xref: /openbmc/linux/net/wireless/nl80211.c (revision fca3aa16) 
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010	Johannes Berg <johannes@sipsolutions.net>
5  * Copyright 2013-2014  Intel Mobile Communications GmbH
6  * Copyright 2015-2017	Intel Deutschland GmbH
7  */
8 
9 #include <linux/if.h>
10 #include <linux/module.h>
11 #include <linux/err.h>
12 #include <linux/slab.h>
13 #include <linux/list.h>
14 #include <linux/if_ether.h>
15 #include <linux/ieee80211.h>
16 #include <linux/nl80211.h>
17 #include <linux/rtnetlink.h>
18 #include <linux/netlink.h>
19 #include <linux/nospec.h>
20 #include <linux/etherdevice.h>
21 #include <net/net_namespace.h>
22 #include <net/genetlink.h>
23 #include <net/cfg80211.h>
24 #include <net/sock.h>
25 #include <net/inet_connection_sock.h>
26 #include "core.h"
27 #include "nl80211.h"
28 #include "reg.h"
29 #include "rdev-ops.h"
30 
31 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
32 				   struct genl_info *info,
33 				   struct cfg80211_crypto_settings *settings,
34 				   int cipher_limit);
35 
36 /* the netlink family */
37 static struct genl_family nl80211_fam;
38 
39 /* multicast groups */
40 enum nl80211_multicast_groups {
41 	NL80211_MCGRP_CONFIG,
42 	NL80211_MCGRP_SCAN,
43 	NL80211_MCGRP_REGULATORY,
44 	NL80211_MCGRP_MLME,
45 	NL80211_MCGRP_VENDOR,
46 	NL80211_MCGRP_NAN,
47 	NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
48 };
49 
50 static const struct genl_multicast_group nl80211_mcgrps[] = {
51 	[NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
52 	[NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
53 	[NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
54 	[NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
55 	[NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
56 	[NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
57 #ifdef CONFIG_NL80211_TESTMODE
58 	[NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
59 #endif
60 };
61 
62 /* returns ERR_PTR values */
63 static struct wireless_dev *
64 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
65 {
66 	struct cfg80211_registered_device *rdev;
67 	struct wireless_dev *result = NULL;
68 	bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
69 	bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
70 	u64 wdev_id;
71 	int wiphy_idx = -1;
72 	int ifidx = -1;
73 
74 	ASSERT_RTNL();
75 
76 	if (!have_ifidx && !have_wdev_id)
77 		return ERR_PTR(-EINVAL);
78 
79 	if (have_ifidx)
80 		ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
81 	if (have_wdev_id) {
82 		wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
83 		wiphy_idx = wdev_id >> 32;
84 	}
85 
86 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
87 		struct wireless_dev *wdev;
88 
89 		if (wiphy_net(&rdev->wiphy) != netns)
90 			continue;
91 
92 		if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
93 			continue;
94 
95 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
96 			if (have_ifidx && wdev->netdev &&
97 			    wdev->netdev->ifindex == ifidx) {
98 				result = wdev;
99 				break;
100 			}
101 			if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
102 				result = wdev;
103 				break;
104 			}
105 		}
106 
107 		if (result)
108 			break;
109 	}
110 
111 	if (result)
112 		return result;
113 	return ERR_PTR(-ENODEV);
114 }
115 
116 static struct cfg80211_registered_device *
117 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
118 {
119 	struct cfg80211_registered_device *rdev = NULL, *tmp;
120 	struct net_device *netdev;
121 
122 	ASSERT_RTNL();
123 
124 	if (!attrs[NL80211_ATTR_WIPHY] &&
125 	    !attrs[NL80211_ATTR_IFINDEX] &&
126 	    !attrs[NL80211_ATTR_WDEV])
127 		return ERR_PTR(-EINVAL);
128 
129 	if (attrs[NL80211_ATTR_WIPHY])
130 		rdev = cfg80211_rdev_by_wiphy_idx(
131 				nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
132 
133 	if (attrs[NL80211_ATTR_WDEV]) {
134 		u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
135 		struct wireless_dev *wdev;
136 		bool found = false;
137 
138 		tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
139 		if (tmp) {
140 			/* make sure wdev exists */
141 			list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
142 				if (wdev->identifier != (u32)wdev_id)
143 					continue;
144 				found = true;
145 				break;
146 			}
147 
148 			if (!found)
149 				tmp = NULL;
150 
151 			if (rdev && tmp != rdev)
152 				return ERR_PTR(-EINVAL);
153 			rdev = tmp;
154 		}
155 	}
156 
157 	if (attrs[NL80211_ATTR_IFINDEX]) {
158 		int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
159 
160 		netdev = __dev_get_by_index(netns, ifindex);
161 		if (netdev) {
162 			if (netdev->ieee80211_ptr)
163 				tmp = wiphy_to_rdev(
164 					netdev->ieee80211_ptr->wiphy);
165 			else
166 				tmp = NULL;
167 
168 			/* not wireless device -- return error */
169 			if (!tmp)
170 				return ERR_PTR(-EINVAL);
171 
172 			/* mismatch -- return error */
173 			if (rdev && tmp != rdev)
174 				return ERR_PTR(-EINVAL);
175 
176 			rdev = tmp;
177 		}
178 	}
179 
180 	if (!rdev)
181 		return ERR_PTR(-ENODEV);
182 
183 	if (netns != wiphy_net(&rdev->wiphy))
184 		return ERR_PTR(-ENODEV);
185 
186 	return rdev;
187 }
188 
189 /*
190  * This function returns a pointer to the driver
191  * that the genl_info item that is passed refers to.
192  *
193  * The result of this can be a PTR_ERR and hence must
194  * be checked with IS_ERR() for errors.
195  */
196 static struct cfg80211_registered_device *
197 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
198 {
199 	return __cfg80211_rdev_from_attrs(netns, info->attrs);
200 }
201 
202 /* policy for the attributes */
203 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
204 	[NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
205 	[NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
206 				      .len = 20-1 },
207 	[NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
208 
209 	[NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
210 	[NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
211 	[NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
212 	[NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
213 	[NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
214 
215 	[NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
216 	[NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
