) * 5;
4914 		int ridx;
4915 
4916 		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4917 			struct ieee80211_rate *srate =
4918 				&sband->bitrates[ridx];
4919 			if (rate == srate->bitrate) {
4920 				mask |= 1 << ridx;
4921 				break;
4922 			}
4923 		}
4924 		if (ridx == sband->n_bitrates)
4925 			return 0; /* rate not found */
4926 	}
4927 
4928 	return mask;
4929 }
4930 
4931 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4932 			       u8 *rates, u8 rates_len,
4933 			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4934 {
4935 	u8 i;
4936 
4937 	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4938 
4939 	for (i = 0; i < rates_len; i++) {
4940 		int ridx, rbit;
4941 
4942 		ridx = rates[i] / 8;
4943 		rbit = BIT(rates[i] % 8);
4944 
4945 		/* check validity */
4946 		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4947 			return false;
4948 
4949 		/* check availability */
4950 		ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4951 		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4952 			mcs[ridx] |= rbit;
4953 		else
4954 			return false;
4955 	}
4956 
4957 	return true;
4958 }
4959 
4960 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4961 {
4962 	u16 mcs_mask = 0;
4963 
4964 	switch (vht_mcs_map) {
4965 	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4966 		break;
4967 	case IEEE80211_VHT_MCS_SUPPORT_0_7:
4968 		mcs_mask = 0x00FF;
4969 		break;
4970 	case IEEE80211_VHT_MCS_SUPPORT_0_8:
4971 		mcs_mask = 0x01FF;
4972 		break;
4973 	case IEEE80211_VHT_MCS_SUPPORT_0_9:
4974 		mcs_mask = 0x03FF;
4975 		break;
4976 	default:
4977 		break;
4978 	}
4979 
4980 	return mcs_mask;
4981 }
4982 
4983 static void vht_build_mcs_mask(u16 vht_mcs_map,
4984 			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4985 {
4986 	u8 nss;
4987 
4988 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4989 		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4990 		vht_mcs_map >>= 2;
4991 	}
4992 }
4993 
4994 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4995 			     struct nl80211_txrate_vht *txrate,
4996 			     u16 mcs[NL80211_VHT_NSS_MAX])
4997 {
4998 	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4999 	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5000 	u8 i;
5001 
5002 	if (!sband->vht_cap.vht_supported)
5003 		return false;
5004 
5005 	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5006 
5007 	/* Build vht_mcs_mask from VHT capabilities */
5008 	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5009 
5010 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5011 		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5012 			mcs[i] = txrate->mcs[i];
5013 		else
5014 			return false;
5015 	}
5016 
5017 	return true;
5018 }
5019 
5020 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5021 {
5022 	switch (he_mcs_map) {
5023 	case IEEE80211_HE_MCS_NOT_SUPPORTED:
5024 		return 0;
5025 	case IEEE80211_HE_MCS_SUPPORT_0_7:
5026 		return 0x00FF;
5027 	case IEEE80211_HE_MCS_SUPPORT_0_9:
5028 		return 0x03FF;
5029 	case IEEE80211_HE_MCS_SUPPORT_0_11:
5030 		return 0xFFF;
5031 	default:
5032 		break;
5033 	}
5034 	return 0;
5035 }
5036 
5037 static void he_build_mcs_mask(u16 he_mcs_map,
5038 			      u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5039 {
5040 	u8 nss;
5041 
5042 	for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5043 		he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5044 		he_mcs_map >>= 2;
5045 	}
5046 }
5047 
5048 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5049 			   const struct ieee80211_sta_he_cap *he_cap)
5050 {
5051 	struct net_device *dev = info->user_ptr[1];
5052 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5053 	struct cfg80211_chan_def *chandef;
5054 	__le16 tx_mcs;
5055 
5056 	chandef = wdev_chandef(wdev, link_id);
5057 	if (!chandef) {
5058 		/*
5059 		 * This is probably broken, but we never maintained
5060 		 * a chandef in these cases, so it always was.
5061 		 */
5062 		return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5063 	}
5064 
5065 	switch (chandef->width) {
5066 	case NL80211_CHAN_WIDTH_80P80:
5067 		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5068 		break;
5069 	case NL80211_CHAN_WIDTH_160:
5070 		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5071 		break;
5072 	default:
5073 		tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5074 		break;
5075 	}
5076 
5077 	return le16_to_cpu(tx_mcs);
5078 }
5079 
5080 static bool he_set_mcs_mask(struct genl_info *info,
5081 			    struct wireless_dev *wdev,
5082 			    struct ieee80211_supported_band *sband,
5083 			    struct nl80211_txrate_he *txrate,
5084 			    u16 mcs[NL80211_HE_NSS_MAX],
5085 			    unsigned int link_id)
5086 {
5087 	const struct ieee80211_sta_he_cap *he_cap;
5088 	u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5089 	u16 tx_mcs_map = 0;
5090 	u8 i;
5091 
5092 	he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5093 	if (!he_cap)
5094 		return false;
5095 
5096 	memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5097 
5098 	tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5099 
5100 	/* Build he_mcs_mask from HE capabilities */
5101 	he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5102 
5103 	for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5104 		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5105 			mcs[i] = txrate->mcs[i];
5106 		else
5107 			return false;
5108 	}
5109 
5110 	return true;
5111 }
5112 
5113 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5114 					 struct nlattr *attrs[],
5115 					 enum nl80211_attrs attr,
5116 					 struct cfg80211_bitrate_mask *mask,
5117 					 struct net_device *dev,
5118 					 bool default_all_enabled,
5119 					 unsigned int link_id)
5120 {
5121 	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5122 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5123 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5124 	int rem, i;
5125 	struct nlattr *tx_rates;
5126 	struct ieee80211_supported_band *sband;
5127 	u16 vht_tx_mcs_map, he_tx_mcs_map;
5128 
5129 	memset(mask, 0, sizeof(*mask));
5130 	/* Default to all rates enabled */
5131 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
5132 		const struct ieee80211_sta_he_cap *he_cap;
5133 
5134 		if (!default_all_enabled)
5135 			break;
5136 
5137 		sband = rdev->wiphy.bands[i];
5138 
5139 		if (!sband)
5140 			continue;
5141 
5142 		mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5143 		memcpy(mask->control[i].ht_mcs,
5144 		       sband->ht_cap.mcs.rx_mask,
5145 		       sizeof(mask->control[i].ht_mcs));
5146 
5147 		if (sband->vht_cap.vht_supported) {
5148 			vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5149 			vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5150 		}
5151 
5152 		he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5153 		if (!he_cap)
5154 			continue;
5155 
5156 		he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5157 		he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5158 
5159 		mask->control[i].he_gi = 0xFF;
5160 		mask->control[i].he_ltf = 0xFF;
5161 	}
5162 
5163 	/* if no rates are given set it back to the defaults */
5164 	if (!attrs[attr])
5165 		goto out;
5166 
5167 	/* The nested attribute uses enum nl80211_band as the index. This maps
5168 	 * directly to the enum nl80211_band values used in cfg80211.
5169 	 */
5170 	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5171 	nla_for_each_nested(tx_rates, attrs[attr], rem) {
5172 		enum nl80211_band band = nla_type(tx_rates);
5173 		int err;
5174 
5175 		if (band < 0 || band >= NUM_NL80211_BANDS)
5176 			return -EINVAL;
5177 		sband = rdev->wiphy.bands[band];
5178 		if (sband == NULL)
5179 			return -EINVAL;
5180 		err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5181 						  tx_rates,
5182 						  nl80211_txattr_policy,
5183 						  info->extack);
5184 		if (err)
5185 			return err;
5186 		if (tb[NL80211_TXRATE_LEGACY]) {
5187 			mask->control[band].legacy = rateset_to_mask(
5188 				sband,
5189 				nla_data(tb[NL80211_TXRATE_LEGACY]),
5190 				nla_len(tb[NL80211_TXRATE_LEGACY]));
5191 			if ((mask->control[band].legacy == 0) &&
5192 			    nla_len(tb[NL80211_TXRATE_LEGACY]))
5193 				return -EINVAL;
5194 		}
5195 		if (tb[NL80211_TXRATE_HT]) {
5196 			if (!ht_rateset_to_mask(
5197 					sband,
5198 					nla_data(tb[NL80211_TXRATE_HT]),
5199 					nla_len(tb[NL80211_TXRATE_HT]),
5200 					mask->control[band].ht_mcs))
5201 				return -EINVAL;
5202 		}
5203 
5204 		if (tb[NL80211_TXRATE_VHT]) {
5205 			if (!vht_set_mcs_mask(
5206 					sband,
5207 					nla_data(tb[NL80211_TXRATE_VHT]),
5208 					mask->control[band].vht_mcs))
5209 				return -EINVAL;
5210 		}
5211 
5212 		if (tb[NL80211_TXRATE_GI]) {
5213 			mask->control[band].gi =
5214 				nla_get_u8(tb[NL80211_TXRATE_GI]);
5215 			if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5216 				return -EINVAL;
5217 		}
5218 		if (tb[NL80211_TXRATE_HE] &&
5219 		    !he_set_mcs_mask(info, wdev, sband,
5220 				     nla_data(tb[NL80211_TXRATE_HE]),
5221 				     mask->control[band].he_mcs,
5222 				     link_id))
5223 			return -EINVAL;
5224 
5225 		if (tb[NL80211_TXRATE_HE_GI])
5226 			mask->control[band].he_gi =
5227 				nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5228 		if (tb[NL80211_TXRATE_HE_LTF])
5229 			mask->control[band].he_ltf =
5230 				nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5231 
5232 		if (mask->control[band].legacy == 0) {
5233 			/* don't allow empty legacy rates if HT, VHT or HE
5234 			 * are not even supported.
5235 			 */
5236 			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5237 			      rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5238 			      ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5239 				return -EINVAL;
5240 
5241 			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5242 				if (mask->control[band].ht_mcs[i])
5243 					goto out;
5244 
5245 			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5246 				if (mask->control[band].vht_mcs[i])
5247 					goto out;
5248 
5249 			for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5250 				if (mask->control[band].he_mcs[i])
5251 					goto out;
5252 
5253 			/* legacy and mcs rates may not be both empty */
5254 			return -EINVAL;
5255 		}
5256 	}
5257 
5258 out:
5259 	return 0;
5260 }
5261 
5262 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5263 				   enum nl80211_band band,
5264 				   struct cfg80211_bitrate_mask *beacon_rate)
5265 {
5266 	u32 count_ht, count_vht, count_he, i;
5267 	u32 rate = beacon_rate->control[band].legacy;
5268 
5269 	/* Allow only one rate */
5270 	if (hweight32(rate) > 1)
5271 		return -EINVAL;
5272 
5273 	count_ht = 0;
5274 	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5275 		if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5276 			return -EINVAL;
5277 		} else if (beacon_rate->control[band].ht_mcs[i]) {
5278 			count_ht++;
5279 			if (count_ht > 1)
5280 				return -EINVAL;
5281 		}
5282 		if (count_ht && rate)
5283 			return -EINVAL;
5284 	}
5285 
5286 	count_vht = 0;
5287 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5288 		if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5289 			return -EINVAL;
5290 		} else if (beacon_rate->control[band].vht_mcs[i]) {
5291 			count_vht++;
5292 			if (count_vht > 1)
5293 				return -EINVAL;
5294 		}
5295 		if (count_vht && rate)
5296 			return -EINVAL;
5297 	}
5298 
5299 	count_he = 0;
5300 	for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5301 		if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5302 			return -EINVAL;
5303 		} else if (beacon_rate->control[band].he_mcs[i]) {
5304 			count_he++;
5305 			if (count_he > 1)
5306 				return -EINVAL;
5307 		}
5308 		if (count_he && rate)
5309 			return -EINVAL;
5310 	}
5311 
5312 	if ((count_ht && count_vht && count_he) ||
5313 	    (!rate && !count_ht && !count_vht && !count_he))
5314 		return -EINVAL;
5315 
5316 	if (rate &&
5317 	    !wiphy_ext_feature_isset(&rdev->wiphy,
5318 				     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5319 		return -EINVAL;
5320 	if (count_ht &&
5321 	    !wiphy_ext_feature_isset(&rdev->wiphy,
5322 				     NL80211_EXT_FEATURE_BEACON_RATE_HT))
5323 		return -EINVAL;
5324 	if (count_vht &&
5325 	    !wiphy_ext_feature_isset(&rdev->wiphy,
5326 				     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5327 		return -EINVAL;
5328 	if (count_he &&
5329 	    !wiphy_ext_feature_isset(&rdev->wiphy,
5330 				     NL80211_EXT_FEATURE_BEACON_RATE_HE))
5331 		return -EINVAL;
5332 
5333 	return 0;
5334 }
5335 
5336 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5337 				       struct net_device *dev,
5338 				       struct nlattr *attrs,
5339 				       struct cfg80211_mbssid_config *config,
5340 				       u8 num_elems)
5341 {
5342 	struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5343 
5344 	if (!wiphy->mbssid_max_interfaces)
5345 		return -EOPNOTSUPP;
5346 
5347 	if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5348 			     NULL) ||
5349 	    !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5350 		return -EINVAL;
5351 
5352 	config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5353 	if (config->ema) {
5354 		if (!wiphy->ema_max_profile_periodicity)
5355 			return -EOPNOTSUPP;
5356 
5357 		if (num_elems > wiphy->ema_max_profile_periodicity)
5358 			return -EINVAL;
5359 	}
5360 
5361 	config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5362 	if (config->index >= wiphy->mbssid_max_interfaces ||
5363 	    (!config->index && !num_elems))
5364 		return -EINVAL;
5365 
5366 	if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5367 		u32 tx_ifindex =
5368 			nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5369 
5370 		if ((!config->index && tx_ifindex != dev->ifindex) ||
5371 		    (config->index && tx_ifindex == dev->ifindex))
5372 			return -EINVAL;
5373 
5374 		if (tx_ifindex != dev->ifindex) {
5375 			struct net_device *tx_netdev =
5376 				dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5377 
5378 			if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5379 			    tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5380 			    tx_netdev->ieee80211_ptr->iftype !=
5381 							NL80211_IFTYPE_AP) {
5382 				dev_put(tx_netdev);
5383 				return -EINVAL;
5384 			}
5385 
5386 			config->tx_wdev = tx_netdev->ieee80211_ptr;
5387 		} else {
5388 			config->tx_wdev = dev->ieee80211_ptr;
5389 		}
5390 	} else if (!config->index) {
5391 		config->tx_wdev = dev->ieee80211_ptr;
5392 	} else {
5393 		return -EINVAL;
5394 	}
5395 
5396 	return 0;
5397 }
5398 
5399 static struct cfg80211_mbssid_elems *
5400 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5401 {
5402 	struct nlattr *nl_elems;
5403 	struct cfg80211_mbssid_elems *elems;
5404 	int rem_elems;
5405 	u8 i = 0, num_elems = 0;
5406 
5407 	if (!wiphy->mbssid_max_interfaces)
5408 		return ERR_PTR(-EINVAL);
5409 
5410 	nla_for_each_nested(nl_elems, attrs, rem_elems)
5411 		num_elems++;
5412 
5413 	elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5414 	if (!elems)
5415 		return ERR_PTR(-ENOMEM);
5416 
5417 	nla_for_each_nested(nl_elems, attrs, rem_elems) {
5418 		elems->elem[i].data = nla_data(nl_elems);
5419 		elems->elem[i].len = nla_len(nl_elems);
5420 		i++;
5421 	}
5422 	elems->cnt = num_elems;
5423 	return elems;
5424 }
5425 
5426 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5427 				      struct cfg80211_he_bss_color *he_bss_color)
5428 {
5429 	struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5430 	int err;
5431 
5432 	err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5433 			       he_bss_color_policy, NULL);
5434 	if (err)
5435 		return err;
5436 
5437 	if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5438 		return -EINVAL;
5439 
5440 	he_bss_color->color =
5441 		nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5442 	he_bss_color->enabled =
5443 		!nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5444 	he_bss_color->partial =
5445 		nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5446 
5447 	return 0;
5448 }
5449 
5450 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5451 				struct nlattr *attrs[],
5452 				struct cfg80211_beacon_data *bcn)
5453 {
5454 	bool haveinfo = false;
5455 	int err;
5456 
5457 	memset(bcn, 0, sizeof(*bcn));
5458 
5459 	bcn->link_id = nl80211_link_id(attrs);
5460 
5461 	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5462 		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5463 		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5464 		if (!bcn->head_len)
5465 			return -EINVAL;
5466 		haveinfo = true;
5467 	}
5468 
5469 	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5470 		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5471 		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5472 		haveinfo = true;
5473 	}
5474 
5475 	if (!haveinfo)
5476 		return -EINVAL;
5477 
5478 	if (attrs[NL80211_ATTR_IE]) {
5479 		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5480 		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5481 	}
5482 
5483 	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5484 		bcn->proberesp_ies =
5485 			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5486 		bcn->proberesp_ies_len =
5487 			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5488 	}
5489 
5490 	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5491 		bcn->assocresp_ies =
5492 			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5493 		bcn->assocresp_ies_len =
5494 			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5495 	}
5496 
5497 	if (attrs[NL80211_ATTR_PROBE_RESP]) {
5498 		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5499 		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5500 	}
5501 
5502 	if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5503 		struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5504 
5505 		err = nla_parse_nested_deprecated(tb,
5506 						  NL80211_FTM_RESP_ATTR_MAX,
5507 						  attrs[NL80211_ATTR_FTM_RESPONDER],
5508 						  NULL, NULL);
5509 		if (err)
5510 			return err;
5511 
5512 		if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5513 		    wiphy_ext_feature_isset(&rdev->wiphy,
5514 					    NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5515 			bcn->ftm_responder = 1;
5516 		else
5517 			return -EOPNOTSUPP;
5518 
5519 		if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5520 			bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5521 			bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5522 		}
5523 
5524 		if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5525 			bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5526 			bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5527 		}
5528 	} else {
5529 		bcn->ftm_responder = -1;
5530 	}
5531 
5532 	if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5533 		err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5534 						 &bcn->he_bss_color);
5535 		if (err)
5536 			return err;
5537 		bcn->he_bss_color_valid = true;
5538 	}
5539 
5540 	if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5541 		struct cfg80211_mbssid_elems *mbssid =
5542 			nl80211_parse_mbssid_elems(&rdev->wiphy,
5543 						   attrs[NL80211_ATTR_MBSSID_ELEMS]);
5544 
5545 		if (IS_ERR(mbssid))
5546 			return PTR_ERR(mbssid);
5547 
5548 		bcn->mbssid_ies = mbssid;
5549 	}
5550 
5551 	return 0;
5552 }
5553 
5554 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5555 				    struct ieee80211_he_obss_pd *he_obss_pd)
5556 {
5557 	struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5558 	int err;
5559 
5560 	err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5561 			       he_obss_pd_policy, NULL);
5562 	if (err)
5563 		return err;
5564 
5565 	if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5566 		return -EINVAL;
5567 
5568 	he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5569 
5570 	if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5571 		he_obss_pd->min_offset =
5572 			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5573 	if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5574 		he_obss_pd->max_offset =
5575 			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5576 	if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5577 		he_obss_pd->non_srg_max_offset =
5578 			nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5579 
5580 	if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5581 		return -EINVAL;
5582 
5583 	if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5584 		memcpy(he_obss_pd->bss_color_bitmap,
5585 		       nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5586 		       sizeof(he_obss_pd->bss_color_bitmap));
5587 
5588 	if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5589 		memcpy(he_obss_pd->partial_bssid_bitmap,
5590 		       nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5591 		       sizeof(he_obss_pd->partial_bssid_bitmap));
5592 
5593 	he_obss_pd->enable = true;
5594 
5595 	return 0;
5596 }
5597 
5598 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5599 					struct nlattr *attrs,
5600 					struct cfg80211_ap_settings *params)
5601 {
5602 	struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5603 	int ret;
5604 	struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5605 
5606 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
5607 				     NL80211_EXT_FEATURE_FILS_DISCOVERY))
5608 		return -EINVAL;
5609 
5610 	ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5611 			       NULL, NULL);
5612 	if (ret)
5613 		return ret;
5614 
5615 	if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5616 	    !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5617 	    !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5618 		return -EINVAL;
5619 
5620 	fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5621 	fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5622 	fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5623 	fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5624 
5625 	return 0;
5626 }
5627 
5628 static int
5629 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5630 				     struct nlattr *attrs,
5631 				     struct cfg80211_ap_settings *params)
5632 {
5633 	struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5634 	int ret;
5635 	struct cfg80211_unsol_bcast_probe_resp *presp =
5636 					&params->unsol_bcast_probe_resp;
5637 
5638 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
5639 				     NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5640 		return -EINVAL;
5641 
5642 	ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5643 			       attrs, NULL, NULL);
5644 	if (ret)
5645 		return ret;
5646 
5647 	if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5648 	    !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5649 		return -EINVAL;
5650 
5651 	presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5652 	presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5653 	presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5654 	return 0;
5655 }
5656 
5657 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5658 					    const struct element *rates)
5659 {
5660 	int i;
5661 
5662 	if (!rates)
5663 		return;
5664 
5665 	for (i = 0; i < rates->datalen; i++) {
5666 		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5667 			params->ht_required = true;
5668 		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5669 			params->vht_required = true;
5670 		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5671 			params->he_required = true;
5672 		if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5673 			params->sae_h2e_required = true;
5674 	}
5675 }
5676 
5677 /*
5678  * Since the nl80211 API didn't include, from the beginning, attributes about
5679  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5680  * benefit of drivers that rebuild IEs in the firmware.
5681  */
5682 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5683 {
5684 	const struct cfg80211_beacon_data *bcn = &params->beacon;
5685 	size_t ies_len = bcn->tail_len;
5686 	const u8 *ies = bcn->tail;
5687 	const struct element *rates;
5688 	const struct element *cap;
5689 
5690 	rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5691 	nl80211_check_ap_rate_selectors(params, rates);
5692 
5693 	rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5694 	nl80211_check_ap_rate_selectors(params, rates);
5695 
5696 	cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5697 	if (cap && cap->datalen >= sizeof(*params->ht_cap))
5698 		params->ht_cap = (void *)cap->data;
5699 	cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5700 	if (cap && cap->datalen >= sizeof(*params->vht_cap))
5701 		params->vht_cap = (void *)cap->data;
5702 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5703 	if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5704 		params->he_cap = (void *)(cap->data + 1);
5705 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5706 	if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5707 		params->he_oper = (void *)(cap->data + 1);
5708 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5709 	if (cap) {
5710 		if (!cap->datalen)
5711 			return -EINVAL;
5712 		params->eht_cap = (void *)(cap->data + 1);
5713 		if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5714 						(const u8 *)params->eht_cap,
5715 						cap->datalen - 1, true))
5716 			return -EINVAL;
5717 	}
5718 	cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5719 	if (cap) {
5720 		if (!cap->datalen)
5721 			return -EINVAL;
5722 		params->eht_oper = (void *)(cap->data + 1);
5723 		if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5724 						cap->datalen - 1))
5725 			return -EINVAL;
5726 	}
5727 	return 0;
5728 }
5729 
5730 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5731 				   struct cfg80211_ap_settings *params)
5732 {
5733 	struct wireless_dev *wdev;
5734 
5735 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5736 		if (wdev->iftype != NL80211_IFTYPE_AP &&
5737 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
5738 			continue;
5739 
5740 		if (!wdev->u.ap.preset_chandef.chan)
5741 			continue;
5742 
5743 		params->chandef = wdev->u.ap.preset_chandef;
5744 		return true;
5745 	}
5746 
5747 	return false;
5748 }
5749 
5750 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5751 				    enum nl80211_auth_type auth_type,
5752 				    enum nl80211_commands cmd)
5753 {
5754 	if (auth_type > NL80211_AUTHTYPE_MAX)
5755 		return false;
5756 
5757 	switch (cmd) {
5758 	case NL80211_CMD_AUTHENTICATE:
5759 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5760 		    auth_type == NL80211_AUTHTYPE_SAE)
5761 			return false;
5762 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
5763 					     NL80211_EXT_FEATURE_FILS_STA) &&
5764 		    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5765 		     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5766 		     auth_type == NL80211_AUTHTYPE_FILS_PK))
5767 			return false;
5768 		return true;
5769 	case NL80211_CMD_CONNECT:
5770 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5771 		    !wiphy_ext_feature_isset(&rdev->wiphy,
5772 					     NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5773 		    auth_type == NL80211_AUTHTYPE_SAE)
5774 			return false;
5775 
5776 		/* FILS with SK PFS or PK not supported yet */
5777 		if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5778 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
5779 			return false;
5780 		if (!wiphy_ext_feature_isset(
5781 			    &rdev->wiphy,
5782 			    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5783 		    auth_type == NL80211_AUTHTYPE_FILS_SK)
5784 			return false;
5785 		return true;
5786 	case NL80211_CMD_START_AP:
5787 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
5788 					     NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5789 		    auth_type == NL80211_AUTHTYPE_SAE)
5790 			return false;
5791 		/* FILS not supported yet */
5792 		if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5793 		    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5794 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
5795 			return false;
5796 		return true;
5797 	default:
5798 		return false;
5799 	}
5800 }
5801 
5802 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5803 				    unsigned int link_id)
5804 {
5805 	struct wiphy *wiphy = wdev->wiphy;
5806 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5807 	struct sk_buff *msg;
5808 	void *hdr;
5809 
5810 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5811 	if (!msg)
5812 		return;
5813 
5814 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5815 	if (!hdr)
5816 		goto out;
5817 
5818 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5819 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5820 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5821 			      NL80211_ATTR_PAD) ||
5822 	    (wdev->u.ap.ssid_len &&
5823 	     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5824 		     wdev->u.ap.ssid)) ||
5825 	    (wdev->valid_links &&
5826 	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5827 		goto out;
5828 
5829 	genlmsg_end(msg, hdr);
5830 
5831 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5832 				NL80211_MCGRP_MLME, GFP_KERNEL);
5833 	return;
5834 out:
5835 	nlmsg_free(msg);
5836 }
5837 
5838 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5839 {
5840 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5841 	unsigned int link_id = nl80211_link_id(info->attrs);
5842 	struct net_device *dev = info->user_ptr[1];
5843 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5844 	struct cfg80211_ap_settings *params;
5845 	int err;
5846 
5847 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5848 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5849 		return -EOPNOTSUPP;
5850 
5851 	if (!rdev->ops->start_ap)
5852 		return -EOPNOTSUPP;
5853 
5854 	if (wdev->links[link_id].ap.beacon_interval)
5855 		return -EALREADY;
5856 
5857 	/* these are required for START_AP */
5858 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5859 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5860 	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
5861 		return -EINVAL;
5862 
5863 	params = kzalloc(sizeof(*params), GFP_KERNEL);
5864 	if (!params)
5865 		return -ENOMEM;
5866 
5867 	err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon);
5868 	if (err)
5869 		goto out;
5870 
5871 	params->beacon_interval =
5872 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5873 	params->dtim_period =
5874 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5875 
5876 	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5877 					   params->beacon_interval);
5878 	if (err)
5879 		goto out;
5880 
5881 	/*
5882 	 * In theory, some of these attributes should be required here
5883 	 * but since they were not used when the command was originally
5884 	 * added, keep them optional for old user space programs to let
5885 	 * them continue to work with drivers that do not need the
5886 	 * additional information -- drivers must check!
5887 	 */
5888 	if (info->attrs[NL80211_ATTR_SSID]) {
5889 		params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5890 		params->ssid_len =
5891 			nla_len(info->attrs[NL80211_ATTR_SSID]);
5892 		if (params->ssid_len == 0) {
5893 			err = -EINVAL;
5894 			goto out;
5895 		}
5896 
5897 		if (wdev->u.ap.ssid_len &&
5898 		    (wdev->u.ap.ssid_len != params->ssid_len ||
5899 		     memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5900 			/* require identical SSID for MLO */
5901 			err = -EINVAL;
5902 			goto out;
5903 		}
5904 	} else if (wdev->valid_links) {
5905 		/* require SSID for MLO */
5906 		err = -EINVAL;
5907 		goto out;
5908 	}
5909 
5910 	if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5911 		params->hidden_ssid = nla_get_u32(
5912 			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5913 
5914 	params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5915 
5916 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5917 		params->auth_type = nla_get_u32(
5918 			info->attrs[NL80211_ATTR_AUTH_TYPE]);
5919 		if (!nl80211_valid_auth_type(rdev, params->auth_type,
5920 					     NL80211_CMD_START_AP)) {
5921 			err = -EINVAL;
5922 			goto out;
5923 		}
5924 	} else
5925 		params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5926 
5927 	err = nl80211_crypto_settings(rdev, info, &params->crypto,
5928 				      NL80211_MAX_NR_CIPHER_SUITES);
5929 	if (err)
5930 		goto out;
5931 
5932 	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5933 		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
5934 			err = -EOPNOTSUPP;
5935 			goto out;
5936 		}
5937 		params->inactivity_timeout = nla_get_u16(
5938 			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5939 	}
5940 
5941 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5942 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5943 			err = -EINVAL;
5944 			goto out;
5945 		}
5946 		params->p2p_ctwindow =
5947 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5948 		if (params->p2p_ctwindow != 0 &&
5949 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
5950 			err = -EINVAL;
5951 			goto out;
5952 		}
5953 	}
5954 
5955 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5956 		u8 tmp;
5957 
5958 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5959 			err = -EINVAL;
5960 			goto out;
5961 		}
5962 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5963 		params->p2p_opp_ps = tmp;
5964 		if (params->p2p_opp_ps != 0 &&
5965 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
5966 			err = -EINVAL;
5967 			goto out;
5968 		}
5969 	}
5970 
5971 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5972 		err = nl80211_parse_chandef(rdev, info, &params->chandef);
5973 		if (err)
5974 			goto out;
5975 	} else if (wdev->valid_links) {
5976 		/* with MLD need to specify the channel configuration */
5977 		err = -EINVAL;
5978 		goto out;
5979 	} else if (wdev->u.ap.preset_chandef.chan) {
5980 		params->chandef = wdev->u.ap.preset_chandef;
5981 	} else if (!nl80211_get_ap_channel(rdev, params)) {
5982 		err = -EINVAL;
5983 		goto out;
5984 	}
5985 
5986 	if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
5987 		err = nl80211_parse_punct_bitmap(rdev, info,
5988 						 &params->chandef,
5989 						 &params->punct_bitmap);
5990 		if (err)
5991 			goto out;
5992 	}
5993 
5994 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
5995 					   wdev->iftype)) {
5996 		err = -EINVAL;
5997 		goto out;
5998 	}
5999 
6000 	wdev_lock(wdev);
6001 
6002 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
6003 		err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6004 						    NL80211_ATTR_TX_RATES,
6005 						    &params->beacon_rate,
6006 						    dev, false, link_id);
6007 		if (err)
6008 			goto out_unlock;
6009 
6010 		err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6011 					      &params->beacon_rate);
6012 		if (err)
6013 			goto out_unlock;
6014 	}
6015 
6016 	if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6017 		params->smps_mode =
6018 			nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6019 		switch (params->smps_mode) {
6020 		case NL80211_SMPS_OFF:
6021 			break;
6022 		case NL80211_SMPS_STATIC:
6023 			if (!(rdev->wiphy.features &
6024 			      NL80211_FEATURE_STATIC_SMPS)) {
6025 				err = -EINVAL;
6026 				goto out_unlock;
6027 			}
6028 			break;
6029 		case NL80211_SMPS_DYNAMIC:
6030 			if (!(rdev->wiphy.features &
6031 			      NL80211_FEATURE_DYNAMIC_SMPS)) {
6032 				err = -EINVAL;
6033 				goto out_unlock;
6034 			}
6035 			break;
6036 		default:
6037 			err = -EINVAL;
6038 			goto out_unlock;
6039 		}
6040 	} else {
6041 		params->smps_mode = NL80211_SMPS_OFF;
6042 	}
6043 
6044 	params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6045 	if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6046 		err = -EOPNOTSUPP;
6047 		goto out_unlock;
6048 	}
6049 
6050 	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6051 		params->acl = parse_acl_data(&rdev->wiphy, info);
6052 		if (IS_ERR(params->acl)) {
6053 			err = PTR_ERR(params->acl);
6054 			params->acl = NULL;
6055 			goto out_unlock;
6056 		}
6057 	}
6058 
6059 	params->twt_responder =
6060 		    nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6061 
6062 	if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6063 		err = nl80211_parse_he_obss_pd(
6064 					info->attrs[NL80211_ATTR_HE_OBSS_PD],
6065 					&params->he_obss_pd);
6066 		if (err)
6067 			goto out_unlock;
6068 	}
6069 
6070 	if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6071 		err = nl80211_parse_fils_discovery(rdev,
6072 						   info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6073 						   params);
6074 		if (err)
6075 			goto out_unlock;
6076 	}
6077 
6078 	if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6079 		err = nl80211_parse_unsol_bcast_probe_resp(
6080 			rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6081 			params);
6082 		if (err)
6083 			goto out_unlock;
6084 	}
6085 
6086 	if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6087 		err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6088 						  info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6089 						  &params->mbssid_config,
6090 						  params->beacon.mbssid_ies ?
6091 							params->beacon.mbssid_ies->cnt :
6092 							0);
6093 		if (err)
6094 			goto out_unlock;
6095 	}
6096 
6097 	err = nl80211_calculate_ap_params(params);
6098 	if (err)
6099 		goto out_unlock;
6100 
6101 	if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6102 		params->flags = nla_get_u32(
6103 			info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6104 	else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6105 		params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6106 
6107 	if (wdev->conn_owner_nlportid &&
6108 	    info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6109 	    wdev->conn_owner_nlportid != info->snd_portid) {
6110 		err = -EINVAL;
6111 		goto out_unlock;
6112 	}
6113 
6114 	/* FIXME: validate MLO/link-id against driver capabilities */
6115 
6116 	err = rdev_start_ap(rdev, dev, params);
6117 	if (!err) {
6118 		wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6119 		wdev->links[link_id].ap.chandef = params->chandef;
6120 		wdev->u.ap.ssid_len = params->ssid_len;
6121 		memcpy(wdev->u.ap.ssid, params->ssid,
6122 		       params->ssid_len);
6123 
6124 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6125 			wdev->conn_owner_nlportid = info->snd_portid;
6126 
6127 		nl80211_send_ap_started(wdev, link_id);
6128 	}
6129 out_unlock:
6130 	wdev_unlock(wdev);
6131 out:
6132 	kfree(params->acl);
6133 	kfree(params->beacon.mbssid_ies);
6134 	if (params->mbssid_config.tx_wdev &&
6135 	    params->mbssid_config.tx_wdev->netdev &&
6136 	    params->mbssid_config.tx_wdev->netdev != dev)
6137 		dev_put(params->mbssid_config.tx_wdev->netdev);
6138 	kfree(params);
6139 
6140 	return err;
6141 }
6142 
6143 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6144 {
6145 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6146 	unsigned int link_id = nl80211_link_id(info->attrs);
6147 	struct net_device *dev = info->user_ptr[1];
6148 	struct wireless_dev *wdev = dev->ieee80211_ptr;
6149 	struct cfg80211_beacon_data params;
6150 	int err;
6151 
6152 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6153 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6154 		return -EOPNOTSUPP;
6155 
6156 	if (!rdev->ops->change_beacon)
6157 		return -EOPNOTSUPP;
6158 
6159 	if (!wdev->links[link_id].ap.beacon_interval)
6160 		return -EINVAL;
6161 
6162 	err = nl80211_parse_beacon(rdev, info->attrs, &params);
6163 	if (err)
6164 		goto out;
6165 
6166 	wdev_lock(wdev);
6167 	err = rdev_change_beacon(rdev, dev, &params);
6168 	wdev_unlock(wdev);
6169 
6170 out:
6171 	kfree(params.mbssid_ies);
6172 	return err;
6173 }
6174 
6175 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6176 {
6177 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6178 	unsigned int link_id = nl80211_link_id(info->attrs);
6179 	struct net_device *dev = info->user_ptr[1];
6180 
6181 	return cfg80211_stop_ap(rdev, dev, link_id, false);
6182 }
6183 
6184 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6185 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6186 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6187 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6188 	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6189 	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6190 	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6191 };
6192 
6193 static int parse_station_flags(struct genl_info *info,
6194 			       enum nl80211_iftype iftype,
6195 			       struct station_parameters *params)
6196 {
6197 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6198 	struct nlattr *nla;
6199 	int flag;
6200 
6201 	/*
6202 	 * Try parsing the new attribute first so userspace
6203 	 * can specify both for older kernels.
6204 	 */
6205 	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6206 	if (nla) {
6207 		struct nl80211_sta_flag_update *sta_flags;
6208 
6209 		sta_flags = nla_data(nla);
6210 		params->sta_flags_mask = sta_flags->mask;
6211 		params->sta_flags_set = sta_flags->set;
6212 		params->sta_flags_set &= params->sta_flags_mask;
6213 		if ((params->sta_flags_mask |
6214 		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6215 			return -EINVAL;
6216 		return 0;
6217 	}
6218 
6219 	/* if present, parse the old attribute */
6220 
6221 	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6222 	if (!nla)
6223 		return 0;
6224 
6225 	if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6226 		return -EINVAL;
6227 
6228 	/*
6229 	 * Only allow certain flags for interface types so that
6230 	 * other attributes are silently ignored. Remember that
6231 	 * this is backward compatibility code with old userspace
6232 	 * and shouldn't be hit in other cases anyway.
6233 	 */
6234 	switch (iftype) {
6235 	case NL80211_IFTYPE_AP:
6236 	case NL80211_IFTYPE_AP_VLAN:
6237 	case NL80211_IFTYPE_P2P_GO:
6238 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6239 					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6240 					 BIT(NL80211_STA_FLAG_WME) |
6241 					 BIT(NL80211_STA_FLAG_MFP);
6242 		break;
6243 	case NL80211_IFTYPE_P2P_CLIENT:
6244 	case NL80211_IFTYPE_STATION:
6245 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6246 					 BIT(NL80211_STA_FLAG_TDLS_PEER);
6247 		break;
6248 	case NL80211_IFTYPE_MESH_POINT:
6249 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6250 					 BIT(NL80211_STA_FLAG_MFP) |
6251 					 BIT(NL80211_STA_FLAG_AUTHORIZED);
6252 		break;
6253 	default:
6254 		return -EINVAL;
6255 	}
6256 
6257 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6258 		if (flags[flag]) {
6259 			params->sta_flags_set |= (1<<flag);
6260 
6261 			/* no longer support new API additions in old API */
6262 			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6263 				return -EINVAL;
6264 		}
6265 	}
6266 
6267 	return 0;
6268 }
6269 
6270 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6271 {
6272 	struct nlattr *rate;
6273 	u32 bitrate;
6274 	u16 bitrate_compat;
6275 	enum nl80211_rate_info rate_flg;
6276 
6277 	rate = nla_nest_start_noflag(msg, attr);
6278 	if (!rate)
6279 		return false;
6280 
6281 	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6282 	bitrate = cfg80211_calculate_bitrate(info);
6283 	/* report 16-bit bitrate only if we can */
6284 	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6285 	if (bitrate > 0 &&
6286 	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6287 		return false;
6288 	if (bitrate_compat > 0 &&
6289 	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6290 		return false;
6291 
6292 	switch (info->bw) {
6293 	case RATE_INFO_BW_5:
6294 		rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6295 		break;
6296 	case RATE_INFO_BW_10:
6297 		rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6298 		break;
6299 	default:
6300 		WARN_ON(1);
6301 		fallthrough;
6302 	case RATE_INFO_BW_20:
6303 		rate_flg = 0;
6304 		break;
6305 	case RATE_INFO_BW_40:
6306 		rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6307 		break;
6308 	case RATE_INFO_BW_80:
6309 		rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6310 		break;
6311 	case RATE_INFO_BW_160:
6312 		rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6313 		break;
6314 	case RATE_INFO_BW_HE_RU:
6315 		rate_flg = 0;
6316 		WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6317 		break;
6318 	case RATE_INFO_BW_320:
6319 		rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6320 		break;
6321 	case RATE_INFO_BW_EHT_RU:
6322 		rate_flg = 0;
6323 		WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6324 		break;
6325 	}
6326 
6327 	if (rate_flg && nla_put_flag(msg, rate_flg))
6328 		return false;
6329 
6330 	if (info->flags & RATE_INFO_FLAGS_MCS) {
6331 		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6332 			return false;
6333 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6334 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6335 			return false;
6336 	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6337 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6338 			return false;
6339 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6340 			return false;
6341 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6342 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6343 			return false;
6344 	} else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6345 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6346 			return false;
6347 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6348 			return false;
6349 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6350 			return false;
6351 		if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6352 			return false;
6353 		if (info->bw == RATE_INFO_BW_HE_RU &&
6354 		    nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6355 			       info->he_ru_alloc))
6356 			return false;
6357 	} else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6358 		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6359 			return false;
6360 		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6361 			return false;
6362 		if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6363 			return false;
6364 		if (info->bw == RATE_INFO_BW_EHT_RU &&
6365 		    nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6366 			       info->eht_ru_alloc))
6367 			return false;
6368 	}
6369 
6370 	nla_nest_end(msg, rate);
6371 	return true;
6372 }
6373 
6374 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6375 			       int id)
6376 {
6377 	void *attr;
6378 	int i = 0;
6379 
6380 	if (!mask)
6381 		return true;
6382 
6383 	attr = nla_nest_start_noflag(msg, id);
6384 	if (!attr)
6385 		return false;
6386 
6387 	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6388 		if (!(mask & BIT(i)))
6389 			continue;
6390 
6391 		if (nla_put_u8(msg, i, signal[i]))
6392 			return false;
6393 	}
6394 
6395 	nla_nest_end(msg, attr);
6396 
6397 	return true;
6398 }
6399 
6400 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6401 				u32 seq, int flags,
6402 				struct cfg80211_registered_device *rdev,
6403 				struct net_device *dev,
6404 				const u8 *mac_addr, struct station_info *sinfo)
6405 {
6406 	void *hdr;
6407 	struct nlattr *sinfoattr, *bss_param;
6408 
6409 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6410 	if (!hdr) {
6411 		cfg80211_sinfo_release_content(sinfo);
6412 		return -1;
6413 	}
6414 
6415 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6416 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6417 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6418 		goto nla_put_failure;
6419 
6420 	sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6421 	if (!sinfoattr)
6422 		goto nla_put_failure;
6423 
6424 #define PUT_SINFO(attr, memb, type) do {				\
6425 	BUILD_BUG_ON(sizeof(type) == sizeof(u64));			\
6426 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
6427 	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
6428 			     sinfo->memb))				\
6429 		goto nla_put_failure;					\
6430 	} while (0)
6431 #define PUT_SINFO_U64(attr, memb) do {					\
6432 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&	\
6433 	    nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,		\
6434 			      sinfo->memb, NL80211_STA_INFO_PAD))	\
6435 		goto nla_put_failure;					\
6436 	} while (0)
6437 
6438 	PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6439 	PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6440 	PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6441 
6442 	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6443 			     BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6444 	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6445 			(u32)sinfo->rx_bytes))
6446 		goto nla_put_failure;
6447 
6448 	if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6449 			     BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6450 	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6451 			(u32)sinfo->tx_bytes))
6452 		goto nla_put_failure;
6453 
6454 	PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6455 	PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6456 	PUT_SINFO(LLID, llid, u16);
6457 	PUT_SINFO(PLID, plid, u16);
6458 	PUT_SINFO(PLINK_STATE, plink_state, u8);
6459 	PUT_SINFO_U64(RX_DURATION, rx_duration);
6460 	PUT_SINFO_U64(TX_DURATION, tx_duration);
6461 
6462 	if (wiphy_ext_feature_isset(&rdev->wiphy,
6463 				    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6464 		PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6465 
6466 	switch (rdev->wiphy.signal_type) {
6467 	case CFG80211_SIGNAL_TYPE_MBM:
6468 		PUT_SINFO(SIGNAL, signal, u8);
6469 		PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6470 		break;
6471 	default:
6472 		break;
6473 	}
6474 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6475 		if (!nl80211_put_signal(msg, sinfo->chains,
6476 					sinfo->chain_signal,
6477 					NL80211_STA_INFO_CHAIN_SIGNAL))
6478 			goto nla_put_failure;
6479 	}
6480 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6481 		if (!nl80211_put_signal(msg, sinfo->chains,
6482 					sinfo->chain_signal_avg,
6483 					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6484 			goto nla_put_failure;
6485 	}
6486 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6487 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6488 					  NL80211_STA_INFO_TX_BITRATE))
6489 			goto nla_put_failure;
6490 	}
6491 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6492 		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6493 					  NL80211_STA_INFO_RX_BITRATE))
6494 			goto nla_put_failure;
6495 	}
6496 
6497 	PUT_SINFO(RX_PACKETS, rx_packets, u32);
6498 	PUT_SINFO(TX_PACKETS, tx_packets, u32);
6499 	PUT_SINFO(TX_RETRIES, tx_retries, u32);
6500 	PUT_SINFO(TX_FAILED, tx_failed, u32);
6501 	PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6502 	PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6503 	PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6504 	PUT_SINFO(LOCAL_PM, local_pm, u32);
6505 	PUT_SINFO(PEER_PM, peer_pm, u32);
6506 	PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6507 	PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6508 	PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6509 
6510 	if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6511 		bss_param = nla_nest_start_noflag(msg,
6512 						  NL80211_STA_INFO_BSS_PARAM);
6513 		if (!bss_param)
6514 			goto nla_put_failure;
6515 
6516 		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6517 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6518 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6519 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6520 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6521 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6522 		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6523 			       sinfo->bss_param.dtim_period) ||
6524 		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6525 				sinfo->bss_param.beacon_interval))
6526 			goto nla_put_failure;
6527 
6528 		nla_nest_end(msg, bss_param);
6529 	}
6530 	if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6531 	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6532 		    sizeof(struct nl80211_sta_flag_update),
6533 		    &sinfo->sta_flags))
6534 		goto nla_put_failure;
6535 
6536 	PUT_SINFO_U64(T_OFFSET, t_offset);
6537 	PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6538 	PUT_SINFO_U64(BEACON_RX, rx_beacon);
6539 	PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6540 	PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6541 	PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6542 	if (wiphy_ext_feature_isset(&rdev->wiphy,
6543 				    NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6544 		PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6545 		PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6546 	}
6547 
6548 #undef PUT_SINFO
6549 #undef PUT_SINFO_U64
6550 
6551 	if (sinfo->pertid) {
6552 		struct nlattr *tidsattr;
6553 		int tid;
6554 
6555 		tidsattr = nla_nest_start_noflag(msg,
6556 						 NL80211_STA_INFO_TID_STATS);
6557 		if (!tidsattr)
6558 			goto nla_put_failure;
6559 
6560 		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6561 			struct cfg80211_tid_stats *tidstats;
6562 			struct nlattr *tidattr;
6563 
6564 			tidstats = &sinfo->pertid[tid];
6565 
6566 			if (!tidstats->filled)
6567 				continue;
6568 
6569 			tidattr = nla_nest_start_noflag(msg, tid + 1);
6570 			if (!tidattr)
6571 				goto nla_put_failure;
6572 
6573 #define PUT_TIDVAL_U64(attr, memb) do {					\
6574 	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
6575 	    nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,		\
6576 			      tidstats->memb, NL80211_TID_STATS_PAD))	\
6577 		goto nla_put_failure;					\
6578 	} while (0)
6579 
6580 			PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6581 			PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6582 			PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6583 			PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6584 
6585 #undef PUT_TIDVAL_U64
6586 			if ((tidstats->filled &
6587 			     BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6588 			    !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6589 						   NL80211_TID_STATS_TXQ_STATS))
6590 				goto nla_put_failure;
6591 
6592 			nla_nest_end(msg, tidattr);
6593 		}
6594 
6595 		nla_nest_end(msg, tidsattr);
6596 	}
6597 
6598 	nla_nest_end(msg, sinfoattr);
6599 
6600 	if (sinfo->assoc_req_ies_len &&
6601 	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6602 		    sinfo->assoc_req_ies))
6603 		goto nla_put_failure;
6604 
6605 	if (sinfo->assoc_resp_ies_len &&
6606 	    nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6607 		    sinfo->assoc_resp_ies))
6608 		goto nla_put_failure;
6609 
6610 	if (sinfo->mlo_params_valid) {
6611 		if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6612 			       sinfo->assoc_link_id))
6613 			goto nla_put_failure;
6614 
6615 		if (!is_zero_ether_addr(sinfo->mld_addr) &&
6616 		    nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6617 			    sinfo->mld_addr))
6618 			goto nla_put_failure;
6619 	}
6620 
6621 	cfg80211_sinfo_release_content(sinfo);
6622 	genlmsg_end(msg, hdr);
6623 	return 0;
6624 
6625  nla_put_failure:
6626 	cfg80211_sinfo_release_content(sinfo);
6627 	genlmsg_cancel(msg, hdr);
6628 	return -EMSGSIZE;
6629 }
6630 
6631 static int nl80211_dump_station(struct sk_buff *skb,
6632 				struct netlink_callback *cb)
6633 {
6634 	struct station_info sinfo;
6635 	struct cfg80211_registered_device *rdev;
6636 	struct wireless_dev *wdev;
6637 	u8 mac_addr[ETH_ALEN];
6638 	int sta_idx = cb->args[2];
6639 	int err;
6640 
6641 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6642 	if (err)
6643 		return err;
6644 	/* nl80211_prepare_wdev_dump acquired it in the successful case */
6645 	__acquire(&rdev->wiphy.mtx);
6646 
6647 	if (!wdev->netdev) {
6648 		err = -EINVAL;
6649 		goto out_err;
6650 	}
6651 
6652 	if (!rdev->ops->dump_station) {
6653 		err = -EOPNOTSUPP;
6654 		goto out_err;
6655 	}
6656 
6657 	while (1) {
6658 		memset(&sinfo, 0, sizeof(sinfo));
6659 		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6660 					mac_addr, &sinfo);
6661 		if (err == -ENOENT)
6662 			break;
6663 		if (err)
6664 			goto out_err;
6665 
6666 		if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6667 				NETLINK_CB(cb->skb).portid,
6668 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
6669 				rdev, wdev->netdev, mac_addr,
6670 				&sinfo) < 0)
6671 			goto out;
6672 
6673 		sta_idx++;
6674 	}
6675 
6676  out:
6677 	cb->args[2] = sta_idx;
6678 	err = skb->len;
6679  out_err:
6680 	wiphy_unlock(&rdev->wiphy);
6681 
6682 	return err;
6683 }
6684 
6685 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6686 {
6687 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6688 	struct net_device *dev = info->user_ptr[1];
6689 	struct station_info sinfo;
6690 	struct sk_buff *msg;
6691 	u8 *mac_addr = NULL;
6692 	int err;
6693 
6694 	memset(&sinfo, 0, sizeof(sinfo));
6695 
6696 	if (!info->attrs[NL80211_ATTR_MAC])
6697 		return -EINVAL;
6698 
6699 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6700 
6701 	if (!rdev->ops->get_station)
6702 		return -EOPNOTSUPP;
6703 
6704 	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6705 	if (err)
6706 		return err;
6707 
6708 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6709 	if (!msg) {
6710 		cfg80211_sinfo_release_content(&sinfo);
6711 		return -ENOMEM;
6712 	}
6713 
6714 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6715 				 info->snd_portid, info->snd_seq, 0,
6716 				 rdev, dev, mac_addr, &sinfo) < 0) {
6717 		nlmsg_free(msg);
6718 		return -ENOBUFS;
6719 	}
6720 
6721 	return genlmsg_reply(msg, info);
6722 }
6723 
6724 int cfg80211_check_station_change(struct wiphy *wiphy,
6725 				  struct station_parameters *params,
6726 				  enum cfg80211_station_type statype)
6727 {
6728 	if (params->listen_interval != -1 &&
6729 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6730 		return -EINVAL;
6731 
6732 	if (params->support_p2p_ps != -1 &&
6733 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6734 		return -EINVAL;
6735 
6736 	if (params->aid &&
6737 	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6738 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6739 		return -EINVAL;
6740 
6741 	/* When you run into this, adjust the code below for the new flag */
6742 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6743 
6744 	switch (statype) {
6745 	case CFG80211_STA_MESH_PEER_KERNEL:
6746 	case CFG80211_STA_MESH_PEER_USER:
6747 		/*
6748 		 * No ignoring the TDLS flag here -- the userspace mesh
6749 		 * code doesn't have the bug of including TDLS in the
6750 		 * mask everywhere.
6751 		 */
6752 		if (params->sta_flags_mask &
6753 				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6754 				  BIT(NL80211_STA_FLAG_MFP) |
6755 				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
6756 			return -EINVAL;
6757 		break;
6758 	case CFG80211_STA_TDLS_PEER_SETUP:
6759 	case CFG80211_STA_TDLS_PEER_ACTIVE:
6760 		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6761 			return -EINVAL;
6762 		/* ignore since it can't change */
6763 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6764 		break;
6765 	default:
6766 		/* disallow mesh-specific things */
6767 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6768 			return -EINVAL;
6769 		if (params->local_pm)
6770 			return -EINVAL;
6771 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6772 			return -EINVAL;
6773 	}
6774 
6775 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6776 	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6777 		/* TDLS can't be set, ... */
6778 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6779 			return -EINVAL;
6780 		/*
6781 		 * ... but don't bother the driver with it. This works around
6782 		 * a hostapd/wpa_supplicant issue -- it always includes the
6783 		 * TLDS_PEER flag in the mask even for AP mode.