217 	[NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
218 	[NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
219 	[NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
220 	[NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
221 
222 	[NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
223 	[NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
224 	[NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
225 
226 	[NL80211_ATTR_MAC] = { .len = ETH_ALEN },
227 	[NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
228 
229 	[NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
230 	[NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
231 				    .len = WLAN_MAX_KEY_LEN },
232 	[NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
233 	[NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
234 	[NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
235 	[NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
236 	[NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
237 
238 	[NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
239 	[NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
240 	[NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
241 				       .len = IEEE80211_MAX_DATA_LEN },
242 	[NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
243 				       .len = IEEE80211_MAX_DATA_LEN },
244 	[NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
245 	[NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
246 	[NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
247 	[NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
248 					       .len = NL80211_MAX_SUPP_RATES },
249 	[NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
250 	[NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
251 	[NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
252 	[NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
253 				   .len = IEEE80211_MAX_MESH_ID_LEN },
254 	[NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
255 
256 	[NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
257 	[NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
258 
259 	[NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
260 	[NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
261 	[NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
262 	[NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
263 					   .len = NL80211_MAX_SUPP_RATES },
264 	[NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
265 
266 	[NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
267 	[NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
268 
269 	[NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
270 
271 	[NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
272 	[NL80211_ATTR_IE] = { .type = NLA_BINARY,
273 			      .len = IEEE80211_MAX_DATA_LEN },
274 	[NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
275 	[NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
276 
277 	[NL80211_ATTR_SSID] = { .type = NLA_BINARY,
278 				.len = IEEE80211_MAX_SSID_LEN },
279 	[NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
280 	[NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
281 	[NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
282 	[NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
283 	[NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
284 	[NL80211_ATTR_STA_FLAGS2] = {
285 		.len = sizeof(struct nl80211_sta_flag_update),
286 	},
287 	[NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
288 	[NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
289 	[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
290 	[NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
291 	[NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
292 	[NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
293 	[NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
294 	[NL80211_ATTR_PID] = { .type = NLA_U32 },
295 	[NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
296 	[NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
297 	[NL80211_ATTR_DURATION] = { .type = NLA_U32 },
298 	[NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
299 	[NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
300 	[NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
301 				 .len = IEEE80211_MAX_DATA_LEN },
302 	[NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
303 	[NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
304 	[NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
305 	[NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
306 	[NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
307 	[NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
308 	[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
309 	[NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
310 	[NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
311 	[NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
312 	[NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
313 	[NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
314 	[NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
315 	[NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
316 	[NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
317 	[NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
318 	[NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
319 	[NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
320 	[NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
321 	[NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
322 					 .len = IEEE80211_MAX_DATA_LEN },
323 	[NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
324 					 .len = IEEE80211_MAX_DATA_LEN },
325 	[NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
326 	[NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
327 	[NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
328 	[NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
329 	[NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
330 	[NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
331 	[NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
332 	[NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
333 	[NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
334 	[NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
335 	[NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