6784 		 */
6785 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6786 	}
6787 
6788 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6789 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6790 		/* reject other things that can't change */
6791 		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6792 			return -EINVAL;
6793 		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6794 			return -EINVAL;
6795 		if (params->link_sta_params.supported_rates)
6796 			return -EINVAL;
6797 		if (params->ext_capab || params->link_sta_params.ht_capa ||
6798 		    params->link_sta_params.vht_capa ||
6799 		    params->link_sta_params.he_capa ||
6800 		    params->link_sta_params.eht_capa)
6801 			return -EINVAL;
6802 	}
6803 
6804 	if (statype != CFG80211_STA_AP_CLIENT &&
6805 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6806 		if (params->vlan)
6807 			return -EINVAL;
6808 	}
6809 
6810 	switch (statype) {
6811 	case CFG80211_STA_AP_MLME_CLIENT:
6812 		/* Use this only for authorizing/unauthorizing a station */
6813 		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6814 			return -EOPNOTSUPP;
6815 		break;
6816 	case CFG80211_STA_AP_CLIENT:
6817 	case CFG80211_STA_AP_CLIENT_UNASSOC:
6818 		/* accept only the listed bits */
6819 		if (params->sta_flags_mask &
6820 				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6821 				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6822 				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
6823 				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6824 				  BIT(NL80211_STA_FLAG_WME) |
6825 				  BIT(NL80211_STA_FLAG_MFP)))
6826 			return -EINVAL;
6827 
6828 		/* but authenticated/associated only if driver handles it */
6829 		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6830 		    params->sta_flags_mask &
6831 				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6832 				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
6833 			return -EINVAL;
6834 		break;
6835 	case CFG80211_STA_IBSS:
6836 	case CFG80211_STA_AP_STA:
6837 		/* reject any changes other than AUTHORIZED */
6838 		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6839 			return -EINVAL;
6840 		break;
6841 	case CFG80211_STA_TDLS_PEER_SETUP:
6842 		/* reject any changes other than AUTHORIZED or WME */
6843 		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6844 					       BIT(NL80211_STA_FLAG_WME)))
6845 			return -EINVAL;
6846 		/* force (at least) rates when authorizing */
6847 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6848 		    !params->link_sta_params.supported_rates)
6849 			return -EINVAL;
6850 		break;
6851 	case CFG80211_STA_TDLS_PEER_ACTIVE:
6852 		/* reject any changes */
6853 		return -EINVAL;
6854 	case CFG80211_STA_MESH_PEER_KERNEL:
6855 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6856 			return -EINVAL;
6857 		break;
6858 	case CFG80211_STA_MESH_PEER_USER:
6859 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6860 		    params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6861 			return -EINVAL;
6862 		break;
6863 	}
6864 
6865 	/*
6866 	 * Older kernel versions ignored this attribute entirely, so don't
6867 	 * reject attempts to update it but mark it as unused instead so the
6868 	 * driver won't look at the data.
6869 	 */
6870 	if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6871 	    statype != CFG80211_STA_TDLS_PEER_SETUP)
6872 		params->link_sta_params.opmode_notif_used = false;
6873 
6874 	return 0;
6875 }
6876 EXPORT_SYMBOL(cfg80211_check_station_change);
6877 
6878 /*
6879  * Get vlan interface making sure it is running and on the right wiphy.
6880  */
6881 static struct net_device *get_vlan(struct genl_info *info,
6882 				   struct cfg80211_registered_device *rdev)
6883 {
6884 	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6885 	struct net_device *v;
6886 	int ret;
6887 
6888 	if (!vlanattr)
6889 		return NULL;
6890 
6891 	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6892 	if (!v)
6893 		return ERR_PTR(-ENODEV);
6894 
6895 	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6896 		ret = -EINVAL;
6897 		goto error;
6898 	}
6899 
6900 	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6901 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6902 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6903 		ret = -EINVAL;
6904 		goto error;
6905 	}
6906 
6907 	if (!netif_running(v)) {
6908 		ret = -ENETDOWN;
6909 		goto error;
6910 	}
6911 
6912 	return v;
6913  error:
6914 	dev_put(v);
6915 	return ERR_PTR(ret);
6916 }
6917 
6918 static int nl80211_parse_sta_wme(struct genl_info *info,
6919 				 struct station_parameters *params)
6920 {
6921 	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6922 	struct nlattr *nla;
6923 	int err;
6924 
6925 	/* parse WME attributes if present */
6926 	if (!info->attrs[NL80211_ATTR_STA_WME])
6927 		return 0;
6928 
6929 	nla = info->attrs[NL80211_ATTR_STA_WME];
6930 	err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6931 					  nl80211_sta_wme_policy,
6932 					  info->extack);
6933 	if (err)
6934 		return err;
6935 
6936 	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6937 		params->uapsd_queues = nla_get_u8(
6938 			tb[NL80211_STA_WME_UAPSD_QUEUES]);
6939 	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6940 		return -EINVAL;
6941 
6942 	if (tb[NL80211_STA_WME_MAX_SP])
6943 		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6944 
6945 	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6946 		return -EINVAL;
6947 
6948 	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6949 
6950 	return 0;
6951 }
6952 
6953 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6954 				      struct station_parameters *params)
6955 {
6956 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6957 		params->supported_channels =
6958 		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6959 		params->supported_channels_len =
6960 		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6961 		/*
6962 		 * Need to include at least one (first channel, number of
6963 		 * channels) tuple for each subband (checked in policy),
6964 		 * and must have proper tuples for the rest of the data as well.
6965 		 */
6966 		if (params->supported_channels_len % 2)
6967 			return -EINVAL;
6968 	}
6969 
6970 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6971 		params->supported_oper_classes =
6972 		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6973 		params->supported_oper_classes_len =
6974 		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6975 	}
6976 	return 0;
6977 }
6978 
6979 static int nl80211_set_station_tdls(struct genl_info *info,
6980 				    struct station_parameters *params)
6981 {
6982 	int err;
6983 	/* Dummy STA entry gets updated once the peer capabilities are known */
6984 	if (info->attrs[NL80211_ATTR_PEER_AID])
6985 		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6986 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6987 		params->link_sta_params.ht_capa =
6988 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6989 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6990 		params->link_sta_params.vht_capa =
6991 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6992 	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6993 		params->link_sta_params.he_capa =
6994 			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6995 		params->link_sta_params.he_capa_len =
6996 			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6997 
6998 		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
6999 			params->link_sta_params.eht_capa =
7000 				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7001 			params->link_sta_params.eht_capa_len =
7002 				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7003 
7004 			if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7005 							(const u8 *)params->link_sta_params.eht_capa,
7006 							params->link_sta_params.eht_capa_len,
7007 							false))
7008 				return -EINVAL;
7009 		}
7010 	}
7011 
7012 	err = nl80211_parse_sta_channel_info(info, params);
7013 	if (err)
7014 		return err;
7015 
7016 	return nl80211_parse_sta_wme(info, params);
7017 }
7018 
7019 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7020 					     struct sta_txpwr *txpwr,
7021 					     bool *txpwr_set)
7022 {
7023 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7024 	int idx;
7025 
7026 	if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7027 		if (!rdev->ops->set_tx_power ||
7028 		    !wiphy_ext_feature_isset(&rdev->wiphy,
7029 					 NL80211_EXT_FEATURE_STA_TX_PWR))
7030 			return -EOPNOTSUPP;
7031 
7032 		idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7033 		txpwr->type = nla_get_u8(info->attrs[idx]);
7034 
7035 		if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7036 			idx = NL80211_ATTR_STA_TX_POWER;
7037 
7038 			if (info->attrs[idx])
7039 				txpwr->power = nla_get_s16(info->attrs[idx]);
7040 			else
7041 				return -EINVAL;
7042 		}
7043 
7044 		*txpwr_set = true;
7045 	} else {
7046 		*txpwr_set = false;
7047 	}
7048 
7049 	return 0;
7050 }
7051 
7052 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7053 {
7054 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7055 	struct net_device *dev = info->user_ptr[1];
7056 	struct station_parameters params;
7057 	u8 *mac_addr;
7058 	int err;
7059 
7060 	memset(&params, 0, sizeof(params));
7061 
7062 	if (!rdev->ops->change_station)
7063 		return -EOPNOTSUPP;
7064 
7065 	/*
7066 	 * AID and listen_interval properties can be set only for unassociated
7067 	 * station. Include these parameters here and will check them in
7068 	 * cfg80211_check_station_change().
7069 	 */
7070 	if (info->attrs[NL80211_ATTR_STA_AID])
7071 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7072 
7073 	if (info->attrs[NL80211_ATTR_VLAN_ID])
7074 		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7075 
7076 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7077 		params.listen_interval =
7078 		     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7079 	else
7080 		params.listen_interval = -1;
7081 
7082 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7083 		params.support_p2p_ps =
7084 			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7085 	else
7086 		params.support_p2p_ps = -1;
7087 
7088 	if (!info->attrs[NL80211_ATTR_MAC])
7089 		return -EINVAL;
7090 
7091 	params.link_sta_params.link_id =
7092 		nl80211_link_id_or_invalid(info->attrs);
7093 
7094 	if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7095 		/* If MLD_ADDR attribute is set then this is an MLD station
7096 		 * and the MLD_ADDR attribute holds the MLD address and the
7097 		 * MAC attribute holds for the LINK address.
7098 		 * In that case, the link_id is also expected to be valid.
7099 		 */
7100 		if (params.link_sta_params.link_id < 0)
7101 			return -EINVAL;
7102 
7103 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7104 		params.link_sta_params.mld_mac = mac_addr;
7105 		params.link_sta_params.link_mac =
7106 			nla_data(info->attrs[NL80211_ATTR_MAC]);
7107 		if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7108 			return -EINVAL;
7109 	} else {
7110 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7111 	}
7112 
7113 
7114 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7115 		params.link_sta_params.supported_rates =
7116 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7117 		params.link_sta_params.supported_rates_len =
7118 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7119 	}
7120 
7121 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7122 		params.capability =
7123 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7124 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7125 	}
7126 
7127 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7128 		params.ext_capab =
7129 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7130 		params.ext_capab_len =
7131 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7132 	}
7133 
7134 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7135 		return -EINVAL;
7136 
7137 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7138 		params.plink_action =
7139 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7140 
7141 	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7142 		params.plink_state =
7143 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7144 		if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7145 			params.peer_aid = nla_get_u16(
7146 				info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7147 		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7148 	}
7149 
7150 	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7151 		params.local_pm = nla_get_u32(
7152 			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7153 
7154 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7155 		params.link_sta_params.opmode_notif_used = true;
7156 		params.link_sta_params.opmode_notif =
7157 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7158 	}
7159 
7160 	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7161 		params.link_sta_params.he_6ghz_capa =
7162 			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7163 
7164 	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7165 		params.airtime_weight =
7166 			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7167 
7168 	if (params.airtime_weight &&
7169 	    !wiphy_ext_feature_isset(&rdev->wiphy,
7170 				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7171 		return -EOPNOTSUPP;
7172 
7173 	err = nl80211_parse_sta_txpower_setting(info,
7174 						&params.link_sta_params.txpwr,
7175 						&params.link_sta_params.txpwr_set);
7176 	if (err)
7177 		return err;
7178 
7179 	/* Include parameters for TDLS peer (will check later) */
7180 	err = nl80211_set_station_tdls(info, &params);
7181 	if (err)
7182 		return err;
7183 
7184 	params.vlan = get_vlan(info, rdev);
7185 	if (IS_ERR(params.vlan))
7186 		return PTR_ERR(params.vlan);
7187 
7188 	switch (dev->ieee80211_ptr->iftype) {
7189 	case NL80211_IFTYPE_AP:
7190 	case NL80211_IFTYPE_AP_VLAN:
7191 	case NL80211_IFTYPE_P2P_GO:
7192 	case NL80211_IFTYPE_P2P_CLIENT:
7193 	case NL80211_IFTYPE_STATION:
7194 	case NL80211_IFTYPE_ADHOC:
7195 	case NL80211_IFTYPE_MESH_POINT:
7196 		break;
7197 	default:
7198 		err = -EOPNOTSUPP;
7199 		goto out_put_vlan;
7200 	}
7201 
7202 	/* driver will call cfg80211_check_station_change() */
7203 	wdev_lock(dev->ieee80211_ptr);
7204 	err = rdev_change_station(rdev, dev, mac_addr, &params);
7205 	wdev_unlock(dev->ieee80211_ptr);
7206 
7207  out_put_vlan:
7208 	dev_put(params.vlan);
7209 
7210 	return err;
7211 }
7212 
7213 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7214 {
7215 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7216 	int err;
7217 	struct net_device *dev = info->user_ptr[1];
7218 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7219 	struct station_parameters params;
7220 	u8 *mac_addr = NULL;
7221 	u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7222 			 BIT(NL80211_STA_FLAG_ASSOCIATED);
7223 
7224 	memset(&params, 0, sizeof(params));
7225 
7226 	if (!rdev->ops->add_station)
7227 		return -EOPNOTSUPP;
7228 
7229 	if (!info->attrs[NL80211_ATTR_MAC])
7230 		return -EINVAL;
7231 
7232 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7233 		return -EINVAL;
7234 
7235 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7236 		return -EINVAL;
7237 
7238 	if (!info->attrs[NL80211_ATTR_STA_AID] &&
7239 	    !info->attrs[NL80211_ATTR_PEER_AID])
7240 		return -EINVAL;
7241 
7242 	params.link_sta_params.link_id =
7243 		nl80211_link_id_or_invalid(info->attrs);
7244 
7245 	if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7246 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7247 		params.link_sta_params.mld_mac = mac_addr;
7248 		params.link_sta_params.link_mac =
7249 			nla_data(info->attrs[NL80211_ATTR_MAC]);
7250 		if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7251 			return -EINVAL;
7252 	} else {
7253 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7254 	}
7255 
7256 	params.link_sta_params.supported_rates =
7257 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7258 	params.link_sta_params.supported_rates_len =
7259 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7260 	params.listen_interval =
7261 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7262 
7263 	if (info->attrs[NL80211_ATTR_VLAN_ID])
7264 		params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7265 
7266 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7267 		params.support_p2p_ps =
7268 			nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7269 	} else {
7270 		/*
7271 		 * if not specified, assume it's supported for P2P GO interface,
7272 		 * and is NOT supported for AP interface
7273 		 */
7274 		params.support_p2p_ps =
7275 			dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7276 	}
7277 
7278 	if (info->attrs[NL80211_ATTR_PEER_AID])
7279 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7280 	else
7281 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7282 
7283 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7284 		params.capability =
7285 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7286 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7287 	}
7288 
7289 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7290 		params.ext_capab =
7291 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7292 		params.ext_capab_len =
7293 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7294 	}
7295 
7296 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7297 		params.link_sta_params.ht_capa =
7298 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7299 
7300 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7301 		params.link_sta_params.vht_capa =
7302 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7303 
7304 	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7305 		params.link_sta_params.he_capa =
7306 			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7307 		params.link_sta_params.he_capa_len =
7308 			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7309 
7310 		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7311 			params.link_sta_params.eht_capa =
7312 				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7313 			params.link_sta_params.eht_capa_len =
7314 				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7315 
7316 			if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7317 							(const u8 *)params.link_sta_params.eht_capa,
7318 							params.link_sta_params.eht_capa_len,
7319 							false))
7320 				return -EINVAL;
7321 		}
7322 	}
7323 
7324 	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7325 		params.link_sta_params.he_6ghz_capa =
7326 			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7327 
7328 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7329 		params.link_sta_params.opmode_notif_used = true;
7330 		params.link_sta_params.opmode_notif =
7331 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7332 	}
7333 
7334 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7335 		params.plink_action =
7336 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7337 
7338 	if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7339 		params.airtime_weight =
7340 			nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7341 
7342 	if (params.airtime_weight &&
7343 	    !wiphy_ext_feature_isset(&rdev->wiphy,
7344 				     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7345 		return -EOPNOTSUPP;
7346 
7347 	err = nl80211_parse_sta_txpower_setting(info,
7348 						&params.link_sta_params.txpwr,
7349 						&params.link_sta_params.txpwr_set);
7350 	if (err)
7351 		return err;
7352 
7353 	err = nl80211_parse_sta_channel_info(info, &params);
7354 	if (err)
7355 		return err;
7356 
7357 	err = nl80211_parse_sta_wme(info, &params);
7358 	if (err)
7359 		return err;
7360 
7361 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7362 		return -EINVAL;
7363 
7364 	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7365 	 * as userspace might just pass through the capabilities from the IEs
7366 	 * directly, rather than enforcing this restriction and returning an
7367 	 * error in this case.
7368 	 */
7369 	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7370 		params.link_sta_params.ht_capa = NULL;
7371 		params.link_sta_params.vht_capa = NULL;
7372 
7373 		/* HE and EHT require WME */
7374 		if (params.link_sta_params.he_capa_len ||
7375 		    params.link_sta_params.he_6ghz_capa ||
7376 		    params.link_sta_params.eht_capa_len)
7377 			return -EINVAL;
7378 	}
7379 
7380 	/* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7381 	if (params.link_sta_params.he_6ghz_capa &&
7382 	    (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7383 		return -EINVAL;
7384 
7385 	/* When you run into this, adjust the code below for the new flag */
7386 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7387 
7388 	switch (dev->ieee80211_ptr->iftype) {
7389 	case NL80211_IFTYPE_AP:
7390 	case NL80211_IFTYPE_AP_VLAN:
7391 	case NL80211_IFTYPE_P2P_GO:
7392 		/* ignore WME attributes if iface/sta is not capable */
7393 		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7394 		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7395 			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7396 
7397 		/* TDLS peers cannot be added */
7398 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7399 		    info->attrs[NL80211_ATTR_PEER_AID])
7400 			return -EINVAL;
7401 		/* but don't bother the driver with it */
7402 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7403 
7404 		/* allow authenticated/associated only if driver handles it */
7405 		if (!(rdev->wiphy.features &
7406 				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7407 		    params.sta_flags_mask & auth_assoc)
7408 			return -EINVAL;
7409 
7410 		/* Older userspace, or userspace wanting to be compatible with
7411 		 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7412 		 * and assoc flags in the mask, but assumes the station will be
7413 		 * added as associated anyway since this was the required driver
7414 		 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7415 		 * introduced.
7416 		 * In order to not bother drivers with this quirk in the API
7417 		 * set the flags in both the mask and set for new stations in
7418 		 * this case.
7419 		 */
7420 		if (!(params.sta_flags_mask & auth_assoc)) {
7421 			params.sta_flags_mask |= auth_assoc;
7422 			params.sta_flags_set |= auth_assoc;
7423 		}
7424 
7425 		/* must be last in here for error handling */
7426 		params.vlan = get_vlan(info, rdev);
7427 		if (IS_ERR(params.vlan))
7428 			return PTR_ERR(params.vlan);
7429 		break;
7430 	case NL80211_IFTYPE_MESH_POINT:
7431 		/* ignore uAPSD data */
7432 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7433 
7434 		/* associated is disallowed */
7435 		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7436 			return -EINVAL;
7437 		/* TDLS peers cannot be added */
7438 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7439 		    info->attrs[NL80211_ATTR_PEER_AID])
7440 			return -EINVAL;
7441 		break;
7442 	case NL80211_IFTYPE_STATION:
7443 	case NL80211_IFTYPE_P2P_CLIENT:
7444 		/* ignore uAPSD data */
7445 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7446 
7447 		/* these are disallowed */
7448 		if (params.sta_flags_mask &
7449 				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
7450 				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7451 			return -EINVAL;
7452 		/* Only TDLS peers can be added */
7453 		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7454 			return -EINVAL;
7455 		/* Can only add if TDLS ... */
7456 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7457 			return -EOPNOTSUPP;
7458 		/* ... with external setup is supported */
7459 		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7460 			return -EOPNOTSUPP;
7461 		/*
7462 		 * Older wpa_supplicant versions always mark the TDLS peer
7463 		 * as authorized, but it shouldn't yet be.
7464 		 */
7465 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7466 		break;
7467 	default:
7468 		return -EOPNOTSUPP;
7469 	}
7470 
7471 	/* be aware of params.vlan when changing code here */
7472 
7473 	wdev_lock(dev->ieee80211_ptr);
7474 	if (wdev->valid_links) {
7475 		if (params.link_sta_params.link_id < 0) {
7476 			err = -EINVAL;
7477 			goto out;
7478 		}
7479 		if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7480 			err = -ENOLINK;
7481 			goto out;
7482 		}
7483 	} else {
7484 		if (params.link_sta_params.link_id >= 0) {
7485 			err = -EINVAL;
7486 			goto out;
7487 		}
7488 	}
7489 	err = rdev_add_station(rdev, dev, mac_addr, &params);
7490 out:
7491 	wdev_unlock(dev->ieee80211_ptr);
7492 	dev_put(params.vlan);
7493 	return err;
7494 }
7495 
7496 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7497 {
7498 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7499 	struct net_device *dev = info->user_ptr[1];
7500 	struct station_del_parameters params;
7501 	int ret;
7502 
7503 	memset(&params, 0, sizeof(params));
7504 
7505 	if (info->attrs[NL80211_ATTR_MAC])
7506 		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7507 
7508 	switch (dev->ieee80211_ptr->iftype) {
7509 	case NL80211_IFTYPE_AP:
7510 	case NL80211_IFTYPE_AP_VLAN:
7511 	case NL80211_IFTYPE_MESH_POINT:
7512 	case NL80211_IFTYPE_P2P_GO:
7513 		/* always accept these */
7514 		break;
7515 	case NL80211_IFTYPE_ADHOC:
7516 		/* conditionally accept */
7517 		if (wiphy_ext_feature_isset(&rdev->wiphy,
7518 					    NL80211_EXT_FEATURE_DEL_IBSS_STA))
7519 			break;
7520 		return -EINVAL;
7521 	default:
7522 		return -EINVAL;
7523 	}
7524 
7525 	if (!rdev->ops->del_station)
7526 		return -EOPNOTSUPP;
7527 
7528 	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7529 		params.subtype =
7530 			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7531 		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7532 		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7533 			return -EINVAL;
7534 	} else {
7535 		/* Default to Deauthentication frame */
7536 		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7537 	}
7538 
7539 	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7540 		params.reason_code =
7541 			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7542 		if (params.reason_code == 0)
7543 			return -EINVAL; /* 0 is reserved */
7544 	} else {
7545 		/* Default to reason code 2 */
7546 		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7547 	}
7548 
7549 	wdev_lock(dev->ieee80211_ptr);
7550 	ret = rdev_del_station(rdev, dev, &params);
7551 	wdev_unlock(dev->ieee80211_ptr);
7552 
7553 	return ret;
7554 }
7555 
7556 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7557 				int flags, struct net_device *dev,
7558 				u8 *dst, u8 *next_hop,
7559 				struct mpath_info *pinfo)
7560 {
7561 	void *hdr;
7562 	struct nlattr *pinfoattr;
7563 
7564 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7565 	if (!hdr)
7566 		return -1;
7567 
7568 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7569 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7570 	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7571 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7572 		goto nla_put_failure;
7573 
7574 	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7575 	if (!pinfoattr)
7576 		goto nla_put_failure;
7577 	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7578 	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7579 			pinfo->frame_qlen))
7580 		goto nla_put_failure;
7581 	if (((pinfo->filled & MPATH_INFO_SN) &&
7582 	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7583 	    ((pinfo->filled & MPATH_INFO_METRIC) &&
7584 	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7585 			 pinfo->metric)) ||
7586 	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7587 	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7588 			 pinfo->exptime)) ||
7589 	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
7590 	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7591 			pinfo->flags)) ||
7592 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7593 	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7594 			 pinfo->discovery_timeout)) ||
7595 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7596 	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7597 			pinfo->discovery_retries)) ||
7598 	    ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7599 	     nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7600 			pinfo->hop_count)) ||
7601 	    ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7602 	     nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7603 			 pinfo->path_change_count)))
7604 		goto nla_put_failure;
7605 
7606 	nla_nest_end(msg, pinfoattr);
7607 
7608 	genlmsg_end(msg, hdr);
7609 	return 0;
7610 
7611  nla_put_failure:
7612 	genlmsg_cancel(msg, hdr);
7613 	return -EMSGSIZE;
7614 }
7615 
7616 static int nl80211_dump_mpath(struct sk_buff *skb,
7617 			      struct netlink_callback *cb)
7618 {
7619 	struct mpath_info pinfo;
7620 	struct cfg80211_registered_device *rdev;
7621 	struct wireless_dev *wdev;
7622 	u8 dst[ETH_ALEN];
7623 	u8 next_hop[ETH_ALEN];
7624 	int path_idx = cb->args[2];
7625 	int err;
7626 
7627 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7628 	if (err)
7629 		return err;
7630 	/* nl80211_prepare_wdev_dump acquired it in the successful case */
7631 	__acquire(&rdev->wiphy.mtx);
7632 
7633 	if (!rdev->ops->dump_mpath) {
7634 		err = -EOPNOTSUPP;
7635 		goto out_err;
7636 	}
7637 
7638 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7639 		err = -EOPNOTSUPP;
7640 		goto out_err;
7641 	}
7642 
7643 	while (1) {
7644 		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7645 				      next_hop, &pinfo);
7646 		if (err == -ENOENT)
7647 			break;
7648 		if (err)
7649 			goto out_err;
7650 
7651 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7652 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
7653 				       wdev->netdev, dst, next_hop,
7654 				       &pinfo) < 0)
7655 			goto out;
7656 
7657 		path_idx++;
7658 	}
7659 
7660  out:
7661 	cb->args[2] = path_idx;
7662 	err = skb->len;
7663  out_err:
7664 	wiphy_unlock(&rdev->wiphy);
7665 	return err;
7666 }
7667 
7668 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7669 {
7670 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7671 	int err;
7672 	struct net_device *dev = info->user_ptr[1];
7673 	struct mpath_info pinfo;
7674 	struct sk_buff *msg;
7675 	u8 *dst = NULL;
7676 	u8 next_hop[ETH_ALEN];
7677 
7678 	memset(&pinfo, 0, sizeof(pinfo));
7679 
7680 	if (!info->attrs[NL80211_ATTR_MAC])
7681 		return -EINVAL;
7682 
7683 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7684 
7685 	if (!rdev->ops->get_mpath)
7686 		return -EOPNOTSUPP;
7687 
7688 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7689 		return -EOPNOTSUPP;
7690 
7691 	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7692 	if (err)
7693 		return err;
7694 
7695 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7696 	if (!msg)
7697 		return -ENOMEM;
7698 
7699 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7700 				 dev, dst, next_hop, &pinfo) < 0) {
7701 		nlmsg_free(msg);
7702 		return -ENOBUFS;
7703 	}
7704 
7705 	return genlmsg_reply(msg, info);
7706 }
7707 
7708 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7709 {
7710 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7711 	struct net_device *dev = info->user_ptr[1];
7712 	u8 *dst = NULL;
7713 	u8 *next_hop = NULL;
7714 
7715 	if (!info->attrs[NL80211_ATTR_MAC])
7716 		return -EINVAL;
7717 
7718 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7719 		return -EINVAL;
7720 
7721 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7722 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7723 
7724 	if (!rdev->ops->change_mpath)
7725 		return -EOPNOTSUPP;
7726 
7727 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7728 		return -EOPNOTSUPP;
7729 
7730 	return rdev_change_mpath(rdev, dev, dst, next_hop);
7731 }
7732 
7733 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7734 {
7735 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7736 	struct net_device *dev = info->user_ptr[1];
7737 	u8 *dst = NULL;
7738 	u8 *next_hop = NULL;
7739 
7740 	if (!info->attrs[NL80211_ATTR_MAC])
7741 		return -EINVAL;
7742 
7743 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7744 		return -EINVAL;
7745 
7746 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7747 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7748 
7749 	if (!rdev->ops->add_mpath)
7750 		return -EOPNOTSUPP;
7751 
7752 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7753 		return -EOPNOTSUPP;
7754 
7755 	return rdev_add_mpath(rdev, dev, dst, next_hop);
7756 }
7757 
7758 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7759 {
7760 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7761 	struct net_device *dev = info->user_ptr[1];
7762 	u8 *dst = NULL;
7763 
7764 	if (info->attrs[NL80211_ATTR_MAC])
7765 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7766 
7767 	if (!rdev->ops->del_mpath)
7768 		return -EOPNOTSUPP;
7769 
7770 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7771 		return -EOPNOTSUPP;
7772 
7773 	return rdev_del_mpath(rdev, dev, dst);
7774 }
7775 
7776 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7777 {
7778 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7779 	int err;
7780 	struct net_device *dev = info->user_ptr[1];
7781 	struct mpath_info pinfo;
7782 	struct sk_buff *msg;
7783 	u8 *dst = NULL;
7784 	u8 mpp[ETH_ALEN];
7785 
7786 	memset(&pinfo, 0, sizeof(pinfo));
7787 
7788 	if (!info->attrs[NL80211_ATTR_MAC])
7789 		return -EINVAL;
7790 
7791 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7792 
7793 	if (!rdev->ops->get_mpp)
7794 		return -EOPNOTSUPP;
7795 
7796 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7797 		return -EOPNOTSUPP;
7798 
7799 	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7800 	if (err)
7801 		return err;
7802 
7803 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7804 	if (!msg)
7805 		return -ENOMEM;
7806 
7807 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7808 			       dev, dst, mpp, &pinfo) < 0) {
7809 		nlmsg_free(msg);
7810 		return -ENOBUFS;
7811 	}
7812 
7813 	return genlmsg_reply(msg, info);
7814 }
7815 
7816 static int nl80211_dump_mpp(struct sk_buff *skb,
7817 			    struct netlink_callback *cb)
7818 {
7819 	struct mpath_info pinfo;
7820 	struct cfg80211_registered_device *rdev;
7821 	struct wireless_dev *wdev;
7822 	u8 dst[ETH_ALEN];
7823 	u8 mpp[ETH_ALEN];
7824 	int path_idx = cb->args[2];
7825 	int err;
7826 
7827 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7828 	if (err)
7829 		return err;
7830 	/* nl80211_prepare_wdev_dump acquired it in the successful case */
7831 	__acquire(&rdev->wiphy.mtx);
7832 
7833 	if (!rdev->ops->dump_mpp) {
7834 		err = -EOPNOTSUPP;
7835 		goto out_err;
7836 	}
7837 
7838 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7839 		err = -EOPNOTSUPP;
7840 		goto out_err;
7841 	}
7842 
7843 	while (1) {
7844 		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7845 				    mpp, &pinfo);
7846 		if (err == -ENOENT)
7847 			break;
7848 		if (err)
7849 			goto out_err;
7850 
7851 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7852 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
7853 				       wdev->netdev, dst, mpp,
7854 				       &pinfo) < 0)
7855 			goto out;
7856 
7857 		path_idx++;
7858 	}
7859 
7860  out:
7861 	cb->args[2] = path_idx;
7862 	err = skb->len;
7863  out_err:
7864 	wiphy_unlock(&rdev->wiphy);
7865 	return err;
7866 }
7867 
7868 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7869 {
7870 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7871 	struct net_device *dev = info->user_ptr[1];
7872 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7873 	struct bss_parameters params;
7874 	int err;
7875 
7876 	memset(&params, 0, sizeof(params));
7877 	params.link_id = nl80211_link_id_or_invalid(info->attrs);
7878 	/* default to not changing parameters */
7879 	params.use_cts_prot = -1;
7880 	params.use_short_preamble = -1;
7881 	params.use_short_slot_time = -1;
7882 	params.ap_isolate = -1;
7883 	params.ht_opmode = -1;
7884 	params.p2p_ctwindow = -1;
7885 	params.p2p_opp_ps = -1;
7886 
7887 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7888 		params.use_cts_prot =
7889 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7890 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7891 		params.use_short_preamble =
7892 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7893 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7894 		params.use_short_slot_time =
7895 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7896 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7897 		params.basic_rates =
7898 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7899 		params.basic_rates_len =
7900 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7901 	}
7902 	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7903 		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7904 	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7905 		params.ht_opmode =
7906 			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7907 
7908 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7909 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7910 			return -EINVAL;
7911 		params.p2p_ctwindow =
7912 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7913 		if (params.p2p_ctwindow != 0 &&
7914 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7915 			return -EINVAL;
7916 	}
7917 
7918 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7919 		u8 tmp;
7920 
7921 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7922 			return -EINVAL;
7923 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7924 		params.p2p_opp_ps = tmp;
7925 		if (params.p2p_opp_ps &&
7926 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7927 			return -EINVAL;
7928 	}
7929 
7930 	if (!rdev->ops->change_bss)
7931 		return -EOPNOTSUPP;
7932 
7933 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7934 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7935 		return -EOPNOTSUPP;
7936 
7937 	wdev_lock(wdev);
7938 	err = rdev_change_bss(rdev, dev, &params);
7939 	wdev_unlock(wdev);
7940 
7941 	return err;
7942 }
7943 
7944 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7945 {
7946 	char *data = NULL;
7947 	bool is_indoor;
7948 	enum nl80211_user_reg_hint_type user_reg_hint_type;
7949 	u32 owner_nlportid;
7950 
7951 	/*
7952 	 * You should only get this when cfg80211 hasn't yet initialized
7953 	 * completely when built-in to the kernel right between the time
7954 	 * window between nl80211_init() and regulatory_init(), if that is
7955 	 * even possible.
7956 	 */
7957 	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7958 		return -EINPROGRESS;
7959 
7960 	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7961 		user_reg_hint_type =
7962 		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7963 	else
7964 		user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7965 
7966 	switch (user_reg_hint_type) {
7967 	case NL80211_USER_REG_HINT_USER:
7968 	case NL80211_USER_REG_HINT_CELL_BASE:
7969 		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7970 			return -EINVAL;
7971 
7972 		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7973 		return regulatory_hint_user(data, user_reg_hint_type);
7974 	case NL80211_USER_REG_HINT_INDOOR:
7975 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7976 			owner_nlportid = info->snd_portid;
7977 			is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7978 		} else {
7979 			owner_nlportid = 0;
7980 			is_indoor = true;
7981 		}
7982 
7983 		return regulatory_hint_indoor(is_indoor, owner_nlportid);
7984 	default:
7985 		return -EINVAL;
7986 	}
7987 }
7988 
7989 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7990 {
7991 	return reg_reload_regdb();
7992 }
7993 
7994 static int nl80211_get_mesh_config(struct sk_buff *skb,
7995 				   struct genl_info *info)
7996 {
7997 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7998 	struct net_device *dev = info->user_ptr[1];
7999 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8000 	struct mesh_config cur_params;
8001 	int err = 0;
8002 	void *hdr;
8003 	struct nlattr *pinfoattr;
8004 	struct sk_buff *msg;
8005 
8006 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8007 		return -EOPNOTSUPP;
8008 
8009 	if (!rdev->ops->get_mesh_config)
8010 		return -EOPNOTSUPP;
8011 
8012 	wdev_lock(wdev);
8013 	/* If not connected, get default parameters */
8014 	if (!wdev->u.mesh.id_len)
8015 		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8016 	else
8017 		err = rdev_get_mesh_config(rdev, dev, &cur_params);
8018 	wdev_unlock(wdev);
8019 
8020 	if (err)
8021 		return err;
8022 
8023 	/* Draw up a netlink message to send back */
8024 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8025 	if (!msg)
8026 		return -ENOMEM;
8027 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8028 			     NL80211_CMD_GET_MESH_CONFIG);
8029 	if (!hdr)
8030 		goto out;
8031 	pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8032 	if (!pinfoattr)
8033 		goto nla_put_failure;
8034 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8035 	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8036 			cur_params.dot11MeshRetryTimeout) ||
8037 	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8038 			cur_params.dot11MeshConfirmTimeout) ||
8039 	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8040 			cur_params.dot11MeshHoldingTimeout) ||
8041 	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8042 			cur_params.dot11MeshMaxPeerLinks) ||
8043 	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8044 		       cur_params.dot11MeshMaxRetries) ||
8045 	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
8046 		       cur_params.dot11MeshTTL) ||
8047 	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8048 		       cur_params.element_ttl) ||
8049 	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8050 		       cur_params.auto_open_plinks) ||
8051 	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8052 			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8053 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8054 		       cur_params.dot11MeshHWMPmaxPREQretries) ||
8055 	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8056 			cur_params.path_refresh_time) ||
8057 	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8058 			cur_params.min_discovery_timeout) ||
8059 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8060 			cur_params.dot11MeshHWMPactivePathTimeout) ||
8061 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8062 			cur_params.dot11MeshHWMPpreqMinInterval) ||
8063 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8064 			cur_params.dot11MeshHWMPperrMinInterval) ||
8065 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8066 			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8067 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8068 		       cur_params.dot11MeshHWMPRootMode) ||
8069 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8070 			cur_params.dot11MeshHWMPRannInterval) ||
8071 	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8072 		       cur_params.dot11MeshGateAnnouncementProtocol) ||
8073 	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8074 		       cur_params.dot11MeshForwarding) ||
8075 	    nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8076 			cur_params.rssi_threshold) ||
8077 	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8078 			cur_params.ht_opmode) ||
8079 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8080 			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8081 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8082 			cur_params.dot11MeshHWMProotInterval) ||
8083 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8084 			cur_params.dot11MeshHWMPconfirmationInterval) ||
8085 	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8086 			cur_params.power_mode) ||
8087 	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8088 			cur_params.dot11MeshAwakeWindowDuration) ||
8089 	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8090 			cur_params.plink_timeout) ||
8091 	    nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8092 		       cur_params.dot11MeshConnectedToMeshGate) ||
8093 	    nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8094 		       cur_params.dot11MeshNolearn) ||
8095 	    nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8096 		       cur_params.dot11MeshConnectedToAuthServer))
8097 		goto nla_put_failure;
8098 	nla_nest_end(msg, pinfoattr);
8099 	genlmsg_end(msg, hdr);
8100 	return genlmsg_reply(msg, info);
8101 
8102  nla_put_failure:
8103  out:
8104 	nlmsg_free(msg);
8105 	return -ENOBUFS;
8106 }
8107 
8108 static const struct nla_policy
8109 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8110 	[NL80211_MESHCONF_RETRY_TIMEOUT] =
8111 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
8112 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8113 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
8114 	[NL80211_MESHCONF_HOLDING_TIMEOUT] =
8115 		NLA_POLICY_RANGE(NLA_U16, 1, 255),
8116 	[NL80211_MESHCONF_MAX_PEER_LINKS] =
8117 		NLA_POLICY_RANGE(NLA_U16, 0, 255),
8118 	[NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8119 	[NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8120 	[NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8121 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8122 	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8123 		NLA_POLICY_RANGE(NLA_U32, 1, 255),
8124 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8125 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8126 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8127 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8128 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8129 		NLA_POLICY_MIN(NLA_U16, 1),
8130 	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8131 		NLA_POLICY_MIN(NLA_U16, 1),
8132 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8133 		NLA_POLICY_MIN(NLA_U16, 1),
8134 	[NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8135 	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8136 		NLA_POLICY_MIN(NLA_U16, 1),
8137 	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8138 	[NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8139 	[NL80211_MESHCONF_RSSI_THRESHOLD] =
8140 		NLA_POLICY_RANGE(NLA_S32, -255, 0),
8141 	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8142 	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8143 	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8144 		NLA_POLICY_MIN(NLA_U16, 1),
8145 	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8146 		NLA_POLICY_MIN(NLA_U16, 1),
8147 	[NL80211_MESHCONF_POWER_MODE] =
8148 		NLA_POLICY_RANGE(NLA_U32,
8149 				 NL80211_MESH_POWER_ACTIVE,
8150 				 NL80211_MESH_POWER_MAX),
8151 	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8152 	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8153 	[NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8154 	[NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8155 	[NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8156 };
8157 
8158 static const struct nla_policy
8159 	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8160 	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8161 	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8162 	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8163 	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8164 	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8165 	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8166 	[NL80211_MESH_SETUP_IE] =
8167 		NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8168 				       IEEE80211_MAX_DATA_LEN),
8169 	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8170 };
8171 
8172 static int nl80211_parse_mesh_config(struct genl_info *info,
8173 				     struct mesh_config *cfg,
8174 				     u32 *mask_out)
8175 {
8176 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8177 	u32 mask = 0;
8178 	u16 ht_opmode;
8179 
8180 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)	\
8181 do {									\
8182 	if (tb[attr]) {							\
8183 		cfg->param = fn(tb[attr]);				\
8184 		mask |= BIT((attr) - 1);				\
8185 	}								\
8186 } while (0)
8187 
8188 	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8189 		return -EINVAL;
8190 	if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8191 		return -EINVAL;
8192 
8193 	/* This makes sure that there aren't more than 32 mesh config
8194 	 * parameters (otherwise our bitfield scheme would not work.) */
8195 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8196 
8197 	/* Fill in the params struct */
8198 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8199 				  NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8200 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8201 				  NL80211_MESHCONF_CONFIRM_TIMEOUT,
8202 				  nla_get_u16);
8203 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8204 				  NL80211_MESHCONF_HOLDING_TIMEOUT,
8205 				  nla_get_u16);
8206 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8207 				  NL80211_MESHCONF_MAX_PEER_LINKS,
8208 				  nla_get_u16);
8209 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8210 				  NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8211 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8212 				  NL80211_MESHCONF_TTL, nla_get_u8);
8213 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8214 				  NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8215 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8216 				  NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8217 				  nla_get_u8);
8218 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8219 				  mask,
8220 				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8221 				  nla_get_u32);
8222 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8223 				  NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8224 				  nla_get_u8);
8225 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8226 				  NL80211_MESHCONF_PATH_REFRESH_TIME,
8227 				  nla_get_u32);
8228 	if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8229 	    (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8230 		return -EINVAL;
8231 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8232 				  NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8233 				  nla_get_u16);
8234 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8235 				  mask,
8236 				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8237 				  nla_get_u32);
8238 	if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8239 	    (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8240 	     cfg->dot11MeshHWMPactivePathTimeout > 65535))
8241 		return -EINVAL;
8242 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8243 				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8244 				  nla_get_u16);
8245 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8246 				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8247 				  nla_get_u16);
8248 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8249 				  dot11MeshHWMPnetDiameterTraversalTime, mask,
8250 				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8251 				  nla_get_u16);
8252 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8253 				  NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8254 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8255 				  NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8256 				  nla_get_u16);
8257 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8258 				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8259 				  nla_get_u8);
8260 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8261 				  NL80211_MESHCONF_FORWARDING, nla_get_u8);
8262 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8263 				  NL80211_MESHCONF_RSSI_THRESHOLD,
8264 				  nla_get_s32);
8265 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8266 				  NL80211_MESHCONF_CONNECTED_TO_GATE,
8267 				  nla_get_u8);
8268 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8269 				  NL80211_MESHCONF_CONNECTED_TO_AS,
8270 				  nla_get_u8);
8271 	/*
8272 	 * Check HT operation mode based on
8273 	 * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8274 	 */
8275 	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8276 		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8277 
8278 		if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8279 				  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8280 				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8281 			return -EINVAL;
8282 
8283 		/* NON_HT_STA bit is reserved, but some programs set it */
8284 		ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8285 
8286 		cfg->ht_opmode = ht_opmode;
8287 		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8288 	}
8289 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8290 				  dot11MeshHWMPactivePathToRootTimeout, mask,
8291 				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8292 				  nla_get_u32);
8293 	if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8294 	    (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8295 	     cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8296 		return -EINVAL;
8297 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8298 				  NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8299 				  nla_get_u16);
8300 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8301 				  mask,
8302 				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8303 				  nla_get_u16);
8304 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8305 				  NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8306 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8307 				  NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8308 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8309 				  NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8310 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8311 				  NL80211_MESHCONF_NOLEARN, nla_get_u8);
8312 	if (mask_out)
8313 		*mask_out = mask;
8314 
8315 	return 0;
8316 
8317 #undef FILL_IN_MESH_PARAM_IF_SET
8318 }
8319 
8320 static int nl80211_parse_mesh_setup(struct genl_info *info,
8321 				     struct mesh_setup *setup)
8322 {
8323 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8324 	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8325 
8326 	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8327 		return -EINVAL;
8328 	if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8329 		return -EINVAL;
8330 
8331 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8332 		setup->sync_method =
8333 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8334 		 IEEE80211_SYNC_METHOD_VENDOR :
8335 		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8336 
8337 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8338 		setup->path_sel_proto =
8339 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8340 		 IEEE80211_PATH_PROTOCOL_VENDOR :
8341 		 IEEE80211_PATH_PROTOCOL_HWMP;
8342 
8343 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8344 		setup->path_metric =
8345 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8346 		 IEEE80211_PATH_METRIC_VENDOR :
8347 		 IEEE80211_PATH_METRIC_AIRTIME;
8348 
8349 	if (tb[NL80211_MESH_SETUP_IE]) {
8350 		struct nlattr *ieattr =
8351 			tb[NL80211_MESH_SETUP_IE];
8352 		setup->ie = nla_data(ieattr);
8353 		setup->ie_len = nla_len(ieattr);
8354 	}
8355 	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8356 	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8357 		return -EINVAL;
8358 	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8359 	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8360 	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8361 	if (setup->is_secure)
8362 		setup->user_mpm = true;
8363 
8364 	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8365 		if (!setup->user_mpm)
8366 			return -EINVAL;
8367 		setup->auth_id =
8368 			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8369 	}
8370 
8371 	return 0;
8372 }
8373 
8374 static int nl80211_update_mesh_config(struct sk_buff *skb,
8375 				      struct genl_info *info)
8376 {
8377 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8378 	struct net_device *dev = info->user_ptr[1];
8379 	struct wireless_dev *wdev = dev->ieee80211_ptr;
8380 	struct mesh_config cfg;
8381 	u32 mask;
8382 	int err;
8383 
8384 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8385 		return -EOPNOTSUPP;
8386 
8387 	if (!rdev->ops->update_mesh_config)
8388 		return -EOPNOTSUPP;
8389 
8390 	err = nl80211_parse_mesh_config(info, &cfg, &mask);
8391 	if (err)
8392 		return err;
8393 
8394 	wdev_lock(wdev);
8395 	if (!wdev->u.mesh.id_len)
8396 		err = -ENOLINK;
8397 
8398 	if (!err)
8399 		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8400 
8401 	wdev_unlock(wdev);
8402 
8403 	return err;
8404 }
8405 
8406 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8407 			      struct sk_buff *msg)
8408 {
8409 	struct nlattr *nl_reg_rules;
8410 	unsigned int i;
8411 
8412 	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8413 	    (regdom->dfs_region &&
8414 	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8415 		goto nla_put_failure;
8416 
8417 	nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8418 	if (!nl_reg_rules)
8419 		goto nla_put_failure;
8420 
8421 	for (i = 0; i < regdom->n_reg_rules; i++) {
8422 		struct nlattr *nl_reg_rule;
8423 		const struct ieee80211_reg_rule *reg_rule;
8424 		const struct ieee80211_freq_range *freq_range;
8425 		const struct ieee80211_power_rule *power_rule;
8426 		unsigned int max_bandwidth_khz;
8427 
8428 		reg_rule = &regdom->reg_rules[i];
8429 		freq_range = &reg_rule->freq_range;
8430 		power_rule = &reg_rule->power_rule;
8431 
8432 		nl_reg_rule = nla_nest_start_noflag(msg, i);
8433 		if (!nl_reg_rule)
8434 			goto nla_put_failure;
8435 
8436 		max_bandwidth_khz = freq_range->max_bandwidth_khz;
8437 		if (!max_bandwidth_khz)
8438 			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8439 								  reg_rule);
8440 
8441 		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8442 				reg_rule->flags) ||
8443 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8444 				freq_range->start_freq_khz) ||
8445 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8446 				freq_range->end_freq_khz) ||
8447 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8448 				max_bandwidth_khz) ||
8449 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8450 				power_rule->max_antenna_gain) ||
8451 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8452 				power_rule->max_eirp) ||
8453 		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8454 				reg_rule->dfs_cac_ms))
8455 			goto nla_put_failure;
8456 
8457 		nla_nest_end(msg, nl_reg_rule);
8458 	}
8459 
8460 	nla_nest_end(msg, nl_reg_rules);
8461 	return 0;
8462 
8463 nla_put_failure:
8464 	return -EMSGSIZE;
8465 }
8466 
8467 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8468 {
8469 	const struct ieee80211_regdomain *regdom = NULL;
8470 	struct cfg80211_registered_device *rdev;
8471 	struct wiphy *wiphy = NULL;
8472 	struct sk_buff *msg;
8473 	int err = -EMSGSIZE;
8474 	void *hdr;
8475 
8476 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8477 	if (!msg)
8478 		return -ENOBUFS;
8479 
8480 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8481 			     NL80211_CMD_GET_REG);
8482 	if (!hdr)
8483 		goto put_failure;
8484 
8485 	rtnl_lock();
8486 
8487 	if (info->attrs[NL80211_ATTR_WIPHY]) {
8488 		bool self_managed;
8489 
8490 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8491 		if (IS_ERR(rdev)) {
8492 			err = PTR_ERR(rdev);
8493 			goto nla_put_failure;
8494 		}
8495 
8496 		wiphy = &rdev->wiphy;
8497 		self_managed = wiphy->regulatory_flags &
8498 			       REGULATORY_WIPHY_SELF_MANAGED;
8499 
8500 		rcu_read_lock();
8501 
8502 		regdom = get_wiphy_regdom(wiphy);
8503 
8504 		/* a self-managed-reg device must have a private regdom */
8505 		if (WARN_ON(!regdom && self_managed)) {
8506 			err = -EINVAL;
8507 			goto nla_put_failure_rcu;
8508 		}
8509 
8510 		if (regdom &&
8511 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8512 			goto nla_put_failure_rcu;
8513 	} else {
8514 		rcu_read_lock();
8515 	}
8516 
8517 	if (!wiphy && reg_last_request_cell_base() &&
8518 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8519 			NL80211_USER_REG_HINT_CELL_BASE))
8520 		goto nla_put_failure_rcu;
8521 
8522 	if (!regdom)
8523 		regdom = rcu_dereference(cfg80211_regdomain);
8524 
8525 	if (nl80211_put_regdom(regdom, msg))
8526 		goto nla_put_failure_rcu;
8527 
8528 	rcu_read_unlock();
8529 
8530 	genlmsg_end(msg, hdr);
8531 	rtnl_unlock();
8532 	return genlmsg_reply(msg, info);
8533 
8534 nla_put_failure_rcu:
8535 	rcu_read_unlock();
8536 nla_put_failure:
8537 	rtnl_unlock();
8538 put_failure:
8539 	nlmsg_free(msg);
8540 	return err;
8541 }
8542 
8543 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8544 			       u32 seq, int flags, struct wiphy *wiphy,
8545 			       const struct ieee80211_regdomain *regdom)
8546 {
8547 	void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8548 				   NL80211_CMD_GET_REG);
8549 
8550 	if (!hdr)
8551 		return -1;
8552 
8553 	genl_dump_check_consistent(cb, hdr);
8554 
8555 	if (nl80211_put_regdom(regdom, msg))
8556 		goto nla_put_failure;
8557 
8558 	if (!wiphy && reg_last_request_cell_base() &&
8559 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8560 			NL80211_USER_REG_HINT_CELL_BASE))
8561 		goto nla_put_failure;
8562 
8563 	if (wiphy &&
8564 	    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8565 		goto nla_put_failure;
8566 
8567 	if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8568 	    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8569 		goto nla_put_failure;
8570 
8571 	genlmsg_end(msg, hdr);
8572 	return 0;
8573 
8574 nla_put_failure:
8575 	genlmsg_cancel(msg, hdr);
8576 	return -EMSGSIZE;
8577 }
8578 
8579 static int nl80211_get_reg_dump(struct sk_buff *skb,
8580 				struct netlink_callback *cb)
8581 {
8582 	const struct ieee80211_regdomain *regdom = NULL;
8583 	struct cfg80211_registered_device *rdev;
8584 	int err, reg_idx, start = cb->args[2];
8585 
8586 	rcu_read_lock();
8587 
8588 	if (cfg80211_regdomain && start == 0) {
8589 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8590 					  NLM_F_MULTI, NULL,
8591 					  rcu_dereference(cfg80211_regdomain));
8592 		if (err < 0)
8593 			goto out_err;
8594 	}
8595 
8596 	/* the global regdom is idx 0 */
8597 	reg_idx = 1;
8598 	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8599 		regdom = get_wiphy_regdom(&rdev->wiphy);
8600 		if (!regdom)
8601 			continue;
8602 
8603 		if (++reg_idx <= start)
8604 			continue;
8605 
8606 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8607 					  NLM_F_MULTI, &rdev->wiphy, regdom);
8608 		if (err < 0) {
8609 			reg_idx--;
8610 			break;
8611 		}
8612 	}
8613 
8614 	cb->args[2] = reg_idx;
8615 	err = skb->len;
8616 out_err:
8617 	rcu_read_unlock();
8618 	return err;
8619 }
8620 
8621 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8622 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8623 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
8624 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
8625 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
8626 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
8627 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
8628 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
8629 	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
8630 };
8631 
8632 static int parse_reg_rule(struct nlattr *tb[],
8633 	struct ieee80211_reg_rule *reg_rule)
8634 {
8635 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8636 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8637 
8638 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8639 		return -EINVAL;
8640 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8641 		return -EINVAL;
8642 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8643 		return -EINVAL;
8644 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8645 		return -EINVAL;
8646 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8647 		return -EINVAL;
8648 
8649 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8650 
8651 	freq_range->start_freq_khz =
8652 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8653 	freq_range->end_freq_khz =
8654 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8655 	freq_range->max_bandwidth_khz =
8656 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8657 
8658 	power_rule->max_eirp =
8659 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8660 
8661 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8662 		power_rule->max_antenna_gain =
8663 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8664 
8665 	if (tb[NL80211_ATTR_DFS_CAC_TIME])
8666 		reg_rule->dfs_cac_ms =
8667 			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8668 
8669 	return 0;
8670 }
8671 
8672 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8673 {
8674 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8675 	struct nlattr *nl_reg_rule;
8676 	char *alpha2;
8677 	int rem_reg_rules, r;
8678 	u32 num_rules = 0, rule_idx = 0;
8679 	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8680 	struct ieee80211_regdomain *rd;
8681 
8682 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8683 		return -EINVAL;
8684 
8685 	if (!info->attrs[NL80211_ATTR_REG_RULES])
8686 		return -EINVAL;
8687 
8688 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8689 
8690 	if (info->attrs[NL80211_ATTR_DFS_REGION])
8691 		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8692 
8693 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8694 			    rem_reg_rules) {
8695 		num_rules++;
8696 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8697 			return -EINVAL;
8698 	}
8699 
8700 	rtnl_lock();
8701 	if (!reg_is_valid_request(alpha2)) {
8702 		r = -EINVAL;
8703 		goto out;
8704 	}
8705 
8706 	rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8707 	if (!rd) {
8708 		r = -ENOMEM;
8709 		goto out;
8710 	}
8711 
8712 	rd->n_reg_rules = num_rules;
8713 	rd->alpha2[0] = alpha2[0];
8714 	rd->alpha2[1] = alpha2[1];
8715 
8716 	/*
8717 	 * Disable DFS master mode if the DFS region was
8718 	 * not supported or known on this kernel.
8719 	 */
8720 	if (reg_supported_dfs_region(dfs_region))
8721 		rd->dfs_region = dfs_region;
8722 
8723 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8724 			    rem_reg_rules) {
8725 		r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8726 						nl_reg_rule, reg_rule_policy,
8727 						info->extack);
8728 		if (r)
8729 			goto bad_reg;
8730 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8731 		if (r)
8732 			goto bad_reg;
8733 
8734 		rule_idx++;
8735 
8736 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8737 			r = -EINVAL;
8738 			goto bad_reg;
8739 		}
8740 	}
8741 
8742 	r = set_regdom(rd, REGD_SOURCE_CRDA);
8743 	/* set_regdom takes ownership of rd */
8744 	rd = NULL;
8745  bad_reg:
8746 	kfree(rd);
8747  out:
8748 	rtnl_unlock();
8749 	return r;
8750 }
8751 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8752 
8753 static int validate_scan_freqs(struct nlattr *freqs)
8754 {
8755 	struct nlattr *attr1, *attr2;
8756 	int n_channels = 0, tmp1, tmp2;
8757 
8758 	nla_for_each_nested(attr1, freqs, tmp1)
8759 		if (nla_len(attr1) != sizeof(u32))
8760 			return 0;
8761 
8762 	nla_for_each_nested(attr1, freqs, tmp1) {
8763 		n_channels++;
8764 		/*
8765 		 * Some hardware has a limited channel list for
8766 		 * scanning, and it is pretty much nonsensical
8767 		 * to scan for a channel twice, so disallow that
8768 		 * and don't require drivers to check that the
8769 		 * channel list they get isn't longer than what
8770 		 * they can scan, as long as they can scan all
8771 		 * the channels they registered at once.
8772 		 */
8773 		nla_for_each_nested(attr2, freqs, tmp2)
8774 			if (attr1 != attr2 &&
8775 			    nla_get_u32(attr1) == nla_get_u32(attr2))
8776 				return 0;
8777 	}
8778 
8779 	return n_channels;
8780 }
8781 
8782 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8783 {
8784 	return b < NUM_NL80211_BANDS && wiphy->bands[b];
8785 }
8786 
8787 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8788 			    struct cfg80211_bss_selection *bss_select)
8789 {
8790 	struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8791 	struct nlattr *nest;
8792 	int err;
8793 	bool found = false;
8794 	int i;
8795 
8796 	/* only process one nested attribute */
8797 	nest = nla_data(nla);
8798 	if (!nla_ok(nest, nla_len(nest)))
8799 		return -EINVAL;
8800 
8801 	err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8802 					  nest, nl80211_bss_select_policy,
8803 					  NULL);
8804 	if (err)
8805 		return err;
8806 
8807 	/* only one attribute may be given */
8808 	for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8809 		if (attr[i]) {
8810 			if (found)
8811 				return -EINVAL;
8812 			found = true;
8813 		}
8814 	}
8815 
8816 	bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8817 
8818 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8819 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8820 
8821 	if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8822 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8823 		bss_select->param.band_pref =
8824 			nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8825 		if (!is_band_valid(wiphy, bss_select->param.band_pref))
8826 			return -EINVAL;
8827 	}
8828 
8829 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8830 		struct nl80211_bss_select_rssi_adjust *adj_param;
8831 
8832 		adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8833 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8834 		bss_select->param.adjust.band = adj_param->band;
8835 		bss_select->param.adjust.delta = adj_param->delta;
8836 		if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8837 			return -EINVAL;
8838 	}
8839 
8840 	/* user-space did not provide behaviour attribute */
8841 	if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8842 		return -EINVAL;
8843 
8844 	if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8845 		return -EINVAL;
8846 
8847 	return 0;
8848 }
8849 
8850 int nl80211_parse_random_mac(struct nlattr **attrs,
8851 			     u8 *mac_addr, u8 *mac_addr_mask)
8852 {
8853 	int i;
8854 
8855 	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8856 		eth_zero_addr(mac_addr);
8857 		eth_zero_addr(mac_addr_mask);
8858 		mac_addr[0] = 0x2;
8859 		mac_addr_mask[0] = 0x3;
8860 
8861 		return 0;
8862 	}
8863 
8864 	/* need both or none */
8865 	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8866 		return -EINVAL;
8867 
8868 	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8869 	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8870 
8871 	/* don't allow or configure an mcast address */
8872 	if (!is_multicast_ether_addr(mac_addr_mask) ||
8873 	    is_multicast_ether_addr(mac_addr))
8874 		return -EINVAL;
8875 
8876 	/*
8877 	 * allow users to pass a MAC address that has bits set outside
8878 	 * of the mask, but don't bother drivers with having to deal
8879 	 * with such bits
8880 	 */
8881 	for (i = 0; i < ETH_ALEN; i++)
8882 		mac_addr[i] &= mac_addr_mask[i];
8883 
8884 	return 0;
8885 }
8886 
8887 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8888 					      struct ieee80211_channel *chan)
8889 {
8890 	unsigned int link_id;
8891 	bool all_ok = true;
8892 
8893 	ASSERT_WDEV_LOCK(wdev);
8894 
8895 	if (!cfg80211_beaconing_iface_active(wdev))
8896 		return true;
8897 
8898 	/*
8899 	 * FIXME: check if we have a free HW resource/link for chan
8900 	 *
8901 	 * This, as well as the FIXME below, requires knowing the link
8902 	 * capabilities of the hardware.
8903 	 */
8904 
8905 	/* we cannot leave radar channels */
8906 	for_each_valid_link(wdev, link_id) {
8907 		struct cfg80211_chan_def *chandef;
8908 
8909 		chandef = wdev_chandef(wdev, link_id);
8910 		if (!chandef || !chandef->chan)
8911 			continue;
8912 
8913 		/*
8914 		 * FIXME: don't require all_ok, but rather check only the
8915 		 *	  correct HW resource/link onto which 'chan' falls,
8916 		 *	  as only that link leaves the channel for doing
8917 		 *	  the off-channel operation.
8918 		 */
8919 
8920 		if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
8921 			all_ok = false;
8922 	}
8923 
8924 	if (all_ok)
8925 		return true;
8926 
8927 	return regulatory_pre_cac_allowed(wdev->wiphy);
8928 }
8929 
8930 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8931 				    enum nl80211_ext_feature_index feat)
8932 {
8933 	if (!(flags & flag))
8934 		return true;
8935 	if (wiphy_ext_feature_isset(wiphy, feat))
8936 		return true;
8937 	return false;
8938 }
8939 
8940 static int
8941 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8942 			 void *request, struct nlattr **attrs,
8943 			 bool is_sched_scan)
8944 {
8945 	u8 *mac_addr, *mac_addr_mask;
8946 	u32 *flags;
8947 	enum nl80211_feature_flags randomness_flag;
8948 
8949 	if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8950 		return 0;
8951 
8952 	if (is_sched_scan) {
8953 		struct cfg80211_sched_scan_request *req = request;
8954 
8955 		randomness_flag = wdev ?
8956 				  NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8957 				  NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8958 		flags = &req->flags;
8959 		mac_addr = req->mac_addr;
8960 		mac_addr_mask = req->mac_addr_mask;
8961 	} else {
8962 		struct cfg80211_scan_request *req = request;
8963 
8964 		randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8965 		flags = &req->flags;
8966 		mac_addr = req->mac_addr;
8967 		mac_addr_mask = req->mac_addr_mask;
8968 	}
8969 
8970 	*flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8971 
8972 	if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8973 	     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8974 	    !nl80211_check_scan_feat(wiphy, *flags,
8975 				     NL80211_SCAN_FLAG_LOW_SPAN,
8976 				     NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8977 	    !nl80211_check_scan_feat(wiphy, *flags,
8978 				     NL80211_SCAN_FLAG_LOW_POWER,
8979 				     NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8980 	    !nl80211_check_scan_feat(wiphy, *flags,
8981 				     NL80211_SCAN_FLAG_HIGH_ACCURACY,
8982 				     NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8983 	    !nl80211_check_scan_feat(wiphy, *flags,
8984 				     NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8985 				     NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8986 	    !nl80211_check_scan_feat(wiphy, *flags,
8987 				     NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8988 				     NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8989 	    !nl80211_check_scan_feat(wiphy, *flags,
8990 				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8991 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8992 	    !nl80211_check_scan_feat(wiphy, *flags,
8993 				     NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8994 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8995 	    !nl80211_check_scan_feat(wiphy, *flags,
8996 				     NL80211_SCAN_FLAG_RANDOM_SN,
8997 				     NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8998 	    !nl80211_check_scan_feat(wiphy, *flags,
8999 				     NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9000 				     NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9001 		return -EOPNOTSUPP;
9002 
9003 	if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9004 		int err;
9005 
9006 		if (!(wiphy->features & randomness_flag) ||
9007 		    (wdev && wdev->connected))
9008 			return -EOPNOTSUPP;
9009 
9010 		err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9011 		if (err)
9012 			return err;
9013 	}
9014 
9015 	return 0;
9016 }
9017 
9018 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9019 {
9020 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9021 	struct wireless_dev *wdev = info->user_ptr[1];
9022 	struct cfg80211_scan_request *request;
9023 	struct nlattr *scan_freqs = NULL;
9024 	bool scan_freqs_khz = false;
9025 	struct nlattr *attr;
9026 	struct wiphy *wiphy;
9027 	int err, tmp, n_ssids = 0, n_channels, i;
9028 	size_t ie_len;
9029 
9030 	wiphy = &rdev->wiphy;
9031 
9032 	if (wdev->iftype == NL80211_IFTYPE_NAN)
9033 		return -EOPNOTSUPP;
9034 
9035 	if (!rdev->ops->scan)
9036 		return -EOPNOTSUPP;
9037 
9038 	if (rdev->scan_req || rdev->scan_msg)
9039 		return -EBUSY;
9040 
9041 	if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9042 		if (!wiphy_ext_feature_isset(wiphy,
9043 					     NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9044 			return -EOPNOTSUPP;
9045 		scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9046 		scan_freqs_khz = true;
9047 	} else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9048 		scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9049 
9050 	if (scan_freqs) {
9051 		n_channels = validate_scan_freqs(scan_freqs);
9052 		if (!n_channels)
9053 			return -EINVAL;
9054 	} else {
9055 		n_channels = ieee80211_get_num_supported_channels(wiphy);
9056 	}
9057 
9058 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9059 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9060 			n_ssids++;
9061 
9062 	if (n_ssids > wiphy->max_scan_ssids)
9063 		return -EINVAL;
9064 
9065 	if (info->attrs[NL80211_ATTR_IE])
9066 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9067 	else
9068 		ie_len = 0;
9069 
9070 	if (ie_len > wiphy->max_scan_ie_len)
9071 		return -EINVAL;
9072 
9073 	request = kzalloc(sizeof(*request)
9074 			+ sizeof(*request->ssids) * n_ssids
9075 			+ sizeof(*request->channels) * n_channels
9076 			+ ie_len, GFP_KERNEL);
9077 	if (!request)
9078 		return -ENOMEM;
9079 
9080 	if (n_ssids)
9081 		request->ssids = (void *)&request->channels[n_channels];
9082 	request->n_ssids = n_ssids;
9083 	if (ie_len) {
9084 		if (n_ssids)
9085 			request->ie = (void *)(request->ssids + n_ssids);
9086 		else
9087 			request->ie = (void *)(request->channels + n_channels);
9088 	}
9089 
9090 	i = 0;
9091 	if (scan_freqs) {
9092 		/* user specified, bail out if channel not found */
9093 		nla_for_each_nested(attr, scan_freqs, tmp) {
9094 			struct ieee80211_channel *chan;
9095 			int freq = nla_get_u32(attr);
9096 
9097 			if (!scan_freqs_khz)
9098 				freq = MHZ_TO_KHZ(freq);
9099 
9100 			chan = ieee80211_get_channel_khz(wiphy, freq);
9101 			if (!chan) {
9102 				err = -EINVAL;
9103 				goto out_free;
9104 			}
9105 
9106 			/* ignore disabled channels */
9107 			if (chan->flags & IEEE80211_CHAN_DISABLED)
9108 				continue;
9109 
9110 			request->channels[i] = chan;
9111 			i++;
9112 		}
9113 	} else {
9114 		enum nl80211_band band;
9115 
9116 		/* all channels */
9117 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
9118 			int j;
9119 
9120 			if (!wiphy->bands[band])
9121 				continue;
9122 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9123 				struct ieee80211_channel *chan;
9124 
9125 				chan = &wiphy->bands[band]->channels[j];
9126 
9127 				if (chan->flags & IEEE80211_CHAN_DISABLED)
9128 					continue;
9129 
9130 				request->channels[i] = chan;
9131 				i++;
9132 			}
9133 		}
9134 	}
9135 
9136 	if (!i) {
9137 		err = -EINVAL;
9138 		goto out_free;
9139 	}
9140 
9141 	request->n_channels = i;
9142 
9143 	wdev_lock(wdev);
9144 	for (i = 0; i < request->n_channels; i++) {
9145 		struct ieee80211_channel *chan = request->channels[i];
9146 
9147 		/* if we can go off-channel to the target channel we're good */
9148 		if (cfg80211_off_channel_oper_allowed(wdev, chan))
9149 			continue;
9150 
9151 		if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9152 			wdev_unlock(wdev);
9153 			err = -EBUSY;
9154 			goto out_free;
9155 		}
9156 	}
9157 	wdev_unlock(wdev);
9158 
9159 	i = 0;
9160 	if (n_ssids) {
9161 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9162 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9163 				err = -EINVAL;
9164 				goto out_free;
9165 			}
9166 			request->ssids[i].ssid_len = nla_len(attr);
9167 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9168 			i++;
9169 		}
9170 	}
9171 
9172 	if (info->attrs[NL80211_ATTR_IE]) {
9173 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9174 		memcpy((void *)request->ie,
9175 		       nla_data(info->attrs[NL80211_ATTR_IE]),
9176 		       request->ie_len);
9177 	}
9178 
9179 	for (i = 0; i < NUM_NL80211_BANDS; i++)
9180 		if (wiphy->bands[i])
9181 			request->rates[i] =
9182 				(1 << wiphy->bands[i]->n_bitrates) - 1;
9183 
9184 	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9185 		nla_for_each_nested(attr,
9186 				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9187 				    tmp) {
9188 			enum nl80211_band band = nla_type(attr);
9189 
9190 			if (band < 0 || band >= NUM_NL80211_BANDS) {
9191 				err = -EINVAL;
9192 				goto out_free;
9193 			}
9194 
9195 			if (!wiphy->bands[band])
9196 				continue;
9197 
9198 			err = ieee80211_get_ratemask(wiphy->bands[band],
9199 						     nla_data(attr),
9200 						     nla_len(attr),
9201 						     &request->rates[band]);
9202 			if (err)
9203 				goto out_free;
9204 		}
9205 	}
9206 
9207 	if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9208 		request->duration =
9209 			nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9210 		request->duration_mandatory =
9211 			nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9212 	}
9213 
9214 	err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9215 				       false);
9216 	if (err)
9217 		goto out_free;
9218 
9219 	request->no_cck =
9220 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9221 
9222 	/* Initial implementation used NL80211_ATTR_MAC to set the specific
9223 	 * BSSID to scan for. This was problematic because that same attribute
9224 	 * was already used for another purpose (local random MAC address). The
9225 	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9226 	 * compatibility with older userspace components, also use the
9227 	 * NL80211_ATTR_MAC value here if it can be determined to be used for
9228 	 * the specific BSSID use case instead of the random MAC address
9229 	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9230 	 */
9231 	if (info->attrs[NL80211_ATTR_BSSID])
9232 		memcpy(request->bssid,
9233 		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9234 	else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9235 		 info->attrs[NL80211_ATTR_MAC])
9236 		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9237 		       ETH_ALEN);
9238 	else
9239 		eth_broadcast_addr(request->bssid);
9240 
9241 	request->wdev = wdev;
9242 	request->wiphy = &rdev->wiphy;
9243 	request->scan_start = jiffies;
9244 
9245 	rdev->scan_req = request;
9246 	err = cfg80211_scan(rdev);
9247 
9248 	if (err)
9249 		goto out_free;
9250 
9251 	nl80211_send_scan_start(rdev, wdev);
9252 	dev_hold(wdev->netdev);
9253 
9254 	return 0;
9255 
9256  out_free:
9257 	rdev->scan_req = NULL;
9258 	kfree(request);
9259 
9260 	return err;
9261 }
9262 
9263 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9264 {
9265 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9266 	struct wireless_dev *wdev = info->user_ptr[1];
9267 
9268 	if (!rdev->ops->abort_scan)
9269 		return -EOPNOTSUPP;
9270 
9271 	if (rdev->scan_msg)
9272 		return 0;
9273 
9274 	if (!rdev->scan_req)
9275 		return -ENOENT;
9276 
9277 	rdev_abort_scan(rdev, wdev);
9278 	return 0;
9279 }
9280 
9281 static int
9282 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9283 			       struct cfg80211_sched_scan_request *request,
9284 			       struct nlattr **attrs)
9285 {
9286 	int tmp, err, i = 0;
9287 	struct nlattr *attr;
9288 
9289 	if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9290 		u32 interval;
9291 
9292 		/*
9293 		 * If scan plans are not specified,
9294 		 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9295 		 * case one scan plan will be set with the specified scan
9296 		 * interval and infinite number of iterations.
9297 		 */
9298 		interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9299 		if (!interval)
9300 			return -EINVAL;
9301 
9302 		request->scan_plans[0].interval =
9303 			DIV_ROUND_UP(interval, MSEC_PER_SEC);
9304 		if (!request->scan_plans[0].interval)
9305 			return -EINVAL;
9306 
9307 		if (request->scan_plans[0].interval >
9308 		    wiphy->max_sched_scan_plan_interval)
9309 			request->scan_plans[0].interval =
9310 				wiphy->max_sched_scan_plan_interval;
9311 
9312 		return 0;
9313 	}
9314 
9315 	nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9316 		struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9317 
9318 		if (WARN_ON(i >= n_plans))
9319 			return -EINVAL;
9320 
9321 		err = nla_parse_nested_deprecated(plan,
9322 						  NL80211_SCHED_SCAN_PLAN_MAX,
9323 						  attr, nl80211_plan_policy,
9324 						  NULL);
9325 		if (err)
9326 			return err;
9327 
9328 		if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9329 			return -EINVAL;
9330 
9331 		request->scan_plans[i].interval =
9332 			nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9333 		if (!request->scan_plans[i].interval ||
9334 		    request->scan_plans[i].interval >
9335 		    wiphy->max_sched_scan_plan_interval)
9336 			return -EINVAL;
9337 
9338 		if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9339 			request->scan_plans[i].iterations =
9340 				nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9341 			if (!request->scan_plans[i].iterations ||
9342 			    (request->scan_plans[i].iterations >
9343 			     wiphy->max_sched_scan_plan_iterations))
9344 				return -EINVAL;
9345 		} else if (i < n_plans - 1) {
9346 			/*
9347 			 * All scan plans but the last one must specify
9348 			 * a finite number of iterations
9349 			 */
9350 			return -EINVAL;
9351 		}
9352 
9353 		i++;
9354 	}
9355 
9356 	/*
9357 	 * The last scan plan must not specify the number of
9358 	 * iterations, it is supposed to run infinitely
9359 	 */
9360 	if (request->scan_plans[n_plans - 1].iterations)
9361 		return  -EINVAL;
9362 
9363 	return 0;
9364 }
9365 
9366 static int
9367 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9368 				       struct cfg80211_match_set *match_sets,
9369 				       struct nlattr *tb_band_rssi,
9370 				       s32 rssi_thold)
9371 {
9372 	struct nlattr *attr;
9373 	int i, tmp, ret = 0;
9374 
9375 	if (!wiphy_ext_feature_isset(wiphy,
9376 		    NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9377 		if (tb_band_rssi)
9378 			ret = -EOPNOTSUPP;
9379 		else
9380 			for (i = 0; i < NUM_NL80211_BANDS; i++)
9381 				match_sets->per_band_rssi_thold[i] =
9382 					NL80211_SCAN_RSSI_THOLD_OFF;
9383 		return ret;
9384 	}
9385 
9386 	for (i = 0; i < NUM_NL80211_BANDS; i++)
9387 		match_sets->per_band_rssi_thold[i] = rssi_thold;
9388 
9389 	nla_for_each_nested(attr, tb_band_rssi, tmp) {
9390 		enum nl80211_band band = nla_type(attr);
9391 
9392 		if (band < 0 || band >= NUM_NL80211_BANDS)
9393 			return -EINVAL;
9394 
9395 		match_sets->per_band_rssi_thold[band] =	nla_get_s32(attr);
9396 	}
9397 
9398 	return 0;
9399 }
9400 
9401 static struct cfg80211_sched_scan_request *
9402 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9403 			 struct nlattr **attrs, int max_match_sets)
9404 {
9405 	struct cfg80211_sched_scan_request *request;
9406 	struct nlattr *attr;
9407 	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9408 	enum nl80211_band band;
9409 	size_t ie_len;
9410 	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9411 	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9412 
9413 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9414 		n_channels = validate_scan_freqs(
9415 				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9416 		if (!n_channels)
9417 			return ERR_PTR(-EINVAL);
9418 	} else {
9419 		n_channels = ieee80211_get_num_supported_channels(wiphy);
9420 	}
9421 
9422 	if (attrs[NL80211_ATTR_SCAN_SSIDS])
9423 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9424 				    tmp)
9425 			n_ssids++;
9426 
9427 	if (n_ssids > wiphy->max_sched_scan_ssids)
9428 		return ERR_PTR(-EINVAL);
9429 
9430 	/*
9431 	 * First, count the number of 'real' matchsets. Due to an issue with
9432 	 * the old implementation, matchsets containing only the RSSI attribute
9433 	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9434 	 * RSSI for all matchsets, rather than their own matchset for reporting
9435 	 * all APs with a strong RSSI. This is needed to be compatible with
9436 	 * older userspace that treated a matchset with only the RSSI as the
9437 	 * global RSSI for all other matchsets - if there are other matchsets.
9438 	 */
9439 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9440 		nla_for_each_nested(attr,
9441 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9442 				    tmp) {
9443 			struct nlattr *rssi;
9444 
9445 			err = nla_parse_nested_deprecated(tb,
9446 							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9447 							  attr,
9448 							  nl80211_match_policy,
9449 							  NULL);
9450 			if (err)
9451 				return ERR_PTR(err);
9452 
9453 			/* SSID and BSSID are mutually exclusive */
9454 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9455 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9456 				return ERR_PTR(-EINVAL);
9457 
9458 			/* add other standalone attributes here */
9459 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9460 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9461 				n_match_sets++;
9462 				continue;
9463 			}
9464 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9465 			if (rssi)
9466 				default_match_rssi = nla_get_s32(rssi);
9467 		}
9468 	}
9469 
9470 	/* However, if there's no other matchset, add the RSSI one */
9471 	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9472 		n_match_sets = 1;
9473 
9474 	if (n_match_sets > max_match_sets)
9475 		return ERR_PTR(-EINVAL);
9476 
9477 	if (attrs[NL80211_ATTR_IE])
9478 		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9479 	else
9480 		ie_len = 0;
9481 
9482 	if (ie_len > wiphy->max_sched_scan_ie_len)
9483 		return ERR_PTR(-EINVAL);
9484 
9485 	if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9486 		/*
9487 		 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9488 		 * each scan plan already specifies its own interval
9489 		 */
9490 		if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9491 			return ERR_PTR(-EINVAL);
9492 
9493 		nla_for_each_nested(attr,
9494 				    attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9495 			n_plans++;
9496 	} else {
9497 		/*
9498 		 * The scan interval attribute is kept for backward
9499 		 * compatibility. If no scan plans are specified and sched scan
9500 		 * interval is specified, one scan plan will be set with this
9501 		 * scan interval and infinite number of iterations.
9502 		 */
9503 		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9504 			return ERR_PTR(-EINVAL);
9505 
9506 		n_plans = 1;
9507 	}
9508 
9509 	if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9510 		return ERR_PTR(-EINVAL);
9511 
9512 	if (!wiphy_ext_feature_isset(
9513 		    wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9514 	    (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9515 	     attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9516 		return ERR_PTR(-EINVAL);
9517 
9518 	request = kzalloc(sizeof(*request)
9519 			+ sizeof(*request->ssids) * n_ssids
9520 			+ sizeof(*request->match_sets) * n_match_sets
9521 			+ sizeof(*request->scan_plans) * n_plans
9522 			+ sizeof(*request->channels) * n_channels
9523 			+ ie_len, GFP_KERNEL);
9524 	if (!request)
9525 		return ERR_PTR(-ENOMEM);
9526 
9527 	if (n_ssids)
9528 		request->ssids = (void *)&request->channels[n_channels];
9529 	request->n_ssids = n_ssids;
9530 	if (ie_len) {
9531 		if (n_ssids)
9532 			request->ie = (void *)(request->ssids + n_ssids);
9533 		else
9534 			request->ie = (void *)(request->channels + n_channels);
9535 	}
9536 
9537 	if (n_match_sets) {
9538 		if (request->ie)
9539 			request->match_sets = (void *)(request->ie + ie_len);
9540 		else if (n_ssids)
9541 			request->match_sets =
9542 				(void *)(request->ssids + n_ssids);
9543 		else
9544 			request->match_sets =
9545 				(void *)(request->channels + n_channels);
9546 	}
9547 	request->n_match_sets = n_match_sets;
9548 
9549 	if (n_match_sets)
9550 		request->scan_plans = (void *)(request->match_sets +
9551 					       n_match_sets);
9552 	else if (request->ie)
9553 		request->scan_plans = (void *)(request->ie + ie_len);
9554 	else if (n_ssids)
9555 		request->scan_plans = (void *)(request->ssids + n_ssids);
9556 	else
9557 		request->scan_plans = (void *)(request->channels + n_channels);
9558 
9559 	request->n_scan_plans = n_plans;
9560 
9561 	i = 0;
9562 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9563 		/* user specified, bail out if channel not found */
9564 		nla_for_each_nested(attr,
9565 				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9566 				    tmp) {
9567 			struct ieee80211_channel *chan;
9568 
9569 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9570 
9571 			if (!chan) {
9572 				err = -EINVAL;
9573 				goto out_free;
9574 			}
9575 
9576 			/* ignore disabled channels */
9577 			if (chan->flags & IEEE80211_CHAN_DISABLED)
9578 				continue;
9579 
9580 			request->channels[i] = chan;
9581 			i++;
9582 		}
9583 	} else {
9584 		/* all channels */
9585 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
9586 			int j;
9587 
9588 			if (!wiphy->bands[band])
9589 				continue;
9590 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9591 				struct ieee80211_channel *chan;
9592 
9593 				chan = &wiphy->bands[band]->channels[j];
9594 
9595 				if (chan->flags & IEEE80211_CHAN_DISABLED)
9596 					continue;
9597 
9598 				request->channels[i] = chan;
9599 				i++;
9600 			}
9601 		}
9602 	}
9603 
9604 	if (!i) {
9605 		err = -EINVAL;
9606 		goto out_free;
9607 	}
9608 
9609 	request->n_channels = i;
9610 
9611 	i = 0;
9612 	if (n_ssids) {
9613 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9614 				    tmp) {
9615 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9616 				err = -EINVAL;
9617 				goto out_free;
9618 			}
9619 			request->ssids[i].ssid_len = nla_len(attr);
9620 			memcpy(request->ssids[i].ssid, nla_data(attr),
9621 			       nla_len(attr));
9622 			i++;
9623 		}
9624 	}
9625 
9626 	i = 0;
9627 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9628 		nla_for_each_nested(attr,
9629 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9630 				    tmp) {
9631 			struct nlattr *ssid, *bssid, *rssi;
9632 
9633 			err = nla_parse_nested_deprecated(tb,
9634 							  NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9635 							  attr,
9636 							  nl80211_match_policy,
9637 							  NULL);
9638 			if (err)
9639 				goto out_free;
9640 			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9641 			bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9642 
9643 			if (!ssid && !bssid) {
9644 				i++;
9645 				continue;
9646 			}
9647 
9648 			if (WARN_ON(i >= n_match_sets)) {
9649 				/* this indicates a programming error,
9650 				 * the loop above should have verified
9651 				 * things properly
9652 				 */
9653 				err = -EINVAL;
9654 				goto out_free;
9655 			}
9656 
9657 			if (ssid) {
9658 				memcpy(request->match_sets[i].ssid.ssid,
9659 				       nla_data(ssid), nla_len(ssid));
9660 				request->match_sets[i].ssid.ssid_len =
9661 					nla_len(ssid);
9662 			}
9663 			if (bssid)
9664 				memcpy(request->match_sets[i].bssid,
9665 				       nla_data(bssid), ETH_ALEN);
9666 
9667 			/* special attribute - old implementation w/a */
9668 			request->match_sets[i].rssi_thold = default_match_rssi;
9669 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9670 			if (rssi)
9671 				request->match_sets[i].rssi_thold =
9672 					nla_get_s32(rssi);
9673 
9674 			/* Parse per band RSSI attribute */
9675 			err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9676 				&request->match_sets[i],
9677 				tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9678 				request->match_sets[i].rssi_thold);
9679 			if (err)
9680 				goto out_free;
9681 
9682 			i++;
9683 		}
9684 
9685 		/* there was no other matchset, so the RSSI one is alone */
9686 		if (i == 0 && n_match_sets)
9687 			request->match_sets[0].rssi_thold = default_match_rssi;
9688 
9689 		request->min_rssi_thold = INT_MAX;
9690 		for (i = 0; i < n_match_sets; i++)
9691 			request->min_rssi_thold =
9692 				min(request->match_sets[i].rssi_thold,
9693 				    request->min_rssi_thold);
9694 	} else {
9695 		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9696 	}
9697 
9698 	if (ie_len) {
9699 		request->ie_len = ie_len;
9700 		memcpy((void *)request->ie,
9701 		       nla_data(attrs[NL80211_ATTR_IE]),
9702 		       request->ie_len);
9703 	}
9704 
9705 	err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9706 	if (err)
9707 		goto out_free;
9708 
9709 	if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9710 		request->delay =
9711 			nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9712 
9713 	if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9714 		request->relative_rssi = nla_get_s8(
9715 			attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9716 		request->relative_rssi_set = true;
9717 	}
9718 
9719 	if (request->relative_rssi_set &&
9720 	    attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9721 		struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9722 
9723 		rssi_adjust = nla_data(
9724 			attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9725 		request->rssi_adjust.band = rssi_adjust->band;
9726 		request->rssi_adjust.delta = rssi_adjust->delta;
9727 		if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9728 			err = -EINVAL;
9729 			goto out_free;
9730 		}
9731 	}
9732 
9733 	err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9734 	if (err)
9735 		goto out_free;
9736 
9737 	request->scan_start = jiffies;
9738 
9739 	return request;
9740 
9741 out_free:
9742 	kfree(request);
9743 	return ERR_PTR(err);
9744 }
9745 
9746 static int nl80211_start_sched_scan(struct sk_buff *skb,
9747 				    struct genl_info *info)
9748 {
9749 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9750 	struct net_device *dev = info->user_ptr[1];
9751 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9752 	struct cfg80211_sched_scan_request *sched_scan_req;
9753 	bool want_multi;
9754 	int err;
9755 
9756 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9757 		return -EOPNOTSUPP;
9758 
9759 	want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9760 	err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9761 	if (err)
9762 		return err;
9763 
9764 	sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9765 						  info->attrs,
9766 						  rdev->wiphy.max_match_sets);
9767 
9768 	err = PTR_ERR_OR_ZERO(sched_scan_req);
9769 	if (err)
9770 		goto out_err;
9771 
9772 	/* leave request id zero for legacy request
9773 	 * or if driver does not support multi-scheduled scan
9774 	 */
9775 	if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9776 		sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9777 
9778 	err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9779 	if (err)
9780 		goto out_free;
9781 
9782 	sched_scan_req->dev = dev;
9783 	sched_scan_req->wiphy = &rdev->wiphy;
9784 
9785 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9786 		sched_scan_req->owner_nlportid = info->snd_portid;
9787 
9788 	cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9789 
9790 	nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9791 	return 0;
9792 
9793 out_free:
9794 	kfree(sched_scan_req);
9795 out_err:
9796 	return err;
9797 }
9798 
9799 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9800 				   struct genl_info *info)
9801 {
9802 	struct cfg80211_sched_scan_request *req;
9803 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9804 	u64 cookie;
9805 
9806 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9807 		return -EOPNOTSUPP;
9808 
9809 	if (info->attrs[NL80211_ATTR_COOKIE]) {
9810 		cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9811 		return __cfg80211_stop_sched_scan(rdev, cookie, false);
9812 	}
9813 
9814 	req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9815 				     struct cfg80211_sched_scan_request,
9816 				     list);
9817 	if (!req || req->reqid ||
9818 	    (req->owner_nlportid &&
9819 	     req->owner_nlportid != info->snd_portid))
9820 		return -ENOENT;
9821 
9822 	return cfg80211_stop_sched_scan_req(rdev, req, false);
9823 }
9824 
9825 static int nl80211_start_radar_detection(struct sk_buff *skb,
9826 					 struct genl_info *info)
9827 {
9828 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9829 	struct net_device *dev = info->user_ptr[1];
9830 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9831 	struct wiphy *wiphy = wdev->wiphy;
9832 	struct cfg80211_chan_def chandef;
9833 	enum nl80211_dfs_regions dfs_region;
9834 	unsigned int cac_time_ms;
9835 	int err = -EINVAL;
9836 
9837 	flush_delayed_work(&rdev->dfs_update_channels_wk);
9838 
9839 	wiphy_lock(wiphy);
9840 
9841 	dfs_region = reg_get_dfs_region(wiphy);
9842 	if (dfs_region == NL80211_DFS_UNSET)
9843 		goto unlock;
9844 
9845 	err = nl80211_parse_chandef(rdev, info, &chandef);
9846 	if (err)
9847 		goto unlock;
9848 
9849 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9850 	if (err < 0)
9851 		goto unlock;
9852 
9853 	if (err == 0) {
9854 		err = -EINVAL;
9855 		goto unlock;
9856 	}
9857 
9858 	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9859 		err = -EINVAL;
9860 		goto unlock;
9861 	}
9862 
9863 	if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9864 		err = cfg80211_start_background_radar_detection(rdev, wdev,
9865 								&chandef);
9866 		goto unlock;
9867 	}
9868 
9869 	if (netif_carrier_ok(dev)) {
9870 		err = -EBUSY;
9871 		goto unlock;
9872 	}
9873 
9874 	if (wdev->cac_started) {
9875 		err = -EBUSY;
9876 		goto unlock;
9877 	}
9878 
9879 	/* CAC start is offloaded to HW and can't be started manually */
9880 	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9881 		err = -EOPNOTSUPP;
9882 		goto unlock;
9883 	}
9884 
9885 	if (!rdev->ops->start_radar_detection) {
9886 		err = -EOPNOTSUPP;
9887 		goto unlock;
9888 	}
9889 
9890 	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9891 	if (WARN_ON(!cac_time_ms))
9892 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9893 
9894 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9895 	if (!err) {
9896 		wdev->links[0].ap.chandef = chandef;
9897 		wdev->cac_started = true;
9898 		wdev->cac_start_time = jiffies;
9899 		wdev->cac_time_ms = cac_time_ms;
9900 	}
9901 unlock:
9902 	wiphy_unlock(wiphy);
9903 
9904 	return err;
9905 }
9906 
9907 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9908 					  struct genl_info *info)
9909 {
9910 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9911 	struct net_device *dev = info->user_ptr[1];
9912 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9913 	struct wiphy *wiphy = wdev->wiphy;
9914 	struct cfg80211_chan_def chandef;
9915 	enum nl80211_dfs_regions dfs_region;
9916 	int err;
9917 
9918 	dfs_region = reg_get_dfs_region(wiphy);
9919 	if (dfs_region == NL80211_DFS_UNSET) {
9920 		GENL_SET_ERR_MSG(info,
9921 				 "DFS Region is not set. Unexpected Radar indication");
9922 		return -EINVAL;
9923 	}
9924 
9925 	err = nl80211_parse_chandef(rdev, info, &chandef);
9926 	if (err) {
9927 		GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9928 		return err;
9929 	}
9930 
9931 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9932 	if (err < 0) {
9933 		GENL_SET_ERR_MSG(info, "chandef is invalid");
9934 		return err;
9935 	}
9936 
9937 	if (err == 0) {
9938 		GENL_SET_ERR_MSG(info,
9939 				 "Unexpected Radar indication for chandef/iftype");
9940 		return -EINVAL;
9941 	}
9942 
9943 	/* Do not process this notification if radar is already detected
9944 	 * by kernel on this channel, and return success.
9945 	 */
9946 	if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9947 		return 0;
9948 
9949 	cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9950 
9951 	cfg80211_sched_dfs_chan_update(rdev);
9952 
9953 	rdev->radar_chandef = chandef;
9954 
9955 	/* Propagate this notification to other radios as well */
9956 	queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9957 
9958 	return 0;
9959 }
9960 
9961 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9962 {
9963 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9964 	unsigned int link_id = nl80211_link_id(info->attrs);
9965 	struct net_device *dev = info->user_ptr[1];
9966 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9967 	struct cfg80211_csa_settings params;
9968 	struct nlattr **csa_attrs = NULL;
9969 	int err;
9970 	bool need_new_beacon = false;
9971 	bool need_handle_dfs_flag = true;
9972 	int len, i;
9973 	u32 cs_count;
9974 
9975 	if (!rdev->ops->channel_switch ||
9976 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9977 		return -EOPNOTSUPP;
9978 
9979 	switch (dev->ieee80211_ptr->iftype) {
9980 	case NL80211_IFTYPE_AP:
9981 	case NL80211_IFTYPE_P2P_GO:
9982 		need_new_beacon = true;
9983 		/* For all modes except AP the handle_dfs flag needs to be
9984 		 * supplied to tell the kernel that userspace will handle radar
9985 		 * events when they happen. Otherwise a switch to a channel
9986 		 * requiring DFS will be rejected.
9987 		 */
9988 		need_handle_dfs_flag = false;
9989 
9990 		/* useless if AP is not running */
9991 		if (!wdev->links[link_id].ap.beacon_interval)
9992 			return -ENOTCONN;
9993 		break;
9994 	case NL80211_IFTYPE_ADHOC:
9995 		if (!wdev->u.ibss.ssid_len)
9996 			return -ENOTCONN;
9997 		break;
9998 	case NL80211_IFTYPE_MESH_POINT:
9999 		if (!wdev->u.mesh.id_len)
10000 			return -ENOTCONN;
10001 		break;
10002 	default:
10003 		return -EOPNOTSUPP;
10004 	}
10005 
10006 	memset(&params, 0, sizeof(params));
10007 	params.beacon_csa.ftm_responder = -1;
10008 
10009 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10010 	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10011 		return -EINVAL;
10012 
10013 	/* only important for AP, IBSS and mesh create IEs internally */
10014 	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10015 		return -EINVAL;
10016 
10017 	/* Even though the attribute is u32, the specification says
10018 	 * u8, so let's make sure we don't overflow.
10019 	 */
10020 	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10021 	if (cs_count > 255)
10022 		return -EINVAL;
10023 
10024 	params.count = cs_count;
10025 
10026 	if (!need_new_beacon)
10027 		goto skip_beacons;
10028 
10029 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
10030 	if (err)
10031 		goto free;
10032 
10033 	csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10034 			    GFP_KERNEL);
10035 	if (!csa_attrs) {
10036 		err = -ENOMEM;
10037 		goto free;
10038 	}
10039 
10040 	err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10041 					  info->attrs[NL80211_ATTR_CSA_IES],
10042 					  nl80211_policy, info->extack);
10043 	if (err)
10044 		goto free;
10045 
10046 	err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
10047 	if (err)
10048 		goto free;
10049 
10050 	if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10051 		err = -EINVAL;
10052 		goto free;
10053 	}
10054 
10055 	len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10056 	if (!len || (len % sizeof(u16))) {
10057 		err = -EINVAL;
10058 		goto free;
10059 	}
10060 
10061 	params.n_counter_offsets_beacon = len / sizeof(u16);
10062 	if (rdev->wiphy.max_num_csa_counters &&
10063 	    (params.n_counter_offsets_beacon >
10064 	     rdev->wiphy.max_num_csa_counters)) {
10065 		err = -EINVAL;
10066 		goto free;
10067 	}
10068 
10069 	params.counter_offsets_beacon =
10070 		nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10071 
10072 	/* sanity checks - counters should fit and be the same */
10073 	for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10074 		u16 offset = params.counter_offsets_beacon[i];
10075 
10076 		if (offset >= params.beacon_csa.tail_len) {
10077 			err = -EINVAL;
10078 			goto free;
10079 		}
10080 
10081 		if (params.beacon_csa.tail[offset] != params.count) {
10082 			err = -EINVAL;
10083 			goto free;
10084 		}
10085 	}
10086 
10087 	if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10088 		len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10089 		if (!len || (len % sizeof(u16))) {
10090 			err = -EINVAL;
10091 			goto free;
10092 		}
10093 
10094 		params.n_counter_offsets_presp = len / sizeof(u16);
10095 		if (rdev->wiphy.max_num_csa_counters &&
10096 		    (params.n_counter_offsets_presp >
10097 		     rdev->wiphy.max_num_csa_counters)) {
10098 			err = -EINVAL;
10099 			goto free;
10100 		}
10101 
10102 		params.counter_offsets_presp =
10103 			nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10104 
10105 		/* sanity checks - counters should fit and be the same */
10106 		for (i = 0; i < params.n_counter_offsets_presp; i++) {
10107 			u16 offset = params.counter_offsets_presp[i];
10108 
10109 			if (offset >= params.beacon_csa.probe_resp_len) {
10110 				err = -EINVAL;
10111 				goto free;
10112 			}
10113 
10114 			if (params.beacon_csa.probe_resp[offset] !=
10115 			    params.count) {
10116 				err = -EINVAL;
10117 				goto free;
10118 			}
10119 		}
10120 	}
10121 
10122 skip_beacons:
10123 	err = nl80211_parse_chandef(rdev, info, &params.chandef);
10124 	if (err)
10125 		goto free;
10126 
10127 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10128 					   wdev->iftype)) {
10129 		err = -EINVAL;
10130 		goto free;
10131 	}
10132 
10133 	err = cfg80211_chandef_dfs_required(wdev->wiphy,
10134 					    &params.chandef,
10135 					    wdev->iftype);
10136 	if (err < 0)
10137 		goto free;
10138 
10139 	if (err > 0) {
10140 		params.radar_required = true;
10141 		if (need_handle_dfs_flag &&
10142 		    !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10143 			err = -EINVAL;
10144 			goto free;
10145 		}
10146 	}
10147 
10148 	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10149 		params.block_tx = true;
10150 
10151 	if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10152 		err = nl80211_parse_punct_bitmap(rdev, info,
10153 						 &params.chandef,
10154 						 &params.punct_bitmap);
10155 		if (err)
10156 			goto free;
10157 	}
10158 
10159 	wdev_lock(wdev);
10160 	err = rdev_channel_switch(rdev, dev, &params);
10161 	wdev_unlock(wdev);
10162 
10163 free:
10164 	kfree(params.beacon_after.mbssid_ies);
10165 	kfree(params.beacon_csa.mbssid_ies);
10166 	kfree(csa_attrs);
10167 	return err;
10168 }
10169 
10170 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10171 			    u32 seq, int flags,
10172 			    struct cfg80211_registered_device *rdev,
10173 			    struct wireless_dev *wdev,
10174 			    struct cfg80211_internal_bss *intbss)
10175 {
10176 	struct cfg80211_bss *res = &intbss->pub;
10177 	const struct cfg80211_bss_ies *ies;
10178 	unsigned int link_id;
10179 	void *hdr;
10180 	struct nlattr *bss;
10181 
10182 	ASSERT_WDEV_LOCK(wdev);
10183 
10184 	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10185 			     NL80211_CMD_NEW_SCAN_RESULTS);
10186 	if (!hdr)
10187 		return -1;
10188 
10189 	genl_dump_check_consistent(cb, hdr);
10190 
10191 	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10192 		goto nla_put_failure;
10193 	if (wdev->netdev &&
10194 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10195 		goto nla_put_failure;
10196 	if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10197 			      NL80211_ATTR_PAD))
10198 		goto nla_put_failure;
10199 
10200 	bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10201 	if (!bss)
10202 		goto nla_put_failure;
10203 	if ((!is_zero_ether_addr(res->bssid) &&
10204 	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10205 		goto nla_put_failure;
10206 
10207 	rcu_read_lock();
10208 	/* indicate whether we have probe response data or not */
10209 	if (rcu_access_pointer(res->proberesp_ies) &&
10210 	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10211 		goto fail_unlock_rcu;
10212 
10213 	/* this pointer prefers to be pointed to probe response data
10214 	 * but is always valid
10215 	 */
10216 	ies = rcu_dereference(res->ies);
10217 	if (ies) {
10218 		if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10219 				      NL80211_BSS_PAD))
10220 			goto fail_unlock_rcu;
10221 		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10222 					ies->len, ies->data))
10223 			goto fail_unlock_rcu;
10224 	}
10225 
10226 	/* and this pointer is always (unless driver didn't know) beacon data */
10227 	ies = rcu_dereference(res->beacon_ies);
10228 	if (ies && ies->from_beacon) {
10229 		if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10230 				      NL80211_BSS_PAD))
10231 			goto fail_unlock_rcu;
10232 		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10233 					ies->len, ies->data))
10234 			goto fail_unlock_rcu;
10235 	}
10236 	rcu_read_unlock();
10237 
10238 	if (res->beacon_interval &&
10239 	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10240 		goto nla_put_failure;
10241 	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10242 	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10243 	    nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10244 			res->channel->freq_offset) ||
10245 	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10246 	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10247 			jiffies_to_msecs(jiffies - intbss->ts)))
10248 		goto nla_put_failure;
10249 
10250 	if (intbss->parent_tsf &&
10251 	    (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10252 			       intbss->parent_tsf, NL80211_BSS_PAD) ||
10253 	     nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10254 		     intbss->parent_bssid)))
10255 		goto nla_put_failure;
10256 
10257 	if (intbss->ts_boottime &&
10258 	    nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10259 			      intbss->ts_boottime, NL80211_BSS_PAD))
10260 		goto nla_put_failure;
10261 
10262 	if (!nl80211_put_signal(msg, intbss->pub.chains,
10263 				intbss->pub.chain_signal,
10264 				NL80211_BSS_CHAIN_SIGNAL))
10265 		goto nla_put_failure;
10266 
10267 	switch (rdev->wiphy.signal_type) {
10268 	case CFG80211_SIGNAL_TYPE_MBM:
10269 		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10270 			goto nla_put_failure;
10271 		break;
10272 	case CFG80211_SIGNAL_TYPE_UNSPEC:
10273 		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10274 			goto nla_put_failure;
10275 		break;
10276 	default:
10277 		break;
10278 	}
10279 
10280 	switch (wdev->iftype) {
10281 	case NL80211_IFTYPE_P2P_CLIENT:
10282 	case NL80211_IFTYPE_STATION:
10283 		for_each_valid_link(wdev, link_id) {
10284 			if (intbss == wdev->links[link_id].client.current_bss &&
10285 			    (nla_put_u32(msg, NL80211_BSS_STATUS,
10286 					 NL80211_BSS_STATUS_ASSOCIATED) ||
10287 			     (wdev->valid_links &&
10288 			      (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10289 					  link_id) ||
10290 			       nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10291 				       wdev->u.client.connected_addr)))))
10292 				goto nla_put_failure;
10293 		}
10294 		break;
10295 	case NL80211_IFTYPE_ADHOC:
10296 		if (intbss == wdev->u.ibss.current_bss &&
10297 		    nla_put_u32(msg, NL80211_BSS_STATUS,
10298 				NL80211_BSS_STATUS_IBSS_JOINED))
10299 			goto nla_put_failure;
10300 		break;
10301 	default:
10302 		break;
10303 	}
10304 
10305 	nla_nest_end(msg, bss);
10306 
10307 	genlmsg_end(msg, hdr);
10308 	return 0;
10309 
10310  fail_unlock_rcu:
10311 	rcu_read_unlock();
10312  nla_put_failure:
10313 	genlmsg_cancel(msg, hdr);
10314 	return -EMSGSIZE;
10315 }
10316 
10317 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10318 {
10319 	struct cfg80211_registered_device *rdev;
10320 	struct cfg80211_internal_bss *scan;
10321 	struct wireless_dev *wdev;
10322 	int start = cb->args[2], idx = 0;
10323 	int err;
10324 
10325 	err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10326 	if (err)
10327 		return err;
10328 	/* nl80211_prepare_wdev_dump acquired it in the successful case */
10329 	__acquire(&rdev->wiphy.mtx);
10330 
10331 	wdev_lock(wdev);
10332 	spin_lock_bh(&rdev->bss_lock);
10333 
10334 	/*
10335 	 * dump_scan will be called multiple times to break up the scan results
10336 	 * into multiple messages.  It is unlikely that any more bss-es will be
10337 	 * expired after the first call, so only call only call this on the
10338 	 * first dump_scan invocation.