336 				      .len = IEEE80211_MAX_DATA_LEN },
337 	[NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
338 	[NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
339 	[NL80211_ATTR_HT_CAPABILITY_MASK] = {
340 		.len = NL80211_HT_CAPABILITY_LEN
341 	},
342 	[NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
343 	[NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
344 	[NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
345 	[NL80211_ATTR_WDEV] = { .type = NLA_U64 },
346 	[NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
347 	[NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
348 	[NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
349 	[NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
350 	[NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
351 	[NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
352 	[NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
353 	[NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
354 	[NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
355 	[NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
356 	[NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
357 	[NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
358 	[NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
359 	[NL80211_ATTR_VHT_CAPABILITY_MASK] = {
360 		.len = NL80211_VHT_CAPABILITY_LEN,
361 	},
362 	[NL80211_ATTR_MDID] = { .type = NLA_U16 },
363 	[NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
364 				  .len = IEEE80211_MAX_DATA_LEN },
365 	[NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
366 	[NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
367 	[NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
368 	[NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
369 	[NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
370 	[NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
371 	[NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
372 	[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
373 	[NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
374 	[NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
375 	[NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
376 	[NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
377 	[NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
378 	[NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
379 				   .len = IEEE80211_QOS_MAP_LEN_MAX },
380 	[NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
381 	[NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
382 	[NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
383 	[NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
384 	[NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
385 	[NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
386 	[NL80211_ATTR_TSID] = { .type = NLA_U8 },
387 	[NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
388 	[NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
389 	[NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
390 	[NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
391 	[NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
392 	[NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
393 	[NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
394 	[NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
395 	[NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
396 	[NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
397 	[NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
398 	[NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
399 		.len = VHT_MUMIMO_GROUPS_DATA_LEN
400 	},
401 	[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
402 	[NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
403 	[NL80211_ATTR_BANDS] = { .type = NLA_U32 },
404 	[NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
405 	[NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
406 				    .len = FILS_MAX_KEK_LEN },
407 	[NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
408 	[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
409 	[NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
410 	[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
411 	[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
412 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
413 	},
414 	[NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
415 	[NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
416 					     .len = FILS_ERP_MAX_USERNAME_LEN },
417 	[NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
418 					  .len = FILS_ERP_MAX_REALM_LEN },
419 	[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
420 	[NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
421 					.len = FILS_ERP_MAX_RRK_LEN },
422 	[NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
423 	[NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
424 	[NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
425 	[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
426 };
427 
428 /* policy for the key attributes */
429 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
430 	[NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
431 	[NL80211_KEY_IDX] = { .type = NLA_U8 },
432 	[NL80211_KEY_CIPHER] = { .type = NLA_U32 },
433 	[NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
434 	[NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
435 	[NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
436 	[NL80211_KEY_TYPE] = { .type = NLA_U32 },
437 	[NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
438 };
439 
440 /* policy for the key default flags */
441 static const struct nla_policy
442 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
443 	[NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
444 	[NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
445 };
446 
447 #ifdef CONFIG_PM
448 /* policy for WoWLAN attributes */
449 static const struct nla_policy
450 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
451 	[NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
452 	[NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
453 	[NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
454 	[NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
455 	[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
456 	[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