10339 	 */
10340 	if (start == 0)
10341 		cfg80211_bss_expire(rdev);
10342 
10343 	cb->seq = rdev->bss_generation;
10344 
10345 	list_for_each_entry(scan, &rdev->bss_list, list) {
10346 		if (++idx <= start)
10347 			continue;
10348 		if (nl80211_send_bss(skb, cb,
10349 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
10350 				rdev, wdev, scan) < 0) {
10351 			idx--;
10352 			break;
10353 		}
10354 	}
10355 
10356 	spin_unlock_bh(&rdev->bss_lock);
10357 	wdev_unlock(wdev);
10358 
10359 	cb->args[2] = idx;
10360 	wiphy_unlock(&rdev->wiphy);
10361 
10362 	return skb->len;
10363 }
10364 
10365 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10366 			       int flags, struct net_device *dev,
10367 			       bool allow_radio_stats,
10368 			       struct survey_info *survey)
10369 {
10370 	void *hdr;
10371 	struct nlattr *infoattr;
10372 
10373 	/* skip radio stats if userspace didn't request them */
10374 	if (!survey->channel && !allow_radio_stats)
10375 		return 0;
10376 
10377 	hdr = nl80211hdr_put(msg, portid, seq, flags,
10378 			     NL80211_CMD_NEW_SURVEY_RESULTS);
10379 	if (!hdr)
10380 		return -ENOMEM;
10381 
10382 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10383 		goto nla_put_failure;
10384 
10385 	infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10386 	if (!infoattr)
10387 		goto nla_put_failure;
10388 
10389 	if (survey->channel &&
10390 	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10391 			survey->channel->center_freq))
10392 		goto nla_put_failure;
10393 
10394 	if (survey->channel && survey->channel->freq_offset &&
10395 	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10396 			survey->channel->freq_offset))
10397 		goto nla_put_failure;
10398 
10399 	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10400 	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10401 		goto nla_put_failure;
10402 	if ((survey->filled & SURVEY_INFO_IN_USE) &&
10403 	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10404 		goto nla_put_failure;
10405 	if ((survey->filled & SURVEY_INFO_TIME) &&
10406 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10407 			survey->time, NL80211_SURVEY_INFO_PAD))
10408 		goto nla_put_failure;
10409 	if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10410 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10411 			      survey->time_busy, NL80211_SURVEY_INFO_PAD))
10412 		goto nla_put_failure;
10413 	if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10414 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10415 			      survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10416 		goto nla_put_failure;
10417 	if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10418 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10419 			      survey->time_rx, NL80211_SURVEY_INFO_PAD))
10420 		goto nla_put_failure;
10421 	if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10422 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10423 			      survey->time_tx, NL80211_SURVEY_INFO_PAD))
10424 		goto nla_put_failure;
10425 	if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10426 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10427 			      survey->time_scan, NL80211_SURVEY_INFO_PAD))
10428 		goto nla_put_failure;
10429 	if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10430 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10431 			      survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10432 		goto nla_put_failure;
10433 
10434 	nla_nest_end(msg, infoattr);
10435 
10436 	genlmsg_end(msg, hdr);
10437 	return 0;
10438 
10439  nla_put_failure:
10440 	genlmsg_cancel(msg, hdr);
10441 	return -EMSGSIZE;
10442 }
10443 
10444 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10445 {
10446 	struct nlattr **attrbuf;
10447 	struct survey_info survey;
10448 	struct cfg80211_registered_device *rdev;
10449 	struct wireless_dev *wdev;
10450 	int survey_idx = cb->args[2];
10451 	int res;
10452 	bool radio_stats;
10453 
10454 	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10455 	if (!attrbuf)
10456 		return -ENOMEM;
10457 
10458 	res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10459 	if (res) {
10460 		kfree(attrbuf);
10461 		return res;
10462 	}
10463 	/* nl80211_prepare_wdev_dump acquired it in the successful case */
10464 	__acquire(&rdev->wiphy.mtx);
10465 
10466 	/* prepare_wdev_dump parsed the attributes */
10467 	radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10468 
10469 	if (!wdev->netdev) {
10470 		res = -EINVAL;
10471 		goto out_err;
10472 	}
10473 
10474 	if (!rdev->ops->dump_survey) {
10475 		res = -EOPNOTSUPP;
10476 		goto out_err;
10477 	}
10478 
10479 	while (1) {
10480 		wdev_lock(wdev);
10481 		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10482 		wdev_unlock(wdev);
10483 		if (res == -ENOENT)
10484 			break;
10485 		if (res)
10486 			goto out_err;
10487 
10488 		/* don't send disabled channels, but do send non-channel data */
10489 		if (survey.channel &&
10490 		    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10491 			survey_idx++;
10492 			continue;
10493 		}
10494 
10495 		if (nl80211_send_survey(skb,
10496 				NETLINK_CB(cb->skb).portid,
10497 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
10498 				wdev->netdev, radio_stats, &survey) < 0)
10499 			goto out;
10500 		survey_idx++;
10501 	}
10502 
10503  out:
10504 	cb->args[2] = survey_idx;
10505 	res = skb->len;
10506  out_err:
10507 	kfree(attrbuf);
10508 	wiphy_unlock(&rdev->wiphy);
10509 	return res;
10510 }
10511 
10512 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10513 {
10514 	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10515 				  NL80211_WPA_VERSION_2 |
10516 				  NL80211_WPA_VERSION_3));
10517 }
10518 
10519 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10520 {
10521 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10522 	struct net_device *dev = info->user_ptr[1];
10523 	struct ieee80211_channel *chan;
10524 	const u8 *bssid, *ssid;
10525 	int err, ssid_len;
10526 	enum nl80211_auth_type auth_type;
10527 	struct key_parse key;
10528 	bool local_state_change;
10529 	struct cfg80211_auth_request req = {};
10530 	u32 freq;
10531 
10532 	if (!info->attrs[NL80211_ATTR_MAC])
10533 		return -EINVAL;
10534 
10535 	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10536 		return -EINVAL;
10537 
10538 	if (!info->attrs[NL80211_ATTR_SSID])
10539 		return -EINVAL;
10540 
10541 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10542 		return -EINVAL;
10543 
10544 	err = nl80211_parse_key(info, &key);
10545 	if (err)
10546 		return err;
10547 
10548 	if (key.idx >= 0) {
10549 		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10550 			return -EINVAL;
10551 		if (!key.p.key || !key.p.key_len)
10552 			return -EINVAL;
10553 		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10554 		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10555 		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10556 		     key.p.key_len != WLAN_KEY_LEN_WEP104))
10557 			return -EINVAL;
10558 		if (key.idx > 3)
10559 			return -EINVAL;
10560 	} else {
10561 		key.p.key_len = 0;
10562 		key.p.key = NULL;
10563 	}
10564 
10565 	if (key.idx >= 0) {
10566 		int i;
10567 		bool ok = false;
10568 
10569 		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10570 			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10571 				ok = true;
10572 				break;
10573 			}
10574 		}
10575 		if (!ok)
10576 			return -EINVAL;
10577 	}
10578 
10579 	if (!rdev->ops->auth)
10580 		return -EOPNOTSUPP;
10581 
10582 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10583 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10584 		return -EOPNOTSUPP;
10585 
10586 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10587 	freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10588 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10589 		freq +=
10590 		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10591 
10592 	chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10593 	if (!chan)
10594 		return -EINVAL;
10595 
10596 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10597 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10598 
10599 	if (info->attrs[NL80211_ATTR_IE]) {
10600 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10601 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10602 	}
10603 
10604 	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10605 	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10606 		return -EINVAL;
10607 
10608 	if ((auth_type == NL80211_AUTHTYPE_SAE ||
10609 	     auth_type == NL80211_AUTHTYPE_FILS_SK ||
10610 	     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10611 	     auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10612 	    !info->attrs[NL80211_ATTR_AUTH_DATA])
10613 		return -EINVAL;
10614 
10615 	if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10616 		if (auth_type != NL80211_AUTHTYPE_SAE &&
10617 		    auth_type != NL80211_AUTHTYPE_FILS_SK &&
10618 		    auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10619 		    auth_type != NL80211_AUTHTYPE_FILS_PK)
10620 			return -EINVAL;
10621 		req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10622 		req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10623 	}
10624 
10625 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10626 
10627 	/*
10628 	 * Since we no longer track auth state, ignore
10629 	 * requests to only change local state.
10630 	 */
10631 	if (local_state_change)
10632 		return 0;
10633 
10634 	req.auth_type = auth_type;
10635 	req.key = key.p.key;
10636 	req.key_len = key.p.key_len;
10637 	req.key_idx = key.idx;
10638 	req.link_id = nl80211_link_id_or_invalid(info->attrs);
10639 	if (req.link_id >= 0) {
10640 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10641 			return -EINVAL;
10642 		if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10643 			return -EINVAL;
10644 		req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10645 	}
10646 
10647 	req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10648 				   IEEE80211_BSS_TYPE_ESS,
10649 				   IEEE80211_PRIVACY_ANY);
10650 	if (!req.bss)
10651 		return -ENOENT;
10652 
10653 	wdev_lock(dev->ieee80211_ptr);
10654 	err = cfg80211_mlme_auth(rdev, dev, &req);
10655 	wdev_unlock(dev->ieee80211_ptr);
10656 
10657 	cfg80211_put_bss(&rdev->wiphy, req.bss);
10658 
10659 	return err;
10660 }
10661 
10662 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10663 				     struct genl_info *info)
10664 {
10665 	if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10666 		GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10667 		return -EINVAL;
10668 	}
10669 
10670 	if (!rdev->ops->tx_control_port ||
10671 	    !wiphy_ext_feature_isset(&rdev->wiphy,
10672 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10673 		return -EOPNOTSUPP;
10674 
10675 	return 0;
10676 }
10677 
10678 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10679 				   struct genl_info *info,
10680 				   struct cfg80211_crypto_settings *settings,
10681 				   int cipher_limit)
10682 {
10683 	memset(settings, 0, sizeof(*settings));
10684 
10685 	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10686 
10687 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10688 		u16 proto;
10689 
10690 		proto = nla_get_u16(
10691 			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10692 		settings->control_port_ethertype = cpu_to_be16(proto);
10693 		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10694 		    proto != ETH_P_PAE)
10695 			return -EINVAL;
10696 		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10697 			settings->control_port_no_encrypt = true;
10698 	} else
10699 		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10700 
10701 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10702 		int r = validate_pae_over_nl80211(rdev, info);
10703 
10704 		if (r < 0)
10705 			return r;
10706 
10707 		settings->control_port_over_nl80211 = true;
10708 
10709 		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10710 			settings->control_port_no_preauth = true;
10711 	}
10712 
10713 	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10714 		void *data;
10715 		int len, i;
10716 
10717 		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10718 		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10719 		settings->n_ciphers_pairwise = len / sizeof(u32);
10720 
10721 		if (len % sizeof(u32))
10722 			return -EINVAL;
10723 
10724 		if (settings->n_ciphers_pairwise > cipher_limit)
10725 			return -EINVAL;
10726 
10727 		memcpy(settings->ciphers_pairwise, data, len);
10728 
10729 		for (i = 0; i < settings->n_ciphers_pairwise; i++)
10730 			if (!cfg80211_supported_cipher_suite(
10731 					&rdev->wiphy,
10732 					settings->ciphers_pairwise[i]))
10733 				return -EINVAL;
10734 	}
10735 
10736 	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10737 		settings->cipher_group =
10738 			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10739 		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10740 						     settings->cipher_group))
10741 			return -EINVAL;
10742 	}
10743 
10744 	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10745 		settings->wpa_versions =
10746 			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10747 		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10748 			return -EINVAL;
10749 	}
10750 
10751 	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10752 		void *data;
10753 		int len;
10754 
10755 		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10756 		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10757 		settings->n_akm_suites = len / sizeof(u32);
10758 
10759 		if (len % sizeof(u32))
10760 			return -EINVAL;
10761 
10762 		if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10763 			return -EINVAL;
10764 
10765 		memcpy(settings->akm_suites, data, len);
10766 	}
10767 
10768 	if (info->attrs[NL80211_ATTR_PMK]) {
10769 		if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10770 			return -EINVAL;
10771 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
10772 					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10773 		    !wiphy_ext_feature_isset(&rdev->wiphy,
10774 					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10775 			return -EINVAL;
10776 		settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10777 	}
10778 
10779 	if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10780 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
10781 					     NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10782 		    !wiphy_ext_feature_isset(&rdev->wiphy,
10783 					     NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10784 			return -EINVAL;
10785 		settings->sae_pwd =
10786 			nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10787 		settings->sae_pwd_len =
10788 			nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10789 	}
10790 
10791 	if (info->attrs[NL80211_ATTR_SAE_PWE])
10792 		settings->sae_pwe =
10793 			nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10794 	else
10795 		settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10796 
10797 	return 0;
10798 }
10799 
10800 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10801 					      const u8 *ssid, int ssid_len,
10802 					      struct nlattr **attrs)
10803 {
10804 	struct ieee80211_channel *chan;
10805 	struct cfg80211_bss *bss;
10806 	const u8 *bssid;
10807 	u32 freq;
10808 
10809 	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10810 		return ERR_PTR(-EINVAL);
10811 
10812 	bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10813 
10814 	freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10815 	if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10816 		freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10817 
10818 	chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10819 	if (!chan)
10820 		return ERR_PTR(-EINVAL);
10821 
10822 	bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10823 			       ssid, ssid_len,
10824 			       IEEE80211_BSS_TYPE_ESS,
10825 			       IEEE80211_PRIVACY_ANY);
10826 	if (!bss)
10827 		return ERR_PTR(-ENOENT);
10828 
10829 	return bss;
10830 }
10831 
10832 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10833 {
10834 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10835 	struct net_device *dev = info->user_ptr[1];
10836 	struct cfg80211_assoc_request req = {};
10837 	struct nlattr **attrs = NULL;
10838 	const u8 *ap_addr, *ssid;
10839 	unsigned int link_id;
10840 	int err, ssid_len;
10841 
10842 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
10843 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10844 		return -EPERM;
10845 
10846 	if (!info->attrs[NL80211_ATTR_SSID])
10847 		return -EINVAL;
10848 
10849 	if (!rdev->ops->assoc)
10850 		return -EOPNOTSUPP;
10851 
10852 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10853 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10854 		return -EOPNOTSUPP;
10855 
10856 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10857 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10858 
10859 	if (info->attrs[NL80211_ATTR_IE]) {
10860 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10861 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10862 
10863 		if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10864 					   req.ie, req.ie_len)) {
10865 			GENL_SET_ERR_MSG(info,
10866 					 "non-inheritance makes no sense");
10867 			return -EINVAL;
10868 		}
10869 	}
10870 
10871 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
10872 		enum nl80211_mfp mfp =
10873 			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10874 		if (mfp == NL80211_MFP_REQUIRED)
10875 			req.use_mfp = true;
10876 		else if (mfp != NL80211_MFP_NO)
10877 			return -EINVAL;
10878 	}
10879 
10880 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
10881 		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10882 
10883 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10884 		req.flags |= ASSOC_REQ_DISABLE_HT;
10885 
10886 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10887 		memcpy(&req.ht_capa_mask,
10888 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10889 		       sizeof(req.ht_capa_mask));
10890 
10891 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10892 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10893 			return -EINVAL;
10894 		memcpy(&req.ht_capa,
10895 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10896 		       sizeof(req.ht_capa));
10897 	}
10898 
10899 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10900 		req.flags |= ASSOC_REQ_DISABLE_VHT;
10901 
10902 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10903 		req.flags |= ASSOC_REQ_DISABLE_HE;
10904 
10905 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
10906 		req.flags |= ASSOC_REQ_DISABLE_EHT;
10907 
10908 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10909 		memcpy(&req.vht_capa_mask,
10910 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10911 		       sizeof(req.vht_capa_mask));
10912 
10913 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10914 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10915 			return -EINVAL;
10916 		memcpy(&req.vht_capa,
10917 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10918 		       sizeof(req.vht_capa));
10919 	}
10920 
10921 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10922 		if (!((rdev->wiphy.features &
10923 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10924 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10925 		    !wiphy_ext_feature_isset(&rdev->wiphy,
10926 					     NL80211_EXT_FEATURE_RRM))
10927 			return -EINVAL;
10928 		req.flags |= ASSOC_REQ_USE_RRM;
10929 	}
10930 
10931 	if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10932 		req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10933 		req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10934 		if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10935 			return -EINVAL;
10936 		req.fils_nonces =
10937 			nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10938 	}
10939 
10940 	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10941 		if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10942 			return -EINVAL;
10943 		memcpy(&req.s1g_capa_mask,
10944 		       nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10945 		       sizeof(req.s1g_capa_mask));
10946 	}
10947 
10948 	if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10949 		if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10950 			return -EINVAL;
10951 		memcpy(&req.s1g_capa,
10952 		       nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10953 		       sizeof(req.s1g_capa));
10954 	}
10955 
10956 	req.link_id = nl80211_link_id_or_invalid(info->attrs);
10957 
10958 	if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
10959 		unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
10960 		struct nlattr *link;
10961 		int rem = 0;
10962 
10963 		if (req.link_id < 0)
10964 			return -EINVAL;
10965 
10966 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10967 			return -EINVAL;
10968 
10969 		if (info->attrs[NL80211_ATTR_MAC] ||
10970 		    info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10971 		    !info->attrs[NL80211_ATTR_MLD_ADDR])
10972 			return -EINVAL;
10973 
10974 		req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10975 		ap_addr = req.ap_mld_addr;
10976 
10977 		attrs = kzalloc(attrsize, GFP_KERNEL);
10978 		if (!attrs)
10979 			return -ENOMEM;
10980 
10981 		nla_for_each_nested(link,
10982 				    info->attrs[NL80211_ATTR_MLO_LINKS],
10983 				    rem) {
10984 			memset(attrs, 0, attrsize);
10985 
10986 			nla_parse_nested(attrs, NL80211_ATTR_MAX,
10987 					 link, NULL, NULL);
10988 
10989 			if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
10990 				err = -EINVAL;
10991 				goto free;
10992 			}
10993 
10994 			link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
10995 			/* cannot use the same link ID again */
10996 			if (req.links[link_id].bss) {
10997 				err = -EINVAL;
10998 				goto free;
10999 			}
11000 			req.links[link_id].bss =
11001 				nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11002 			if (IS_ERR(req.links[link_id].bss)) {
11003 				err = PTR_ERR(req.links[link_id].bss);
11004 				req.links[link_id].bss = NULL;
11005 				goto free;
11006 			}
11007 
11008 			if (attrs[NL80211_ATTR_IE]) {
11009 				req.links[link_id].elems =
11010 					nla_data(attrs[NL80211_ATTR_IE]);
11011 				req.links[link_id].elems_len =
11012 					nla_len(attrs[NL80211_ATTR_IE]);
11013 
11014 				if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11015 						       req.links[link_id].elems,
11016 						       req.links[link_id].elems_len)) {
11017 					GENL_SET_ERR_MSG(info,
11018 							 "cannot deal with fragmentation");
11019 					err = -EINVAL;
11020 					goto free;
11021 				}
11022 
11023 				if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11024 							   req.links[link_id].elems,
11025 							   req.links[link_id].elems_len)) {
11026 					GENL_SET_ERR_MSG(info,
11027 							 "cannot deal with non-inheritance");
11028 					err = -EINVAL;
11029 					goto free;
11030 				}
11031 			}
11032 		}
11033 
11034 		if (!req.links[req.link_id].bss) {
11035 			err = -EINVAL;
11036 			goto free;
11037 		}
11038 
11039 		if (req.links[req.link_id].elems_len) {
11040 			GENL_SET_ERR_MSG(info,
11041 					 "cannot have per-link elems on assoc link");
11042 			err = -EINVAL;
11043 			goto free;
11044 		}
11045 
11046 		kfree(attrs);
11047 		attrs = NULL;
11048 	} else {
11049 		if (req.link_id >= 0)
11050 			return -EINVAL;
11051 
11052 		req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11053 		if (IS_ERR(req.bss))
11054 			return PTR_ERR(req.bss);
11055 		ap_addr = req.bss->bssid;
11056 	}
11057 
11058 	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11059 	if (!err) {
11060 		wdev_lock(dev->ieee80211_ptr);
11061 
11062 		err = cfg80211_mlme_assoc(rdev, dev, &req);
11063 
11064 		if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11065 			dev->ieee80211_ptr->conn_owner_nlportid =
11066 				info->snd_portid;
11067 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
11068 			       ap_addr, ETH_ALEN);
11069 		}
11070 
11071 		wdev_unlock(dev->ieee80211_ptr);
11072 	}
11073 
11074 free:
11075 	for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11076 		cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11077 	cfg80211_put_bss(&rdev->wiphy, req.bss);
11078 	kfree(attrs);
11079 
11080 	return err;
11081 }
11082 
11083 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11084 {
11085 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11086 	struct net_device *dev = info->user_ptr[1];
11087 	const u8 *ie = NULL, *bssid;
11088 	int ie_len = 0, err;
11089 	u16 reason_code;
11090 	bool local_state_change;
11091 
11092 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
11093 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11094 		return -EPERM;
11095 
11096 	if (!info->attrs[NL80211_ATTR_MAC])
11097 		return -EINVAL;
11098 
11099 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
11100 		return -EINVAL;
11101 
11102 	if (!rdev->ops->deauth)
11103 		return -EOPNOTSUPP;
11104 
11105 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11106 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11107 		return -EOPNOTSUPP;
11108 
11109 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11110 
11111 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11112 	if (reason_code == 0) {
11113 		/* Reason Code 0 is reserved */
11114 		return -EINVAL;
11115 	}
11116 
11117 	if (info->attrs[NL80211_ATTR_IE]) {
11118 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11119 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11120 	}
11121 
11122 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11123 
11124 	wdev_lock(dev->ieee80211_ptr);
11125 	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11126 				   local_state_change);
11127 	wdev_unlock(dev->ieee80211_ptr);
11128 	return err;
11129 }
11130 
11131 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11132 {
11133 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11134 	struct net_device *dev = info->user_ptr[1];
11135 	const u8 *ie = NULL, *bssid;
11136 	int ie_len = 0, err;
11137 	u16 reason_code;
11138 	bool local_state_change;
11139 
11140 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
11141 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11142 		return -EPERM;
11143 
11144 	if (!info->attrs[NL80211_ATTR_MAC])
11145 		return -EINVAL;
11146 
11147 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
11148 		return -EINVAL;
11149 
11150 	if (!rdev->ops->disassoc)
11151 		return -EOPNOTSUPP;
11152 
11153 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11154 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11155 		return -EOPNOTSUPP;
11156 
11157 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11158 
11159 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11160 	if (reason_code == 0) {
11161 		/* Reason Code 0 is reserved */
11162 		return -EINVAL;
11163 	}
11164 
11165 	if (info->attrs[NL80211_ATTR_IE]) {
11166 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11167 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11168 	}
11169 
11170 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11171 
11172 	wdev_lock(dev->ieee80211_ptr);
11173 	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11174 				     local_state_change);
11175 	wdev_unlock(dev->ieee80211_ptr);
11176 	return err;
11177 }
11178 
11179 static bool
11180 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11181 			 int mcast_rate[NUM_NL80211_BANDS],
11182 			 int rateval)
11183 {
11184 	struct wiphy *wiphy = &rdev->wiphy;
11185 	bool found = false;
11186 	int band, i;
11187 
11188 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
11189 		struct ieee80211_supported_band *sband;
11190 
11191 		sband = wiphy->bands[band];
11192 		if (!sband)
11193 			continue;
11194 
11195 		for (i = 0; i < sband->n_bitrates; i++) {
11196 			if (sband->bitrates[i].bitrate == rateval) {
11197 				mcast_rate[band] = i + 1;
11198 				found = true;
11199 				break;
11200 			}
11201 		}
11202 	}
11203 
11204 	return found;
11205 }
11206 
11207 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11208 {
11209 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11210 	struct net_device *dev = info->user_ptr[1];
11211 	struct cfg80211_ibss_params ibss;
11212 	struct wiphy *wiphy;
11213 	struct cfg80211_cached_keys *connkeys = NULL;
11214 	int err;
11215 
11216 	memset(&ibss, 0, sizeof(ibss));
11217 
11218 	if (!info->attrs[NL80211_ATTR_SSID] ||
11219 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
11220 		return -EINVAL;
11221 
11222 	ibss.beacon_interval = 100;
11223 
11224 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11225 		ibss.beacon_interval =
11226 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11227 
11228 	err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11229 					   ibss.beacon_interval);
11230 	if (err)
11231 		return err;
11232 
11233 	if (!rdev->ops->join_ibss)
11234 		return -EOPNOTSUPP;
11235 
11236 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11237 		return -EOPNOTSUPP;
11238 
11239 	wiphy = &rdev->wiphy;
11240 
11241 	if (info->attrs[NL80211_ATTR_MAC]) {
11242 		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11243 
11244 		if (!is_valid_ether_addr(ibss.bssid))
11245 			return -EINVAL;
11246 	}
11247 	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11248 	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11249 
11250 	if (info->attrs[NL80211_ATTR_IE]) {
11251 		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11252 		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11253 	}
11254 
11255 	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11256 	if (err)
11257 		return err;
11258 
11259 	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11260 				     NL80211_IFTYPE_ADHOC))
11261 		return -EINVAL;
11262 
11263 	switch (ibss.chandef.width) {
11264 	case NL80211_CHAN_WIDTH_5:
11265 	case NL80211_CHAN_WIDTH_10:
11266 	case NL80211_CHAN_WIDTH_20_NOHT:
11267 		break;
11268 	case NL80211_CHAN_WIDTH_20:
11269 	case NL80211_CHAN_WIDTH_40:
11270 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11271 			return -EINVAL;
11272 		break;
11273 	case NL80211_CHAN_WIDTH_80:
11274 	case NL80211_CHAN_WIDTH_80P80:
11275 	case NL80211_CHAN_WIDTH_160:
11276 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11277 			return -EINVAL;
11278 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
11279 					     NL80211_EXT_FEATURE_VHT_IBSS))
11280 			return -EINVAL;
11281 		break;
11282 	case NL80211_CHAN_WIDTH_320:
11283 		return -EINVAL;
11284 	default:
11285 		return -EINVAL;
11286 	}
11287 
11288 	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11289 	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11290 
11291 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11292 		u8 *rates =
11293 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11294 		int n_rates =
11295 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11296 		struct ieee80211_supported_band *sband =
11297 			wiphy->bands[ibss.chandef.chan->band];
11298 
11299 		err = ieee80211_get_ratemask(sband, rates, n_rates,
11300 					     &ibss.basic_rates);
11301 		if (err)
11302 			return err;
11303 	}
11304 
11305 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11306 		memcpy(&ibss.ht_capa_mask,
11307 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11308 		       sizeof(ibss.ht_capa_mask));
11309 
11310 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11311 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11312 			return -EINVAL;
11313 		memcpy(&ibss.ht_capa,
11314 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11315 		       sizeof(ibss.ht_capa));
11316 	}
11317 
11318 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11319 	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11320 			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11321 		return -EINVAL;
11322 
11323 	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11324 		bool no_ht = false;
11325 
11326 		connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11327 		if (IS_ERR(connkeys))
11328 			return PTR_ERR(connkeys);
11329 
11330 		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11331 		    no_ht) {
11332 			kfree_sensitive(connkeys);
11333 			return -EINVAL;
11334 		}
11335 	}
11336 
11337 	ibss.control_port =
11338 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11339 
11340 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11341 		int r = validate_pae_over_nl80211(rdev, info);
11342 
11343 		if (r < 0) {
11344 			kfree_sensitive(connkeys);
11345 			return r;
11346 		}
11347 
11348 		ibss.control_port_over_nl80211 = true;
11349 	}
11350 
11351 	ibss.userspace_handles_dfs =
11352 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11353 
11354 	wdev_lock(dev->ieee80211_ptr);
11355 	err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11356 	if (err)
11357 		kfree_sensitive(connkeys);
11358 	else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11359 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11360 	wdev_unlock(dev->ieee80211_ptr);
11361 
11362 	return err;
11363 }
11364 
11365 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11366 {
11367 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11368 	struct net_device *dev = info->user_ptr[1];
11369 
11370 	if (!rdev->ops->leave_ibss)
11371 		return -EOPNOTSUPP;
11372 
11373 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11374 		return -EOPNOTSUPP;
11375 
11376 	return cfg80211_leave_ibss(rdev, dev, false);
11377 }
11378 
11379 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11380 {
11381 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11382 	struct net_device *dev = info->user_ptr[1];
11383 	int mcast_rate[NUM_NL80211_BANDS];
11384 	u32 nla_rate;
11385 
11386 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11387 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11388 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11389 		return -EOPNOTSUPP;
11390 
11391 	if (!rdev->ops->set_mcast_rate)
11392 		return -EOPNOTSUPP;
11393 
11394 	memset(mcast_rate, 0, sizeof(mcast_rate));
11395 
11396 	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11397 		return -EINVAL;
11398 
11399 	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11400 	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11401 		return -EINVAL;
11402 
11403 	return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11404 }
11405 
11406 static struct sk_buff *
11407 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11408 			    struct wireless_dev *wdev, int approxlen,
11409 			    u32 portid, u32 seq, enum nl80211_commands cmd,
11410 			    enum nl80211_attrs attr,
11411 			    const struct nl80211_vendor_cmd_info *info,
11412 			    gfp_t gfp)
11413 {
11414 	struct sk_buff *skb;
11415 	void *hdr;
11416 	struct nlattr *data;
11417 
11418 	skb = nlmsg_new(approxlen + 100, gfp);
11419 	if (!skb)
11420 		return NULL;
11421 
11422 	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11423 	if (!hdr) {
11424 		kfree_skb(skb);
11425 		return NULL;
11426 	}
11427 
11428 	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11429 		goto nla_put_failure;
11430 
11431 	if (info) {
11432 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11433 				info->vendor_id))
11434 			goto nla_put_failure;
11435 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11436 				info->subcmd))
11437 			goto nla_put_failure;
11438 	}
11439 
11440 	if (wdev) {
11441 		if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11442 				      wdev_id(wdev), NL80211_ATTR_PAD))
11443 			goto nla_put_failure;
11444 		if (wdev->netdev &&
11445 		    nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11446 				wdev->netdev->ifindex))
11447 			goto nla_put_failure;
11448 	}
11449 
11450 	data = nla_nest_start_noflag(skb, attr);
11451 	if (!data)
11452 		goto nla_put_failure;
11453 
11454 	((void **)skb->cb)[0] = rdev;
11455 	((void **)skb->cb)[1] = hdr;
11456 	((void **)skb->cb)[2] = data;
11457 
11458 	return skb;
11459 
11460  nla_put_failure:
11461 	kfree_skb(skb);
11462 	return NULL;
11463 }
11464 
11465 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11466 					   struct wireless_dev *wdev,
11467 					   enum nl80211_commands cmd,
11468 					   enum nl80211_attrs attr,
11469 					   unsigned int portid,
11470 					   int vendor_event_idx,
11471 					   int approxlen, gfp_t gfp)
11472 {
11473 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11474 	const struct nl80211_vendor_cmd_info *info;
11475 
11476 	switch (cmd) {
11477 	case NL80211_CMD_TESTMODE:
11478 		if (WARN_ON(vendor_event_idx != -1))
11479 			return NULL;
11480 		info = NULL;
11481 		break;
11482 	case NL80211_CMD_VENDOR:
11483 		if (WARN_ON(vendor_event_idx < 0 ||
11484 			    vendor_event_idx >= wiphy->n_vendor_events))
11485 			return NULL;
11486 		info = &wiphy->vendor_events[vendor_event_idx];
11487 		break;
11488 	default:
11489 		WARN_ON(1);
11490 		return NULL;
11491 	}
11492 
11493 	return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11494 					   cmd, attr, info, gfp);
11495 }
11496 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11497 
11498 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11499 {
11500 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11501 	void *hdr = ((void **)skb->cb)[1];
11502 	struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11503 	struct nlattr *data = ((void **)skb->cb)[2];
11504 	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11505 
11506 	/* clear CB data for netlink core to own from now on */
11507 	memset(skb->cb, 0, sizeof(skb->cb));
11508 
11509 	nla_nest_end(skb, data);
11510 	genlmsg_end(skb, hdr);
11511 
11512 	if (nlhdr->nlmsg_pid) {
11513 		genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11514 				nlhdr->nlmsg_pid);
11515 	} else {
11516 		if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11517 			mcgrp = NL80211_MCGRP_VENDOR;
11518 
11519 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11520 					skb, 0, mcgrp, gfp);
11521 	}
11522 }
11523 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11524 
11525 #ifdef CONFIG_NL80211_TESTMODE
11526 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11527 {
11528 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11529 	struct wireless_dev *wdev;
11530 	int err;
11531 
11532 	lockdep_assert_held(&rdev->wiphy.mtx);
11533 
11534 	wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11535 					  info->attrs);
11536 
11537 	if (!rdev->ops->testmode_cmd)
11538 		return -EOPNOTSUPP;
11539 
11540 	if (IS_ERR(wdev)) {
11541 		err = PTR_ERR(wdev);
11542 		if (err != -EINVAL)
11543 			return err;
11544 		wdev = NULL;
11545 	} else if (wdev->wiphy != &rdev->wiphy) {
11546 		return -EINVAL;
11547 	}
11548 
11549 	if (!info->attrs[NL80211_ATTR_TESTDATA])
11550 		return -EINVAL;
11551 
11552 	rdev->cur_cmd_info = info;
11553 	err = rdev_testmode_cmd(rdev, wdev,
11554 				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11555 				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11556 	rdev->cur_cmd_info = NULL;
11557 
11558 	return err;
11559 }
11560 
11561 static int nl80211_testmode_dump(struct sk_buff *skb,
11562 				 struct netlink_callback *cb)
11563 {
11564 	struct cfg80211_registered_device *rdev;
11565 	struct nlattr **attrbuf = NULL;
11566 	int err;
11567 	long phy_idx;
11568 	void *data = NULL;
11569 	int data_len = 0;
11570 
11571 	rtnl_lock();
11572 
11573 	if (cb->args[0]) {
11574 		/*
11575 		 * 0 is a valid index, but not valid for args[0],
11576 		 * so we need to offset by 1.
11577 		 */
11578 		phy_idx = cb->args[0] - 1;
11579 
11580 		rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11581 		if (!rdev) {
11582 			err = -ENOENT;
11583 			goto out_err;
11584 		}
11585 	} else {
11586 		attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11587 				  GFP_KERNEL);
11588 		if (!attrbuf) {
11589 			err = -ENOMEM;
11590 			goto out_err;
11591 		}
11592 
11593 		err = nlmsg_parse_deprecated(cb->nlh,
11594 					     GENL_HDRLEN + nl80211_fam.hdrsize,
11595 					     attrbuf, nl80211_fam.maxattr,
11596 					     nl80211_policy, NULL);
11597 		if (err)
11598 			goto out_err;
11599 
11600 		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11601 		if (IS_ERR(rdev)) {
11602 			err = PTR_ERR(rdev);
11603 			goto out_err;
11604 		}
11605 		phy_idx = rdev->wiphy_idx;
11606 
11607 		if (attrbuf[NL80211_ATTR_TESTDATA])
11608 			cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11609 	}
11610 
11611 	if (cb->args[1]) {
11612 		data = nla_data((void *)cb->args[1]);
11613 		data_len = nla_len((void *)cb->args[1]);
11614 	}
11615 
11616 	if (!rdev->ops->testmode_dump) {
11617 		err = -EOPNOTSUPP;
11618 		goto out_err;
11619 	}
11620 
11621 	while (1) {
11622 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11623 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
11624 					   NL80211_CMD_TESTMODE);
11625 		struct nlattr *tmdata;
11626 
11627 		if (!hdr)
11628 			break;
11629 
11630 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11631 			genlmsg_cancel(skb, hdr);
11632 			break;
11633 		}
11634 
11635 		tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11636 		if (!tmdata) {
11637 			genlmsg_cancel(skb, hdr);
11638 			break;
11639 		}
11640 		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11641 		nla_nest_end(skb, tmdata);
11642 
11643 		if (err == -ENOBUFS || err == -ENOENT) {
11644 			genlmsg_cancel(skb, hdr);
11645 			break;
11646 		} else if (err) {
11647 			genlmsg_cancel(skb, hdr);
11648 			goto out_err;
11649 		}
11650 
11651 		genlmsg_end(skb, hdr);
11652 	}
11653 
11654 	err = skb->len;
11655 	/* see above */
11656 	cb->args[0] = phy_idx + 1;
11657  out_err:
11658 	kfree(attrbuf);
11659 	rtnl_unlock();
11660 	return err;
11661 }
11662 #endif
11663 
11664 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11665 {
11666 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11667 	struct net_device *dev = info->user_ptr[1];
11668 	struct cfg80211_connect_params connect;
11669 	struct wiphy *wiphy;
11670 	struct cfg80211_cached_keys *connkeys = NULL;
11671 	u32 freq = 0;
11672 	int err;
11673 
11674 	memset(&connect, 0, sizeof(connect));
11675 
11676 	if (!info->attrs[NL80211_ATTR_SSID] ||
11677 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
11678 		return -EINVAL;
11679 
11680 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11681 		connect.auth_type =
11682 			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11683 		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11684 					     NL80211_CMD_CONNECT))
11685 			return -EINVAL;
11686 	} else
11687 		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11688 
11689 	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11690 
11691 	if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11692 	    !wiphy_ext_feature_isset(&rdev->wiphy,
11693 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11694 		return -EINVAL;
11695 	connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11696 
11697 	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11698 				      NL80211_MAX_NR_CIPHER_SUITES);
11699 	if (err)
11700 		return err;
11701 
11702 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11703 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11704 		return -EOPNOTSUPP;
11705 
11706 	wiphy = &rdev->wiphy;
11707 
11708 	connect.bg_scan_period = -1;
11709 	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11710 		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11711 		connect.bg_scan_period =
11712 			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11713 	}
11714 
11715 	if (info->attrs[NL80211_ATTR_MAC])
11716 		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11717 	else if (info->attrs[NL80211_ATTR_MAC_HINT])
11718 		connect.bssid_hint =
11719 			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11720 	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11721 	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11722 
11723 	if (info->attrs[NL80211_ATTR_IE]) {
11724 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11725 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11726 	}
11727 
11728 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
11729 		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11730 		if (connect.mfp == NL80211_MFP_OPTIONAL &&
11731 		    !wiphy_ext_feature_isset(&rdev->wiphy,
11732 					     NL80211_EXT_FEATURE_MFP_OPTIONAL))
11733 			return -EOPNOTSUPP;
11734 	} else {
11735 		connect.mfp = NL80211_MFP_NO;
11736 	}
11737 
11738 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
11739 		connect.prev_bssid =
11740 			nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11741 
11742 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11743 		freq = MHZ_TO_KHZ(nla_get_u32(
11744 					info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11745 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11746 		freq +=
11747 		    nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11748 
11749 	if (freq) {
11750 		connect.channel = nl80211_get_valid_chan(wiphy, freq);
11751 		if (!connect.channel)
11752 			return -EINVAL;
11753 	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11754 		freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11755 		freq = MHZ_TO_KHZ(freq);
11756 		connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11757 		if (!connect.channel_hint)
11758 			return -EINVAL;
11759 	}
11760 
11761 	if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11762 		connect.edmg.channels =
11763 		      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11764 
11765 		if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11766 			connect.edmg.bw_config =
11767 				nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11768 	}
11769 
11770 	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11771 		connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11772 		if (IS_ERR(connkeys))
11773 			return PTR_ERR(connkeys);
11774 	}
11775 
11776 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11777 		connect.flags |= ASSOC_REQ_DISABLE_HT;
11778 
11779 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11780 		memcpy(&connect.ht_capa_mask,
11781 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11782 		       sizeof(connect.ht_capa_mask));
11783 
11784 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11785 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11786 			kfree_sensitive(connkeys);
11787 			return -EINVAL;
11788 		}
11789 		memcpy(&connect.ht_capa,
11790 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11791 		       sizeof(connect.ht_capa));
11792 	}
11793 
11794 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11795 		connect.flags |= ASSOC_REQ_DISABLE_VHT;
11796 
11797 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11798 		connect.flags |= ASSOC_REQ_DISABLE_HE;
11799 
11800 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11801 		connect.flags |= ASSOC_REQ_DISABLE_EHT;
11802 
11803 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11804 		memcpy(&connect.vht_capa_mask,
11805 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11806 		       sizeof(connect.vht_capa_mask));
11807 
11808 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11809 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11810 			kfree_sensitive(connkeys);
11811 			return -EINVAL;
11812 		}
11813 		memcpy(&connect.vht_capa,
11814 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11815 		       sizeof(connect.vht_capa));
11816 	}
11817 
11818 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11819 		if (!((rdev->wiphy.features &
11820 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11821 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11822 		    !wiphy_ext_feature_isset(&rdev->wiphy,
11823 					     NL80211_EXT_FEATURE_RRM)) {
11824 			kfree_sensitive(connkeys);
11825 			return -EINVAL;
11826 		}
11827 		connect.flags |= ASSOC_REQ_USE_RRM;
11828 	}
11829 
11830 	connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11831 	if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11832 		kfree_sensitive(connkeys);
11833 		return -EOPNOTSUPP;
11834 	}
11835 
11836 	if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11837 		/* bss selection makes no sense if bssid is set */
11838 		if (connect.bssid) {
11839 			kfree_sensitive(connkeys);
11840 			return -EINVAL;
11841 		}
11842 
11843 		err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11844 				       wiphy, &connect.bss_select);
11845 		if (err) {
11846 			kfree_sensitive(connkeys);
11847 			return err;
11848 		}
11849 	}
11850 
11851 	if (wiphy_ext_feature_isset(&rdev->wiphy,
11852 				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11853 	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11854 	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11855 	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11856 	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11857 		connect.fils_erp_username =
11858 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11859 		connect.fils_erp_username_len =
11860 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11861 		connect.fils_erp_realm =
11862 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11863 		connect.fils_erp_realm_len =
11864 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11865 		connect.fils_erp_next_seq_num =
11866 			nla_get_u16(
11867 			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11868 		connect.fils_erp_rrk =
11869 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11870 		connect.fils_erp_rrk_len =
11871 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11872 	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11873 		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11874 		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11875 		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11876 		kfree_sensitive(connkeys);
11877 		return -EINVAL;
11878 	}
11879 
11880 	if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
11881 		if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11882 			kfree_sensitive(connkeys);
11883 			GENL_SET_ERR_MSG(info,
11884 					 "external auth requires connection ownership");
11885 			return -EINVAL;
11886 		}
11887 		connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
11888 	}
11889 
11890 	if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
11891 		connect.flags |= CONNECT_REQ_MLO_SUPPORT;
11892 
11893 	wdev_lock(dev->ieee80211_ptr);
11894 
11895 	err = cfg80211_connect(rdev, dev, &connect, connkeys,
11896 			       connect.prev_bssid);
11897 	if (err)
11898 		kfree_sensitive(connkeys);
11899 
11900 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11901 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11902 		if (connect.bssid)
11903 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
11904 			       connect.bssid, ETH_ALEN);
11905 		else
11906 			eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
11907 	}
11908 
11909 	wdev_unlock(dev->ieee80211_ptr);
11910 
11911 	return err;
11912 }
11913 
11914 static int nl80211_update_connect_params(struct sk_buff *skb,
11915 					 struct genl_info *info)
11916 {
11917 	struct cfg80211_connect_params connect = {};
11918 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11919 	struct net_device *dev = info->user_ptr[1];
11920 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11921 	bool fils_sk_offload;
11922 	u32 auth_type;
11923 	u32 changed = 0;
11924 	int ret;
11925 
11926 	if (!rdev->ops->update_connect_params)
11927 		return -EOPNOTSUPP;
11928 
11929 	if (info->attrs[NL80211_ATTR_IE]) {
11930 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11931 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11932 		changed |= UPDATE_ASSOC_IES;
11933 	}
11934 
11935 	fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
11936 						  NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
11937 
11938 	/*
11939 	 * when driver supports fils-sk offload all attributes must be
11940 	 * provided. So the else covers "fils-sk-not-all" and
11941 	 * "no-fils-sk-any".
11942 	 */
11943 	if (fils_sk_offload &&
11944 	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11945 	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11946 	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11947 	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11948 		connect.fils_erp_username =
11949 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11950 		connect.fils_erp_username_len =
11951 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11952 		connect.fils_erp_realm =
11953 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11954 		connect.fils_erp_realm_len =
11955 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11956 		connect.fils_erp_next_seq_num =
11957 			nla_get_u16(
11958 			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11959 		connect.fils_erp_rrk =
11960 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11961 		connect.fils_erp_rrk_len =
11962 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11963 		changed |= UPDATE_FILS_ERP_INFO;
11964 	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11965 		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11966 		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11967 		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11968 		return -EINVAL;
11969 	}
11970 
11971 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11972 		auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11973 		if (!nl80211_valid_auth_type(rdev, auth_type,
11974 					     NL80211_CMD_CONNECT))
11975 			return -EINVAL;
11976 
11977 		if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
11978 		    fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
11979 			return -EINVAL;
11980 
11981 		connect.auth_type = auth_type;
11982 		changed |= UPDATE_AUTH_TYPE;
11983 	}
11984 
11985 	wdev_lock(dev->ieee80211_ptr);
11986 	if (!wdev->connected)
11987 		ret = -ENOLINK;
11988 	else
11989 		ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11990 	wdev_unlock(dev->ieee80211_ptr);
11991 
11992 	return ret;
11993 }
11994 
11995 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11996 {
11997 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11998 	struct net_device *dev = info->user_ptr[1];
11999 	u16 reason;
12000 	int ret;
12001 
12002 	if (dev->ieee80211_ptr->conn_owner_nlportid &&
12003 	    dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12004 		return -EPERM;
12005 
12006 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
12007 		reason = WLAN_REASON_DEAUTH_LEAVING;
12008 	else
12009 		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12010 
12011 	if (reason == 0)
12012 		return -EINVAL;
12013 
12014 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12015 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12016 		return -EOPNOTSUPP;
12017 
12018 	wdev_lock(dev->ieee80211_ptr);
12019 	ret = cfg80211_disconnect(rdev, dev, reason, true);
12020 	wdev_unlock(dev->ieee80211_ptr);
12021 	return ret;
12022 }
12023 
12024 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12025 {
12026 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12027 	struct net *net;
12028 	int err;
12029 
12030 	if (info->attrs[NL80211_ATTR_PID]) {
12031 		u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12032 
12033 		net = get_net_ns_by_pid(pid);
12034 	} else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12035 		u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12036 
12037 		net = get_net_ns_by_fd(fd);
12038 	} else {
12039 		return -EINVAL;
12040 	}
12041 
12042 	if (IS_ERR(net))
12043 		return PTR_ERR(net);
12044 
12045 	err = 0;
12046 
12047 	/* check if anything to do */
12048 	if (!net_eq(wiphy_net(&rdev->wiphy), net))
12049 		err = cfg80211_switch_netns(rdev, net);
12050 
12051 	put_net(net);
12052 	return err;
12053 }
12054 
12055 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12056 {
12057 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12058 	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12059 			struct cfg80211_pmksa *pmksa) = NULL;
12060 	struct net_device *dev = info->user_ptr[1];
12061 	struct cfg80211_pmksa pmksa;
12062 
12063 	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12064 
12065 	if (!info->attrs[NL80211_ATTR_PMKID])
12066 		return -EINVAL;
12067 
12068 	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12069 
12070 	if (info->attrs[NL80211_ATTR_MAC]) {
12071 		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12072 	} else if (info->attrs[NL80211_ATTR_SSID] &&
12073 		   info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12074 		   (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12075 		    info->attrs[NL80211_ATTR_PMK])) {
12076 		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12077 		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12078 		pmksa.cache_id =
12079 			nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12080 	} else {
12081 		return -EINVAL;
12082 	}
12083 	if (info->attrs[NL80211_ATTR_PMK]) {
12084 		pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12085 		pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12086 	}
12087 
12088 	if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12089 		pmksa.pmk_lifetime =
12090 			nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12091 
12092 	if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12093 		pmksa.pmk_reauth_threshold =
12094 			nla_get_u8(
12095 				info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12096 
12097 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12098 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12099 	    !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12100 	      wiphy_ext_feature_isset(&rdev->wiphy,
12101 				      NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12102 		return -EOPNOTSUPP;
12103 
12104 	switch (info->genlhdr->cmd) {
12105 	case NL80211_CMD_SET_PMKSA:
12106 		rdev_ops = rdev->ops->set_pmksa;
12107 		break;
12108 	case NL80211_CMD_DEL_PMKSA:
12109 		rdev_ops = rdev->ops->del_pmksa;
12110 		break;
12111 	default:
12112 		WARN_ON(1);
12113 		break;
12114 	}
12115 
12116 	if (!rdev_ops)
12117 		return -EOPNOTSUPP;
12118 
12119 	return rdev_ops(&rdev->wiphy, dev, &pmksa);
12120 }
12121 
12122 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12123 {
12124 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12125 	struct net_device *dev = info->user_ptr[1];
12126 
12127 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12128 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12129 		return -EOPNOTSUPP;
12130 
12131 	if (!rdev->ops->flush_pmksa)
12132 		return -EOPNOTSUPP;
12133 
12134 	return rdev_flush_pmksa(rdev, dev);
12135 }
12136 
12137 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12138 {
12139 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12140 	struct net_device *dev = info->user_ptr[1];
12141 	u8 action_code, dialog_token;
12142 	u32 peer_capability = 0;
12143 	u16 status_code;
12144 	u8 *peer;
12145 	bool initiator;
12146 
12147 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12148 	    !rdev->ops->tdls_mgmt)
12149 		return -EOPNOTSUPP;
12150 
12151 	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12152 	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12153 	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12154 	    !info->attrs[NL80211_ATTR_IE] ||
12155 	    !info->attrs[NL80211_ATTR_MAC])
12156 		return -EINVAL;
12157 
12158 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12159 	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12160 	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12161 	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12162 	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12163 	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12164 		peer_capability =
12165 			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12166 
12167 	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
12168 			      dialog_token, status_code, peer_capability,
12169 			      initiator,
12170 			      nla_data(info->attrs[NL80211_ATTR_IE]),
12171 			      nla_len(info->attrs[NL80211_ATTR_IE]));
12172 }
12173 
12174 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12175 {
12176 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12177 	struct net_device *dev = info->user_ptr[1];
12178 	enum nl80211_tdls_operation operation;
12179 	u8 *peer;
12180 
12181 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12182 	    !rdev->ops->tdls_oper)
12183 		return -EOPNOTSUPP;
12184 
12185 	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12186 	    !info->attrs[NL80211_ATTR_MAC])
12187 		return -EINVAL;
12188 
12189 	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12190 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12191 
12192 	return rdev_tdls_oper(rdev, dev, peer, operation);
12193 }
12194 
12195 static int nl80211_remain_on_channel(struct sk_buff *skb,
12196 				     struct genl_info *info)
12197 {
12198 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12199 	unsigned int link_id = nl80211_link_id(info->attrs);
12200 	struct wireless_dev *wdev = info->user_ptr[1];
12201 	struct cfg80211_chan_def chandef;
12202 	struct sk_buff *msg;
12203 	void *hdr;
12204 	u64 cookie;
12205 	u32 duration;
12206 	int err;
12207 
12208 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12209 	    !info->attrs[NL80211_ATTR_DURATION])
12210 		return -EINVAL;
12211 
12212 	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12213 
12214 	if (!rdev->ops->remain_on_channel ||
12215 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12216 		return -EOPNOTSUPP;
12217 
12218 	/*
12219 	 * We should be on that channel for at least a minimum amount of
12220 	 * time (10ms) but no longer than the driver supports.
12221 	 */
12222 	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12223 	    duration > rdev->wiphy.max_remain_on_channel_duration)
12224 		return -EINVAL;
12225 
12226 	err = nl80211_parse_chandef(rdev, info, &chandef);
12227 	if (err)
12228 		return err;
12229 
12230 	wdev_lock(wdev);
12231 	if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12232 		const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12233 
12234 		oper_chandef = wdev_chandef(wdev, link_id);
12235 
12236 		if (WARN_ON(!oper_chandef)) {
12237 			/* cannot happen since we must beacon to get here */
12238 			WARN_ON(1);
12239 			wdev_unlock(wdev);
12240 			return -EBUSY;
12241 		}
12242 
12243 		/* note: returns first one if identical chandefs */
12244 		compat_chandef = cfg80211_chandef_compatible(&chandef,
12245 							     oper_chandef);
12246 
12247 		if (compat_chandef != &chandef) {
12248 			wdev_unlock(wdev);
12249 			return -EBUSY;
12250 		}
12251 	}
12252 	wdev_unlock(wdev);
12253 
12254 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12255 	if (!msg)
12256 		return -ENOMEM;
12257 
12258 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12259 			     NL80211_CMD_REMAIN_ON_CHANNEL);
12260 	if (!hdr) {
12261 		err = -ENOBUFS;
12262 		goto free_msg;
12263 	}
12264 
12265 	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12266 				     duration, &cookie);
12267 
12268 	if (err)
12269 		goto free_msg;
12270 
12271 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12272 			      NL80211_ATTR_PAD))
12273 		goto nla_put_failure;
12274 
12275 	genlmsg_end(msg, hdr);
12276 
12277 	return genlmsg_reply(msg, info);
12278 
12279  nla_put_failure:
12280 	err = -ENOBUFS;
12281  free_msg:
12282 	nlmsg_free(msg);
12283 	return err;
12284 }
12285 
12286 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12287 					    struct genl_info *info)
12288 {
12289 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12290 	struct wireless_dev *wdev = info->user_ptr[1];
12291 	u64 cookie;
12292 
12293 	if (!info->attrs[NL80211_ATTR_COOKIE])
12294 		return -EINVAL;
12295 
12296 	if (!rdev->ops->cancel_remain_on_channel)
12297 		return -EOPNOTSUPP;
12298 
12299 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12300 
12301 	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12302 }
12303 
12304 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12305 				       struct genl_info *info)
12306 {
12307 	struct cfg80211_bitrate_mask mask;
12308 	unsigned int link_id = nl80211_link_id(info->attrs);
12309 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12310 	struct net_device *dev = info->user_ptr[1];
12311 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12312 	int err;
12313 
12314 	if (!rdev->ops->set_bitrate_mask)
12315 		return -EOPNOTSUPP;
12316 
12317 	wdev_lock(wdev);
12318 	err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12319 					    NL80211_ATTR_TX_RATES, &mask,
12320 					    dev, true, link_id);
12321 	if (err)
12322 		goto out;
12323 
12324 	err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12325 out:
12326 	wdev_unlock(wdev);
12327 	return err;
12328 }
12329 
12330 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12331 {
12332 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12333 	struct wireless_dev *wdev = info->user_ptr[1];
12334 	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12335 
12336 	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12337 		return -EINVAL;
12338 
12339 	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12340 		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12341 
12342 	switch (wdev->iftype) {
12343 	case NL80211_IFTYPE_STATION:
12344 	case NL80211_IFTYPE_ADHOC:
12345 	case NL80211_IFTYPE_P2P_CLIENT:
12346 	case NL80211_IFTYPE_AP:
12347 	case NL80211_IFTYPE_AP_VLAN:
12348 	case NL80211_IFTYPE_MESH_POINT:
12349 	case NL80211_IFTYPE_P2P_GO:
12350 	case NL80211_IFTYPE_P2P_DEVICE:
12351 		break;
12352 	case NL80211_IFTYPE_NAN:
12353 		if (!wiphy_ext_feature_isset(wdev->wiphy,
12354 					     NL80211_EXT_FEATURE_SECURE_NAN))
12355 			return -EOPNOTSUPP;
12356 		break;
12357 	default:
12358 		return -EOPNOTSUPP;
12359 	}
12360 
12361 	/* not much point in registering if we can't reply */
12362 	if (!rdev->ops->mgmt_tx)
12363 		return -EOPNOTSUPP;
12364 
12365 	if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12366 	    !wiphy_ext_feature_isset(&rdev->wiphy,
12367 				     NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12368 		GENL_SET_ERR_MSG(info,
12369 				 "multicast RX registrations are not supported");
12370 		return -EOPNOTSUPP;
12371 	}
12372 
12373 	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12374 					   nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12375 					   nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12376 					   info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12377 					   info->extack);
12378 }
12379 
12380 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12381 {
12382 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12383 	struct wireless_dev *wdev = info->user_ptr[1];
12384 	struct cfg80211_chan_def chandef;
12385 	int err;
12386 	void *hdr = NULL;
12387 	u64 cookie;
12388 	struct sk_buff *msg = NULL;
12389 	struct cfg80211_mgmt_tx_params params = {
12390 		.dont_wait_for_ack =
12391 			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12392 	};
12393 
12394 	if (!info->attrs[NL80211_ATTR_FRAME])
12395 		return -EINVAL;
12396 
12397 	if (!rdev->ops->mgmt_tx)
12398 		return -EOPNOTSUPP;
12399 
12400 	switch (wdev->iftype) {
12401 	case NL80211_IFTYPE_P2P_DEVICE:
12402 		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12403 			return -EINVAL;
12404 		break;
12405 	case NL80211_IFTYPE_STATION:
12406 	case NL80211_IFTYPE_ADHOC:
12407 	case NL80211_IFTYPE_P2P_CLIENT:
12408 	case NL80211_IFTYPE_AP:
12409 	case NL80211_IFTYPE_AP_VLAN:
12410 	case NL80211_IFTYPE_MESH_POINT:
12411 	case NL80211_IFTYPE_P2P_GO:
12412 		break;
12413 	case NL80211_IFTYPE_NAN:
12414 		if (!wiphy_ext_feature_isset(wdev->wiphy,
12415 					     NL80211_EXT_FEATURE_SECURE_NAN))
12416 			return -EOPNOTSUPP;
12417 		break;
12418 	default:
12419 		return -EOPNOTSUPP;
12420 	}
12421 
12422 	if (info->attrs[NL80211_ATTR_DURATION]) {
12423 		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12424 			return -EINVAL;
12425 		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12426 
12427 		/*
12428 		 * We should wait on the channel for at least a minimum amount
12429 		 * of time (10ms) but no longer than the driver supports.
12430 		 */
12431 		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12432 		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
12433 			return -EINVAL;
12434 	}
12435 
12436 	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12437 
12438 	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12439 		return -EINVAL;
12440 
12441 	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12442 
12443 	/* get the channel if any has been specified, otherwise pass NULL to
12444 	 * the driver. The latter will use the current one
12445 	 */
12446 	chandef.chan = NULL;
12447 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12448 		err = nl80211_parse_chandef(rdev, info, &chandef);
12449 		if (err)
12450 			return err;
12451 	}
12452 
12453 	if (!chandef.chan && params.offchan)
12454 		return -EINVAL;
12455 
12456 	wdev_lock(wdev);
12457 	if (params.offchan &&
12458 	    !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12459 		wdev_unlock(wdev);
12460 		return -EBUSY;
12461 	}
12462 
12463 	params.link_id = nl80211_link_id_or_invalid(info->attrs);
12464 	/*
12465 	 * This now races due to the unlock, but we cannot check
12466 	 * the valid links for the _station_ anyway, so that's up
12467 	 * to the driver.
12468 	 */
12469 	if (params.link_id >= 0 &&
12470 	    !(wdev->valid_links & BIT(params.link_id))) {
12471 		wdev_unlock(wdev);
12472 		return -EINVAL;
12473 	}
12474 	wdev_unlock(wdev);
12475 
12476 	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12477 	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12478 
12479 	if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12480 		int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12481 		int i;
12482 
12483 		if (len % sizeof(u16))
12484 			return -EINVAL;
12485 
12486 		params.n_csa_offsets = len / sizeof(u16);
12487 		params.csa_offsets =
12488 			nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12489 
12490 		/* check that all the offsets fit the frame */
12491 		for (i = 0; i < params.n_csa_offsets; i++) {
12492 			if (params.csa_offsets[i] >= params.len)
12493 				return -EINVAL;
12494 		}
12495 	}
12496 
12497 	if (!params.dont_wait_for_ack) {
12498 		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12499 		if (!msg)
12500 			return -ENOMEM;
12501 
12502 		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12503 				     NL80211_CMD_FRAME);
12504 		if (!hdr) {
12505 			err = -ENOBUFS;
12506 			goto free_msg;
12507 		}
12508 	}
12509 
12510 	params.chan = chandef.chan;
12511 	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12512 	if (err)
12513 		goto free_msg;
12514 
12515 	if (msg) {
12516 		if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12517 				      NL80211_ATTR_PAD))
12518 			goto nla_put_failure;
12519 
12520 		genlmsg_end(msg, hdr);
12521 		return genlmsg_reply(msg, info);
12522 	}
12523 
12524 	return 0;
12525 
12526  nla_put_failure:
12527 	err = -ENOBUFS;
12528  free_msg:
12529 	nlmsg_free(msg);
12530 	return err;
12531 }
12532 
12533 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12534 {
12535 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12536 	struct wireless_dev *wdev = info->user_ptr[1];
12537 	u64 cookie;
12538 
12539 	if (!info->attrs[NL80211_ATTR_COOKIE])
12540 		return -EINVAL;
12541 
12542 	if (!rdev->ops->mgmt_tx_cancel_wait)
12543 		return -EOPNOTSUPP;
12544 
12545 	switch (wdev->iftype) {
12546 	case NL80211_IFTYPE_STATION:
12547 	case NL80211_IFTYPE_ADHOC:
12548 	case NL80211_IFTYPE_P2P_CLIENT:
12549 	case NL80211_IFTYPE_AP:
12550 	case NL80211_IFTYPE_AP_VLAN:
12551 	case NL80211_IFTYPE_P2P_GO:
12552 	case NL80211_IFTYPE_P2P_DEVICE:
12553 		break;
12554 	case NL80211_IFTYPE_NAN:
12555 		if (!wiphy_ext_feature_isset(wdev->wiphy,
12556 					     NL80211_EXT_FEATURE_SECURE_NAN))
12557 			return -EOPNOTSUPP;
12558 		break;
12559 	default:
12560 		return -EOPNOTSUPP;
12561 	}
12562 
12563 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12564 
12565 	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12566 }
12567 
12568 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12569 {
12570 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12571 	struct wireless_dev *wdev;
12572 	struct net_device *dev = info->user_ptr[1];
12573 	u8 ps_state;
12574 	bool state;
12575 	int err;
12576 
12577 	if (!info->attrs[NL80211_ATTR_PS_STATE])
12578 		return -EINVAL;
12579 
12580 	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12581 
12582 	wdev = dev->ieee80211_ptr;
12583 
12584 	if (!rdev->ops->set_power_mgmt)
12585 		return -EOPNOTSUPP;
12586 
12587 	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12588 
12589 	if (state == wdev->ps)
12590 		return 0;
12591 
12592 	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12593 	if (!err)
12594 		wdev->ps = state;
12595 	return err;
12596 }
12597 
12598 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12599 {
12600 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12601 	enum nl80211_ps_state ps_state;
12602 	struct wireless_dev *wdev;
12603 	struct net_device *dev = info->user_ptr[1];
12604 	struct sk_buff *msg;
12605 	void *hdr;
12606 	int err;
12607 
12608 	wdev = dev->ieee80211_ptr;
12609 
12610 	if (!rdev->ops->set_power_mgmt)
12611 		return -EOPNOTSUPP;
12612 
12613 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12614 	if (!msg)
12615 		return -ENOMEM;
12616 
12617 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12618 			     NL80211_CMD_GET_POWER_SAVE);
12619 	if (!hdr) {
12620 		err = -ENOBUFS;
12621 		goto free_msg;
12622 	}
12623 
12624 	if (wdev->ps)
12625 		ps_state = NL80211_PS_ENABLED;
12626 	else
12627 		ps_state = NL80211_PS_DISABLED;
12628 
12629 	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12630 		goto nla_put_failure;
12631 
12632 	genlmsg_end(msg, hdr);
12633 	return genlmsg_reply(msg, info);
12634 
12635  nla_put_failure:
12636 	err = -ENOBUFS;
12637  free_msg:
12638 	nlmsg_free(msg);
12639 	return err;
12640 }
12641 
12642 static const struct nla_policy
12643 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12644 	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12645 	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12646 	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12647 	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12648 	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12649 	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12650 	[NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12651 };
12652 
12653 static int nl80211_set_cqm_txe(struct genl_info *info,
12654 			       u32 rate, u32 pkts, u32 intvl)
12655 {
12656 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12657 	struct net_device *dev = info->user_ptr[1];
12658 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12659 
12660 	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12661 		return -EINVAL;
12662 
12663 	if (!rdev->ops->set_cqm_txe_config)
12664 		return -EOPNOTSUPP;
12665 
12666 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
12667 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12668 		return -EOPNOTSUPP;
12669 
12670 	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12671 }
12672 
12673 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12674 				    struct net_device *dev)
12675 {
12676 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12677 	s32 last, low, high;
12678 	u32 hyst;
12679 	int i, n, low_index;
12680 	int err;
12681 
12682 	/* RSSI reporting disabled? */
12683 	if (!wdev->cqm_config)
12684 		return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12685 
12686 	/*
12687 	 * Obtain current RSSI value if possible, if not and no RSSI threshold
12688 	 * event has been received yet, we should receive an event after a
12689 	 * connection is established and enough beacons received to calculate
12690 	 * the average.
12691 	 */
12692 	if (!wdev->cqm_config->last_rssi_event_value &&
12693 	    wdev->links[0].client.current_bss &&
12694 	    rdev->ops->get_station) {
12695 		struct station_info sinfo = {};
12696 		u8 *mac_addr;
12697 
12698 		mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12699 
12700 		err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12701 		if (err)
12702 			return err;
12703 
12704 		cfg80211_sinfo_release_content(&sinfo);
12705 		if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12706 			wdev->cqm_config->last_rssi_event_value =
12707 				(s8) sinfo.rx_beacon_signal_avg;
12708 	}
12709 
12710 	last = wdev->cqm_config->last_rssi_event_value;
12711 	hyst = wdev->cqm_config->rssi_hyst;
12712 	n = wdev->cqm_config->n_rssi_thresholds;
12713 
12714 	for (i = 0; i < n; i++) {
12715 		i = array_index_nospec(i, n);
12716 		if (last < wdev->cqm_config->rssi_thresholds[i])
12717 			break;
12718 	}
12719 
12720 	low_index = i - 1;
12721 	if (low_index >= 0) {
12722 		low_index = array_index_nospec(low_index, n);
12723 		low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
12724 	} else {
12725 		low = S32_MIN;
12726 	}
12727 	if (i < n) {
12728 		i = array_index_nospec(i, n);
12729 		high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
12730 	} else {
12731 		high = S32_MAX;
12732 	}
12733 
12734 	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12735 }
12736 
12737 static int nl80211_set_cqm_rssi(struct genl_info *info,
12738 				const s32 *thresholds, int n_thresholds,
12739 				u32 hysteresis)
12740 {
12741 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12742 	struct net_device *dev = info->user_ptr[1];
12743 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12744 	int i, err;
12745 	s32 prev = S32_MIN;
12746 
12747 	/* Check all values negative and sorted */
12748 	for (i = 0; i < n_thresholds; i++) {
12749 		if (thresholds[i] > 0 || thresholds[i] <= prev)
12750 			return -EINVAL;
12751 
12752 		prev = thresholds[i];
12753 	}
12754 
12755 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
12756 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12757 		return -EOPNOTSUPP;
12758 
12759 	wdev_lock(wdev);
12760 	cfg80211_cqm_config_free(wdev);
12761 	wdev_unlock(wdev);
12762 
12763 	if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12764 		if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12765 			return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12766 
12767 		return rdev_set_cqm_rssi_config(rdev, dev,
12768 						thresholds[0], hysteresis);
12769 	}
12770 
12771 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
12772 				     NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12773 		return -EOPNOTSUPP;
12774 
12775 	if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12776 		n_thresholds = 0;
12777 
12778 	wdev_lock(wdev);
12779 	if (n_thresholds) {
12780 		struct cfg80211_cqm_config *cqm_config;
12781 
12782 		cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12783 						 n_thresholds),
12784 				     GFP_KERNEL);
12785 		if (!cqm_config) {
12786 			err = -ENOMEM;
12787 			goto unlock;
12788 		}
12789 
12790 		cqm_config->rssi_hyst = hysteresis;
12791 		cqm_config->n_rssi_thresholds = n_thresholds;
12792 		memcpy(cqm_config->rssi_thresholds, thresholds,
12793 		       flex_array_size(cqm_config, rssi_thresholds,
12794 				       n_thresholds));
12795 
12796 		wdev->cqm_config = cqm_config;
12797 	}
12798 
12799 	err = cfg80211_cqm_rssi_update(rdev, dev);
12800 
12801 unlock:
12802 	wdev_unlock(wdev);
12803 
12804 	return err;
12805 }
12806 
12807 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12808 {
12809 	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12810 	struct nlattr *cqm;
12811 	int err;
12812 
12813 	cqm = info->attrs[NL80211_ATTR_CQM];
12814 	if (!cqm)
12815 		return -EINVAL;
12816 
12817 	err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12818 					  nl80211_attr_cqm_policy,
12819 					  info->extack);
12820 	if (err)
12821 		return err;
12822 
12823 	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12824 	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12825 		const s32 *thresholds =
12826 			nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12827 		int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12828 		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12829 
12830 		if (len % 4)
12831 			return -EINVAL;
12832 
12833 		return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12834 					    hysteresis);
12835 	}
12836 
12837 	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12838 	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12839 	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12840 		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12841 		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12842 		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12843 
12844 		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12845 	}
12846 
12847 	return -EINVAL;
12848 }
12849 
12850 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12851 {
12852 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12853 	struct net_device *dev = info->user_ptr[1];
12854 	struct ocb_setup setup = {};
12855 	int err;
12856 
12857 	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12858 	if (err)
12859 		return err;
12860 
12861 	return cfg80211_join_ocb(rdev, dev, &setup);
12862 }
12863 
12864 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12865 {
12866 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12867 	struct net_device *dev = info->user_ptr[1];
12868 
12869 	return cfg80211_leave_ocb(rdev, dev);
12870 }
12871 
12872 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12873 {
12874 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12875 	struct net_device *dev = info->user_ptr[1];
12876 	struct mesh_config cfg;
12877 	struct mesh_setup setup;
12878 	int err;
12879 
12880 	/* start with default */
12881 	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
12882 	memcpy(&setup, &default_mesh_setup, sizeof(setup));
12883 
12884 	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
12885 		/* and parse parameters if given */
12886 		err = nl80211_parse_mesh_config(info, &cfg, NULL);
12887 		if (err)
12888 			return err;
12889 	}
12890 
12891 	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
12892 	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
12893 		return -EINVAL;
12894 
12895 	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
12896 	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
12897 
12898 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12899 	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
12900 			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12901 			return -EINVAL;
12902 
12903 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
12904 		setup.beacon_interval =
12905 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12906 
12907 		err = cfg80211_validate_beacon_int(rdev,
12908 						   NL80211_IFTYPE_MESH_POINT,
12909 						   setup.beacon_interval);
12910 		if (err)
12911 			return err;
12912 	}
12913 
12914 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
12915 		setup.dtim_period =
12916 			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
12917 		if (setup.dtim_period < 1 || setup.dtim_period > 100)
12918 			return -EINVAL;
12919 	}
12920 
12921 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
12922 		/* parse additional setup parameters if given */
12923 		err = nl80211_parse_mesh_setup(info, &setup);
12924 		if (err)
12925 			return err;
12926 	}
12927 
12928 	if (setup.user_mpm)
12929 		cfg.auto_open_plinks = false;
12930 
12931 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12932 		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12933 		if (err)
12934 			return err;
12935 	} else {
12936 		/* __cfg80211_join_mesh() will sort it out */
12937 		setup.chandef.chan = NULL;
12938 	}
12939 
12940 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12941 		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12942 		int n_rates =
12943 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12944 		struct ieee80211_supported_band *sband;
12945 
12946 		if (!setup.chandef.chan)
12947 			return -EINVAL;
12948 
12949 		sband = rdev->wiphy.bands[setup.chandef.chan->band];
12950 
12951 		err = ieee80211_get_ratemask(sband, rates, n_rates,
12952 					     &setup.basic_rates);
12953 		if (err)
12954 			return err;
12955 	}
12956 
12957 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
12958 		err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12959 						    NL80211_ATTR_TX_RATES,
12960 						    &setup.beacon_rate,
12961 						    dev, false, 0);
12962 		if (err)
12963 			return err;
12964 
12965 		if (!setup.chandef.chan)
12966 			return -EINVAL;
12967 
12968 		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
12969 					      &setup.beacon_rate);
12970 		if (err)
12971 			return err;
12972 	}
12973 
12974 	setup.userspace_handles_dfs =
12975 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12976 
12977 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12978 		int r = validate_pae_over_nl80211(rdev, info);
12979 
12980 		if (r < 0)
12981 			return r;
12982 
12983 		setup.control_port_over_nl80211 = true;
12984 	}
12985 
12986 	wdev_lock(dev->ieee80211_ptr);
12987 	err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
12988 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
12989 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12990 	wdev_unlock(dev->ieee80211_ptr);
12991 
12992 	return err;
12993 }
12994 
12995 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
12996 {
12997 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12998 	struct net_device *dev = info->user_ptr[1];
12999 
13000 	return cfg80211_leave_mesh(rdev, dev);
13001 }
13002 
13003 #ifdef CONFIG_PM
13004 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13005 					struct cfg80211_registered_device *rdev)
13006 {
13007 	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13008 	struct nlattr *nl_pats, *nl_pat;
13009 	int i, pat_len;
13010 
13011 	if (!wowlan->n_patterns)
13012 		return 0;
13013 
13014 	nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13015 	if (!nl_pats)
13016 		return -ENOBUFS;
13017 
13018 	for (i = 0; i < wowlan->n_patterns; i++) {
13019 		nl_pat = nla_nest_start_noflag(msg, i + 1);
13020 		if (!nl_pat)
13021 			return -ENOBUFS;
13022 		pat_len = wowlan->patterns[i].pattern_len;
13023 		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13024 			    wowlan->patterns[i].mask) ||
13025 		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13026 			    wowlan->patterns[i].pattern) ||
13027 		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13028 				wowlan->patterns[i].pkt_offset))
13029 			return -ENOBUFS;
13030 		nla_nest_end(msg, nl_pat);
13031 	}
13032 	nla_nest_end(msg, nl_pats);
13033 
13034 	return 0;
13035 }
13036 
13037 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13038 				   struct cfg80211_wowlan_tcp *tcp)
13039 {
13040 	struct nlattr *nl_tcp;
13041 
13042 	if (!tcp)
13043 		return 0;
13044 
13045 	nl_tcp = nla_nest_start_noflag(msg,
13046 				       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13047 	if (!nl_tcp)
13048 		return -ENOBUFS;
13049 
13050 	if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13051 	    nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13052 	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13053 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13054 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13055 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13056 		    tcp->payload_len, tcp->payload) ||
13057 	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13058 			tcp->data_interval) ||
13059 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13060 		    tcp->wake_len, tcp->wake_data) ||
13061 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13062 		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13063 		return -ENOBUFS;
13064 
13065 	if (tcp->payload_seq.len &&
13066 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13067 		    sizeof(tcp->payload_seq), &tcp->payload_seq))
13068 		return -ENOBUFS;
13069 
13070 	if (tcp->payload_tok.len &&
13071 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13072 		    sizeof(tcp->payload_tok) + tcp->tokens_size,
13073 		    &tcp->payload_tok))
13074 		return -ENOBUFS;
13075 
13076 	nla_nest_end(msg, nl_tcp);
13077 
13078 	return 0;
13079 }
13080 
13081 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13082 				  struct cfg80211_sched_scan_request *req)
13083 {
13084 	struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13085 	int i;
13086 
13087 	if (!req)
13088 		return 0;
13089 
13090 	nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13091 	if (!nd)
13092 		return -ENOBUFS;
13093 
13094 	if (req->n_scan_plans == 1 &&
13095 	    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13096 			req->scan_plans[0].interval * 1000))
13097 		return -ENOBUFS;
13098 
13099 	if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13100 		return -ENOBUFS;
13101 
13102 	if (req->relative_rssi_set) {
13103 		struct nl80211_bss_select_rssi_adjust rssi_adjust;
13104 
13105 		if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13106 			       req->relative_rssi))
13107 			return -ENOBUFS;
13108 
13109 		rssi_adjust.band = req->rssi_adjust.band;
13110 		rssi_adjust.delta = req->rssi_adjust.delta;
13111 		if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13112 			    sizeof(rssi_adjust), &rssi_adjust))
13113 			return -ENOBUFS;
13114 	}
13115 
13116 	freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13117 	if (!freqs)
13118 		return -ENOBUFS;
13119 
13120 	for (i = 0; i < req->n_channels; i++) {
13121 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13122 			return -ENOBUFS;
13123 	}
13124 
13125 	nla_nest_end(msg, freqs);
13126 
13127 	if (req->n_match_sets) {
13128 		matches = nla_nest_start_noflag(msg,
13129 						NL80211_ATTR_SCHED_SCAN_MATCH);
13130 		if (!matches)
13131 			return -ENOBUFS;
13132 
13133 		for (i = 0; i < req->n_match_sets; i++) {
13134 			match = nla_nest_start_noflag(msg, i);
13135 			if (!match)
13136 				return -ENOBUFS;
13137 
13138 			if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13139 				    req->match_sets[i].ssid.ssid_len,
13140 				    req->match_sets[i].ssid.ssid))
13141 				return -ENOBUFS;
13142 			nla_nest_end(msg, match);
13143 		}
13144 		nla_nest_end(msg, matches);
13145 	}
13146 
13147 	scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13148 	if (!scan_plans)
13149 		return -ENOBUFS;
13150 
13151 	for (i = 0; i < req->n_scan_plans; i++) {
13152 		scan_plan = nla_nest_start_noflag(msg, i + 1);
13153 		if (!scan_plan)
13154 			return -ENOBUFS;
13155 
13156 		if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13157 				req->scan_plans[i].interval) ||
13158 		    (req->scan_plans[i].iterations &&
13159 		     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13160 				 req->scan_plans[i].iterations)))
13161 			return -ENOBUFS;
13162 		nla_nest_end(msg, scan_plan);
13163 	}
13164 	nla_nest_end(msg, scan_plans);
13165 
13166 	nla_nest_end(msg, nd);
13167 
13168 	return 0;
13169 }
13170 
13171 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13172 {
13173 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13174 	struct sk_buff *msg;
13175 	void *hdr;
13176 	u32 size = NLMSG_DEFAULT_SIZE;
13177 
13178 	if (!rdev->wiphy.wowlan)
13179 		return -EOPNOTSUPP;
13180 
13181 	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13182 		/* adjust size to have room for all the data */
13183 		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13184 			rdev->wiphy.wowlan_config->tcp->payload_len +
13185 			rdev->wiphy.wowlan_config->tcp->wake_len +
13186 			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13187 	}
13188 
13189 	msg = nlmsg_new(size, GFP_KERNEL);
13190 	if (!msg)
13191 		return -ENOMEM;
13192 
13193 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13194 			     NL80211_CMD_GET_WOWLAN);
13195 	if (!hdr)
13196 		goto nla_put_failure;
13197 
13198 	if (rdev->wiphy.wowlan_config) {
13199 		struct nlattr *nl_wowlan;
13200 
13201 		nl_wowlan = nla_nest_start_noflag(msg,
13202 						  NL80211_ATTR_WOWLAN_TRIGGERS);
13203 		if (!nl_wowlan)
13204 			goto nla_put_failure;
13205 
13206 		if ((rdev->wiphy.wowlan_config->any &&
13207 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13208 		    (rdev->wiphy.wowlan_config->disconnect &&
13209 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13210 		    (rdev->wiphy.wowlan_config->magic_pkt &&
13211 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13212 		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13213 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13214 		    (rdev->wiphy.wowlan_config->eap_identity_req &&
13215 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13216 		    (rdev->wiphy.wowlan_config->four_way_handshake &&
13217 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13218 		    (rdev->wiphy.wowlan_config->rfkill_release &&
13219 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13220 			goto nla_put_failure;
13221 
13222 		if (nl80211_send_wowlan_patterns(msg, rdev))
13223 			goto nla_put_failure;
13224 
13225 		if (nl80211_send_wowlan_tcp(msg,
13226 					    rdev->wiphy.wowlan_config->tcp))
13227 			goto nla_put_failure;
13228 
13229 		if (nl80211_send_wowlan_nd(
13230 			    msg,
13231 			    rdev->wiphy.wowlan_config->nd_config))
13232 			goto nla_put_failure;
13233 
13234 		nla_nest_end(msg, nl_wowlan);
13235 	}
13236 
13237 	genlmsg_end(msg, hdr);
13238 	return genlmsg_reply(msg, info);
13239 
13240 nla_put_failure:
13241 	nlmsg_free(msg);
13242 	return -ENOBUFS;
13243 }
13244 
13245 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13246 				    struct nlattr *attr,
13247 				    struct cfg80211_wowlan *trig)
13248 {
13249 	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13250 	struct cfg80211_wowlan_tcp *cfg;
13251 	struct nl80211_wowlan_tcp_data_token *tok = NULL;
13252 	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13253 	u32 size;
13254 	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13255 	int err, port;
13256 
13257 	if (!rdev->wiphy.wowlan->tcp)
13258 		return -EINVAL;
13259 
13260 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13261 					  nl80211_wowlan_tcp_policy, NULL);
13262 	if (err)
13263 		return err;
13264 
13265 	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13266 	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13267 	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13268 	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13269 	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13270 	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13271 	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13272 	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13273 		return -EINVAL;
13274 
13275 	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13276 	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13277 		return -EINVAL;
13278 
13279 	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13280 			rdev->wiphy.wowlan->tcp->data_interval_max ||
13281 	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13282 		return -EINVAL;
13283 
13284 	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13285 	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13286 		return -EINVAL;
13287 
13288 	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13289 	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13290 		return -EINVAL;
13291 
13292 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13293 		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13294 
13295 		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13296 		tokens_size = tokln - sizeof(*tok);
13297 
13298 		if (!tok->len || tokens_size % tok->len)
13299 			return -EINVAL;
13300 		if (!rdev->wiphy.wowlan->tcp->tok)
13301 			return -EINVAL;
13302 		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13303 			return -EINVAL;
13304 		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13305 			return -EINVAL;
13306 		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13307 			return -EINVAL;
13308 		if (tok->offset + tok->len > data_size)
13309 			return -EINVAL;
13310 	}
13311 
13312 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13313 		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13314 		if (!rdev->wiphy.wowlan->tcp->seq)
13315 			return -EINVAL;
13316 		if (seq->len == 0 || seq->len > 4)
13317 			return -EINVAL;
13318 		if (seq->len + seq->offset > data_size)
13319 			return -EINVAL;
13320 	}
13321 
13322 	size = sizeof(*cfg);
13323 	size += data_size;
13324 	size += wake_size + wake_mask_size;
13325 	size += tokens_size;
13326 
13327 	cfg = kzalloc(size, GFP_KERNEL);
13328 	if (!cfg)
13329 		return -ENOMEM;
13330 	cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13331 	cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13332 	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13333 	       ETH_ALEN);
13334 	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13335 		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13336 	else
13337 		port = 0;
13338 #ifdef CONFIG_INET
13339 	/* allocate a socket and port for it and use it */
13340 	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13341 			    IPPROTO_TCP, &cfg->sock, 1);
13342 	if (err) {
13343 		kfree(cfg);
13344 		return err;
13345 	}
13346 	if (inet_csk_get_port(cfg->sock->sk, port)) {
13347 		sock_release(cfg->sock);
13348 		kfree(cfg);
13349 		return -EADDRINUSE;
13350 	}
13351 	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13352 #else
13353 	if (!port) {
13354 		kfree(cfg);
13355 		return -EINVAL;
13356 	}
13357 	cfg->src_port = port;
13358 #endif
13359 
13360 	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13361 	cfg->payload_len = data_size;
13362 	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13363 	memcpy((void *)cfg->payload,
13364 	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13365 	       data_size);
13366 	if (seq)
13367 		cfg->payload_seq = *seq;
13368 	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13369 	cfg->wake_len = wake_size;
13370 	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13371 	memcpy((void *)cfg->wake_data,
13372 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13373 	       wake_size);
13374 	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13375 			 data_size + wake_size;
13376 	memcpy((void *)cfg->wake_mask,
13377 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13378 	       wake_mask_size);
13379 	if (tok) {
13380 		cfg->tokens_size = tokens_size;
13381 		cfg->payload_tok = *tok;
13382 		memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13383 		       tokens_size);
13384 	}
13385 
13386 	trig->tcp = cfg;
13387 
13388 	return 0;
13389 }
13390 
13391 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13392 				   const struct wiphy_wowlan_support *wowlan,
13393 				   struct nlattr *attr,
13394 				   struct cfg80211_wowlan *trig)
13395 {
13396 	struct nlattr **tb;
13397 	int err;
13398 
13399 	tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13400 	if (!tb)
13401 		return -ENOMEM;
13402 
13403 	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13404 		err = -EOPNOTSUPP;
13405 		goto out;
13406 	}
13407 
13408 	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13409 					  nl80211_policy, NULL);
13410 	if (err)
13411 		goto out;
13412 
13413 	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13414 						   wowlan->max_nd_match_sets);
13415 	err = PTR_ERR_OR_ZERO(trig->nd_config);
13416 	if (err)
13417 		trig->nd_config = NULL;
13418 
13419 out:
13420 	kfree(tb);
13421 	return err;
13422 }
13423 
13424 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13425 {
13426 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13427 	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13428 	struct cfg80211_wowlan new_triggers = {};
13429 	struct cfg80211_wowlan *ntrig;
13430 	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13431 	int err, i;
13432 	bool prev_enabled = rdev->wiphy.wowlan_config;
13433 	bool regular = false;
13434 
13435 	if (!wowlan)
13436 		return -EOPNOTSUPP;
13437 
13438 	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13439 		cfg80211_rdev_free_wowlan(rdev);
13440 		rdev->wiphy.wowlan_config = NULL;
13441 		goto set_wakeup;
13442 	}
13443 
13444 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13445 					  info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13446 					  nl80211_wowlan_policy, info->extack);
13447 	if (err)
13448 		return err;
13449 
13450 	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13451 		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13452 			return -EINVAL;
13453 		new_triggers.any = true;
13454 	}
13455 
13456 	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13457 		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13458 			return -EINVAL;
13459 		new_triggers.disconnect = true;
13460 		regular = true;
13461 	}
13462 
13463 	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13464 		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13465 			return -EINVAL;
13466 		new_triggers.magic_pkt = true;
13467 		regular = true;
13468 	}
13469 
13470 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13471 		return -EINVAL;
13472 
13473 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13474 		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13475 			return -EINVAL;
13476 		new_triggers.gtk_rekey_failure = true;
13477 		regular = true;
13478 	}
13479 
13480 	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13481 		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13482 			return -EINVAL;
13483 		new_triggers.eap_identity_req = true;
13484 		regular = true;
13485 	}
13486 
13487 	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13488 		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13489 			return -EINVAL;
13490 		new_triggers.four_way_handshake = true;
13491 		regular = true;
13492 	}
13493 
13494 	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13495 		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13496 			return -EINVAL;
13497 		new_triggers.rfkill_release = true;
13498 		regular = true;
13499 	}
13500 
13501 	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13502 		struct nlattr *pat;
13503 		int n_patterns = 0;
13504 		int rem, pat_len, mask_len, pkt_offset;
13505 		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13506 
13507 		regular = true;
13508 
13509 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13510 				    rem)
13511 			n_patterns++;
13512 		if (n_patterns > wowlan->n_patterns)
13513 			return -EINVAL;
13514 
13515 		new_triggers.patterns = kcalloc(n_patterns,
13516 						sizeof(new_triggers.patterns[0]),
13517 						GFP_KERNEL);
13518 		if (!new_triggers.patterns)
13519 			return -ENOMEM;
13520 
13521 		new_triggers.n_patterns = n_patterns;
13522 		i = 0;
13523 
13524 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13525 				    rem) {
13526 			u8 *mask_pat;
13527 
13528 			err = nla_parse_nested_deprecated(pat_tb,
13529 							  MAX_NL80211_PKTPAT,
13530 							  pat,
13531 							  nl80211_packet_pattern_policy,
13532 							  info->extack);
13533 			if (err)
13534 				goto error;
13535 
13536 			err = -EINVAL;
13537 			if (!pat_tb[NL80211_PKTPAT_MASK] ||
13538 			    !pat_tb[NL80211_PKTPAT_PATTERN])
13539 				goto error;
13540 			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13541 			mask_len = DIV_ROUND_UP(pat_len, 8);
13542 			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13543 				goto error;
13544 			if (pat_len > wowlan->pattern_max_len ||
13545 			    pat_len < wowlan->pattern_min_len)
13546 				goto error;
13547 
13548 			if (!pat_tb[NL80211_PKTPAT_OFFSET])
13549 				pkt_offset = 0;
13550 			else
13551 				pkt_offset = nla_get_u32(
13552 					pat_tb[NL80211_PKTPAT_OFFSET]);
13553 			if (pkt_offset > wowlan->max_pkt_offset)
13554 				goto error;
13555 			new_triggers.patterns[i].pkt_offset = pkt_offset;
13556 
13557 			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13558 			if (!mask_pat) {
13559 				err = -ENOMEM;
13560 				goto error;
13561 			}
13562 			new_triggers.patterns[i].mask = mask_pat;
13563 			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13564 			       mask_len);
13565 			mask_pat += mask_len;
13566 			new_triggers.patterns[i].pattern = mask_pat;
13567 			new_triggers.patterns[i].pattern_len = pat_len;
13568 			memcpy(mask_pat,
13569 			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13570 			       pat_len);
13571 			i++;
13572 		}
13573 	}
13574 
13575 	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13576 		regular = true;
13577 		err = nl80211_parse_wowlan_tcp(
13578 			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13579 			&new_triggers);
13580 		if (err)
13581 			goto error;
13582 	}
13583 
13584 	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13585 		regular = true;
13586 		err = nl80211_parse_wowlan_nd(
13587 			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13588 			&new_triggers);
13589 		if (err)
13590 			goto error;
13591 	}
13592 
13593 	/* The 'any' trigger means the device continues operating more or less
13594 	 * as in its normal operation mode and wakes up the host on most of the
13595 	 * normal interrupts (like packet RX, ...)
13596 	 * It therefore makes little sense to combine with the more constrained
13597 	 * wakeup trigger modes.
13598 	 */
13599 	if (new_triggers.any && regular) {
13600 		err = -EINVAL;
13601 		goto error;
13602 	}
13603 
13604 	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13605 	if (!ntrig) {
13606 		err = -ENOMEM;
13607 		goto error;
13608 	}
13609 	cfg80211_rdev_free_wowlan(rdev);
13610 	rdev->wiphy.wowlan_config = ntrig;
13611 
13612  set_wakeup:
13613 	if (rdev->ops->set_wakeup &&
13614 	    prev_enabled != !!rdev->wiphy.wowlan_config)
13615 		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13616 
13617 	return 0;
13618  error:
13619 	for (i = 0; i < new_triggers.n_patterns; i++)
13620 		kfree(new_triggers.patterns[i].mask);
13621 	kfree(new_triggers.patterns);
13622 	if (new_triggers.tcp && new_triggers.tcp->sock)
13623 		sock_release(new_triggers.tcp->sock);
13624 	kfree(new_triggers.tcp);
13625 	kfree(new_triggers.nd_config);
13626 	return err;
13627 }
13628 #endif
13629 
13630 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13631 				       struct cfg80211_registered_device *rdev)
13632 {
13633 	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13634 	int i, j, pat_len;
13635 	struct cfg80211_coalesce_rules *rule;
13636 
13637 	if (!rdev->coalesce->n_rules)
13638 		return 0;
13639 
13640 	nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13641 	if (!nl_rules)
13642 		return -ENOBUFS;
13643 
13644 	for (i = 0; i < rdev->coalesce->n_rules; i++) {
13645 		nl_rule = nla_nest_start_noflag(msg, i + 1);
13646 		if (!nl_rule)
13647 			return -ENOBUFS;
13648 
13649 		rule = &rdev->coalesce->rules[i];
13650 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13651 				rule->delay))
13652 			return -ENOBUFS;
13653 
13654 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13655 				rule->condition))
13656 			return -ENOBUFS;
13657 
13658 		nl_pats = nla_nest_start_noflag(msg,
13659 						NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13660 		if (!nl_pats)
13661 			return -ENOBUFS;
13662 
13663 		for (j = 0; j < rule->n_patterns; j++) {
13664 			nl_pat = nla_nest_start_noflag(msg, j + 1);
13665 			if (!nl_pat)
13666 				return -ENOBUFS;
13667 			pat_len = rule->patterns[j].pattern_len;
13668 			if (nla_put(msg, NL80211_PKTPAT_MASK,
13669 				    DIV_ROUND_UP(pat_len, 8),
13670 				    rule->patterns[j].mask) ||
13671 			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13672 				    rule->patterns[j].pattern) ||
13673 			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13674 					rule->patterns[j].pkt_offset))
13675 				return -ENOBUFS;
13676 			nla_nest_end(msg, nl_pat);
13677 		}
13678 		nla_nest_end(msg, nl_pats);
13679 		nla_nest_end(msg, nl_rule);
13680 	}
13681 	nla_nest_end(msg, nl_rules);
13682 
13683 	return 0;
13684 }
13685 
13686 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13687 {
13688 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13689 	struct sk_buff *msg;
13690 	void *hdr;
13691 
13692 	if (!rdev->wiphy.coalesce)
13693 		return -EOPNOTSUPP;
13694 
13695 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13696 	if (!msg)
13697 		return -ENOMEM;
13698 
13699 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13700 			     NL80211_CMD_GET_COALESCE);
13701 	if (!hdr)
13702 		goto nla_put_failure;
13703 
13704 	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13705 		goto nla_put_failure;
13706 
13707 	genlmsg_end(msg, hdr);
13708 	return genlmsg_reply(msg, info);
13709 
13710 nla_put_failure:
13711 	nlmsg_free(msg);
13712 	return -ENOBUFS;
13713 }
13714 
13715 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13716 {
13717 	struct cfg80211_coalesce *coalesce = rdev->coalesce;
13718 	int i, j;
13719 	struct cfg80211_coalesce_rules *rule;
13720 
13721 	if (!coalesce)
13722 		return;
13723 
13724 	for (i = 0; i < coalesce->n_rules; i++) {
13725 		rule = &coalesce->rules[i];
13726 		for (j = 0; j < rule->n_patterns; j++)
13727 			kfree(rule->patterns[j].mask);
13728 		kfree(rule->patterns);
13729 	}
13730 	kfree(coalesce->rules);
13731 	kfree(coalesce);
13732 	rdev->coalesce = NULL;
13733 }
13734 
13735 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13736 				       struct nlattr *rule,
13737 				       struct cfg80211_coalesce_rules *new_rule)
13738 {
13739 	int err, i;
13740 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13741 	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13742 	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13743 	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13744 
13745 	err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13746 					  rule, nl80211_coalesce_policy, NULL);
13747 	if (err)
13748 		return err;
13749 
13750 	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13751 		new_rule->delay =
13752 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13753 	if (new_rule->delay > coalesce->max_delay)
13754 		return -EINVAL;
13755 
13756 	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13757 		new_rule->condition =
13758 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13759 
13760 	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13761 		return -EINVAL;
13762 
13763 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13764 			    rem)
13765 		n_patterns++;
13766 	if (n_patterns > coalesce->n_patterns)
13767 		return -EINVAL;
13768 
13769 	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13770 				     GFP_KERNEL);
13771 	if (!new_rule->patterns)
13772 		return -ENOMEM;
13773 
13774 	new_rule->n_patterns = n_patterns;
13775 	i = 0;
13776 
13777 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13778 			    rem) {
13779 		u8 *mask_pat;
13780 
13781 		err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13782 						  pat,
13783 						  nl80211_packet_pattern_policy,
13784 						  NULL);
13785 		if (err)
13786 			return err;
13787 
13788 		if (!pat_tb[NL80211_PKTPAT_MASK] ||
13789 		    !pat_tb[NL80211_PKTPAT_PATTERN])
13790 			return -EINVAL;
13791 		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13792 		mask_len = DIV_ROUND_UP(pat_len, 8);
13793 		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13794 			return -EINVAL;
13795 		if (pat_len > coalesce->pattern_max_len ||
13796 		    pat_len < coalesce->pattern_min_len)
13797 			return -EINVAL;
13798 
13799 		if (!pat_tb[NL80211_PKTPAT_OFFSET])
13800 			pkt_offset = 0;
13801 		else
13802 			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13803 		if (pkt_offset > coalesce->max_pkt_offset)
13804 			return -EINVAL;
13805 		new_rule->patterns[i].pkt_offset = pkt_offset;
13806 
13807 		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13808 		if (!mask_pat)
13809 			return -ENOMEM;
13810 
13811 		new_rule->patterns[i].mask = mask_pat;
13812 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13813 		       mask_len);
13814 
13815 		mask_pat += mask_len;
13816 		new_rule->patterns[i].pattern = mask_pat;
13817 		new_rule->patterns[i].pattern_len = pat_len;
13818 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13819 		       pat_len);
13820 		i++;
13821 	}
13822 
13823 	return 0;
13824 }
13825 
13826 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13827 {
13828 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13829 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13830 	struct cfg80211_coalesce new_coalesce = {};
13831 	struct cfg80211_coalesce *n_coalesce;
13832 	int err, rem_rule, n_rules = 0, i, j;
13833 	struct nlattr *rule;
13834 	struct cfg80211_coalesce_rules *tmp_rule;
13835 
13836 	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13837 		return -EOPNOTSUPP;
13838 
13839 	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13840 		cfg80211_rdev_free_coalesce(rdev);
13841 		rdev_set_coalesce(rdev, NULL);
13842 		return 0;
13843 	}
13844 
13845 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13846 			    rem_rule)
13847 		n_rules++;
13848 	if (n_rules > coalesce->n_rules)
13849 		return -EINVAL;
13850 
13851 	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13852 				     GFP_KERNEL);
13853 	if (!new_coalesce.rules)
13854 		return -ENOMEM;
13855 
13856 	new_coalesce.n_rules = n_rules;
13857 	i = 0;
13858 
13859 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13860 			    rem_rule) {
13861 		err = nl80211_parse_coalesce_rule(rdev, rule,
13862 						  &new_coalesce.rules[i]);
13863 		if (err)
13864 			goto error;
13865 
13866 		i++;
13867 	}
13868 
13869 	err = rdev_set_coalesce(rdev, &new_coalesce);
13870 	if (err)
13871 		goto error;
13872 
13873 	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13874 	if (!n_coalesce) {
13875 		err = -ENOMEM;
13876 		goto error;
13877 	}
13878 	cfg80211_rdev_free_coalesce(rdev);
13879 	rdev->coalesce = n_coalesce;
13880 
13881 	return 0;
13882 error:
13883 	for (i = 0; i < new_coalesce.n_rules; i++) {
13884 		tmp_rule = &new_coalesce.rules[i];
13885 		for (j = 0; j < tmp_rule->n_patterns; j++)
13886 			kfree(tmp_rule->patterns[j].mask);
13887 		kfree(tmp_rule->patterns);
13888 	}
13889 	kfree(new_coalesce.rules);
13890 
13891 	return err;
13892 }
13893 
13894 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
13895 {
13896 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13897 	struct net_device *dev = info->user_ptr[1];
13898 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13899 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
13900 	struct cfg80211_gtk_rekey_data rekey_data = {};
13901 	int err;
13902 
13903 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
13904 		return -EINVAL;
13905 
13906 	err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
13907 					  info->attrs[NL80211_ATTR_REKEY_DATA],
13908 					  nl80211_rekey_policy, info->extack);
13909 	if (err)
13910 		return err;
13911 
13912 	if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
13913 	    !tb[NL80211_REKEY_DATA_KCK])
13914 		return -EINVAL;
13915 	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
13916 	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13917 	      nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
13918 		return -ERANGE;
13919 	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
13920 	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13921 	      nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
13922 	     !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
13923 	       nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
13924 		return -ERANGE;
13925 
13926 	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
13927 	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
13928 	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
13929 	rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
13930 	rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
13931 	if (tb[NL80211_REKEY_DATA_AKM])
13932 		rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
13933 
13934 	wdev_lock(wdev);
13935 	if (!wdev->connected) {
13936 		err = -ENOTCONN;
13937 		goto out;
13938 	}
13939 
13940 	if (!rdev->ops->set_rekey_data) {
13941 		err = -EOPNOTSUPP;
13942 		goto out;
13943 	}
13944 
13945 	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
13946  out:
13947 	wdev_unlock(wdev);
13948 	return err;
13949 }
13950 
13951 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
13952 					     struct genl_info *info)
13953 {
13954 	struct net_device *dev = info->user_ptr[1];
13955 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13956 
13957 	if (wdev->iftype != NL80211_IFTYPE_AP &&
13958 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
13959 		return -EINVAL;
13960 
13961 	if (wdev->ap_unexpected_nlportid)
13962 		return -EBUSY;
13963 
13964 	wdev->ap_unexpected_nlportid = info->snd_portid;
13965 	return 0;
13966 }
13967 
13968 static int nl80211_probe_client(struct sk_buff *skb,
13969 				struct genl_info *info)
13970 {
13971 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
13972 	struct net_device *dev = info->user_ptr[1];
13973 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13974 	struct sk_buff *msg;
13975 	void *hdr;
13976 	const u8 *addr;
13977 	u64 cookie;
13978 	int err;
13979 
13980 	if (wdev->iftype != NL80211_IFTYPE_AP &&
13981 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
13982 		return -EOPNOTSUPP;
13983 
13984 	if (!info->attrs[NL80211_ATTR_MAC])
13985 		return -EINVAL;
13986 
13987 	if (!rdev->ops->probe_client)
13988 		return -EOPNOTSUPP;
13989 
13990 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13991 	if (!msg)
13992 		return -ENOMEM;
13993 
13994 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13995 			     NL80211_CMD_PROBE_CLIENT);
13996 	if (!hdr) {
13997 		err = -ENOBUFS;
13998 		goto free_msg;
13999 	}
14000 
14001 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14002 
14003 	err = rdev_probe_client(rdev, dev, addr, &cookie);
14004 	if (err)
14005 		goto free_msg;
14006 
14007 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14008 			      NL80211_ATTR_PAD))
14009 		goto nla_put_failure;
14010 
14011 	genlmsg_end(msg, hdr);
14012 
14013 	return genlmsg_reply(msg, info);
14014 
14015  nla_put_failure:
14016 	err = -ENOBUFS;
14017  free_msg:
14018 	nlmsg_free(msg);
14019 	return err;
14020 }
14021 
14022 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14023 {
14024 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14025 	struct cfg80211_beacon_registration *reg, *nreg;
14026 	int rv;
14027 
14028 	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14029 		return -EOPNOTSUPP;
14030 
14031 	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14032 	if (!nreg)
14033 		return -ENOMEM;
14034 
14035 	/* First, check if already registered. */
14036 	spin_lock_bh(&rdev->beacon_registrations_lock);
14037 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14038 		if (reg->nlportid == info->snd_portid) {
14039 			rv = -EALREADY;
14040 			goto out_err;
14041 		}
14042 	}
14043 	/* Add it to the list */
14044 	nreg->nlportid = info->snd_portid;
14045 	list_add(&nreg->list, &rdev->beacon_registrations);
14046 
14047 	spin_unlock_bh(&rdev->beacon_registrations_lock);
14048 
14049 	return 0;
14050 out_err:
14051 	spin_unlock_bh(&rdev->beacon_registrations_lock);
14052 	kfree(nreg);
14053 	return rv;
14054 }
14055 
14056 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14057 {
14058 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14059 	struct wireless_dev *wdev = info->user_ptr[1];
14060 	int err;
14061 
14062 	if (!rdev->ops->start_p2p_device)
14063 		return -EOPNOTSUPP;
14064 
14065 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14066 		return -EOPNOTSUPP;
14067 
14068 	if (wdev_running(wdev))
14069 		return 0;
14070 
14071 	if (rfkill_blocked(rdev->wiphy.rfkill))
14072 		return -ERFKILL;
14073 
14074 	err = rdev_start_p2p_device(rdev, wdev);
14075 	if (err)
14076 		return err;
14077 
14078 	wdev->is_running = true;
14079 	rdev->opencount++;
14080 
14081 	return 0;
14082 }
14083 
14084 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14085 {
14086 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14087 	struct wireless_dev *wdev = info->user_ptr[1];
14088 
14089 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14090 		return -EOPNOTSUPP;
14091 
14092 	if (!rdev->ops->stop_p2p_device)
14093 		return -EOPNOTSUPP;
14094 
14095 	cfg80211_stop_p2p_device(rdev, wdev);
14096 
14097 	return 0;
14098 }
14099 
14100 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14101 {
14102 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14103 	struct wireless_dev *wdev = info->user_ptr[1];
14104 	struct cfg80211_nan_conf conf = {};
14105 	int err;
14106 
14107 	if (wdev->iftype != NL80211_IFTYPE_NAN)
14108 		return -EOPNOTSUPP;
14109 
14110 	if (wdev_running(wdev))
14111 		return -EEXIST;
14112 
14113 	if (rfkill_blocked(rdev->wiphy.rfkill))
14114 		return -ERFKILL;
14115 
14116 	if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14117 		return -EINVAL;
14118 
14119 	conf.master_pref =
14120 		nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14121 
14122 	if (info->attrs[NL80211_ATTR_BANDS]) {
14123 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14124 
14125 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14126 			return -EOPNOTSUPP;
14127 
14128 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14129 			return -EINVAL;
14130 
14131 		conf.bands = bands;
14132 	}
14133 
14134 	err = rdev_start_nan(rdev, wdev, &conf);
14135 	if (err)
14136 		return err;
14137 
14138 	wdev->is_running = true;
14139 	rdev->opencount++;
14140 
14141 	return 0;
14142 }
14143 
14144 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14145 {
14146 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14147 	struct wireless_dev *wdev = info->user_ptr[1];
14148 
14149 	if (wdev->iftype != NL80211_IFTYPE_NAN)
14150 		return -EOPNOTSUPP;
14151 
14152 	cfg80211_stop_nan(rdev, wdev);
14153 
14154 	return 0;
14155 }
14156 
14157 static int validate_nan_filter(struct nlattr *filter_attr)
14158 {
14159 	struct nlattr *attr;
14160 	int len = 0, n_entries = 0, rem;
14161 
14162 	nla_for_each_nested(attr, filter_attr, rem) {
14163 		len += nla_len(attr);
14164 		n_entries++;
14165 	}
14166 
14167 	if (len >= U8_MAX)
14168 		return -EINVAL;
14169 
14170 	return n_entries;
14171 }
14172 
14173 static int handle_nan_filter(struct nlattr *attr_filter,
14174 			     struct cfg80211_nan_func *func,
14175 			     bool tx)
14176 {
14177 	struct nlattr *attr;
14178 	int n_entries, rem, i;
14179 	struct cfg80211_nan_func_filter *filter;
14180 
14181 	n_entries = validate_nan_filter(attr_filter);
14182 	if (n_entries < 0)
14183 		return n_entries;
14184 
14185 	BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14186 
14187 	filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14188 	if (!filter)
14189 		return -ENOMEM;
14190 
14191 	i = 0;
14192 	nla_for_each_nested(attr, attr_filter, rem) {
14193 		filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14194 		if (!filter[i].filter)
14195 			goto err;
14196 
14197 		filter[i].len = nla_len(attr);
14198 		i++;
14199 	}
14200 	if (tx) {
14201 		func->num_tx_filters = n_entries;
14202 		func->tx_filters = filter;
14203 	} else {
14204 		func->num_rx_filters = n_entries;
14205 		func->rx_filters = filter;
14206 	}
14207 
14208 	return 0;
14209 
14210 err:
14211 	i = 0;
14212 	nla_for_each_nested(attr, attr_filter, rem) {
14213 		kfree(filter[i].filter);
14214 		i++;
14215 	}
14216 	kfree(filter);
14217 	return -ENOMEM;
14218 }
14219 
14220 static int nl80211_nan_add_func(struct sk_buff *skb,
14221 				struct genl_info *info)
14222 {
14223 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14224 	struct wireless_dev *wdev = info->user_ptr[1];
14225 	struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14226 	struct cfg80211_nan_func *func;
14227 	struct sk_buff *msg = NULL;
14228 	void *hdr = NULL;
14229 	int err = 0;
14230 
14231 	if (wdev->iftype != NL80211_IFTYPE_NAN)
14232 		return -EOPNOTSUPP;
14233 
14234 	if (!wdev_running(wdev))
14235 		return -ENOTCONN;
14236 
14237 	if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14238 		return -EINVAL;
14239 
14240 	err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14241 					  info->attrs[NL80211_ATTR_NAN_FUNC],
14242 					  nl80211_nan_func_policy,
14243 					  info->extack);
14244 	if (err)
14245 		return err;
14246 
14247 	func = kzalloc(sizeof(*func), GFP_KERNEL);
14248 	if (!func)
14249 		return -ENOMEM;
14250 
14251 	func->cookie = cfg80211_assign_cookie(rdev);
14252 
14253 	if (!tb[NL80211_NAN_FUNC_TYPE]) {
14254 		err = -EINVAL;
14255 		goto out;
14256 	}
14257 
14258 
14259 	func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14260 
14261 	if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14262 		err = -EINVAL;
14263 		goto out;
14264 	}
14265 
14266 	memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14267 	       sizeof(func->service_id));
14268 
14269 	func->close_range =
14270 		nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14271 
14272 	if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14273 		func->serv_spec_info_len =
14274 			nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14275 		func->serv_spec_info =
14276 			kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14277 				func->serv_spec_info_len,
14278 				GFP_KERNEL);
14279 		if (!func->serv_spec_info) {
14280 			err = -ENOMEM;
14281 			goto out;
14282 		}
14283 	}
14284 
14285 	if (tb[NL80211_NAN_FUNC_TTL])
14286 		func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14287 
14288 	switch (func->type) {
14289 	case NL80211_NAN_FUNC_PUBLISH:
14290 		if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14291 			err = -EINVAL;
14292 			goto out;
14293 		}
14294 
14295 		func->publish_type =
14296 			nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14297 		func->publish_bcast =
14298 			nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14299 
14300 		if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14301 			func->publish_bcast) {
14302 			err = -EINVAL;
14303 			goto out;
14304 		}
14305 		break;
14306 	case NL80211_NAN_FUNC_SUBSCRIBE:
14307 		func->subscribe_active =
14308 			nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14309 		break;
14310 	case NL80211_NAN_FUNC_FOLLOW_UP:
14311 		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14312 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14313 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14314 			err = -EINVAL;
14315 			goto out;
14316 		}
14317 
14318 		func->followup_id =
14319 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14320 		func->followup_reqid =
14321 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14322 		memcpy(func->followup_dest.addr,
14323 		       nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14324 		       sizeof(func->followup_dest.addr));
14325 		if (func->ttl) {
14326 			err = -EINVAL;
14327 			goto out;
14328 		}
14329 		break;
14330 	default:
14331 		err = -EINVAL;
14332 		goto out;
14333 	}
14334 
14335 	if (tb[NL80211_NAN_FUNC_SRF]) {
14336 		struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14337 
14338 		err = nla_parse_nested_deprecated(srf_tb,
14339 						  NL80211_NAN_SRF_ATTR_MAX,
14340 						  tb[NL80211_NAN_FUNC_SRF],
14341 						  nl80211_nan_srf_policy,
14342 						  info->extack);
14343 		if (err)
14344 			goto out;
14345 
14346 		func->srf_include =
14347 			nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14348 
14349 		if (srf_tb[NL80211_NAN_SRF_BF]) {
14350 			if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14351 			    !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14352 				err = -EINVAL;
14353 				goto out;
14354 			}
14355 
14356 			func->srf_bf_len =
14357 				nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14358 			func->srf_bf =
14359 				kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14360 					func->srf_bf_len, GFP_KERNEL);
14361 			if (!func->srf_bf) {
14362 				err = -ENOMEM;
14363 				goto out;
14364 			}
14365 
14366 			func->srf_bf_idx =
14367 				nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14368 		} else {
14369 			struct nlattr *attr, *mac_attr =
14370 				srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14371 			int n_entries, rem, i = 0;
14372 
14373 			if (!mac_attr) {
14374 				err = -EINVAL;
14375 				goto out;
14376 			}
14377 
14378 			n_entries = validate_acl_mac_addrs(mac_attr);
14379 			if (n_entries <= 0) {
14380 				err = -EINVAL;
14381 				goto out;
14382 			}
14383 
14384 			func->srf_num_macs = n_entries;
14385 			func->srf_macs =
14386 				kcalloc(n_entries, sizeof(*func->srf_macs),
14387 					GFP_KERNEL);
14388 			if (!func->srf_macs) {
14389 				err = -ENOMEM;
14390 				goto out;
14391 			}
14392 
14393 			nla_for_each_nested(attr, mac_attr, rem)
14394 				memcpy(func->srf_macs[i++].addr, nla_data(attr),
14395 				       sizeof(*func->srf_macs));
14396 		}
14397 	}
14398 
14399 	if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14400 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14401 					func, true);
14402 		if (err)
14403 			goto out;
14404 	}
14405 
14406 	if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14407 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14408 					func, false);
14409 		if (err)
14410 			goto out;
14411 	}
14412 
14413 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14414 	if (!msg) {
14415 		err = -ENOMEM;
14416 		goto out;
14417 	}
14418 
14419 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14420 			     NL80211_CMD_ADD_NAN_FUNCTION);
14421 	/* This can't really happen - we just allocated 4KB */
14422 	if (WARN_ON(!hdr)) {
14423 		err = -ENOMEM;
14424 		goto out;
14425 	}
14426 
14427 	err = rdev_add_nan_func(rdev, wdev, func);
14428 out:
14429 	if (err < 0) {
14430 		cfg80211_free_nan_func(func);
14431 		nlmsg_free(msg);
14432 		return err;
14433 	}
14434 
14435 	/* propagate the instance id and cookie to userspace  */
14436 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14437 			      NL80211_ATTR_PAD))
14438 		goto nla_put_failure;
14439 
14440 	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14441 	if (!func_attr)
14442 		goto nla_put_failure;
14443 
14444 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14445 		       func->instance_id))
14446 		goto nla_put_failure;
14447 
14448 	nla_nest_end(msg, func_attr);
14449 
14450 	genlmsg_end(msg, hdr);
14451 	return genlmsg_reply(msg, info);
14452 
14453 nla_put_failure:
14454 	nlmsg_free(msg);
14455 	return -ENOBUFS;
14456 }
14457 
14458 static int nl80211_nan_del_func(struct sk_buff *skb,
14459 			       struct genl_info *info)
14460 {
14461 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14462 	struct wireless_dev *wdev = info->user_ptr[1];
14463 	u64 cookie;
14464 
14465 	if (wdev->iftype != NL80211_IFTYPE_NAN)
14466 		return -EOPNOTSUPP;
14467 
14468 	if (!wdev_running(wdev))
14469 		return -ENOTCONN;
14470 
14471 	if (!info->attrs[NL80211_ATTR_COOKIE])
14472 		return -EINVAL;
14473 
14474 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14475 
14476 	rdev_del_nan_func(rdev, wdev, cookie);
14477 
14478 	return 0;
14479 }
14480 
14481 static int nl80211_nan_change_config(struct sk_buff *skb,
14482 				     struct genl_info *info)
14483 {
14484 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14485 	struct wireless_dev *wdev = info->user_ptr[1];
14486 	struct cfg80211_nan_conf conf = {};
14487 	u32 changed = 0;
14488 
14489 	if (wdev->iftype != NL80211_IFTYPE_NAN)
14490 		return -EOPNOTSUPP;
14491 
14492 	if (!wdev_running(wdev))
14493 		return -ENOTCONN;
14494 
14495 	if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14496 		conf.master_pref =
14497 			nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14498 		if (conf.master_pref <= 1 || conf.master_pref == 255)
14499 			return -EINVAL;
14500 
14501 		changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14502 	}
14503 
14504 	if (info->attrs[NL80211_ATTR_BANDS]) {
14505 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14506 
14507 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14508 			return -EOPNOTSUPP;
14509 
14510 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14511 			return -EINVAL;
14512 
14513 		conf.bands = bands;
14514 		changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14515 	}
14516 
14517 	if (!changed)
14518 		return -EINVAL;
14519 
14520 	return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14521 }
14522 
14523 void cfg80211_nan_match(struct wireless_dev *wdev,
14524 			struct cfg80211_nan_match_params *match, gfp_t gfp)
14525 {
14526 	struct wiphy *wiphy = wdev->wiphy;
14527 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14528 	struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14529 	struct sk_buff *msg;
14530 	void *hdr;
14531 
14532 	if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14533 		return;
14534 
14535 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14536 	if (!msg)
14537 		return;
14538 
14539 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14540 	if (!hdr) {
14541 		nlmsg_free(msg);
14542 		return;
14543 	}
14544 
14545 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14546 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14547 					 wdev->netdev->ifindex)) ||
14548 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14549 			      NL80211_ATTR_PAD))
14550 		goto nla_put_failure;
14551 
14552 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14553 			      NL80211_ATTR_PAD) ||
14554 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14555 		goto nla_put_failure;
14556 
14557 	match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14558 	if (!match_attr)
14559 		goto nla_put_failure;
14560 
14561 	local_func_attr = nla_nest_start_noflag(msg,
14562 						NL80211_NAN_MATCH_FUNC_LOCAL);
14563 	if (!local_func_attr)
14564 		goto nla_put_failure;
14565 
14566 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14567 		goto nla_put_failure;
14568 
14569 	nla_nest_end(msg, local_func_attr);
14570 
14571 	peer_func_attr = nla_nest_start_noflag(msg,
14572 					       NL80211_NAN_MATCH_FUNC_PEER);
14573 	if (!peer_func_attr)
14574 		goto nla_put_failure;
14575 
14576 	if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14577 	    nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14578 		goto nla_put_failure;
14579 
14580 	if (match->info && match->info_len &&
14581 	    nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14582 		    match->info))
14583 		goto nla_put_failure;
14584 
14585 	nla_nest_end(msg, peer_func_attr);
14586 	nla_nest_end(msg, match_attr);
14587 	genlmsg_end(msg, hdr);
14588 
14589 	if (!wdev->owner_nlportid)
14590 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14591 					msg, 0, NL80211_MCGRP_NAN, gfp);
14592 	else
14593 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14594 				wdev->owner_nlportid);
14595 
14596 	return;
14597 
14598 nla_put_failure:
14599 	nlmsg_free(msg);
14600 }
14601 EXPORT_SYMBOL(cfg80211_nan_match);
14602 
14603 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14604 				  u8 inst_id,
14605 				  enum nl80211_nan_func_term_reason reason,
14606 				  u64 cookie, gfp_t gfp)
14607 {
14608 	struct wiphy *wiphy = wdev->wiphy;
14609 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14610 	struct sk_buff *msg;
14611 	struct nlattr *func_attr;
14612 	void *hdr;
14613 
14614 	if (WARN_ON(!inst_id))
14615 		return;
14616 
14617 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14618 	if (!msg)
14619 		return;
14620 
14621 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14622 	if (!hdr) {
14623 		nlmsg_free(msg);
14624 		return;
14625 	}
14626 
14627 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14628 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14629 					 wdev->netdev->ifindex)) ||
14630 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14631 			      NL80211_ATTR_PAD))
14632 		goto nla_put_failure;
14633 
14634 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14635 			      NL80211_ATTR_PAD))
14636 		goto nla_put_failure;
14637 
14638 	func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14639 	if (!func_attr)
14640 		goto nla_put_failure;
14641 
14642 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14643 	    nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14644 		goto nla_put_failure;
14645 
14646 	nla_nest_end(msg, func_attr);
14647 	genlmsg_end(msg, hdr);
14648 
14649 	if (!wdev->owner_nlportid)
14650 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14651 					msg, 0, NL80211_MCGRP_NAN, gfp);
14652 	else
14653 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14654 				wdev->owner_nlportid);
14655 
14656 	return;
14657 
14658 nla_put_failure:
14659 	nlmsg_free(msg);
14660 }
14661 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14662 
14663 static int nl80211_get_protocol_features(struct sk_buff *skb,
14664 					 struct genl_info *info)
14665 {
14666 	void *hdr;
14667 	struct sk_buff *msg;
14668 
14669 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14670 	if (!msg)
14671 		return -ENOMEM;
14672 
14673 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14674 			     NL80211_CMD_GET_PROTOCOL_FEATURES);
14675 	if (!hdr)
14676 		goto nla_put_failure;
14677 
14678 	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14679 			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14680 		goto nla_put_failure;
14681 
14682 	genlmsg_end(msg, hdr);
14683 	return genlmsg_reply(msg, info);
14684 
14685  nla_put_failure:
14686 	kfree_skb(msg);
14687 	return -ENOBUFS;
14688 }
14689 
14690 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14691 {
14692 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14693 	struct cfg80211_update_ft_ies_params ft_params;
14694 	struct net_device *dev = info->user_ptr[1];
14695 
14696 	if (!rdev->ops->update_ft_ies)
14697 		return -EOPNOTSUPP;
14698 
14699 	if (!info->attrs[NL80211_ATTR_MDID] ||
14700 	    !info->attrs[NL80211_ATTR_IE])
14701 		return -EINVAL;
14702 
14703 	memset(&ft_params, 0, sizeof(ft_params));
14704 	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14705 	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14706 	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14707 
14708 	return rdev_update_ft_ies(rdev, dev, &ft_params);
14709 }
14710 
14711 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14712 				       struct genl_info *info)
14713 {
14714 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14715 	struct wireless_dev *wdev = info->user_ptr[1];
14716 	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14717 	u16 duration;
14718 	int ret;
14719 
14720 	if (!rdev->ops->crit_proto_start)
14721 		return -EOPNOTSUPP;
14722 
14723 	if (WARN_ON(!rdev->ops->crit_proto_stop))
14724 		return -EINVAL;
14725 
14726 	if (rdev->crit_proto_nlportid)
14727 		return -EBUSY;
14728 
14729 	/* determine protocol if provided */
14730 	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14731 		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14732 
14733 	if (proto >= NUM_NL80211_CRIT_PROTO)
14734 		return -EINVAL;
14735 
14736 	/* timeout must be provided */
14737 	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14738 		return -EINVAL;
14739 
14740 	duration =
14741 		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14742 
14743 	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14744 	if (!ret)
14745 		rdev->crit_proto_nlportid = info->snd_portid;
14746 
14747 	return ret;
14748 }
14749 
14750 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14751 				      struct genl_info *info)
14752 {
14753 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14754 	struct wireless_dev *wdev = info->user_ptr[1];
14755 
14756 	if (!rdev->ops->crit_proto_stop)
14757 		return -EOPNOTSUPP;
14758 
14759 	if (rdev->crit_proto_nlportid) {
14760 		rdev->crit_proto_nlportid = 0;
14761 		rdev_crit_proto_stop(rdev, wdev);
14762 	}
14763 	return 0;
14764 }
14765 
14766 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14767 				       struct nlattr *attr,
14768 				       struct netlink_ext_ack *extack)
14769 {
14770 	if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14771 		if (attr->nla_type & NLA_F_NESTED) {
14772 			NL_SET_ERR_MSG_ATTR(extack, attr,
14773 					    "unexpected nested data");
14774 			return -EINVAL;
14775 		}
14776 
14777 		return 0;
14778 	}
14779 
14780 	if (!(attr->nla_type & NLA_F_NESTED)) {
14781 		NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14782 		return -EINVAL;
14783 	}
14784 
14785 	return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14786 }
14787 
14788 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14789 {
14790 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
14791 	struct wireless_dev *wdev =
14792 		__cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14793 					   info->attrs);
14794 	int i, err;
14795 	u32 vid, subcmd;
14796 
14797 	if (!rdev->wiphy.vendor_commands)
14798 		return -EOPNOTSUPP;
14799 
14800 	if (IS_ERR(wdev)) {
14801 		err = PTR_ERR(wdev);
14802 		if (err != -EINVAL)
14803 			return err;
14804 		wdev = NULL;
14805 	} else if (wdev->wiphy != &rdev->wiphy) {
14806 		return -EINVAL;
14807 	}
14808 
14809 	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14810 	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14811 		return -EINVAL;
14812 
14813 	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14814 	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14815 	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14816 		const struct wiphy_vendor_command *vcmd;
14817 		void *data = NULL;
14818 		int len = 0;
14819 
14820 		vcmd = &rdev->wiphy.vendor_commands[i];
14821 
14822 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14823 			continue;
14824 
14825 		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14826 				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14827 			if (!wdev)
14828 				return -EINVAL;
14829 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14830 			    !wdev->netdev)
14831 				return -EINVAL;
14832 
14833 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14834 				if (!wdev_running(wdev))
14835 					return -ENETDOWN;
14836 			}
14837 		} else {
14838 			wdev = NULL;
14839 		}
14840 
14841 		if (!vcmd->doit)
14842 			return -EOPNOTSUPP;
14843 
14844 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14845 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14846 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14847 
14848 			err = nl80211_vendor_check_policy(vcmd,
14849 					info->attrs[NL80211_ATTR_VENDOR_DATA],
14850 					info->extack);
14851 			if (err)
14852 				return err;
14853 		}
14854 
14855 		rdev->cur_cmd_info = info;
14856 		err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14857 		rdev->cur_cmd_info = NULL;
14858 		return err;
14859 	}
14860 
14861 	return -EOPNOTSUPP;
14862 }
14863 
14864 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14865 				       struct netlink_callback *cb,
14866 				       struct cfg80211_registered_device **rdev,
14867 				       struct wireless_dev **wdev)
14868 {
14869 	struct nlattr **attrbuf;
14870 	u32 vid, subcmd;
14871 	unsigned int i;
14872 	int vcmd_idx = -1;
14873 	int err;
14874 	void *data = NULL;
14875 	unsigned int data_len = 0;
14876 
14877 	if (cb->args[0]) {
14878 		/* subtract the 1 again here */
14879 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14880 		struct wireless_dev *tmp;
14881 
14882 		if (!wiphy)
14883 			return -ENODEV;
14884 		*rdev = wiphy_to_rdev(wiphy);
14885 		*wdev = NULL;
14886 
14887 		if (cb->args[1]) {
14888 			list_for_each_entry(tmp, &wiphy->wdev_list, list) {
14889 				if (tmp->identifier == cb->args[1] - 1) {
14890 					*wdev = tmp;
14891 					break;
14892 				}
14893 			}
14894 		}
14895 
14896 		/* keep rtnl locked in successful case */
14897 		return 0;
14898 	}
14899 
14900 	attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
14901 	if (!attrbuf)
14902 		return -ENOMEM;
14903 
14904 	err = nlmsg_parse_deprecated(cb->nlh,
14905 				     GENL_HDRLEN + nl80211_fam.hdrsize,
14906 				     attrbuf, nl80211_fam.maxattr,
14907 				     nl80211_policy, NULL);
14908 	if (err)
14909 		goto out;
14910 
14911 	if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
14912 	    !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
14913 		err = -EINVAL;
14914 		goto out;
14915 	}
14916 
14917 	*wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
14918 	if (IS_ERR(*wdev))
14919 		*wdev = NULL;
14920 
14921 	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
14922 	if (IS_ERR(*rdev)) {
14923 		err = PTR_ERR(*rdev);
14924 		goto out;
14925 	}
14926 
14927 	vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
14928 	subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
14929 
14930 	for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
14931 		const struct wiphy_vendor_command *vcmd;
14932 
14933 		vcmd = &(*rdev)->wiphy.vendor_commands[i];
14934 
14935 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14936 			continue;
14937 
14938 		if (!vcmd->dumpit) {
14939 			err = -EOPNOTSUPP;
14940 			goto out;
14941 		}
14942 
14943 		vcmd_idx = i;
14944 		break;
14945 	}
14946 
14947 	if (vcmd_idx < 0) {
14948 		err = -EOPNOTSUPP;
14949 		goto out;
14950 	}
14951 
14952 	if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
14953 		data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14954 		data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14955 
14956 		err = nl80211_vendor_check_policy(
14957 				&(*rdev)->wiphy.vendor_commands[vcmd_idx],
14958 				attrbuf[NL80211_ATTR_VENDOR_DATA],
14959 				cb->extack);
14960 		if (err)
14961 			goto out;
14962 	}
14963 
14964 	/* 0 is the first index - add 1 to parse only once */
14965 	cb->args[0] = (*rdev)->wiphy_idx + 1;
14966 	/* add 1 to know if it was NULL */
14967 	cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
14968 	cb->args[2] = vcmd_idx;
14969 	cb->args[3] = (unsigned long)data;
14970 	cb->args[4] = data_len;
14971 
14972 	/* keep rtnl locked in successful case */
14973 	err = 0;
14974 out:
14975 	kfree(attrbuf);
14976 	return err;
14977 }
14978 
14979 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
14980 				   struct netlink_callback *cb)
14981 {
14982 	struct cfg80211_registered_device *rdev;
14983 	struct wireless_dev *wdev;
14984 	unsigned int vcmd_idx;
14985 	const struct wiphy_vendor_command *vcmd;
14986 	void *data;
14987 	int data_len;
14988 	int err;
14989 	struct nlattr *vendor_data;
14990 
14991 	rtnl_lock();
14992 	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
14993 	if (err)
14994 		goto out;
14995 
14996 	vcmd_idx = cb->args[2];
14997 	data = (void *)cb->args[3];
14998 	data_len = cb->args[4];
14999 	vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15000 
15001 	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15002 			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15003 		if (!wdev) {
15004 			err = -EINVAL;
15005 			goto out;
15006 		}
15007 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15008 		    !wdev->netdev) {
15009 			err = -EINVAL;
15010 			goto out;
15011 		}
15012 
15013 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15014 			if (!wdev_running(wdev)) {
15015 				err = -ENETDOWN;
15016 				goto out;
15017 			}
15018 		}
15019 	}
15020 
15021 	while (1) {
15022 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15023 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
15024 					   NL80211_CMD_VENDOR);
15025 		if (!hdr)
15026 			break;
15027 
15028 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15029 		    (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15030 					       wdev_id(wdev),
15031 					       NL80211_ATTR_PAD))) {
15032 			genlmsg_cancel(skb, hdr);
15033 			break;
15034 		}
15035 
15036 		vendor_data = nla_nest_start_noflag(skb,
15037 						    NL80211_ATTR_VENDOR_DATA);
15038 		if (!vendor_data) {
15039 			genlmsg_cancel(skb, hdr);
15040 			break;
15041 		}
15042 
15043 		err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15044 				   (unsigned long *)&cb->args[5]);
15045 		nla_nest_end(skb, vendor_data);
15046 
15047 		if (err == -ENOBUFS || err == -ENOENT) {
15048 			genlmsg_cancel(skb, hdr);
15049 			break;
15050 		} else if (err <= 0) {
15051 			genlmsg_cancel(skb, hdr);
15052 			goto out;
15053 		}
15054 
15055 		genlmsg_end(skb, hdr);
15056 	}
15057 
15058 	err = skb->len;
15059  out:
15060 	rtnl_unlock();
15061 	return err;
15062 }
15063 
15064 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15065 					   enum nl80211_commands cmd,
15066 					   enum nl80211_attrs attr,
15067 					   int approxlen)
15068 {
15069 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15070 
15071 	if (WARN_ON(!rdev->cur_cmd_info))
15072 		return NULL;
15073 
15074 	return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15075 					   rdev->cur_cmd_info->snd_portid,
15076 					   rdev->cur_cmd_info->snd_seq,
15077 					   cmd, attr, NULL, GFP_KERNEL);
15078 }
15079 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15080 
15081 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15082 {
15083 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15084 	void *hdr = ((void **)skb->cb)[1];
15085 	struct nlattr *data = ((void **)skb->cb)[2];
15086 
15087 	/* clear CB data for netlink core to own from now on */
15088 	memset(skb->cb, 0, sizeof(skb->cb));
15089 
15090 	if (WARN_ON(!rdev->cur_cmd_info)) {
15091 		kfree_skb(skb);
15092 		return -EINVAL;
15093 	}
15094 
15095 	nla_nest_end(skb, data);
15096 	genlmsg_end(skb, hdr);
15097 	return genlmsg_reply(skb, rdev->cur_cmd_info);
15098 }
15099 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15100 
15101 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15102 {
15103 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15104 
15105 	if (WARN_ON(!rdev->cur_cmd_info))
15106 		return 0;
15107 
15108 	return rdev->cur_cmd_info->snd_portid;
15109 }
15110 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15111 
15112 static int nl80211_set_qos_map(struct sk_buff *skb,
15113 			       struct genl_info *info)
15114 {
15115 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15116 	struct cfg80211_qos_map *qos_map = NULL;
15117 	struct net_device *dev = info->user_ptr[1];
15118 	u8 *pos, len, num_des, des_len, des;
15119 	int ret;
15120 
15121 	if (!rdev->ops->set_qos_map)
15122 		return -EOPNOTSUPP;
15123 
15124 	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15125 		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15126 		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15127 
15128 		if (len % 2)
15129 			return -EINVAL;
15130 
15131 		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15132 		if (!qos_map)
15133 			return -ENOMEM;
15134 
15135 		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15136 		if (num_des) {
15137 			des_len = num_des *
15138 				sizeof(struct cfg80211_dscp_exception);
15139 			memcpy(qos_map->dscp_exception, pos, des_len);
15140 			qos_map->num_des = num_des;
15141 			for (des = 0; des < num_des; des++) {
15142 				if (qos_map->dscp_exception[des].up > 7) {
15143 					kfree(qos_map);
15144 					return -EINVAL;
15145 				}
15146 			}
15147 			pos += des_len;
15148 		}
15149 		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15150 	}
15151 
15152 	wdev_lock(dev->ieee80211_ptr);
15153 	ret = nl80211_key_allowed(dev->ieee80211_ptr);
15154 	if (!ret)
15155 		ret = rdev_set_qos_map(rdev, dev, qos_map);
15156 	wdev_unlock(dev->ieee80211_ptr);
15157 
15158 	kfree(qos_map);
15159 	return ret;
15160 }
15161 
15162 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15163 {
15164 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15165 	struct net_device *dev = info->user_ptr[1];
15166 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15167 	const u8 *peer;
15168 	u8 tsid, up;
15169 	u16 admitted_time = 0;
15170 	int err;
15171 
15172 	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15173 		return -EOPNOTSUPP;
15174 
15175 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15176 	    !info->attrs[NL80211_ATTR_USER_PRIO])
15177 		return -EINVAL;
15178 
15179 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15180 	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15181 
15182 	/* WMM uses TIDs 0-7 even for TSPEC */
15183 	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15184 		/* TODO: handle 802.11 TSPEC/admission control
15185 		 * need more attributes for that (e.g. BA session requirement);
15186 		 * change the WMM adminssion test above to allow both then
15187 		 */
15188 		return -EINVAL;
15189 	}
15190 
15191 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15192 
15193 	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15194 		admitted_time =
15195 			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15196 		if (!admitted_time)
15197 			return -EINVAL;
15198 	}
15199 
15200 	wdev_lock(wdev);
15201 	switch (wdev->iftype) {
15202 	case NL80211_IFTYPE_STATION:
15203 	case NL80211_IFTYPE_P2P_CLIENT:
15204 		if (wdev->connected)
15205 			break;
15206 		err = -ENOTCONN;
15207 		goto out;
15208 	default:
15209 		err = -EOPNOTSUPP;
15210 		goto out;
15211 	}
15212 
15213 	err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15214 
15215  out:
15216 	wdev_unlock(wdev);
15217 	return err;
15218 }
15219 
15220 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15221 {
15222 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15223 	struct net_device *dev = info->user_ptr[1];
15224 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15225 	const u8 *peer;
15226 	u8 tsid;
15227 	int err;
15228 
15229 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15230 		return -EINVAL;
15231 
15232 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15233 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15234 
15235 	wdev_lock(wdev);
15236 	err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15237 	wdev_unlock(wdev);
15238 
15239 	return err;
15240 }
15241 
15242 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15243 				       struct genl_info *info)
15244 {
15245 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15246 	struct net_device *dev = info->user_ptr[1];
15247 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15248 	struct cfg80211_chan_def chandef = {};
15249 	const u8 *addr;
15250 	u8 oper_class;
15251 	int err;
15252 
15253 	if (!rdev->ops->tdls_channel_switch ||
15254 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15255 		return -EOPNOTSUPP;
15256 
15257 	switch (dev->ieee80211_ptr->iftype) {
15258 	case NL80211_IFTYPE_STATION:
15259 	case NL80211_IFTYPE_P2P_CLIENT:
15260 		break;
15261 	default:
15262 		return -EOPNOTSUPP;
15263 	}
15264 
15265 	if (!info->attrs[NL80211_ATTR_MAC] ||
15266 	    !info->attrs[NL80211_ATTR_OPER_CLASS])
15267 		return -EINVAL;
15268 
15269 	err = nl80211_parse_chandef(rdev, info, &chandef);
15270 	if (err)
15271 		return err;
15272 
15273 	/*
15274 	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15275 	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15276 	 * specification is not defined for them.
15277 	 */
15278 	if (chandef.chan->band == NL80211_BAND_2GHZ &&
15279 	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15280 	    chandef.width != NL80211_CHAN_WIDTH_20)
15281 		return -EINVAL;
15282 
15283 	/* we will be active on the TDLS link */
15284 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15285 					   wdev->iftype))
15286 		return -EINVAL;
15287 
15288 	/* don't allow switching to DFS channels */
15289 	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15290 		return -EINVAL;
15291 
15292 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15293 	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15294 
15295 	wdev_lock(wdev);
15296 	err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15297 	wdev_unlock(wdev);
15298 
15299 	return err;
15300 }
15301 
15302 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15303 					      struct genl_info *info)
15304 {
15305 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15306 	struct net_device *dev = info->user_ptr[1];
15307 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15308 	const u8 *addr;
15309 
15310 	if (!rdev->ops->tdls_channel_switch ||
15311 	    !rdev->ops->tdls_cancel_channel_switch ||
15312 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15313 		return -EOPNOTSUPP;
15314 
15315 	switch (dev->ieee80211_ptr->iftype) {
15316 	case NL80211_IFTYPE_STATION:
15317 	case NL80211_IFTYPE_P2P_CLIENT:
15318 		break;
15319 	default:
15320 		return -EOPNOTSUPP;
15321 	}
15322 
15323 	if (!info->attrs[NL80211_ATTR_MAC])
15324 		return -EINVAL;
15325 
15326 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15327 
15328 	wdev_lock(wdev);
15329 	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15330 	wdev_unlock(wdev);
15331 
15332 	return 0;
15333 }
15334 
15335 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15336 					    struct genl_info *info)
15337 {
15338 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15339 	struct net_device *dev = info->user_ptr[1];
15340 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15341 	const struct nlattr *nla;
15342 	bool enabled;
15343 
15344 	if (!rdev->ops->set_multicast_to_unicast)
15345 		return -EOPNOTSUPP;
15346 
15347 	if (wdev->iftype != NL80211_IFTYPE_AP &&
15348 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
15349 		return -EOPNOTSUPP;
15350 
15351 	nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15352 	enabled = nla_get_flag(nla);
15353 
15354 	return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15355 }
15356 
15357 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15358 {
15359 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15360 	struct net_device *dev = info->user_ptr[1];
15361 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15362 	struct cfg80211_pmk_conf pmk_conf = {};
15363 	int ret;
15364 
15365 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
15366 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15367 		return -EOPNOTSUPP;
15368 
15369 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
15370 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15371 		return -EOPNOTSUPP;
15372 
15373 	if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15374 		return -EINVAL;
15375 
15376 	wdev_lock(wdev);
15377 	if (!wdev->connected) {
15378 		ret = -ENOTCONN;
15379 		goto out;
15380 	}
15381 
15382 	pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15383 	if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15384 		ret = -EINVAL;
15385 		goto out;
15386 	}
15387 
15388 	pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15389 	pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15390 	if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15391 	    pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15392 		ret = -EINVAL;
15393 		goto out;
15394 	}
15395 
15396 	if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15397 		pmk_conf.pmk_r0_name =
15398 			nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15399 
15400 	ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15401 out:
15402 	wdev_unlock(wdev);
15403 	return ret;
15404 }
15405 
15406 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15407 {
15408 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15409 	struct net_device *dev = info->user_ptr[1];
15410 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15411 	const u8 *aa;
15412 	int ret;
15413 
15414 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
15415 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15416 		return -EOPNOTSUPP;
15417 
15418 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
15419 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15420 		return -EOPNOTSUPP;
15421 
15422 	if (!info->attrs[NL80211_ATTR_MAC])
15423 		return -EINVAL;
15424 
15425 	wdev_lock(wdev);
15426 	aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15427 	ret = rdev_del_pmk(rdev, dev, aa);
15428 	wdev_unlock(wdev);
15429 
15430 	return ret;
15431 }
15432 
15433 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15434 {
15435 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15436 	struct net_device *dev = info->user_ptr[1];
15437 	struct cfg80211_external_auth_params params;
15438 
15439 	if (!rdev->ops->external_auth)
15440 		return -EOPNOTSUPP;
15441 
15442 	if (!info->attrs[NL80211_ATTR_SSID] &&
15443 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15444 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15445 		return -EINVAL;
15446 
15447 	if (!info->attrs[NL80211_ATTR_BSSID])
15448 		return -EINVAL;
15449 
15450 	if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15451 		return -EINVAL;
15452 
15453 	memset(&params, 0, sizeof(params));
15454 
15455 	if (info->attrs[NL80211_ATTR_SSID]) {
15456 		params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15457 		if (params.ssid.ssid_len == 0)
15458 			return -EINVAL;
15459 		memcpy(params.ssid.ssid,
15460 		       nla_data(info->attrs[NL80211_ATTR_SSID]),
15461 		       params.ssid.ssid_len);
15462 	}
15463 
15464 	memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15465 	       ETH_ALEN);
15466 
15467 	params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15468 
15469 	if (info->attrs[NL80211_ATTR_PMKID])
15470 		params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15471 
15472 	return rdev_external_auth(rdev, dev, &params);
15473 }
15474 
15475 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15476 {
15477 	bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15478 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15479 	struct net_device *dev = info->user_ptr[1];
15480 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15481 	const u8 *buf;
15482 	size_t len;
15483 	u8 *dest;
15484 	u16 proto;
15485 	bool noencrypt;
15486 	u64 cookie = 0;
15487 	int link_id;
15488 	int err;
15489 
15490 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
15491 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15492 		return -EOPNOTSUPP;
15493 
15494 	if (!rdev->ops->tx_control_port)
15495 		return -EOPNOTSUPP;
15496 
15497 	if (!info->attrs[NL80211_ATTR_FRAME] ||
15498 	    !info->attrs[NL80211_ATTR_MAC] ||
15499 	    !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15500 		GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15501 		return -EINVAL;
15502 	}
15503 
15504 	wdev_lock(wdev);
15505 
15506 	switch (wdev->iftype) {
15507 	case NL80211_IFTYPE_AP:
15508 	case NL80211_IFTYPE_P2P_GO:
15509 	case NL80211_IFTYPE_MESH_POINT:
15510 		break;
15511 	case NL80211_IFTYPE_ADHOC:
15512 		if (wdev->u.ibss.current_bss)
15513 			break;
15514 		err = -ENOTCONN;
15515 		goto out;
15516 	case NL80211_IFTYPE_STATION:
15517 	case NL80211_IFTYPE_P2P_CLIENT:
15518 		if (wdev->connected)
15519 			break;
15520 		err = -ENOTCONN;
15521 		goto out;
15522 	default:
15523 		err = -EOPNOTSUPP;
15524 		goto out;
15525 	}
15526 
15527 	wdev_unlock(wdev);
15528 
15529 	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15530 	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15531 	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15532 	proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15533 	noencrypt =
15534 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15535 
15536 	link_id = nl80211_link_id_or_invalid(info->attrs);
15537 
15538 	err = rdev_tx_control_port(rdev, dev, buf, len,
15539 				   dest, cpu_to_be16(proto), noencrypt, link_id,
15540 				   dont_wait_for_ack ? NULL : &cookie);
15541 	if (!err && !dont_wait_for_ack)
15542 		nl_set_extack_cookie_u64(info->extack, cookie);
15543 	return err;
15544  out:
15545 	wdev_unlock(wdev);
15546 	return err;
15547 }
15548 
15549 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15550 					   struct genl_info *info)
15551 {
15552 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15553 	struct net_device *dev = info->user_ptr[1];
15554 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15555 	struct cfg80211_ftm_responder_stats ftm_stats = {};
15556 	unsigned int link_id = nl80211_link_id(info->attrs);
15557 	struct sk_buff *msg;
15558 	void *hdr;
15559 	struct nlattr *ftm_stats_attr;
15560 	int err;
15561 
15562 	if (wdev->iftype != NL80211_IFTYPE_AP ||
15563 	    !wdev->links[link_id].ap.beacon_interval)
15564 		return -EOPNOTSUPP;
15565 
15566 	err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15567 	if (err)
15568 		return err;
15569 
15570 	if (!ftm_stats.filled)
15571 		return -ENODATA;
15572 
15573 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15574 	if (!msg)
15575 		return -ENOMEM;
15576 
15577 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15578 			     NL80211_CMD_GET_FTM_RESPONDER_STATS);
15579 	if (!hdr)
15580 		goto nla_put_failure;
15581 
15582 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15583 		goto nla_put_failure;
15584 
15585 	ftm_stats_attr = nla_nest_start_noflag(msg,
15586 					       NL80211_ATTR_FTM_RESPONDER_STATS);
15587 	if (!ftm_stats_attr)
15588 		goto nla_put_failure;
15589 
15590 #define SET_FTM(field, name, type)					 \
15591 	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15592 	    nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,		 \
15593 			     ftm_stats.field))				 \
15594 		goto nla_put_failure; } while (0)
15595 #define SET_FTM_U64(field, name)					 \
15596 	do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15597 	    nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,		 \
15598 			      ftm_stats.field, NL80211_FTM_STATS_PAD))	 \
15599 		goto nla_put_failure; } while (0)
15600 
15601 	SET_FTM(success_num, SUCCESS_NUM, u32);
15602 	SET_FTM(partial_num, PARTIAL_NUM, u32);
15603 	SET_FTM(failed_num, FAILED_NUM, u32);
15604 	SET_FTM(asap_num, ASAP_NUM, u32);
15605 	SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15606 	SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15607 	SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15608 	SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15609 	SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15610 #undef SET_FTM
15611 
15612 	nla_nest_end(msg, ftm_stats_attr);
15613 
15614 	genlmsg_end(msg, hdr);
15615 	return genlmsg_reply(msg, info);
15616 
15617 nla_put_failure:
15618 	nlmsg_free(msg);
15619 	return -ENOBUFS;
15620 }
15621 
15622 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15623 {
15624 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15625 	struct cfg80211_update_owe_info owe_info;
15626 	struct net_device *dev = info->user_ptr[1];
15627 
15628 	if (!rdev->ops->update_owe_info)
15629 		return -EOPNOTSUPP;
15630 
15631 	if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15632 	    !info->attrs[NL80211_ATTR_MAC])
15633 		return -EINVAL;
15634 
15635 	memset(&owe_info, 0, sizeof(owe_info));
15636 	owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15637 	nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15638 
15639 	if (info->attrs[NL80211_ATTR_IE]) {
15640 		owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15641 		owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15642 	}
15643 
15644 	return rdev_update_owe_info(rdev, dev, &owe_info);
15645 }
15646 
15647 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15648 {
15649 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15650 	struct net_device *dev = info->user_ptr[1];
15651 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15652 	struct station_info sinfo = {};
15653 	const u8 *buf;
15654 	size_t len;
15655 	u8 *dest;
15656 	int err;
15657 
15658 	if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15659 		return -EOPNOTSUPP;
15660 
15661 	if (!info->attrs[NL80211_ATTR_MAC] ||
15662 	    !info->attrs[NL80211_ATTR_FRAME]) {
15663 		GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15664 		return -EINVAL;
15665 	}
15666 
15667 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15668 		return -EOPNOTSUPP;
15669 
15670 	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15671 	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15672 	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15673 
15674 	if (len < sizeof(struct ethhdr))
15675 		return -EINVAL;
15676 
15677 	if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15678 	    !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15679 		return -EINVAL;
15680 
15681 	err = rdev_get_station(rdev, dev, dest, &sinfo);
15682 	if (err)
15683 		return err;
15684 
15685 	cfg80211_sinfo_release_content(&sinfo);
15686 
15687 	return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15688 }
15689 
15690 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15691 			  struct nlattr *attrs[], struct net_device *dev,
15692 			  struct cfg80211_tid_cfg *tid_conf,
15693 			  struct genl_info *info, const u8 *peer,
15694 			  unsigned int link_id)
15695 {
15696 	struct netlink_ext_ack *extack = info->extack;
15697 	u64 mask;
15698 	int err;
15699 
15700 	if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15701 		return -EINVAL;
15702 
15703 	tid_conf->config_override =
15704 			nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15705 	tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15706 
15707 	if (tid_conf->config_override) {
15708 		if (rdev->ops->reset_tid_config) {
15709 			err = rdev_reset_tid_config(rdev, dev, peer,
15710 						    tid_conf->tids);
15711 			if (err)
15712 				return err;
15713 		} else {
15714 			return -EINVAL;
15715 		}
15716 	}
15717 
15718 	if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15719 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15720 		tid_conf->noack =
15721 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15722 	}
15723 
15724 	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15725 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15726 		tid_conf->retry_short =
15727 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15728 
15729 		if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15730 			return -EINVAL;
15731 	}
15732 
15733 	if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15734 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15735 		tid_conf->retry_long =
15736 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15737 
15738 		if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15739 			return -EINVAL;
15740 	}
15741 
15742 	if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15743 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15744 		tid_conf->ampdu =
15745 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15746 	}
15747 
15748 	if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15749 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15750 		tid_conf->rtscts =
15751 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15752 	}
15753 
15754 	if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15755 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15756 		tid_conf->amsdu =
15757 			nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15758 	}
15759 
15760 	if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15761 		u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15762 
15763 		tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15764 
15765 		if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15766 			attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15767 			err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15768 						    &tid_conf->txrate_mask, dev,
15769 						    true, link_id);
15770 			if (err)
15771 				return err;
15772 
15773 			tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15774 		}
15775 		tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15776 	}
15777 
15778 	if (peer)
15779 		mask = rdev->wiphy.tid_config_support.peer;
15780 	else
15781 		mask = rdev->wiphy.tid_config_support.vif;
15782 
15783 	if (tid_conf->mask & ~mask) {
15784 		NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15785 		return -ENOTSUPP;
15786 	}
15787 
15788 	return 0;
15789 }
15790 
15791 static int nl80211_set_tid_config(struct sk_buff *skb,
15792 				  struct genl_info *info)
15793 {
15794 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15795 	struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15796 	unsigned int link_id = nl80211_link_id(info->attrs);
15797 	struct net_device *dev = info->user_ptr[1];
15798 	struct cfg80211_tid_config *tid_config;
15799 	struct nlattr *tid;
15800 	int conf_idx = 0, rem_conf;
15801 	int ret = -EINVAL;
15802 	u32 num_conf = 0;
15803 
15804 	if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15805 		return -EINVAL;
15806 
15807 	if (!rdev->ops->set_tid_config)
15808 		return -EOPNOTSUPP;
15809 
15810 	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15811 			    rem_conf)
15812 		num_conf++;
15813 
15814 	tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15815 			     GFP_KERNEL);
15816 	if (!tid_config)
15817 		return -ENOMEM;
15818 
15819 	tid_config->n_tid_conf = num_conf;
15820 
15821 	if (info->attrs[NL80211_ATTR_MAC])
15822 		tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15823 
15824 	wdev_lock(dev->ieee80211_ptr);
15825 
15826 	nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15827 			    rem_conf) {
15828 		ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15829 				       tid, NULL, NULL);
15830 
15831 		if (ret)
15832 			goto bad_tid_conf;
15833 
15834 		ret = parse_tid_conf(rdev, attrs, dev,
15835 				     &tid_config->tid_conf[conf_idx],
15836 				     info, tid_config->peer, link_id);
15837 		if (ret)
15838 			goto bad_tid_conf;
15839 
15840 		conf_idx++;
15841 	}
15842 
15843 	ret = rdev_set_tid_config(rdev, dev, tid_config);
15844 
15845 bad_tid_conf:
15846 	kfree(tid_config);
15847 	wdev_unlock(dev->ieee80211_ptr);
15848 	return ret;
15849 }
15850 
15851 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15852 {
15853 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15854 	struct cfg80211_color_change_settings params = {};
15855 	struct net_device *dev = info->user_ptr[1];
15856 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15857 	struct nlattr **tb;
15858 	u16 offset;
15859 	int err;
15860 
15861 	if (!rdev->ops->color_change)
15862 		return -EOPNOTSUPP;
15863 
15864 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
15865 				     NL80211_EXT_FEATURE_BSS_COLOR))
15866 		return -EOPNOTSUPP;
15867 
15868 	if (wdev->iftype != NL80211_IFTYPE_AP)
15869 		return -EOPNOTSUPP;
15870 
15871 	if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15872 	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15873 	    !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15874 		return -EINVAL;
15875 
15876 	params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15877 	params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15878 
15879 	err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next);
15880 	if (err)
15881 		return err;
15882 
15883 	tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15884 	if (!tb)
15885 		return -ENOMEM;
15886 
15887 	err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15888 			       info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15889 			       nl80211_policy, info->extack);
15890 	if (err)
15891 		goto out;
15892 
15893 	err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change);
15894 	if (err)
15895 		goto out;
15896 
15897 	if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15898 		err = -EINVAL;
15899 		goto out;
15900 	}
15901 
15902 	if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15903 		err = -EINVAL;
15904 		goto out;
15905 	}
15906 
15907 	offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15908 	if (offset >= params.beacon_color_change.tail_len) {
15909 		err = -EINVAL;
15910 		goto out;
15911 	}
15912 
15913 	if (params.beacon_color_change.tail[offset] != params.count) {
15914 		err = -EINVAL;
15915 		goto out;
15916 	}
15917 
15918 	params.counter_offset_beacon = offset;
15919 
15920 	if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
15921 		if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
15922 		    sizeof(u16)) {
15923 			err = -EINVAL;
15924 			goto out;
15925 		}
15926 
15927 		offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
15928 		if (offset >= params.beacon_color_change.probe_resp_len) {
15929 			err = -EINVAL;
15930 			goto out;
15931 		}
15932 
15933 		if (params.beacon_color_change.probe_resp[offset] !=
15934 		    params.count) {
15935 			err = -EINVAL;
15936 			goto out;
15937 		}
15938 
15939 		params.counter_offset_presp = offset;
15940 	}
15941 
15942 	wdev_lock(wdev);
15943 	err = rdev_color_change(rdev, dev, &params);
15944 	wdev_unlock(wdev);
15945 
15946 out:
15947 	kfree(params.beacon_next.mbssid_ies);
15948 	kfree(params.beacon_color_change.mbssid_ies);
15949 	kfree(tb);
15950 	return err;
15951 }
15952 
15953 static int nl80211_set_fils_aad(struct sk_buff *skb,
15954 				struct genl_info *info)
15955 {
15956 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15957 	struct net_device *dev = info->user_ptr[1];
15958 	struct cfg80211_fils_aad fils_aad = {};
15959 	u8 *nonces;
15960 
15961 	if (!info->attrs[NL80211_ATTR_MAC] ||
15962 	    !info->attrs[NL80211_ATTR_FILS_KEK] ||
15963 	    !info->attrs[NL80211_ATTR_FILS_NONCES])
15964 		return -EINVAL;
15965 
15966 	fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15967 	fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
15968 	fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
15969 	nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
15970 	fils_aad.snonce = nonces;
15971 	fils_aad.anonce = nonces + FILS_NONCE_LEN;
15972 
15973 	return rdev_set_fils_aad(rdev, dev, &fils_aad);
15974 }
15975 
15976 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
15977 {
15978 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
15979 	unsigned int link_id = nl80211_link_id(info->attrs);
15980 	struct net_device *dev = info->user_ptr[1];
15981 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15982 	int ret;
15983 
15984 	if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
15985 		return -EINVAL;
15986 
15987 	switch (wdev->iftype) {
15988 	case NL80211_IFTYPE_AP:
15989 		break;
15990 	default:
15991 		return -EINVAL;
15992 	}
15993 
15994 	if (!info->attrs[NL80211_ATTR_MAC] ||
15995 	    !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
15996 		return -EINVAL;
15997 
15998 	wdev_lock(wdev);
15999 	wdev->valid_links |= BIT(link_id);
16000 	ether_addr_copy(wdev->links[link_id].addr,
16001 			nla_data(info->attrs[NL80211_ATTR_MAC]));
16002 
16003 	ret = rdev_add_intf_link(rdev, wdev, link_id);
16004 	if (ret) {
16005 		wdev->valid_links &= ~BIT(link_id);
16006 		eth_zero_addr(wdev->links[link_id].addr);
16007 	}
16008 	wdev_unlock(wdev);
16009 
16010 	return ret;
16011 }
16012 
16013 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16014 {
16015 	unsigned int link_id = nl80211_link_id(info->attrs);
16016 	struct net_device *dev = info->user_ptr[1];
16017 	struct wireless_dev *wdev = dev->ieee80211_ptr;
16018 
16019 	/* cannot remove if there's no link */
16020 	if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16021 		return -EINVAL;
16022 
16023 	switch (wdev->iftype) {
16024 	case NL80211_IFTYPE_AP:
16025 		break;
16026 	default:
16027 		return -EINVAL;
16028 	}
16029 
16030 	wdev_lock(wdev);
16031 	cfg80211_remove_link(wdev, link_id);
16032 	wdev_unlock(wdev);
16033 
16034 	return 0;
16035 }
16036 
16037 static int
16038 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16039 			     bool add)
16040 {
16041 	struct link_station_parameters params = {};
16042 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16043 	struct net_device *dev = info->user_ptr[1];
16044 	int err;
16045 
16046 	if ((add && !rdev->ops->add_link_station) ||
16047 	    (!add && !rdev->ops->mod_link_station))
16048 		return -EOPNOTSUPP;
16049 
16050 	if (add && !info->attrs[NL80211_ATTR_MAC])
16051 		return -EINVAL;
16052 
16053 	if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16054 		return -EINVAL;
16055 
16056 	if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16057 		return -EINVAL;
16058 
16059 	params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16060 
16061 	if (info->attrs[NL80211_ATTR_MAC]) {
16062 		params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16063 		if (!is_valid_ether_addr(params.link_mac))
16064 			return -EINVAL;
16065 	}
16066 
16067 	if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16068 		return -EINVAL;
16069 
16070 	params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16071 
16072 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16073 		params.supported_rates =
16074 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16075 		params.supported_rates_len =
16076 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16077 	}
16078 
16079 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16080 		params.ht_capa =
16081 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16082 
16083 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16084 		params.vht_capa =
16085 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16086 
16087 	if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16088 		params.he_capa =
16089 			nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16090 		params.he_capa_len =
16091 			nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16092 
16093 		if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16094 			params.eht_capa =
16095 				nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16096 			params.eht_capa_len =
16097 				nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16098 
16099 			if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16100 							(const u8 *)params.eht_capa,
16101 							params.eht_capa_len,
16102 							false))
16103 				return -EINVAL;
16104 		}
16105 	}
16106 
16107 	if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16108 		params.he_6ghz_capa =
16109 			nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16110 
16111 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16112 		params.opmode_notif_used = true;
16113 		params.opmode_notif =
16114 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16115 	}
16116 
16117 	err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16118 						&params.txpwr_set);
16119 	if (err)
16120 		return err;
16121 
16122 	wdev_lock(dev->ieee80211_ptr);
16123 	if (add)
16124 		err = rdev_add_link_station(rdev, dev, &params);
16125 	else
16126 		err = rdev_mod_link_station(rdev, dev, &params);
16127 	wdev_unlock(dev->ieee80211_ptr);
16128 
16129 	return err;
16130 }
16131 
16132 static int
16133 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16134 {
16135 	return nl80211_add_mod_link_station(skb, info, true);
16136 }
16137 
16138 static int
16139 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16140 {
16141 	return nl80211_add_mod_link_station(skb, info, false);
16142 }
16143 
16144 static int
16145 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16146 {
16147 	struct link_station_del_parameters params = {};
16148 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16149 	struct net_device *dev = info->user_ptr[1];
16150 	int ret;
16151 
16152 	if (!rdev->ops->del_link_station)
16153 		return -EOPNOTSUPP;
16154 
16155 	if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16156 	    !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16157 		return -EINVAL;
16158 
16159 	params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16160 	params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16161 
16162 	wdev_lock(dev->ieee80211_ptr);
16163 	ret = rdev_del_link_station(rdev, dev, &params);
16164 	wdev_unlock(dev->ieee80211_ptr);
16165 
16166 	return ret;
16167 }
16168 
16169 #define NL80211_FLAG_NEED_WIPHY		0x01
16170 #define NL80211_FLAG_NEED_NETDEV	0x02
16171 #define NL80211_FLAG_NEED_RTNL		0x04
16172 #define NL80211_FLAG_CHECK_NETDEV_UP	0x08
16173 #define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
16174 					 NL80211_FLAG_CHECK_NETDEV_UP)
16175 #define NL80211_FLAG_NEED_WDEV		0x10
16176 /* If a netdev is associated, it must be UP, P2P must be started */
16177 #define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
16178 					 NL80211_FLAG_CHECK_NETDEV_UP)
16179 #define NL80211_FLAG_CLEAR_SKB		0x20
16180 #define NL80211_FLAG_NO_WIPHY_MTX	0x40
16181 #define NL80211_FLAG_MLO_VALID_LINK_ID	0x80
16182 #define NL80211_FLAG_MLO_UNSUPPORTED	0x100
16183 
16184 #define INTERNAL_FLAG_SELECTORS(__sel)			\
16185 	SELECTOR(__sel, NONE, 0) /* must be first */	\
16186 	SELECTOR(__sel, WIPHY,				\
16187 		 NL80211_FLAG_NEED_WIPHY)		\
16188 	SELECTOR(__sel, WDEV,				\
16189 		 NL80211_FLAG_NEED_WDEV)		\
16190 	SELECTOR(__sel, NETDEV,				\
16191 		 NL80211_FLAG_NEED_NETDEV)		\
16192 	SELECTOR(__sel, NETDEV_LINK,			\
16193 		 NL80211_FLAG_NEED_NETDEV |		\
16194 		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
16195 	SELECTOR(__sel, NETDEV_NO_MLO,			\
16196 		 NL80211_FLAG_NEED_NETDEV |		\
16197 		 NL80211_FLAG_MLO_UNSUPPORTED)	\
16198 	SELECTOR(__sel, WIPHY_RTNL,			\
16199 		 NL80211_FLAG_NEED_WIPHY |		\
16200 		 NL80211_FLAG_NEED_RTNL)		\
16201 	SELECTOR(__sel, WIPHY_RTNL_NOMTX,		\
16202 		 NL80211_FLAG_NEED_WIPHY |		\
16203 		 NL80211_FLAG_NEED_RTNL |		\
16204 		 NL80211_FLAG_NO_WIPHY_MTX)		\
16205 	SELECTOR(__sel, WDEV_RTNL,			\
16206 		 NL80211_FLAG_NEED_WDEV |		\
16207 		 NL80211_FLAG_NEED_RTNL)		\
16208 	SELECTOR(__sel, NETDEV_RTNL,			\
16209 		 NL80211_FLAG_NEED_NETDEV |		\
16210 		 NL80211_FLAG_NEED_RTNL)		\
16211 	SELECTOR(__sel, NETDEV_UP,			\
16212 		 NL80211_FLAG_NEED_NETDEV_UP)		\
16213 	SELECTOR(__sel, NETDEV_UP_LINK,			\
16214 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16215 		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
16216 	SELECTOR(__sel, NETDEV_UP_NO_MLO,		\
16217 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16218 		 NL80211_FLAG_MLO_UNSUPPORTED)		\
16219 	SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,		\
16220 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16221 		 NL80211_FLAG_CLEAR_SKB |		\
16222 		 NL80211_FLAG_MLO_UNSUPPORTED)		\
16223 	SELECTOR(__sel, NETDEV_UP_NOTMX,		\
16224 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16225 		 NL80211_FLAG_NO_WIPHY_MTX)		\
16226 	SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,		\
16227 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16228 		 NL80211_FLAG_NO_WIPHY_MTX |		\
16229 		 NL80211_FLAG_MLO_UNSUPPORTED)		\
16230 	SELECTOR(__sel, NETDEV_UP_CLEAR,		\
16231 		 NL80211_FLAG_NEED_NETDEV_UP |		\
16232 		 NL80211_FLAG_CLEAR_SKB)		\
16233 	SELECTOR(__sel, WDEV_UP,			\
16234 		 NL80211_FLAG_NEED_WDEV_UP)		\
16235 	SELECTOR(__sel, WDEV_UP_LINK,			\
16236 		 NL80211_FLAG_NEED_WDEV_UP |		\
16237 		 NL80211_FLAG_MLO_VALID_LINK_ID)	\
16238 	SELECTOR(__sel, WDEV_UP_RTNL,			\
16239 		 NL80211_FLAG_NEED_WDEV_UP |		\
16240 		 NL80211_FLAG_NEED_RTNL)		\
16241 	SELECTOR(__sel, WIPHY_CLEAR,			\
16242 		 NL80211_FLAG_NEED_WIPHY |		\
16243 		 NL80211_FLAG_CLEAR_SKB)
16244 
16245 enum nl80211_internal_flags_selector {
16246 #define SELECTOR(_, name, value)	NL80211_IFL_SEL_##name,
16247 	INTERNAL_FLAG_SELECTORS(_)
16248 #undef SELECTOR
16249 };
16250 
16251 static u32 nl80211_internal_flags[] = {
16252 #define SELECTOR(_, name, value)	[NL80211_IFL_SEL_##name] = value,
16253 	INTERNAL_FLAG_SELECTORS(_)
16254 #undef SELECTOR
16255 };
16256 
16257 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16258 			    struct sk_buff *skb,
16259 			    struct genl_info *info)
16260 {
16261 	struct cfg80211_registered_device *rdev = NULL;
16262 	struct wireless_dev *wdev = NULL;
16263 	struct net_device *dev = NULL;
16264 	u32 internal_flags;
16265 	int err;
16266 
16267 	if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16268 		return -EINVAL;
16269 
16270 	internal_flags = nl80211_internal_flags[ops->internal_flags];
16271 
16272 	rtnl_lock();
16273 	if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16274 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16275 		if (IS_ERR(rdev)) {
16276 			err = PTR_ERR(rdev);
16277 			goto out_unlock;
16278 		}
16279 		info->user_ptr[0] = rdev;
16280 	} else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16281 		   internal_flags & NL80211_FLAG_NEED_WDEV) {
16282 		wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16283 						  info->attrs);
16284 		if (IS_ERR(wdev)) {
16285 			err = PTR_ERR(wdev);
16286 			goto out_unlock;
16287 		}
16288 
16289 		dev = wdev->netdev;
16290 		dev_hold(dev);
16291 		rdev = wiphy_to_rdev(wdev->wiphy);
16292 
16293 		if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16294 			if (!dev) {
16295 				err = -EINVAL;
16296 				goto out_unlock;
16297 			}
16298 
16299 			info->user_ptr[1] = dev;
16300 		} else {
16301 			info->user_ptr[1] = wdev;
16302 		}
16303 
16304 		if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16305 		    !wdev_running(wdev)) {
16306 			err = -ENETDOWN;
16307 			goto out_unlock;
16308 		}
16309 
16310 		info->user_ptr[0] = rdev;
16311 	}
16312 
16313 	if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16314 		struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16315 
16316 		if (!wdev) {
16317 			err = -EINVAL;
16318 			goto out_unlock;
16319 		}
16320 
16321 		/* MLO -> require valid link ID */
16322 		if (wdev->valid_links &&
16323 		    (!link_id ||
16324 		     !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16325 			err = -EINVAL;
16326 			goto out_unlock;
16327 		}
16328 
16329 		/* non-MLO -> no link ID attribute accepted */
16330 		if (!wdev->valid_links && link_id) {
16331 			err = -EINVAL;
16332 			goto out_unlock;
16333 		}
16334 	}
16335 
16336 	if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16337 		if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16338 		    (wdev && wdev->valid_links)) {
16339 			err = -EINVAL;
16340 			goto out_unlock;
16341 		}
16342 	}
16343 
16344 	if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16345 		wiphy_lock(&rdev->wiphy);
16346 		/* we keep the mutex locked until post_doit */
16347 		__release(&rdev->wiphy.mtx);
16348 	}
16349 	if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16350 		rtnl_unlock();
16351 
16352 	return 0;
16353 out_unlock:
16354 	rtnl_unlock();
16355 	dev_put(dev);
16356 	return err;
16357 }
16358 
16359 static void nl80211_post_doit(const struct genl_split_ops *ops,
16360 			      struct sk_buff *skb,
16361 			      struct genl_info *info)
16362 {
16363 	u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16364 
16365 	if (info->user_ptr[1]) {
16366 		if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16367 			struct wireless_dev *wdev = info->user_ptr[1];
16368 
16369 			dev_put(wdev->netdev);
16370 		} else {
16371 			dev_put(info->user_ptr[1]);
16372 		}
16373 	}
16374 
16375 	if (info->user_ptr[0] &&
16376 	    !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16377 		struct cfg80211_registered_device *rdev = info->user_ptr[0];
16378 
16379 		/* we kept the mutex locked since pre_doit */
16380 		__acquire(&rdev->wiphy.mtx);
16381 		wiphy_unlock(&rdev->wiphy);
16382 	}
16383 
16384 	if (internal_flags & NL80211_FLAG_NEED_RTNL)
16385 		rtnl_unlock();
16386 
16387 	/* If needed, clear the netlink message payload from the SKB
16388 	 * as it might contain key data that shouldn't stick around on
16389 	 * the heap after the SKB is freed. The netlink message header
16390 	 * is still needed for further processing, so leave it intact.
16391 	 */
16392 	if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16393 		struct nlmsghdr *nlh = nlmsg_hdr(skb);
16394 
16395 		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16396 	}
16397 }
16398 
16399 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16400 				     struct cfg80211_sar_specs *sar_specs,
16401 				     struct nlattr *spec[], int index)
16402 {
16403 	u32 range_index, i;
16404 
16405 	if (!sar_specs || !spec)
16406 		return -EINVAL;
16407 
16408 	if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16409 	    !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16410 		return -EINVAL;
16411 
16412 	range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16413 
16414 	/* check if range_index exceeds num_freq_ranges */
16415 	if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16416 		return -EINVAL;
16417 
16418 	/* check if range_index duplicates */
16419 	for (i = 0; i < index; i++) {
16420 		if (sar_specs->sub_specs[i].freq_range_index == range_index)
16421 			return -EINVAL;
16422 	}
16423 
16424 	sar_specs->sub_specs[index].power =
16425 		nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16426 
16427 	sar_specs->sub_specs[index].freq_range_index = range_index;
16428 
16429 	return 0;
16430 }
16431 
16432 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16433 {
16434 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
16435 	struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16436 	struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16437 	struct cfg80211_sar_specs *sar_spec;
16438 	enum nl80211_sar_type type;
16439 	struct nlattr *spec_list;
16440 	u32 specs;
16441 	int rem, err;
16442 
16443 	if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16444 		return -EOPNOTSUPP;
16445 
16446 	if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16447 		return -EINVAL;
16448 
16449 	nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16450 			 info->attrs[NL80211_ATTR_SAR_SPEC],
16451 			 NULL, NULL);
16452 
16453 	if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16454 		return -EINVAL;
16455 
16456 	type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16457 	if (type != rdev->wiphy.sar_capa->type)
16458 		return -EINVAL;
16459 
16460 	specs = 0;
16461 	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16462 		specs++;
16463 
16464 	if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16465 		return -EINVAL;
16466 
16467 	sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16468 	if (!sar_spec)
16469 		return -ENOMEM;
16470 
16471 	sar_spec->type = type;
16472 	specs = 0;
16473 	nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16474 		nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16475 				 spec_list, NULL, NULL);
16476 
16477 		switch (type) {
16478 		case NL80211_SAR_TYPE_POWER:
16479 			if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16480 						      spec, specs)) {
16481 				err = -EINVAL;
16482 				goto error;
16483 			}
16484 			break;
16485 		default:
16486 			err = -EINVAL;
16487 			goto error;
16488 		}
16489 		specs++;
16490 	}
16491 
16492 	sar_spec->num_sub_specs = specs;
16493 
16494 	rdev->cur_cmd_info = info;
16495 	err = rdev_set_sar_specs(rdev, sar_spec);
16496 	rdev->cur_cmd_info = NULL;
16497 error:
16498 	kfree(sar_spec);
16499 	return err;
16500 }
16501 
16502 #define SELECTOR(__sel, name, value) \
16503 	((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16504 int __missing_selector(void);
16505 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16506 
16507 static const struct genl_ops nl80211_ops[] = {
16508 	{
16509 		.cmd = NL80211_CMD_GET_WIPHY,
16510 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16511 		.doit = nl80211_get_wiphy,
16512 		.dumpit = nl80211_dump_wiphy,
16513 		.done = nl80211_dump_wiphy_done,
16514 		/* can be retrieved by unprivileged users */
16515 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16516 	},
16517 };
16518 
16519 static const struct genl_small_ops nl80211_small_ops[] = {
16520 	{
16521 		.cmd = NL80211_CMD_SET_WIPHY,
16522 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16523 		.doit = nl80211_set_wiphy,
16524 		.flags = GENL_UNS_ADMIN_PERM,
16525 	},
16526 	{
16527 		.cmd = NL80211_CMD_GET_INTERFACE,
16528 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16529 		.doit = nl80211_get_interface,
16530 		.dumpit = nl80211_dump_interface,
16531 		/* can be retrieved by unprivileged users */
16532 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16533 	},
16534 	{
16535 		.cmd = NL80211_CMD_SET_INTERFACE,
16536 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16537 		.doit = nl80211_set_interface,
16538 		.flags = GENL_UNS_ADMIN_PERM,
16539 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16540 					 NL80211_FLAG_NEED_RTNL),
16541 	},
16542 	{
16543 		.cmd = NL80211_CMD_NEW_INTERFACE,
16544 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16545 		.doit = nl80211_new_interface,
16546 		.flags = GENL_UNS_ADMIN_PERM,
16547 		.internal_flags =
16548 			IFLAGS(NL80211_FLAG_NEED_WIPHY |
16549 			       NL80211_FLAG_NEED_RTNL |
16550 			       /* we take the wiphy mutex later ourselves */
16551 			       NL80211_FLAG_NO_WIPHY_MTX),
16552 	},
16553 	{
16554 		.cmd = NL80211_CMD_DEL_INTERFACE,
16555 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16556 		.doit = nl80211_del_interface,
16557 		.flags = GENL_UNS_ADMIN_PERM,
16558 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16559 					 NL80211_FLAG_NEED_RTNL),
16560 	},
16561 	{
16562 		.cmd = NL80211_CMD_GET_KEY,
16563 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16564 		.doit = nl80211_get_key,
16565 		.flags = GENL_UNS_ADMIN_PERM,
16566 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16567 	},
16568 	{
16569 		.cmd = NL80211_CMD_SET_KEY,
16570 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16571 		.doit = nl80211_set_key,
16572 		.flags = GENL_UNS_ADMIN_PERM,
16573 		/* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16574 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16575 					 NL80211_FLAG_CLEAR_SKB),
16576 	},
16577 	{
16578 		.cmd = NL80211_CMD_NEW_KEY,
16579 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16580 		.doit = nl80211_new_key,
16581 		.flags = GENL_UNS_ADMIN_PERM,
16582 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16583 					 NL80211_FLAG_CLEAR_SKB),
16584 	},
16585 	{
16586 		.cmd = NL80211_CMD_DEL_KEY,
16587 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16588 		.doit = nl80211_del_key,
16589 		.flags = GENL_UNS_ADMIN_PERM,
16590 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16591 	},
16592 	{
16593 		.cmd = NL80211_CMD_SET_BEACON,
16594 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16595 		.flags = GENL_UNS_ADMIN_PERM,
16596 		.doit = nl80211_set_beacon,
16597 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16598 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16599 	},
16600 	{
16601 		.cmd = NL80211_CMD_START_AP,
16602 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16603 		.flags = GENL_UNS_ADMIN_PERM,
16604 		.doit = nl80211_start_ap,
16605 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16606 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16607 	},
16608 	{
16609 		.cmd = NL80211_CMD_STOP_AP,
16610 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16611 		.flags = GENL_UNS_ADMIN_PERM,
16612 		.doit = nl80211_stop_ap,
16613 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16614 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16615 	},
16616 	{
16617 		.cmd = NL80211_CMD_GET_STATION,
16618 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16619 		.doit = nl80211_get_station,
16620 		.dumpit = nl80211_dump_station,
16621 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16622 	},
16623 	{
16624 		.cmd = NL80211_CMD_SET_STATION,
16625 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16626 		.doit = nl80211_set_station,
16627 		.flags = GENL_UNS_ADMIN_PERM,
16628 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16629 	},
16630 	{
16631 		.cmd = NL80211_CMD_NEW_STATION,
16632 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16633 		.doit = nl80211_new_station,
16634 		.flags = GENL_UNS_ADMIN_PERM,
16635 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16636 	},
16637 	{
16638 		.cmd = NL80211_CMD_DEL_STATION,
16639 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16640 		.doit = nl80211_del_station,
16641 		.flags = GENL_UNS_ADMIN_PERM,
16642 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16643 	},
16644 	{
16645 		.cmd = NL80211_CMD_GET_MPATH,
16646 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16647 		.doit = nl80211_get_mpath,
16648 		.dumpit = nl80211_dump_mpath,
16649 		.flags = GENL_UNS_ADMIN_PERM,
16650 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16651 	},
16652 	{
16653 		.cmd = NL80211_CMD_GET_MPP,
16654 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16655 		.doit = nl80211_get_mpp,
16656 		.dumpit = nl80211_dump_mpp,
16657 		.flags = GENL_UNS_ADMIN_PERM,
16658 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16659 	},
16660 	{
16661 		.cmd = NL80211_CMD_SET_MPATH,
16662 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16663 		.doit = nl80211_set_mpath,
16664 		.flags = GENL_UNS_ADMIN_PERM,
16665 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16666 	},
16667 	{
16668 		.cmd = NL80211_CMD_NEW_MPATH,
16669 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16670 		.doit = nl80211_new_mpath,
16671 		.flags = GENL_UNS_ADMIN_PERM,
16672 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16673 	},
16674 	{
16675 		.cmd = NL80211_CMD_DEL_MPATH,
16676 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16677 		.doit = nl80211_del_mpath,
16678 		.flags = GENL_UNS_ADMIN_PERM,
16679 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16680 	},
16681 	{
16682 		.cmd = NL80211_CMD_SET_BSS,
16683 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16684 		.doit = nl80211_set_bss,
16685 		.flags = GENL_UNS_ADMIN_PERM,
16686 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16687 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16688 	},
16689 	{
16690 		.cmd = NL80211_CMD_GET_REG,
16691 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16692 		.doit = nl80211_get_reg_do,
16693 		.dumpit = nl80211_get_reg_dump,
16694 		/* can be retrieved by unprivileged users */
16695 	},
16696 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16697 	{
16698 		.cmd = NL80211_CMD_SET_REG,
16699 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16700 		.doit = nl80211_set_reg,
16701 		.flags = GENL_ADMIN_PERM,
16702 	},
16703 #endif
16704 	{
16705 		.cmd = NL80211_CMD_REQ_SET_REG,
16706 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16707 		.doit = nl80211_req_set_reg,
16708 		.flags = GENL_ADMIN_PERM,
16709 	},
16710 	{
16711 		.cmd = NL80211_CMD_RELOAD_REGDB,
16712 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16713 		.doit = nl80211_reload_regdb,
16714 		.flags = GENL_ADMIN_PERM,
16715 	},
16716 	{
16717 		.cmd = NL80211_CMD_GET_MESH_CONFIG,
16718 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16719 		.doit = nl80211_get_mesh_config,
16720 		/* can be retrieved by unprivileged users */
16721 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16722 	},
16723 	{
16724 		.cmd = NL80211_CMD_SET_MESH_CONFIG,
16725 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16726 		.doit = nl80211_update_mesh_config,
16727 		.flags = GENL_UNS_ADMIN_PERM,
16728 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16729 	},
16730 	{
16731 		.cmd = NL80211_CMD_TRIGGER_SCAN,
16732 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16733 		.doit = nl80211_trigger_scan,
16734 		.flags = GENL_UNS_ADMIN_PERM,
16735 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16736 	},
16737 	{
16738 		.cmd = NL80211_CMD_ABORT_SCAN,
16739 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16740 		.doit = nl80211_abort_scan,
16741 		.flags = GENL_UNS_ADMIN_PERM,
16742 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16743 	},
16744 	{
16745 		.cmd = NL80211_CMD_GET_SCAN,
16746 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16747 		.dumpit = nl80211_dump_scan,
16748 	},
16749 	{
16750 		.cmd = NL80211_CMD_START_SCHED_SCAN,
16751 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16752 		.doit = nl80211_start_sched_scan,
16753 		.flags = GENL_UNS_ADMIN_PERM,
16754 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16755 	},
16756 	{
16757 		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
16758 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16759 		.doit = nl80211_stop_sched_scan,
16760 		.flags = GENL_UNS_ADMIN_PERM,
16761 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16762 	},
16763 	{
16764 		.cmd = NL80211_CMD_AUTHENTICATE,
16765 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16766 		.doit = nl80211_authenticate,
16767 		.flags = GENL_UNS_ADMIN_PERM,
16768 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16769 					 NL80211_FLAG_CLEAR_SKB),
16770 	},
16771 	{
16772 		.cmd = NL80211_CMD_ASSOCIATE,
16773 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16774 		.doit = nl80211_associate,
16775 		.flags = GENL_UNS_ADMIN_PERM,
16776 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16777 					 NL80211_FLAG_CLEAR_SKB),
16778 	},
16779 	{
16780 		.cmd = NL80211_CMD_DEAUTHENTICATE,
16781 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16782 		.doit = nl80211_deauthenticate,
16783 		.flags = GENL_UNS_ADMIN_PERM,
16784 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16785 	},
16786 	{
16787 		.cmd = NL80211_CMD_DISASSOCIATE,
16788 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16789 		.doit = nl80211_disassociate,
16790 		.flags = GENL_UNS_ADMIN_PERM,
16791 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16792 	},
16793 	{
16794 		.cmd = NL80211_CMD_JOIN_IBSS,
16795 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16796 		.doit = nl80211_join_ibss,
16797 		.flags = GENL_UNS_ADMIN_PERM,
16798 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16799 	},
16800 	{
16801 		.cmd = NL80211_CMD_LEAVE_IBSS,
16802 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16803 		.doit = nl80211_leave_ibss,
16804 		.flags = GENL_UNS_ADMIN_PERM,
16805 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16806 	},
16807 #ifdef CONFIG_NL80211_TESTMODE
16808 	{
16809 		.cmd = NL80211_CMD_TESTMODE,
16810 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16811 		.doit = nl80211_testmode_do,
16812 		.dumpit = nl80211_testmode_dump,
16813 		.flags = GENL_UNS_ADMIN_PERM,
16814 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16815 	},
16816 #endif
16817 	{
16818 		.cmd = NL80211_CMD_CONNECT,
16819 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16820 		.doit = nl80211_connect,
16821 		.flags = GENL_UNS_ADMIN_PERM,
16822 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16823 					 NL80211_FLAG_CLEAR_SKB),
16824 	},
16825 	{
16826 		.cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16827 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16828 		.doit = nl80211_update_connect_params,
16829 		.flags = GENL_ADMIN_PERM,
16830 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16831 					 NL80211_FLAG_CLEAR_SKB),
16832 	},
16833 	{
16834 		.cmd = NL80211_CMD_DISCONNECT,
16835 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16836 		.doit = nl80211_disconnect,
16837 		.flags = GENL_UNS_ADMIN_PERM,
16838 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16839 	},
16840 	{
16841 		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
16842 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16843 		.doit = nl80211_wiphy_netns,
16844 		.flags = GENL_UNS_ADMIN_PERM,
16845 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16846 					 NL80211_FLAG_NEED_RTNL |
16847 					 NL80211_FLAG_NO_WIPHY_MTX),
16848 	},
16849 	{
16850 		.cmd = NL80211_CMD_GET_SURVEY,
16851 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16852 		.dumpit = nl80211_dump_survey,
16853 	},
16854 	{
16855 		.cmd = NL80211_CMD_SET_PMKSA,
16856 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16857 		.doit = nl80211_setdel_pmksa,
16858 		.flags = GENL_UNS_ADMIN_PERM,
16859 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16860 					 NL80211_FLAG_CLEAR_SKB),
16861 	},
16862 	{
16863 		.cmd = NL80211_CMD_DEL_PMKSA,
16864 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16865 		.doit = nl80211_setdel_pmksa,
16866 		.flags = GENL_UNS_ADMIN_PERM,
16867 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16868 	},
16869 	{
16870 		.cmd = NL80211_CMD_FLUSH_PMKSA,
16871 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16872 		.doit = nl80211_flush_pmksa,
16873 		.flags = GENL_UNS_ADMIN_PERM,
16874 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16875 	},
16876 	{
16877 		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16878 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16879 		.doit = nl80211_remain_on_channel,
16880 		.flags = GENL_UNS_ADMIN_PERM,
16881 		/* FIXME: requiring a link ID here is probably not good */
16882 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16883 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16884 	},
16885 	{
16886 		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16887 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16888 		.doit = nl80211_cancel_remain_on_channel,
16889 		.flags = GENL_UNS_ADMIN_PERM,
16890 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16891 	},
16892 	{
16893 		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
16894 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16895 		.doit = nl80211_set_tx_bitrate_mask,
16896 		.flags = GENL_UNS_ADMIN_PERM,
16897 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16898 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16899 	},
16900 	{
16901 		.cmd = NL80211_CMD_REGISTER_FRAME,
16902 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16903 		.doit = nl80211_register_mgmt,
16904 		.flags = GENL_UNS_ADMIN_PERM,
16905 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16906 	},
16907 	{
16908 		.cmd = NL80211_CMD_FRAME,
16909 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16910 		.doit = nl80211_tx_mgmt,
16911 		.flags = GENL_UNS_ADMIN_PERM,
16912 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16913 	},
16914 	{
16915 		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
16916 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16917 		.doit = nl80211_tx_mgmt_cancel_wait,
16918 		.flags = GENL_UNS_ADMIN_PERM,
16919 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16920 	},
16921 	{
16922 		.cmd = NL80211_CMD_SET_POWER_SAVE,
16923 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16924 		.doit = nl80211_set_power_save,
16925 		.flags = GENL_UNS_ADMIN_PERM,
16926 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16927 	},
16928 	{
16929 		.cmd = NL80211_CMD_GET_POWER_SAVE,
16930 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16931 		.doit = nl80211_get_power_save,
16932 		/* can be retrieved by unprivileged users */
16933 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16934 	},
16935 	{
16936 		.cmd = NL80211_CMD_SET_CQM,
16937 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16938 		.doit = nl80211_set_cqm,
16939 		.flags = GENL_UNS_ADMIN_PERM,
16940 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16941 	},
16942 	{
16943 		.cmd = NL80211_CMD_SET_CHANNEL,
16944 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16945 		.doit = nl80211_set_channel,
16946 		.flags = GENL_UNS_ADMIN_PERM,
16947 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16948 					 NL80211_FLAG_MLO_VALID_LINK_ID),
16949 	},
16950 	{
16951 		.cmd = NL80211_CMD_JOIN_MESH,
16952 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16953 		.doit = nl80211_join_mesh,
16954 		.flags = GENL_UNS_ADMIN_PERM,
16955 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16956 	},
16957 	{
16958 		.cmd = NL80211_CMD_LEAVE_MESH,
16959 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16960 		.doit = nl80211_leave_mesh,
16961 		.flags = GENL_UNS_ADMIN_PERM,
16962 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16963 	},
16964 	{
16965 		.cmd = NL80211_CMD_JOIN_OCB,
16966 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16967 		.doit = nl80211_join_ocb,
16968 		.flags = GENL_UNS_ADMIN_PERM,
16969 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16970 	},
16971 	{
16972 		.cmd = NL80211_CMD_LEAVE_OCB,
16973 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16974 		.doit = nl80211_leave_ocb,
16975 		.flags = GENL_UNS_ADMIN_PERM,
16976 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16977 	},
16978 #ifdef CONFIG_PM
16979 	{
16980 		.cmd = NL80211_CMD_GET_WOWLAN,
16981 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16982 		.doit = nl80211_get_wowlan,
16983 		/* can be retrieved by unprivileged users */
16984 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16985 	},
16986 	{
16987 		.cmd = NL80211_CMD_SET_WOWLAN,
16988 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16989 		.doit = nl80211_set_wowlan,
16990 		.flags = GENL_UNS_ADMIN_PERM,
16991 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16992 	},
16993 #endif
16994 	{
16995 		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
16996 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16997 		.doit = nl80211_set_rekey_data,
16998 		.flags = GENL_UNS_ADMIN_PERM,
16999 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17000 					 NL80211_FLAG_CLEAR_SKB),
17001 	},
17002 	{
17003 		.cmd = NL80211_CMD_TDLS_MGMT,
17004 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17005 		.doit = nl80211_tdls_mgmt,
17006 		.flags = GENL_UNS_ADMIN_PERM,
17007 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17008 	},
17009 	{
17010 		.cmd = NL80211_CMD_TDLS_OPER,
17011 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17012 		.doit = nl80211_tdls_oper,
17013 		.flags = GENL_UNS_ADMIN_PERM,
17014 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17015 	},
17016 	{
17017 		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
17018 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17019 		.doit = nl80211_register_unexpected_frame,
17020 		.flags = GENL_UNS_ADMIN_PERM,
17021 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17022 	},
17023 	{
17024 		.cmd = NL80211_CMD_PROBE_CLIENT,
17025 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17026 		.doit = nl80211_probe_client,
17027 		.flags = GENL_UNS_ADMIN_PERM,
17028 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17029 	},
17030 	{
17031 		.cmd = NL80211_CMD_REGISTER_BEACONS,
17032 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17033 		.doit = nl80211_register_beacons,
17034 		.flags = GENL_UNS_ADMIN_PERM,
17035 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17036 	},
17037 	{
17038 		.cmd = NL80211_CMD_SET_NOACK_MAP,
17039 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17040 		.doit = nl80211_set_noack_map,
17041 		.flags = GENL_UNS_ADMIN_PERM,
17042 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17043 	},
17044 	{
17045 		.cmd = NL80211_CMD_START_P2P_DEVICE,
17046 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17047 		.doit = nl80211_start_p2p_device,
17048 		.flags = GENL_UNS_ADMIN_PERM,
17049 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17050 					 NL80211_FLAG_NEED_RTNL),
17051 	},
17052 	{
17053 		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
17054 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17055 		.doit = nl80211_stop_p2p_device,
17056 		.flags = GENL_UNS_ADMIN_PERM,
17057 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17058 					 NL80211_FLAG_NEED_RTNL),
17059 	},
17060 	{
17061 		.cmd = NL80211_CMD_START_NAN,
17062 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17063 		.doit = nl80211_start_nan,
17064 		.flags = GENL_ADMIN_PERM,
17065 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17066 					 NL80211_FLAG_NEED_RTNL),
17067 	},
17068 	{
17069 		.cmd = NL80211_CMD_STOP_NAN,
17070 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17071 		.doit = nl80211_stop_nan,
17072 		.flags = GENL_ADMIN_PERM,
17073 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17074 					 NL80211_FLAG_NEED_RTNL),
17075 	},
17076 	{
17077 		.cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17078 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17079 		.doit = nl80211_nan_add_func,
17080 		.flags = GENL_ADMIN_PERM,
17081 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17082 	},
17083 	{
17084 		.cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17085 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17086 		.doit = nl80211_nan_del_func,
17087 		.flags = GENL_ADMIN_PERM,
17088 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17089 	},
17090 	{
17091 		.cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17092 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17093 		.doit = nl80211_nan_change_config,
17094 		.flags = GENL_ADMIN_PERM,
17095 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17096 	},
17097 	{
17098 		.cmd = NL80211_CMD_SET_MCAST_RATE,
17099 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17100 		.doit = nl80211_set_mcast_rate,
17101 		.flags = GENL_UNS_ADMIN_PERM,
17102 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17103 	},
17104 	{
17105 		.cmd = NL80211_CMD_SET_MAC_ACL,
17106 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17107 		.doit = nl80211_set_mac_acl,
17108 		.flags = GENL_UNS_ADMIN_PERM,
17109 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17110 					 NL80211_FLAG_MLO_UNSUPPORTED),
17111 	},
17112 	{
17113 		.cmd = NL80211_CMD_RADAR_DETECT,
17114 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115 		.doit = nl80211_start_radar_detection,
17116 		.flags = GENL_UNS_ADMIN_PERM,
17117 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17118 					 NL80211_FLAG_NO_WIPHY_MTX |
17119 					 NL80211_FLAG_MLO_UNSUPPORTED),
17120 	},
17121 	{
17122 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17123 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17124 		.doit = nl80211_get_protocol_features,
17125 	},
17126 	{
17127 		.cmd = NL80211_CMD_UPDATE_FT_IES,
17128 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17129 		.doit = nl80211_update_ft_ies,
17130 		.flags = GENL_UNS_ADMIN_PERM,
17131 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17132 	},
17133 	{
17134 		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17135 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17136 		.doit = nl80211_crit_protocol_start,
17137 		.flags = GENL_UNS_ADMIN_PERM,
17138 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17139 	},
17140 	{
17141 		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17142 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17143 		.doit = nl80211_crit_protocol_stop,
17144 		.flags = GENL_UNS_ADMIN_PERM,
17145 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17146 	},
17147 	{
17148 		.cmd = NL80211_CMD_GET_COALESCE,
17149 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17150 		.doit = nl80211_get_coalesce,
17151 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17152 	},
17153 	{
17154 		.cmd = NL80211_CMD_SET_COALESCE,
17155 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17156 		.doit = nl80211_set_coalesce,
17157 		.flags = GENL_UNS_ADMIN_PERM,
17158 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17159 	},
17160 	{
17161 		.cmd = NL80211_CMD_CHANNEL_SWITCH,
17162 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17163 		.doit = nl80211_channel_switch,
17164 		.flags = GENL_UNS_ADMIN_PERM,
17165 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17166 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17167 	},
17168 	{
17169 		.cmd = NL80211_CMD_VENDOR,
17170 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17171 		.doit = nl80211_vendor_cmd,
17172 		.dumpit = nl80211_vendor_cmd_dump,
17173 		.flags = GENL_UNS_ADMIN_PERM,
17174 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17175 					 NL80211_FLAG_CLEAR_SKB),
17176 	},
17177 	{
17178 		.cmd = NL80211_CMD_SET_QOS_MAP,
17179 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17180 		.doit = nl80211_set_qos_map,
17181 		.flags = GENL_UNS_ADMIN_PERM,
17182 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17183 	},
17184 	{
17185 		.cmd = NL80211_CMD_ADD_TX_TS,
17186 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17187 		.doit = nl80211_add_tx_ts,
17188 		.flags = GENL_UNS_ADMIN_PERM,
17189 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17190 					 NL80211_FLAG_MLO_UNSUPPORTED),
17191 	},
17192 	{
17193 		.cmd = NL80211_CMD_DEL_TX_TS,
17194 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17195 		.doit = nl80211_del_tx_ts,
17196 		.flags = GENL_UNS_ADMIN_PERM,
17197 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17198 	},
17199 	{
17200 		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17201 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17202 		.doit = nl80211_tdls_channel_switch,
17203 		.flags = GENL_UNS_ADMIN_PERM,
17204 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17205 	},
17206 	{
17207 		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17208 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17209 		.doit = nl80211_tdls_cancel_channel_switch,
17210 		.flags = GENL_UNS_ADMIN_PERM,
17211 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17212 	},
17213 	{
17214 		.cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17215 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17216 		.doit = nl80211_set_multicast_to_unicast,
17217 		.flags = GENL_UNS_ADMIN_PERM,
17218 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17219 	},
17220 	{
17221 		.cmd = NL80211_CMD_SET_PMK,
17222 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17223 		.doit = nl80211_set_pmk,
17224 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17225 					 NL80211_FLAG_CLEAR_SKB),
17226 	},
17227 	{
17228 		.cmd = NL80211_CMD_DEL_PMK,
17229 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17230 		.doit = nl80211_del_pmk,
17231 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17232 	},
17233 	{
17234 		.cmd = NL80211_CMD_EXTERNAL_AUTH,
17235 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17236 		.doit = nl80211_external_auth,
17237 		.flags = GENL_ADMIN_PERM,
17238 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17239 	},
17240 	{
17241 		.cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17242 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17243 		.doit = nl80211_tx_control_port,
17244 		.flags = GENL_UNS_ADMIN_PERM,
17245 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17246 	},
17247 	{
17248 		.cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17249 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17250 		.doit = nl80211_get_ftm_responder_stats,
17251 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17252 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17253 	},
17254 	{
17255 		.cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17256 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17257 		.doit = nl80211_pmsr_start,
17258 		.flags = GENL_UNS_ADMIN_PERM,
17259 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17260 	},
17261 	{
17262 		.cmd = NL80211_CMD_NOTIFY_RADAR,
17263 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17264 		.doit = nl80211_notify_radar_detection,
17265 		.flags = GENL_UNS_ADMIN_PERM,
17266 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17267 	},
17268 	{
17269 		.cmd = NL80211_CMD_UPDATE_OWE_INFO,
17270 		.doit = nl80211_update_owe_info,
17271 		.flags = GENL_ADMIN_PERM,
17272 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17273 	},
17274 	{
17275 		.cmd = NL80211_CMD_PROBE_MESH_LINK,
17276 		.doit = nl80211_probe_mesh_link,
17277 		.flags = GENL_UNS_ADMIN_PERM,
17278 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17279 	},
17280 	{
17281 		.cmd = NL80211_CMD_SET_TID_CONFIG,
17282 		.doit = nl80211_set_tid_config,
17283 		.flags = GENL_UNS_ADMIN_PERM,
17284 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17285 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17286 	},
17287 	{
17288 		.cmd = NL80211_CMD_SET_SAR_SPECS,
17289 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17290 		.doit = nl80211_set_sar_specs,
17291 		.flags = GENL_UNS_ADMIN_PERM,
17292 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17293 					 NL80211_FLAG_NEED_RTNL),
17294 	},
17295 	{
17296 		.cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17297 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17298 		.doit = nl80211_color_change,
17299 		.flags = GENL_UNS_ADMIN_PERM,
17300 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17301 	},
17302 	{
17303 		.cmd = NL80211_CMD_SET_FILS_AAD,
17304 		.validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17305 		.doit = nl80211_set_fils_aad,
17306 		.flags = GENL_UNS_ADMIN_PERM,
17307 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17308 	},
17309 	{
17310 		.cmd = NL80211_CMD_ADD_LINK,
17311 		.doit = nl80211_add_link,
17312 		.flags = GENL_UNS_ADMIN_PERM,
17313 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17314 	},
17315 	{
17316 		.cmd = NL80211_CMD_REMOVE_LINK,
17317 		.doit = nl80211_remove_link,
17318 		.flags = GENL_UNS_ADMIN_PERM,
17319 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17320 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17321 	},
17322 	{
17323 		.cmd = NL80211_CMD_ADD_LINK_STA,
17324 		.doit = nl80211_add_link_station,
17325 		.flags = GENL_UNS_ADMIN_PERM,
17326 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17327 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17328 	},
17329 	{
17330 		.cmd = NL80211_CMD_MODIFY_LINK_STA,
17331 		.doit = nl80211_modify_link_station,
17332 		.flags = GENL_UNS_ADMIN_PERM,
17333 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17334 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17335 	},
17336 	{
17337 		.cmd = NL80211_CMD_REMOVE_LINK_STA,
17338 		.doit = nl80211_remove_link_station,
17339 		.flags = GENL_UNS_ADMIN_PERM,
17340 		.internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17341 					 NL80211_FLAG_MLO_VALID_LINK_ID),
17342 	},
17343 };
17344 
17345 static struct genl_family nl80211_fam __ro_after_init = {
17346 	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
17347 	.hdrsize = 0,			/* no private header */
17348 	.version = 1,			/* no particular meaning now */
17349 	.maxattr = NL80211_ATTR_MAX,
17350 	.policy = nl80211_policy,
17351 	.netnsok = true,
17352 	.pre_doit = nl80211_pre_doit,
17353 	.post_doit = nl80211_post_doit,
17354 	.module = THIS_MODULE,
17355 	.ops = nl80211_ops,
17356 	.n_ops = ARRAY_SIZE(nl80211_ops),
17357 	.small_ops = nl80211_small_ops,
17358 	.n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17359 	.resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17360 	.mcgrps = nl80211_mcgrps,
17361 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17362 	.parallel_ops = true,
17363 };
17364 
17365 /* notification functions */
17366 
17367 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17368 			  enum nl80211_commands cmd)
17369 {
17370 	struct sk_buff *msg;
17371 	struct nl80211_dump_wiphy_state state = {};
17372 
17373 	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17374 		cmd != NL80211_CMD_DEL_WIPHY);
17375 
17376 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17377 	if (!msg)
17378 		return;
17379 
17380 	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17381 		nlmsg_free(msg);
17382 		return;
17383 	}
17384 
17385 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17386 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
17387 }
17388 
17389 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17390 				struct wireless_dev *wdev,
17391 				enum nl80211_commands cmd)
17392 {
17393 	struct sk_buff *msg;
17394 
17395 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17396 	if (!msg)
17397 		return;
17398 
17399 	if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17400 		nlmsg_free(msg);
17401 		return;
17402 	}
17403 
17404 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17405 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
17406 }
17407 
17408 static int nl80211_add_scan_req(struct sk_buff *msg,
17409 				struct cfg80211_registered_device *rdev)
17410 {
17411 	struct cfg80211_scan_request *req = rdev->scan_req;
17412 	struct nlattr *nest;
17413 	int i;
17414 	struct cfg80211_scan_info *info;
17415 
17416 	if (WARN_ON(!req))
17417 		return 0;
17418 
17419 	nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17420 	if (!nest)
17421 		goto nla_put_failure;
17422 	for (i = 0; i < req->n_ssids; i++) {
17423 		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17424 			goto nla_put_failure;
17425 	}
17426 	nla_nest_end(msg, nest);
17427 
17428 	if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17429 		nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17430 		if (!nest)
17431 			goto nla_put_failure;
17432 		for (i = 0; i < req->n_channels; i++) {
17433 			if (nla_put_u32(msg, i,
17434 				   ieee80211_channel_to_khz(req->channels[i])))
17435 				goto nla_put_failure;
17436 		}
17437 		nla_nest_end(msg, nest);
17438 	} else {
17439 		nest = nla_nest_start_noflag(msg,
17440 					     NL80211_ATTR_SCAN_FREQUENCIES);
17441 		if (!nest)
17442 			goto nla_put_failure;
17443 		for (i = 0; i < req->n_channels; i++) {
17444 			if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17445 				goto nla_put_failure;
17446 		}
17447 		nla_nest_end(msg, nest);
17448 	}
17449 
17450 	if (req->ie &&
17451 	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17452 		goto nla_put_failure;
17453 
17454 	if (req->flags &&
17455 	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17456 		goto nla_put_failure;
17457 
17458 	info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17459 		&rdev->scan_req->info;
17460 	if (info->scan_start_tsf &&
17461 	    (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17462 			       info->scan_start_tsf, NL80211_BSS_PAD) ||
17463 	     nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17464 		     info->tsf_bssid)))
17465 		goto nla_put_failure;
17466 
17467 	return 0;
17468  nla_put_failure:
17469 	return -ENOBUFS;
17470 }
17471 
17472 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17473 				 struct cfg80211_registered_device *rdev,
17474 				 struct wireless_dev *wdev,
17475 				 u32 portid, u32 seq, int flags,
17476 				 u32 cmd)
17477 {
17478 	void *hdr;
17479 
17480 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17481 	if (!hdr)
17482 		return -1;
17483 
17484 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17485 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17486 					 wdev->netdev->ifindex)) ||
17487 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17488 			      NL80211_ATTR_PAD))
17489 		goto nla_put_failure;
17490 
17491 	/* ignore errors and send incomplete event anyway */
17492 	nl80211_add_scan_req(msg, rdev);
17493 
17494 	genlmsg_end(msg, hdr);
17495 	return 0;
17496 
17497  nla_put_failure:
17498 	genlmsg_cancel(msg, hdr);
17499 	return -EMSGSIZE;
17500 }
17501 
17502 static int
17503 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17504 			    struct cfg80211_sched_scan_request *req, u32 cmd)
17505 {
17506 	void *hdr;
17507 
17508 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17509 	if (!hdr)
17510 		return -1;
17511 
17512 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17513 			wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17514 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17515 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17516 			      NL80211_ATTR_PAD))
17517 		goto nla_put_failure;
17518 
17519 	genlmsg_end(msg, hdr);
17520 	return 0;
17521 
17522  nla_put_failure:
17523 	genlmsg_cancel(msg, hdr);
17524 	return -EMSGSIZE;
17525 }
17526 
17527 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17528 			     struct wireless_dev *wdev)
17529 {
17530 	struct sk_buff *msg;
17531 
17532 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17533 	if (!msg)
17534 		return;
17535 
17536 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17537 				  NL80211_CMD_TRIGGER_SCAN) < 0) {
17538 		nlmsg_free(msg);
17539 		return;
17540 	}
17541 
17542 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17543 				NL80211_MCGRP_SCAN, GFP_KERNEL);
17544 }
17545 
17546 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17547 				       struct wireless_dev *wdev, bool aborted)
17548 {
17549 	struct sk_buff *msg;
17550 
17551 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17552 	if (!msg)
17553 		return NULL;
17554 
17555 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17556 				  aborted ? NL80211_CMD_SCAN_ABORTED :
17557 					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17558 		nlmsg_free(msg);
17559 		return NULL;
17560 	}
17561 
17562 	return msg;
17563 }
17564 
17565 /* send message created by nl80211_build_scan_msg() */
17566 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17567 			   struct sk_buff *msg)
17568 {
17569 	if (!msg)
17570 		return;
17571 
17572 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17573 				NL80211_MCGRP_SCAN, GFP_KERNEL);
17574 }
17575 
17576 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17577 {
17578 	struct sk_buff *msg;
17579 
17580 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17581 	if (!msg)
17582 		return;
17583 
17584 	if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17585 		nlmsg_free(msg);
17586 		return;
17587 	}
17588 
17589 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17590 				NL80211_MCGRP_SCAN, GFP_KERNEL);
17591 }
17592 
17593 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17594 					  struct regulatory_request *request)
17595 {
17596 	/* Userspace can always count this one always being set */
17597 	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17598 		goto nla_put_failure;
17599 
17600 	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17601 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17602 			       NL80211_REGDOM_TYPE_WORLD))
17603 			goto nla_put_failure;
17604 	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17605 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17606 			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17607 			goto nla_put_failure;
17608 	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17609 		   request->intersect) {
17610 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17611 			       NL80211_REGDOM_TYPE_INTERSECTION))
17612 			goto nla_put_failure;
17613 	} else {
17614 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17615 			       NL80211_REGDOM_TYPE_COUNTRY) ||
17616 		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17617 				   request->alpha2))
17618 			goto nla_put_failure;
17619 	}
17620 
17621 	if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17622 		struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17623 
17624 		if (wiphy &&
17625 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17626 			goto nla_put_failure;
17627 
17628 		if (wiphy &&
17629 		    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17630 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17631 			goto nla_put_failure;
17632 	}
17633 
17634 	return true;
17635 
17636 nla_put_failure:
17637 	return false;
17638 }
17639 
17640 /*
17641  * This can happen on global regulatory changes or device specific settings
17642  * based on custom regulatory domains.
17643  */
17644 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17645 				     struct regulatory_request *request)
17646 {
17647 	struct sk_buff *msg;
17648 	void *hdr;
17649 
17650 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17651 	if (!msg)
17652 		return;
17653 
17654 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17655 	if (!hdr)
17656 		goto nla_put_failure;
17657 
17658 	if (!nl80211_reg_change_event_fill(msg, request))
17659 		goto nla_put_failure;
17660 
17661 	genlmsg_end(msg, hdr);
17662 
17663 	rcu_read_lock();
17664 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17665 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17666 	rcu_read_unlock();
17667 
17668 	return;
17669 
17670 nla_put_failure:
17671 	nlmsg_free(msg);
17672 }
17673 
17674 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17675 				    struct net_device *netdev,
17676 				    const u8 *buf, size_t len,
17677 				    enum nl80211_commands cmd, gfp_t gfp,
17678 				    int uapsd_queues, const u8 *req_ies,
17679 				    size_t req_ies_len, bool reconnect)
17680 {
17681 	struct sk_buff *msg;
17682 	void *hdr;
17683 
17684 	msg = nlmsg_new(100 + len + req_ies_len, gfp);
17685 	if (!msg)
17686 		return;
17687 
17688 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17689 	if (!hdr) {
17690 		nlmsg_free(msg);
17691 		return;
17692 	}
17693 
17694 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17695 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17696 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17697 	    (req_ies &&
17698 	     nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17699 		goto nla_put_failure;
17700 
17701 	if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17702 		goto nla_put_failure;
17703 
17704 	if (uapsd_queues >= 0) {
17705 		struct nlattr *nla_wmm =
17706 			nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17707 		if (!nla_wmm)
17708 			goto nla_put_failure;
17709 
17710 		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17711 			       uapsd_queues))
17712 			goto nla_put_failure;
17713 
17714 		nla_nest_end(msg, nla_wmm);
17715 	}
17716 
17717 	genlmsg_end(msg, hdr);
17718 
17719 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17720 				NL80211_MCGRP_MLME, gfp);
17721 	return;
17722 
17723  nla_put_failure:
17724 	nlmsg_free(msg);
17725 }
17726 
17727 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17728 			  struct net_device *netdev, const u8 *buf,
17729 			  size_t len, gfp_t gfp)
17730 {
17731 	nl80211_send_mlme_event(rdev, netdev, buf, len,
17732 				NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17733 				false);
17734 }
17735 
17736 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17737 			   struct net_device *netdev,
17738 			   struct cfg80211_rx_assoc_resp *data)
17739 {
17740 	nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17741 				NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17742 				data->uapsd_queues,
17743 				data->req_ies, data->req_ies_len, false);
17744 }
17745 
17746 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17747 			 struct net_device *netdev, const u8 *buf,
17748 			 size_t len, bool reconnect, gfp_t gfp)
17749 {
17750 	nl80211_send_mlme_event(rdev, netdev, buf, len,
17751 				NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17752 				reconnect);
17753 }
17754 
17755 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17756 			   struct net_device *netdev, const u8 *buf,
17757 			   size_t len, bool reconnect, gfp_t gfp)
17758 {
17759 	nl80211_send_mlme_event(rdev, netdev, buf, len,
17760 				NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17761 				reconnect);
17762 }
17763 
17764 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17765 				  size_t len)
17766 {
17767 	struct wireless_dev *wdev = dev->ieee80211_ptr;
17768 	struct wiphy *wiphy = wdev->wiphy;
17769 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17770 	const struct ieee80211_mgmt *mgmt = (void *)buf;
17771 	u32 cmd;
17772 
17773 	if (WARN_ON(len < 2))
17774 		return;
17775 
17776 	if (ieee80211_is_deauth(mgmt->frame_control)) {
17777 		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17778 	} else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17779 		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17780 	} else if (ieee80211_is_beacon(mgmt->frame_control)) {
17781 		if (wdev->unprot_beacon_reported &&
17782 		    elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17783 			return;
17784 		cmd = NL80211_CMD_UNPROT_BEACON;
17785 		wdev->unprot_beacon_reported = jiffies;
17786 	} else {
17787 		return;
17788 	}
17789 
17790 	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17791 	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17792 				NULL, 0, false);
17793 }
17794 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17795 
17796 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17797 				      struct net_device *netdev, int cmd,
17798 				      const u8 *addr, gfp_t gfp)
17799 {
17800 	struct sk_buff *msg;
17801 	void *hdr;
17802 
17803 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17804 	if (!msg)
17805 		return;
17806 
17807 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17808 	if (!hdr) {
17809 		nlmsg_free(msg);
17810 		return;
17811 	}
17812 
17813 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17814 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17815 	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17816 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17817 		goto nla_put_failure;
17818 
17819 	genlmsg_end(msg, hdr);
17820 
17821 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17822 				NL80211_MCGRP_MLME, gfp);
17823 	return;
17824 
17825  nla_put_failure:
17826 	nlmsg_free(msg);
17827 }
17828 
17829 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17830 			       struct net_device *netdev, const u8 *addr,
17831 			       gfp_t gfp)
17832 {
17833 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17834 				  addr, gfp);
17835 }
17836 
17837 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17838 				struct net_device *netdev, const u8 *addr,
17839 				gfp_t gfp)
17840 {
17841 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17842 				  addr, gfp);
17843 }
17844 
17845 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17846 				 struct net_device *netdev,
17847 				 struct cfg80211_connect_resp_params *cr,
17848 				 gfp_t gfp)
17849 {
17850 	struct sk_buff *msg;
17851 	void *hdr;
17852 	unsigned int link;
17853 	size_t link_info_size = 0;
17854 	const u8 *connected_addr = cr->valid_links ?
17855 				   cr->ap_mld_addr : cr->links[0].bssid;
17856 
17857 	if (cr->valid_links) {
17858 		for_each_valid_link(cr, link) {
17859 			/* Nested attribute header */
17860 			link_info_size += NLA_HDRLEN;
17861 			/* Link ID */
17862 			link_info_size += nla_total_size(sizeof(u8));
17863 			link_info_size += cr->links[link].addr ?
17864 					  nla_total_size(ETH_ALEN) : 0;
17865 			link_info_size += (cr->links[link].bssid ||
17866 					   cr->links[link].bss) ?
17867 					  nla_total_size(ETH_ALEN) : 0;
17868 			link_info_size += nla_total_size(sizeof(u16));
17869 		}
17870 	}
17871 
17872 	msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17873 			cr->fils.kek_len + cr->fils.pmk_len +
17874 			(cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
17875 			gfp);
17876 	if (!msg)
17877 		return;
17878 
17879 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17880 	if (!hdr) {
17881 		nlmsg_free(msg);
17882 		return;
17883 	}
17884 
17885 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17886 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17887 	    (connected_addr &&
17888 	     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
17889 	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
17890 			cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
17891 			cr->status) ||
17892 	    (cr->status < 0 &&
17893 	     (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17894 	      nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
17895 			  cr->timeout_reason))) ||
17896 	    (cr->req_ie &&
17897 	     nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
17898 	    (cr->resp_ie &&
17899 	     nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
17900 		     cr->resp_ie)) ||
17901 	    (cr->fils.update_erp_next_seq_num &&
17902 	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17903 			 cr->fils.erp_next_seq_num)) ||
17904 	    (cr->status == WLAN_STATUS_SUCCESS &&
17905 	     ((cr->fils.kek &&
17906 	       nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
17907 		       cr->fils.kek)) ||
17908 	      (cr->fils.pmk &&
17909 	       nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
17910 	      (cr->fils.pmkid &&
17911 	       nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
17912 		goto nla_put_failure;
17913 
17914 	if (cr->valid_links) {
17915 		int i = 1;
17916 		struct nlattr *nested;
17917 
17918 		nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
17919 		if (!nested)
17920 			goto nla_put_failure;
17921 
17922 		for_each_valid_link(cr, link) {
17923 			struct nlattr *nested_mlo_links;
17924 			const u8 *bssid = cr->links[link].bss ?
17925 					  cr->links[link].bss->bssid :
17926 					  cr->links[link].bssid;
17927 
17928 			nested_mlo_links = nla_nest_start(msg, i);
17929 			if (!nested_mlo_links)
17930 				goto nla_put_failure;
17931 
17932 			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
17933 			    (bssid &&
17934 			     nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
17935 			    (cr->links[link].addr &&
17936 			     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
17937 				     cr->links[link].addr)) ||
17938 			    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
17939 					cr->links[link].status))
17940 				goto nla_put_failure;
17941 
17942 			nla_nest_end(msg, nested_mlo_links);
17943 			i++;
17944 		}
17945 		nla_nest_end(msg, nested);
17946 	}
17947 
17948 	genlmsg_end(msg, hdr);
17949 
17950 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17951 				NL80211_MCGRP_MLME, gfp);
17952 	return;
17953 
17954  nla_put_failure:
17955 	nlmsg_free(msg);
17956 }
17957 
17958 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
17959 			 struct net_device *netdev,
17960 			 struct cfg80211_roam_info *info, gfp_t gfp)
17961 {
17962 	struct sk_buff *msg;
17963 	void *hdr;
17964 	size_t link_info_size = 0;
17965 	unsigned int link;
17966 	const u8 *connected_addr = info->ap_mld_addr ?
17967 				   info->ap_mld_addr :
17968 				   (info->links[0].bss ?
17969 				    info->links[0].bss->bssid :
17970 				    info->links[0].bssid);
17971 
17972 	if (info->valid_links) {
17973 		for_each_valid_link(info, link) {
17974 			/* Nested attribute header */
17975 			link_info_size += NLA_HDRLEN;
17976 			/* Link ID */
17977 			link_info_size += nla_total_size(sizeof(u8));
17978 			link_info_size += info->links[link].addr ?
17979 					  nla_total_size(ETH_ALEN) : 0;
17980 			link_info_size += (info->links[link].bssid ||
17981 					   info->links[link].bss) ?
17982 					  nla_total_size(ETH_ALEN) : 0;
17983 		}
17984 	}
17985 
17986 	msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
17987 			info->fils.kek_len + info->fils.pmk_len +
17988 			(info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
17989 			link_info_size, gfp);
17990 	if (!msg)
17991 		return;
17992 
17993 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
17994 	if (!hdr) {
17995 		nlmsg_free(msg);
17996 		return;
17997 	}
17998 
17999 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18000 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18001 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18002 	    (info->req_ie &&
18003 	     nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18004 		     info->req_ie)) ||
18005 	    (info->resp_ie &&
18006 	     nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18007 		     info->resp_ie)) ||
18008 	    (info->fils.update_erp_next_seq_num &&
18009 	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18010 			 info->fils.erp_next_seq_num)) ||
18011 	    (info->fils.kek &&
18012 	     nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18013 		     info->fils.kek)) ||
18014 	    (info->fils.pmk &&
18015 	     nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18016 	    (info->fils.pmkid &&
18017 	     nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18018 		goto nla_put_failure;
18019 
18020 	if (info->valid_links) {
18021 		int i = 1;
18022 		struct nlattr *nested;
18023 
18024 		nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18025 		if (!nested)
18026 			goto nla_put_failure;
18027 
18028 		for_each_valid_link(info, link) {
18029 			struct nlattr *nested_mlo_links;
18030 			const u8 *bssid = info->links[link].bss ?
18031 					  info->links[link].bss->bssid :
18032 					  info->links[link].bssid;
18033 
18034 			nested_mlo_links = nla_nest_start(msg, i);
18035 			if (!nested_mlo_links)
18036 				goto nla_put_failure;
18037 
18038 			if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18039 			    (bssid &&
18040 			     nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18041 			    (info->links[link].addr &&
18042 			     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18043 				     info->links[link].addr)))
18044 				goto nla_put_failure;
18045 
18046 			nla_nest_end(msg, nested_mlo_links);
18047 			i++;
18048 		}
18049 		nla_nest_end(msg, nested);
18050 	}
18051 
18052 	genlmsg_end(msg, hdr);
18053 
18054 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18055 				NL80211_MCGRP_MLME, gfp);
18056 	return;
18057 
18058  nla_put_failure:
18059 	nlmsg_free(msg);
18060 }
18061 
18062 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18063 				  struct net_device *netdev, const u8 *bssid,
18064 				  const u8 *td_bitmap, u8 td_bitmap_len)
18065 {
18066 	struct sk_buff *msg;
18067 	void *hdr;
18068 
18069 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18070 	if (!msg)
18071 		return;
18072 
18073 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18074 	if (!hdr) {
18075 		nlmsg_free(msg);
18076 		return;
18077 	}
18078 
18079 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18080 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18081 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18082 		goto nla_put_failure;
18083 
18084 	if ((td_bitmap_len > 0) && td_bitmap)
18085 		if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18086 			    td_bitmap_len, td_bitmap))
18087 			goto nla_put_failure;
18088 
18089 	genlmsg_end(msg, hdr);
18090 
18091 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18092 				NL80211_MCGRP_MLME, GFP_KERNEL);
18093 	return;
18094 
18095  nla_put_failure:
18096 	nlmsg_free(msg);
18097 }
18098 
18099 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18100 			       struct net_device *netdev, u16 reason,
18101 			       const u8 *ie, size_t ie_len, bool from_ap)
18102 {
18103 	struct sk_buff *msg;
18104 	void *hdr;
18105 
18106 	msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18107 	if (!msg)
18108 		return;
18109 
18110 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18111 	if (!hdr) {
18112 		nlmsg_free(msg);
18113 		return;
18114 	}
18115 
18116 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18117 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18118 	    (reason &&
18119 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18120 	    (from_ap &&
18121 	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18122 	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18123 		goto nla_put_failure;
18124 
18125 	genlmsg_end(msg, hdr);
18126 
18127 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18128 				NL80211_MCGRP_MLME, GFP_KERNEL);
18129 	return;
18130 
18131  nla_put_failure:
18132 	nlmsg_free(msg);
18133 }
18134 
18135 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18136 			     struct net_device *netdev, const u8 *bssid,
18137 			     gfp_t gfp)
18138 {
18139 	struct sk_buff *msg;
18140 	void *hdr;
18141 
18142 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18143 	if (!msg)
18144 		return;
18145 
18146 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18147 	if (!hdr) {
18148 		nlmsg_free(msg);
18149 		return;
18150 	}
18151 
18152 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18153 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18154 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18155 		goto nla_put_failure;
18156 
18157 	genlmsg_end(msg, hdr);
18158 
18159 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18160 				NL80211_MCGRP_MLME, gfp);
18161 	return;
18162 
18163  nla_put_failure:
18164 	nlmsg_free(msg);
18165 }
18166 
18167 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18168 					const u8 *ie, u8 ie_len,
18169 					int sig_dbm, gfp_t gfp)
18170 {
18171 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18172 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18173 	struct sk_buff *msg;
18174 	void *hdr;
18175 
18176 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18177 		return;
18178 
18179 	trace_cfg80211_notify_new_peer_candidate(dev, addr);
18180 
18181 	msg = nlmsg_new(100 + ie_len, gfp);
18182 	if (!msg)
18183 		return;
18184 
18185 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18186 	if (!hdr) {
18187 		nlmsg_free(msg);
18188 		return;
18189 	}
18190 
18191 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18192 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18193 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18194 	    (ie_len && ie &&
18195 	     nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18196 	    (sig_dbm &&
18197 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18198 		goto nla_put_failure;
18199 
18200 	genlmsg_end(msg, hdr);
18201 
18202 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18203 				NL80211_MCGRP_MLME, gfp);
18204 	return;
18205 
18206  nla_put_failure:
18207 	nlmsg_free(msg);
18208 }
18209 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18210 
18211 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18212 				 struct net_device *netdev, const u8 *addr,
18213 				 enum nl80211_key_type key_type, int key_id,
18214 				 const u8 *tsc, gfp_t gfp)
18215 {
18216 	struct sk_buff *msg;
18217 	void *hdr;
18218 
18219 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18220 	if (!msg)
18221 		return;
18222 
18223 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18224 	if (!hdr) {
18225 		nlmsg_free(msg);
18226 		return;
18227 	}
18228 
18229 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18230 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18231 	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18232 	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18233 	    (key_id != -1 &&
18234 	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18235 	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18236 		goto nla_put_failure;
18237 
18238 	genlmsg_end(msg, hdr);
18239 
18240 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18241 				NL80211_MCGRP_MLME, gfp);
18242 	return;
18243 
18244  nla_put_failure:
18245 	nlmsg_free(msg);
18246 }
18247 
18248 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18249 				    struct ieee80211_channel *channel_before,
18250 				    struct ieee80211_channel *channel_after)
18251 {
18252 	struct sk_buff *msg;
18253 	void *hdr;
18254 	struct nlattr *nl_freq;
18255 
18256 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18257 	if (!msg)
18258 		return;
18259 
18260 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18261 	if (!hdr) {
18262 		nlmsg_free(msg);
18263 		return;
18264 	}
18265 
18266 	/*
18267 	 * Since we are applying the beacon hint to a wiphy we know its
18268 	 * wiphy_idx is valid
18269 	 */
18270 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18271 		goto nla_put_failure;
18272 
18273 	/* Before */
18274 	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18275 	if (!nl_freq)
18276 		goto nla_put_failure;
18277 
18278 	if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18279 		goto nla_put_failure;
18280 	nla_nest_end(msg, nl_freq);
18281 
18282 	/* After */
18283 	nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18284 	if (!nl_freq)
18285 		goto nla_put_failure;
18286 
18287 	if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18288 		goto nla_put_failure;
18289 	nla_nest_end(msg, nl_freq);
18290 
18291 	genlmsg_end(msg, hdr);
18292 
18293 	rcu_read_lock();
18294 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18295 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18296 	rcu_read_unlock();
18297 
18298 	return;
18299 
18300 nla_put_failure:
18301 	nlmsg_free(msg);
18302 }
18303 
18304 static void nl80211_send_remain_on_chan_event(
18305 	int cmd, struct cfg80211_registered_device *rdev,
18306 	struct wireless_dev *wdev, u64 cookie,
18307 	struct ieee80211_channel *chan,
18308 	unsigned int duration, gfp_t gfp)
18309 {
18310 	struct sk_buff *msg;
18311 	void *hdr;
18312 
18313 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18314 	if (!msg)
18315 		return;
18316 
18317 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18318 	if (!hdr) {
18319 		nlmsg_free(msg);
18320 		return;
18321 	}
18322 
18323 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18324 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18325 					 wdev->netdev->ifindex)) ||
18326 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18327 			      NL80211_ATTR_PAD) ||
18328 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18329 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18330 			NL80211_CHAN_NO_HT) ||
18331 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18332 			      NL80211_ATTR_PAD))
18333 		goto nla_put_failure;
18334 
18335 	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18336 	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18337 		goto nla_put_failure;
18338 
18339 	genlmsg_end(msg, hdr);
18340 
18341 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18342 				NL80211_MCGRP_MLME, gfp);
18343 	return;
18344 
18345  nla_put_failure:
18346 	nlmsg_free(msg);
18347 }
18348 
18349 void cfg80211_assoc_comeback(struct net_device *netdev,
18350 			     const u8 *ap_addr, u32 timeout)
18351 {
18352 	struct wireless_dev *wdev = netdev->ieee80211_ptr;
18353 	struct wiphy *wiphy = wdev->wiphy;
18354 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18355 	struct sk_buff *msg;
18356 	void *hdr;
18357 
18358 	trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18359 
18360 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18361 	if (!msg)
18362 		return;
18363 
18364 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18365 	if (!hdr) {
18366 		nlmsg_free(msg);
18367 		return;
18368 	}
18369 
18370 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18371 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18372 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18373 	    nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18374 		goto nla_put_failure;
18375 
18376 	genlmsg_end(msg, hdr);
18377 
18378 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18379 				NL80211_MCGRP_MLME, GFP_KERNEL);
18380 	return;
18381 
18382  nla_put_failure:
18383 	nlmsg_free(msg);
18384 }
18385 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18386 
18387 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18388 			       struct ieee80211_channel *chan,
18389 			       unsigned int duration, gfp_t gfp)
18390 {
18391 	struct wiphy *wiphy = wdev->wiphy;
18392 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18393 
18394 	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18395 	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18396 					  rdev, wdev, cookie, chan,
18397 					  duration, gfp);
18398 }
18399 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18400 
18401 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18402 					struct ieee80211_channel *chan,
18403 					gfp_t gfp)
18404 {
18405 	struct wiphy *wiphy = wdev->wiphy;
18406 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18407 
18408 	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18409 	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18410 					  rdev, wdev, cookie, chan, 0, gfp);
18411 }
18412 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18413 
18414 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18415 					struct ieee80211_channel *chan,
18416 					gfp_t gfp)
18417 {
18418 	struct wiphy *wiphy = wdev->wiphy;
18419 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18420 
18421 	trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18422 	nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18423 					  rdev, wdev, cookie, chan, 0, gfp);
18424 }
18425 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18426 
18427 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18428 		      struct station_info *sinfo, gfp_t gfp)
18429 {
18430 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18431 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18432 	struct sk_buff *msg;
18433 
18434 	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18435 
18436 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18437 	if (!msg)
18438 		return;
18439 
18440 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18441 				 rdev, dev, mac_addr, sinfo) < 0) {
18442 		nlmsg_free(msg);
18443 		return;
18444 	}
18445 
18446 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18447 				NL80211_MCGRP_MLME, gfp);
18448 }
18449 EXPORT_SYMBOL(cfg80211_new_sta);
18450 
18451 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18452 			    struct station_info *sinfo, gfp_t gfp)
18453 {
18454 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18455 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18456 	struct sk_buff *msg;
18457 	struct station_info empty_sinfo = {};
18458 
18459 	if (!sinfo)
18460 		sinfo = &empty_sinfo;
18461 
18462 	trace_cfg80211_del_sta(dev, mac_addr);
18463 
18464 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18465 	if (!msg) {
18466 		cfg80211_sinfo_release_content(sinfo);
18467 		return;
18468 	}
18469 
18470 	if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18471 				 rdev, dev, mac_addr, sinfo) < 0) {
18472 		nlmsg_free(msg);
18473 		return;
18474 	}
18475 
18476 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18477 				NL80211_MCGRP_MLME, gfp);
18478 }
18479 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18480 
18481 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18482 			  enum nl80211_connect_failed_reason reason,
18483 			  gfp_t gfp)
18484 {
18485 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18486 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18487 	struct sk_buff *msg;
18488 	void *hdr;
18489 
18490 	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18491 	if (!msg)
18492 		return;
18493 
18494 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18495 	if (!hdr) {
18496 		nlmsg_free(msg);
18497 		return;
18498 	}
18499 
18500 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18501 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18502 	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18503 		goto nla_put_failure;
18504 
18505 	genlmsg_end(msg, hdr);
18506 
18507 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18508 				NL80211_MCGRP_MLME, gfp);
18509 	return;
18510 
18511  nla_put_failure:
18512 	nlmsg_free(msg);
18513 }
18514 EXPORT_SYMBOL(cfg80211_conn_failed);
18515 
18516 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18517 				       const u8 *addr, gfp_t gfp)
18518 {
18519 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18520 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18521 	struct sk_buff *msg;
18522 	void *hdr;
18523 	u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18524 
18525 	if (!nlportid)
18526 		return false;
18527 
18528 	msg = nlmsg_new(100, gfp);
18529 	if (!msg)
18530 		return true;
18531 
18532 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18533 	if (!hdr) {
18534 		nlmsg_free(msg);
18535 		return true;
18536 	}
18537 
18538 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18539 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18540 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18541 		goto nla_put_failure;
18542 
18543 	genlmsg_end(msg, hdr);
18544 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18545 	return true;
18546 
18547  nla_put_failure:
18548 	nlmsg_free(msg);
18549 	return true;
18550 }
18551 
18552 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18553 				const u8 *addr, gfp_t gfp)
18554 {
18555 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18556 	bool ret;
18557 
18558 	trace_cfg80211_rx_spurious_frame(dev, addr);
18559 
18560 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18561 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18562 		trace_cfg80211_return_bool(false);
18563 		return false;
18564 	}
18565 	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18566 					 addr, gfp);
18567 	trace_cfg80211_return_bool(ret);
18568 	return ret;
18569 }
18570 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18571 
18572 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18573 					const u8 *addr, gfp_t gfp)
18574 {
18575 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18576 	bool ret;
18577 
18578 	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18579 
18580 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18581 		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18582 		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18583 		trace_cfg80211_return_bool(false);
18584 		return false;
18585 	}
18586 	ret = __nl80211_unexpected_frame(dev,
18587 					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18588 					 addr, gfp);
18589 	trace_cfg80211_return_bool(ret);
18590 	return ret;
18591 }
18592 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18593 
18594 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18595 		      struct wireless_dev *wdev, u32 nlportid,
18596 		      struct cfg80211_rx_info *info, gfp_t gfp)
18597 {
18598 	struct net_device *netdev = wdev->netdev;
18599 	struct sk_buff *msg;
18600 	void *hdr;
18601 
18602 	msg = nlmsg_new(100 + info->len, gfp);
18603 	if (!msg)
18604 		return -ENOMEM;
18605 
18606 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18607 	if (!hdr) {
18608 		nlmsg_free(msg);
18609 		return -ENOMEM;
18610 	}
18611 
18612 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18613 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18614 					netdev->ifindex)) ||
18615 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18616 			      NL80211_ATTR_PAD) ||
18617 	    (info->have_link_id &&
18618 	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18619 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18620 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18621 	    (info->sig_dbm &&
18622 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18623 	    nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18624 	    (info->flags &&
18625 	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18626 	    (info->rx_tstamp && nla_put_u64_64bit(msg,
18627 						  NL80211_ATTR_RX_HW_TIMESTAMP,
18628 						  info->rx_tstamp,
18629 						  NL80211_ATTR_PAD)) ||
18630 	    (info->ack_tstamp && nla_put_u64_64bit(msg,
18631 						   NL80211_ATTR_TX_HW_TIMESTAMP,
18632 						   info->ack_tstamp,
18633 						   NL80211_ATTR_PAD)))
18634 		goto nla_put_failure;
18635 
18636 	genlmsg_end(msg, hdr);
18637 
18638 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18639 
18640  nla_put_failure:
18641 	nlmsg_free(msg);
18642 	return -ENOBUFS;
18643 }
18644 
18645 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18646 				    struct cfg80211_tx_status *status,
18647 				    gfp_t gfp, enum nl80211_commands command)
18648 {
18649 	struct wiphy *wiphy = wdev->wiphy;
18650 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18651 	struct net_device *netdev = wdev->netdev;
18652 	struct sk_buff *msg;
18653 	void *hdr;
18654 
18655 	if (command == NL80211_CMD_FRAME_TX_STATUS)
18656 		trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18657 					      status->ack);
18658 	else
18659 		trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18660 						      status->ack);
18661 
18662 	msg = nlmsg_new(100 + status->len, gfp);
18663 	if (!msg)
18664 		return;
18665 
18666 	hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18667 	if (!hdr) {
18668 		nlmsg_free(msg);
18669 		return;
18670 	}
18671 
18672 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18673 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18674 				   netdev->ifindex)) ||
18675 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18676 			      NL80211_ATTR_PAD) ||
18677 	    nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18678 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18679 			      NL80211_ATTR_PAD) ||
18680 	    (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18681 	    (status->tx_tstamp &&
18682 	     nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18683 			       status->tx_tstamp, NL80211_ATTR_PAD)) ||
18684 	    (status->ack_tstamp &&
18685 	     nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18686 			       status->ack_tstamp, NL80211_ATTR_PAD)))
18687 		goto nla_put_failure;
18688 
18689 	genlmsg_end(msg, hdr);
18690 
18691 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18692 				NL80211_MCGRP_MLME, gfp);
18693 	return;
18694 
18695 nla_put_failure:
18696 	nlmsg_free(msg);
18697 }
18698 
18699 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18700 				     const u8 *buf, size_t len, bool ack,
18701 				     gfp_t gfp)
18702 {
18703 	struct cfg80211_tx_status status = {
18704 		.cookie = cookie,
18705 		.buf = buf,
18706 		.len = len,
18707 		.ack = ack
18708 	};
18709 
18710 	nl80211_frame_tx_status(wdev, &status, gfp,
18711 				NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18712 }
18713 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18714 
18715 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18716 				 struct cfg80211_tx_status *status, gfp_t gfp)
18717 {
18718 	nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18719 }
18720 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18721 
18722 static int __nl80211_rx_control_port(struct net_device *dev,
18723 				     struct sk_buff *skb,
18724 				     bool unencrypted, gfp_t gfp)
18725 {
18726 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18727 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18728 	struct ethhdr *ehdr = eth_hdr(skb);
18729 	const u8 *addr = ehdr->h_source;
18730 	u16 proto = be16_to_cpu(skb->protocol);
18731 	struct sk_buff *msg;
18732 	void *hdr;
18733 	struct nlattr *frame;
18734 
18735 	u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18736 
18737 	if (!nlportid)
18738 		return -ENOENT;
18739 
18740 	msg = nlmsg_new(100 + skb->len, gfp);
18741 	if (!msg)
18742 		return -ENOMEM;
18743 
18744 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18745 	if (!hdr) {
18746 		nlmsg_free(msg);
18747 		return -ENOBUFS;
18748 	}
18749 
18750 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18751 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18752 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18753 			      NL80211_ATTR_PAD) ||
18754 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18755 	    nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18756 	    (unencrypted && nla_put_flag(msg,
18757 					 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18758 		goto nla_put_failure;
18759 
18760 	frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18761 	if (!frame)
18762 		goto nla_put_failure;
18763 
18764 	skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18765 	genlmsg_end(msg, hdr);
18766 
18767 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18768 
18769  nla_put_failure:
18770 	nlmsg_free(msg);
18771 	return -ENOBUFS;
18772 }
18773 
18774 bool cfg80211_rx_control_port(struct net_device *dev,
18775 			      struct sk_buff *skb, bool unencrypted)
18776 {
18777 	int ret;
18778 
18779 	trace_cfg80211_rx_control_port(dev, skb, unencrypted);
18780 	ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
18781 	trace_cfg80211_return_bool(ret == 0);
18782 	return ret == 0;
18783 }
18784 EXPORT_SYMBOL(cfg80211_rx_control_port);
18785 
18786 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
18787 					    const char *mac, gfp_t gfp)
18788 {
18789 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18790 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18791 	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18792 	void **cb;
18793 
18794 	if (!msg)
18795 		return NULL;
18796 
18797 	cb = (void **)msg->cb;
18798 
18799 	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
18800 	if (!cb[0]) {
18801 		nlmsg_free(msg);
18802 		return NULL;
18803 	}
18804 
18805 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18806 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18807 		goto nla_put_failure;
18808 
18809 	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18810 		goto nla_put_failure;
18811 
18812 	cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
18813 	if (!cb[1])
18814 		goto nla_put_failure;
18815 
18816 	cb[2] = rdev;
18817 
18818 	return msg;
18819  nla_put_failure:
18820 	nlmsg_free(msg);
18821 	return NULL;
18822 }
18823 
18824 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
18825 {
18826 	void **cb = (void **)msg->cb;
18827 	struct cfg80211_registered_device *rdev = cb[2];
18828 
18829 	nla_nest_end(msg, cb[1]);
18830 	genlmsg_end(msg, cb[0]);
18831 
18832 	memset(msg->cb, 0, sizeof(msg->cb));
18833 
18834 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18835 				NL80211_MCGRP_MLME, gfp);
18836 }
18837 
18838 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18839 			      enum nl80211_cqm_rssi_threshold_event rssi_event,
18840 			      s32 rssi_level, gfp_t gfp)
18841 {
18842 	struct sk_buff *msg;
18843 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18844 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18845 
18846 	trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
18847 
18848 	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
18849 		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
18850 		return;
18851 
18852 	if (wdev->cqm_config) {
18853 		wdev->cqm_config->last_rssi_event_value = rssi_level;
18854 
18855 		cfg80211_cqm_rssi_update(rdev, dev);
18856 
18857 		if (rssi_level == 0)
18858 			rssi_level = wdev->cqm_config->last_rssi_event_value;
18859 	}
18860 
18861 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18862 	if (!msg)
18863 		return;
18864 
18865 	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
18866 			rssi_event))
18867 		goto nla_put_failure;
18868 
18869 	if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
18870 				      rssi_level))
18871 		goto nla_put_failure;
18872 
18873 	cfg80211_send_cqm(msg, gfp);
18874 
18875 	return;
18876 
18877  nla_put_failure:
18878 	nlmsg_free(msg);
18879 }
18880 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
18881 
18882 void cfg80211_cqm_txe_notify(struct net_device *dev,
18883 			     const u8 *peer, u32 num_packets,
18884 			     u32 rate, u32 intvl, gfp_t gfp)
18885 {
18886 	struct sk_buff *msg;
18887 
18888 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
18889 	if (!msg)
18890 		return;
18891 
18892 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
18893 		goto nla_put_failure;
18894 
18895 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
18896 		goto nla_put_failure;
18897 
18898 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
18899 		goto nla_put_failure;
18900 
18901 	cfg80211_send_cqm(msg, gfp);
18902 	return;
18903 
18904  nla_put_failure:
18905 	nlmsg_free(msg);
18906 }
18907 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
18908 
18909 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
18910 				 const u8 *peer, u32 num_packets, gfp_t gfp)
18911 {
18912 	struct sk_buff *msg;
18913 
18914 	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
18915 
18916 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
18917 	if (!msg)
18918 		return;
18919 
18920 	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
18921 		goto nla_put_failure;
18922 
18923 	cfg80211_send_cqm(msg, gfp);
18924 	return;
18925 
18926  nla_put_failure:
18927 	nlmsg_free(msg);
18928 }
18929 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
18930 
18931 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
18932 {
18933 	struct sk_buff *msg;
18934 
18935 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18936 	if (!msg)
18937 		return;
18938 
18939 	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
18940 		goto nla_put_failure;
18941 
18942 	cfg80211_send_cqm(msg, gfp);
18943 	return;
18944 
18945  nla_put_failure:
18946 	nlmsg_free(msg);
18947 }
18948 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
18949 
18950 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
18951 				     struct net_device *netdev, const u8 *bssid,
18952 				     const u8 *replay_ctr, gfp_t gfp)
18953 {
18954 	struct sk_buff *msg;
18955 	struct nlattr *rekey_attr;
18956 	void *hdr;
18957 
18958 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18959 	if (!msg)
18960 		return;
18961 
18962 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
18963 	if (!hdr) {
18964 		nlmsg_free(msg);
18965 		return;
18966 	}
18967 
18968 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18969 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18970 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18971 		goto nla_put_failure;
18972 
18973 	rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
18974 	if (!rekey_attr)
18975 		goto nla_put_failure;
18976 
18977 	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
18978 		    NL80211_REPLAY_CTR_LEN, replay_ctr))
18979 		goto nla_put_failure;
18980 
18981 	nla_nest_end(msg, rekey_attr);
18982 
18983 	genlmsg_end(msg, hdr);
18984 
18985 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18986 				NL80211_MCGRP_MLME, gfp);
18987 	return;
18988 
18989  nla_put_failure:
18990 	nlmsg_free(msg);
18991 }
18992 
18993 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
18994 			       const u8 *replay_ctr, gfp_t gfp)
18995 {
18996 	struct wireless_dev *wdev = dev->ieee80211_ptr;
18997 	struct wiphy *wiphy = wdev->wiphy;
18998 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18999 
19000 	trace_cfg80211_gtk_rekey_notify(dev, bssid);
19001 	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19002 }
19003 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19004 
19005 static void
19006 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19007 			       struct net_device *netdev, int index,
19008 			       const u8 *bssid, bool preauth, gfp_t gfp)
19009 {
19010 	struct sk_buff *msg;
19011 	struct nlattr *attr;
19012 	void *hdr;
19013 
19014 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19015 	if (!msg)
19016 		return;
19017 
19018 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19019 	if (!hdr) {
19020 		nlmsg_free(msg);
19021 		return;
19022 	}
19023 
19024 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19025 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19026 		goto nla_put_failure;
19027 
19028 	attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19029 	if (!attr)
19030 		goto nla_put_failure;
19031 
19032 	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19033 	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19034 	    (preauth &&
19035 	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19036 		goto nla_put_failure;
19037 
19038 	nla_nest_end(msg, attr);
19039 
19040 	genlmsg_end(msg, hdr);
19041 
19042 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19043 				NL80211_MCGRP_MLME, gfp);
19044 	return;
19045 
19046  nla_put_failure:
19047 	nlmsg_free(msg);
19048 }
19049 
19050 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19051 				     const u8 *bssid, bool preauth, gfp_t gfp)
19052 {
19053 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19054 	struct wiphy *wiphy = wdev->wiphy;
19055 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19056 
19057 	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19058 	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19059 }
19060 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19061 
19062 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19063 				     struct net_device *netdev,
19064 				     unsigned int link_id,
19065 				     struct cfg80211_chan_def *chandef,
19066 				     gfp_t gfp,
19067 				     enum nl80211_commands notif,
19068 				     u8 count, bool quiet, u16 punct_bitmap)
19069 {
19070 	struct wireless_dev *wdev = netdev->ieee80211_ptr;
19071 	struct sk_buff *msg;
19072 	void *hdr;
19073 
19074 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19075 	if (!msg)
19076 		return;
19077 
19078 	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19079 	if (!hdr) {
19080 		nlmsg_free(msg);
19081 		return;
19082 	}
19083 
19084 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19085 		goto nla_put_failure;
19086 
19087 	if (wdev->valid_links &&
19088 	    nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19089 		goto nla_put_failure;
19090 
19091 	if (nl80211_send_chandef(msg, chandef))
19092 		goto nla_put_failure;
19093 
19094 	if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19095 		if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19096 			goto nla_put_failure;
19097 		if (quiet &&
19098 		    nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19099 			goto nla_put_failure;
19100 	}
19101 
19102 	if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19103 		goto nla_put_failure;
19104 
19105 	genlmsg_end(msg, hdr);
19106 
19107 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19108 				NL80211_MCGRP_MLME, gfp);
19109 	return;
19110 
19111  nla_put_failure:
19112 	nlmsg_free(msg);
19113 }
19114 
19115 void cfg80211_ch_switch_notify(struct net_device *dev,
19116 			       struct cfg80211_chan_def *chandef,
19117 			       unsigned int link_id, u16 punct_bitmap)
19118 {
19119 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19120 	struct wiphy *wiphy = wdev->wiphy;
19121 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19122 
19123 	ASSERT_WDEV_LOCK(wdev);
19124 	WARN_INVALID_LINK_ID(wdev, link_id);
19125 
19126 	trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19127 
19128 	switch (wdev->iftype) {
19129 	case NL80211_IFTYPE_STATION:
19130 	case NL80211_IFTYPE_P2P_CLIENT:
19131 		if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19132 			cfg80211_update_assoc_bss_entry(wdev, link_id,
19133 							chandef->chan);
19134 		break;
19135 	case NL80211_IFTYPE_MESH_POINT:
19136 		wdev->u.mesh.chandef = *chandef;
19137 		wdev->u.mesh.preset_chandef = *chandef;
19138 		break;
19139 	case NL80211_IFTYPE_AP:
19140 	case NL80211_IFTYPE_P2P_GO:
19141 		wdev->links[link_id].ap.chandef = *chandef;
19142 		break;
19143 	case NL80211_IFTYPE_ADHOC:
19144 		wdev->u.ibss.chandef = *chandef;
19145 		break;
19146 	default:
19147 		WARN_ON(1);
19148 		break;
19149 	}
19150 
19151 	cfg80211_sched_dfs_chan_update(rdev);
19152 
19153 	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19154 				 NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19155 				 punct_bitmap);
19156 }
19157 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19158 
19159 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19160 				       struct cfg80211_chan_def *chandef,
19161 				       unsigned int link_id, u8 count,
19162 				       bool quiet, u16 punct_bitmap)
19163 {
19164 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19165 	struct wiphy *wiphy = wdev->wiphy;
19166 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19167 
19168 	ASSERT_WDEV_LOCK(wdev);
19169 	WARN_INVALID_LINK_ID(wdev, link_id);
19170 
19171 	trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19172 						punct_bitmap);
19173 
19174 
19175 	nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19176 				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19177 				 count, quiet, punct_bitmap);
19178 }
19179 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19180 
19181 int cfg80211_bss_color_notify(struct net_device *dev,
19182 			      enum nl80211_commands cmd, u8 count,
19183 			      u64 color_bitmap)
19184 {
19185 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19186 	struct wiphy *wiphy = wdev->wiphy;
19187 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19188 	struct sk_buff *msg;
19189 	void *hdr;
19190 
19191 	ASSERT_WDEV_LOCK(wdev);
19192 
19193 	trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19194 
19195 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19196 	if (!msg)
19197 		return -ENOMEM;
19198 
19199 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19200 	if (!hdr)
19201 		goto nla_put_failure;
19202 
19203 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19204 		goto nla_put_failure;
19205 
19206 	if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19207 	    nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19208 		goto nla_put_failure;
19209 
19210 	if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19211 	    nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19212 			      color_bitmap, NL80211_ATTR_PAD))
19213 		goto nla_put_failure;
19214 
19215 	genlmsg_end(msg, hdr);
19216 
19217 	return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19218 				       msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19219 
19220 nla_put_failure:
19221 	nlmsg_free(msg);
19222 	return -EINVAL;
19223 }
19224 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19225 
19226 void
19227 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19228 		     const struct cfg80211_chan_def *chandef,
19229 		     enum nl80211_radar_event event,
19230 		     struct net_device *netdev, gfp_t gfp)
19231 {
19232 	struct sk_buff *msg;
19233 	void *hdr;
19234 
19235 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19236 	if (!msg)
19237 		return;
19238 
19239 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19240 	if (!hdr) {
19241 		nlmsg_free(msg);
19242 		return;
19243 	}
19244 
19245 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19246 		goto nla_put_failure;
19247 
19248 	/* NOP and radar events don't need a netdev parameter */
19249 	if (netdev) {
19250 		struct wireless_dev *wdev = netdev->ieee80211_ptr;
19251 
19252 		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19253 		    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19254 				      NL80211_ATTR_PAD))
19255 			goto nla_put_failure;
19256 	}
19257 
19258 	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19259 		goto nla_put_failure;
19260 
19261 	if (nl80211_send_chandef(msg, chandef))
19262 		goto nla_put_failure;
19263 
19264 	genlmsg_end(msg, hdr);
19265 
19266 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19267 				NL80211_MCGRP_MLME, gfp);
19268 	return;
19269 
19270  nla_put_failure:
19271 	nlmsg_free(msg);
19272 }
19273 
19274 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19275 				       struct sta_opmode_info *sta_opmode,
19276 				       gfp_t gfp)
19277 {
19278 	struct sk_buff *msg;
19279 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19280 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19281 	void *hdr;
19282 
19283 	if (WARN_ON(!mac))
19284 		return;
19285 
19286 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19287 	if (!msg)
19288 		return;
19289 
19290 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19291 	if (!hdr) {
19292 		nlmsg_free(msg);
19293 		return;
19294 	}
19295 
19296 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19297 		goto nla_put_failure;
19298 
19299 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19300 		goto nla_put_failure;
19301 
19302 	if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19303 		goto nla_put_failure;
19304 
19305 	if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19306 	    nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19307 		goto nla_put_failure;
19308 
19309 	if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19310 	    nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19311 		goto nla_put_failure;
19312 
19313 	if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19314 	    nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19315 		goto nla_put_failure;
19316 
19317 	genlmsg_end(msg, hdr);
19318 
19319 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19320 				NL80211_MCGRP_MLME, gfp);
19321 
19322 	return;
19323 
19324 nla_put_failure:
19325 	nlmsg_free(msg);
19326 }
19327 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19328 
19329 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19330 			   u64 cookie, bool acked, s32 ack_signal,
19331 			   bool is_valid_ack_signal, gfp_t gfp)
19332 {
19333 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19334 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19335 	struct sk_buff *msg;
19336 	void *hdr;
19337 
19338 	trace_cfg80211_probe_status(dev, addr, cookie, acked);
19339 
19340 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19341 
19342 	if (!msg)
19343 		return;
19344 
19345 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19346 	if (!hdr) {
19347 		nlmsg_free(msg);
19348 		return;
19349 	}
19350 
19351 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19352 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19353 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19354 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19355 			      NL80211_ATTR_PAD) ||
19356 	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19357 	    (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19358 						ack_signal)))
19359 		goto nla_put_failure;
19360 
19361 	genlmsg_end(msg, hdr);
19362 
19363 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19364 				NL80211_MCGRP_MLME, gfp);
19365 	return;
19366 
19367  nla_put_failure:
19368 	nlmsg_free(msg);
19369 }
19370 EXPORT_SYMBOL(cfg80211_probe_status);
19371 
19372 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19373 				     size_t len, int freq, int sig_dbm)
19374 {
19375 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19376 	struct sk_buff *msg;
19377 	void *hdr;
19378 	struct cfg80211_beacon_registration *reg;
19379 
19380 	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19381 
19382 	spin_lock_bh(&rdev->beacon_registrations_lock);
19383 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19384 		msg = nlmsg_new(len + 100, GFP_ATOMIC);
19385 		if (!msg) {
19386 			spin_unlock_bh(&rdev->beacon_registrations_lock);
19387 			return;
19388 		}
19389 
19390 		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19391 		if (!hdr)
19392 			goto nla_put_failure;
19393 
19394 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19395 		    (freq &&
19396 		     (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19397 				  KHZ_TO_MHZ(freq)) ||
19398 		      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19399 				  freq % 1000))) ||
19400 		    (sig_dbm &&
19401 		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19402 		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19403 			goto nla_put_failure;
19404 
19405 		genlmsg_end(msg, hdr);
19406 
19407 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19408 	}
19409 	spin_unlock_bh(&rdev->beacon_registrations_lock);
19410 	return;
19411 
19412  nla_put_failure:
19413 	spin_unlock_bh(&rdev->beacon_registrations_lock);
19414 	nlmsg_free(msg);
19415 }
19416 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19417 
19418 #ifdef CONFIG_PM
19419 static int cfg80211_net_detect_results(struct sk_buff *msg,
19420 				       struct cfg80211_wowlan_wakeup *wakeup)
19421 {
19422 	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19423 	struct nlattr *nl_results, *nl_match, *nl_freqs;
19424 	int i, j;
19425 
19426 	nl_results = nla_nest_start_noflag(msg,
19427 					   NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19428 	if (!nl_results)
19429 		return -EMSGSIZE;
19430 
19431 	for (i = 0; i < nd->n_matches; i++) {
19432 		struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19433 
19434 		nl_match = nla_nest_start_noflag(msg, i);
19435 		if (!nl_match)
19436 			break;
19437 
19438 		/* The SSID attribute is optional in nl80211, but for
19439 		 * simplicity reasons it's always present in the
19440 		 * cfg80211 structure.  If a driver can't pass the
19441 		 * SSID, that needs to be changed.  A zero length SSID
19442 		 * is still a valid SSID (wildcard), so it cannot be
19443 		 * used for this purpose.
19444 		 */
19445 		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19446 			    match->ssid.ssid)) {
19447 			nla_nest_cancel(msg, nl_match);
19448 			goto out;
19449 		}
19450 
19451 		if (match->n_channels) {
19452 			nl_freqs = nla_nest_start_noflag(msg,
19453 							 NL80211_ATTR_SCAN_FREQUENCIES);
19454 			if (!nl_freqs) {
19455 				nla_nest_cancel(msg, nl_match);
19456 				goto out;
19457 			}
19458 
19459 			for (j = 0; j < match->n_channels; j++) {
19460 				if (nla_put_u32(msg, j, match->channels[j])) {
19461 					nla_nest_cancel(msg, nl_freqs);
19462 					nla_nest_cancel(msg, nl_match);
19463 					goto out;
19464 				}
19465 			}
19466 
19467 			nla_nest_end(msg, nl_freqs);
19468 		}
19469 
19470 		nla_nest_end(msg, nl_match);
19471 	}
19472 
19473 out:
19474 	nla_nest_end(msg, nl_results);
19475 	return 0;
19476 }
19477 
19478 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19479 				   struct cfg80211_wowlan_wakeup *wakeup,
19480 				   gfp_t gfp)
19481 {
19482 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19483 	struct sk_buff *msg;
19484 	void *hdr;
19485 	int size = 200;
19486 
19487 	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19488 
19489 	if (wakeup)
19490 		size += wakeup->packet_present_len;
19491 
19492 	msg = nlmsg_new(size, gfp);
19493 	if (!msg)
19494 		return;
19495 
19496 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19497 	if (!hdr)
19498 		goto free_msg;
19499 
19500 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19501 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19502 			      NL80211_ATTR_PAD))
19503 		goto free_msg;
19504 
19505 	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19506 					wdev->netdev->ifindex))
19507 		goto free_msg;
19508 
19509 	if (wakeup) {
19510 		struct nlattr *reasons;
19511 
19512 		reasons = nla_nest_start_noflag(msg,
19513 						NL80211_ATTR_WOWLAN_TRIGGERS);
19514 		if (!reasons)
19515 			goto free_msg;
19516 
19517 		if (wakeup->disconnect &&
19518 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19519 			goto free_msg;
19520 		if (wakeup->magic_pkt &&
19521 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19522 			goto free_msg;
19523 		if (wakeup->gtk_rekey_failure &&
19524 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19525 			goto free_msg;
19526 		if (wakeup->eap_identity_req &&
19527 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19528 			goto free_msg;
19529 		if (wakeup->four_way_handshake &&
19530 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19531 			goto free_msg;
19532 		if (wakeup->rfkill_release &&
19533 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19534 			goto free_msg;
19535 
19536 		if (wakeup->pattern_idx >= 0 &&
19537 		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19538 				wakeup->pattern_idx))
19539 			goto free_msg;
19540 
19541 		if (wakeup->tcp_match &&
19542 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19543 			goto free_msg;
19544 
19545 		if (wakeup->tcp_connlost &&
19546 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19547 			goto free_msg;
19548 
19549 		if (wakeup->tcp_nomoretokens &&
19550 		    nla_put_flag(msg,
19551 				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19552 			goto free_msg;
19553 
19554 		if (wakeup->packet) {
19555 			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19556 			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19557 
19558 			if (!wakeup->packet_80211) {
19559 				pkt_attr =
19560 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19561 				len_attr =
19562 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19563 			}
19564 
19565 			if (wakeup->packet_len &&
19566 			    nla_put_u32(msg, len_attr, wakeup->packet_len))
19567 				goto free_msg;
19568 
19569 			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19570 				    wakeup->packet))
19571 				goto free_msg;
19572 		}
19573 
19574 		if (wakeup->net_detect &&
19575 		    cfg80211_net_detect_results(msg, wakeup))
19576 				goto free_msg;
19577 
19578 		nla_nest_end(msg, reasons);
19579 	}
19580 
19581 	genlmsg_end(msg, hdr);
19582 
19583 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19584 				NL80211_MCGRP_MLME, gfp);
19585 	return;
19586 
19587  free_msg:
19588 	nlmsg_free(msg);
19589 }
19590 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19591 #endif
19592 
19593 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19594 				enum nl80211_tdls_operation oper,
19595 				u16 reason_code, gfp_t gfp)
19596 {
19597 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19598 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19599 	struct sk_buff *msg;
19600 	void *hdr;
19601 
19602 	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19603 					 reason_code);
19604 
19605 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19606 	if (!msg)
19607 		return;
19608 
19609 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19610 	if (!hdr) {
19611 		nlmsg_free(msg);
19612 		return;
19613 	}
19614 
19615 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19616 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19617 	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19618 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19619 	    (reason_code > 0 &&
19620 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19621 		goto nla_put_failure;
19622 
19623 	genlmsg_end(msg, hdr);
19624 
19625 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19626 				NL80211_MCGRP_MLME, gfp);
19627 	return;
19628 
19629  nla_put_failure:
19630 	nlmsg_free(msg);
19631 }
19632 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19633 
19634 static int nl80211_netlink_notify(struct notifier_block * nb,
19635 				  unsigned long state,
19636 				  void *_notify)
19637 {
19638 	struct netlink_notify *notify = _notify;
19639 	struct cfg80211_registered_device *rdev;
19640 	struct wireless_dev *wdev;
19641 	struct cfg80211_beacon_registration *reg, *tmp;
19642 
19643 	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19644 		return NOTIFY_DONE;
19645 
19646 	rcu_read_lock();
19647 
19648 	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19649 		struct cfg80211_sched_scan_request *sched_scan_req;
19650 
19651 		list_for_each_entry_rcu(sched_scan_req,
19652 					&rdev->sched_scan_req_list,
19653 					list) {
19654 			if (sched_scan_req->owner_nlportid == notify->portid) {
19655 				sched_scan_req->nl_owner_dead = true;
19656 				schedule_work(&rdev->sched_scan_stop_wk);
19657 			}
19658 		}
19659 
19660 		list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19661 			cfg80211_mlme_unregister_socket(wdev, notify->portid);
19662 
19663 			if (wdev->owner_nlportid == notify->portid) {
19664 				wdev->nl_owner_dead = true;
19665 				schedule_work(&rdev->destroy_work);
19666 			} else if (wdev->conn_owner_nlportid == notify->portid) {
19667 				schedule_work(&wdev->disconnect_wk);
19668 			}
19669 
19670 			cfg80211_release_pmsr(wdev, notify->portid);
19671 		}
19672 
19673 		spin_lock_bh(&rdev->beacon_registrations_lock);
19674 		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19675 					 list) {
19676 			if (reg->nlportid == notify->portid) {
19677 				list_del(&reg->list);
19678 				kfree(reg);
19679 				break;
19680 			}
19681 		}
19682 		spin_unlock_bh(&rdev->beacon_registrations_lock);
19683 	}
19684 
19685 	rcu_read_unlock();
19686 
19687 	/*
19688 	 * It is possible that the user space process that is controlling the
19689 	 * indoor setting disappeared, so notify the regulatory core.
19690 	 */
19691 	regulatory_netlink_notify(notify->portid);
19692 	return NOTIFY_OK;
19693 }
19694 
19695 static struct notifier_block nl80211_netlink_notifier = {
19696 	.notifier_call = nl80211_netlink_notify,
19697 };
19698 
19699 void cfg80211_ft_event(struct net_device *netdev,
19700 		       struct cfg80211_ft_event_params *ft_event)
19701 {
19702 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19703 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19704 	struct sk_buff *msg;
19705 	void *hdr;
19706 
19707 	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19708 
19709 	if (!ft_event->target_ap)
19710 		return;
19711 
19712 	msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19713 			GFP_KERNEL);
19714 	if (!msg)
19715 		return;
19716 
19717 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19718 	if (!hdr)
19719 		goto out;
19720 
19721 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19722 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19723 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19724 		goto out;
19725 
19726 	if (ft_event->ies &&
19727 	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19728 		goto out;
19729 	if (ft_event->ric_ies &&
19730 	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19731 		    ft_event->ric_ies))
19732 		goto out;
19733 
19734 	genlmsg_end(msg, hdr);
19735 
19736 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19737 				NL80211_MCGRP_MLME, GFP_KERNEL);
19738 	return;
19739  out:
19740 	nlmsg_free(msg);
19741 }
19742 EXPORT_SYMBOL(cfg80211_ft_event);
19743 
19744 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19745 {
19746 	struct cfg80211_registered_device *rdev;
19747 	struct sk_buff *msg;
19748 	void *hdr;
19749 	u32 nlportid;
19750 
19751 	rdev = wiphy_to_rdev(wdev->wiphy);
19752 	if (!rdev->crit_proto_nlportid)
19753 		return;
19754 
19755 	nlportid = rdev->crit_proto_nlportid;
19756 	rdev->crit_proto_nlportid = 0;
19757 
19758 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19759 	if (!msg)
19760 		return;
19761 
19762 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19763 	if (!hdr)
19764 		goto nla_put_failure;
19765 
19766 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19767 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19768 			      NL80211_ATTR_PAD))
19769 		goto nla_put_failure;
19770 
19771 	genlmsg_end(msg, hdr);
19772 
19773 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19774 	return;
19775 
19776  nla_put_failure:
19777 	nlmsg_free(msg);
19778 }
19779 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
19780 
19781 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
19782 {
19783 	struct wiphy *wiphy = wdev->wiphy;
19784 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19785 	struct sk_buff *msg;
19786 	void *hdr;
19787 
19788 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19789 	if (!msg)
19790 		return;
19791 
19792 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
19793 	if (!hdr)
19794 		goto out;
19795 
19796 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19797 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
19798 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19799 			      NL80211_ATTR_PAD) ||
19800 	    (wdev->valid_links &&
19801 	     nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
19802 		goto out;
19803 
19804 	genlmsg_end(msg, hdr);
19805 
19806 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
19807 				NL80211_MCGRP_MLME, GFP_KERNEL);
19808 	return;
19809  out:
19810 	nlmsg_free(msg);
19811 }
19812 
19813 int cfg80211_external_auth_request(struct net_device *dev,
19814 				   struct cfg80211_external_auth_params *params,
19815 				   gfp_t gfp)
19816 {
19817 	struct wireless_dev *wdev = dev->ieee80211_ptr;
19818 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19819 	struct sk_buff *msg;
19820 	void *hdr;
19821 
19822 	if (!wdev->conn_owner_nlportid)
19823 		return -EINVAL;
19824 
19825 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19826 	if (!msg)
19827 		return -ENOMEM;
19828 
19829 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
19830 	if (!hdr)
19831 		goto nla_put_failure;
19832 
19833 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19834 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19835 	    nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
19836 	    nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
19837 			params->action) ||
19838 	    nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
19839 	    nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
19840 		    params->ssid.ssid) ||
19841 	    (!is_zero_ether_addr(params->mld_addr) &&
19842 	     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
19843 		goto nla_put_failure;
19844 
19845 	genlmsg_end(msg, hdr);
19846 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
19847 			wdev->conn_owner_nlportid);
19848 	return 0;
19849 
19850  nla_put_failure:
19851 	nlmsg_free(msg);
19852 	return -ENOBUFS;
19853 }
19854 EXPORT_SYMBOL(cfg80211_external_auth_request);
19855 
19856 void cfg80211_update_owe_info_event(struct net_device *netdev,
19857 				    struct cfg80211_update_owe_info *owe_info,
19858 				    gfp_t gfp)
19859 {
19860 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19861 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19862 	struct sk_buff *msg;
19863 	void *hdr;
19864 
19865 	trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
19866 
19867 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19868 	if (!msg)
19869 		return;
19870 
19871 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
19872 	if (!hdr)
19873 		goto nla_put_failure;
19874 
19875 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19876 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19877 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
19878 		goto nla_put_failure;
19879 
19880 	if (!owe_info->ie_len ||
19881 	    nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
19882 		goto nla_put_failure;
19883 
19884 	if (owe_info->assoc_link_id != -1) {
19885 		if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
19886 			       owe_info->assoc_link_id))
19887 			goto nla_put_failure;
19888 
19889 		if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
19890 		    nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
19891 			    owe_info->peer_mld_addr))
19892 			goto nla_put_failure;
19893 	}
19894 
19895 	genlmsg_end(msg, hdr);
19896 
19897 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19898 				NL80211_MCGRP_MLME, gfp);
19899 	return;
19900 
19901 nla_put_failure:
19902 	genlmsg_cancel(msg, hdr);
19903 	nlmsg_free(msg);
19904 }
19905 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
19906 
19907 /* initialisation/exit functions */
19908 
19909 int __init nl80211_init(void)
19910 {
19911 	int err;
19912 
19913 	err = genl_register_family(&nl80211_fam);
19914 	if (err)
19915 		return err;
19916 
19917 	err = netlink_register_notifier(&nl80211_netlink_notifier);
19918 	if (err)
19919 		goto err_out;
19920 
19921 	return 0;
19922  err_out:
19923 	genl_unregister_family(&nl80211_fam);
19924 	return err;
19925 }
19926 
19927 void nl80211_exit(void)
19928 {
19929 	netlink_unregister_notifier(&nl80211_netlink_notifier);
19930 	genl_unregister_family(&nl80211_fam);
19931 }
19932