457 	[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
458 	[NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
459 	[NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
460 	[NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
461 };
462 
463 static const struct nla_policy
464 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
465 	[NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
466 	[NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
467 	[NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
468 	[NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
469 	[NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
470 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
471 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
472 		.len = sizeof(struct nl80211_wowlan_tcp_data_seq)
473 	},
474 	[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
475 		.len = sizeof(struct nl80211_wowlan_tcp_data_token)
476 	},
477 	[NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
478 	[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
479 	[NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
480 };
481 #endif /* CONFIG_PM */
482 
483 /* policy for coalesce rule attributes */
484 static const struct nla_policy
485 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
486 	[NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
487 	[NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
488 	[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
489 };
490 
491 /* policy for GTK rekey offload attributes */
492 static const struct nla_policy
493 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
494 	[NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
495 	[NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
496 	[NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
497 };
498 
499 static const struct nla_policy
500 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
501 	[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
502 						 .len = IEEE80211_MAX_SSID_LEN },
503 	[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
504 	[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
505 };
506 
507 static const struct nla_policy
508 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
509 	[NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
510 	[NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
511 };
512 
513 static const struct nla_policy
514 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
515 	[NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
516 	[NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
517 	[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
518 		.len = sizeof(struct nl80211_bss_select_rssi_adjust)
519 	},
520 };
521 
522 /* policy for NAN function attributes */
523 static const struct nla_policy
524 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
525 	[NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
526 	[NL80211_NAN_FUNC_SERVICE_ID] = {
527 				    .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
528 	[NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
529 	[NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
530 	[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
531 	[NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
532 	[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
533 	[NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
534 	[NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
535 	[NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
536 	[NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
537 			.len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
538 	[NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
539 	[NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
540 	[NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
541 	[NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
542 	[NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
543 };
544 
545 /* policy for Service Response Filter attributes */
546 static const struct nla_policy
547 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
548 	[NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
549 	[NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
550 				 .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
551 	[NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
552 	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
553 };
554 
555 /* policy for packet pattern attributes */
556 static const struct nla_policy
557 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
558 	[NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
559 	[NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
560 	[NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
561 };
562 
563 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
564 				     struct netlink_callback *cb,
565 				     struct cfg80211_registered_device **rdev,
566 				     struct wireless_dev **wdev)
567 {
568 	int err;
569 
570 	if (!cb->args[0]) {
571 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
572 				  genl_family_attrbuf(&nl80211_fam),
573 				  nl80211_fam.maxattr, nl80211_policy, NULL);
574 		if (err)
575 			return err;
576 
577 		*wdev = __cfg80211_wdev_from_attrs(
578 					sock_net(skb->sk),
579 					genl_family_attrbuf(&nl80211_fam));
580 		if (IS_ERR(*wdev))
581 			return PTR_ERR(*wdev);
582 		*rdev = wiphy_to_rdev((*wdev)->wiphy);
583 		/* 0 is the first index - add 1 to parse only once */
584 		cb->args[0] = (*rdev)->wiphy_idx + 1;
585 		cb->args[1] = (*wdev)->identifier;
586 	} else {
587 		/* subtract the 1 again here */
588 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
589 		struct wireless_dev *tmp;
590 
591 		if (!wiphy)
592 			return -ENODEV;
593 		*rdev = wiphy_to_rdev(wiphy);
594 		*wdev = NULL;
595 
596 		list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
597 			if (tmp->identifier == cb->args[1]) {
598 				*wdev = tmp;
599 				break;
600 			}
601 		}
602 
603 		if (!*wdev)
604 			return -ENODEV;
605 	}
606 
607 	return 0;
608 }
609 
610 /* IE validation */
611 static bool is_valid_ie_attr(const struct nlattr *attr)
612 {
613 	const u8 *pos;
614 	int len;
615 
616 	if (!attr)
617 		return true;
618 
619 	pos = nla_data(attr);
620 	len = nla_len(attr);
621 
622 	while (len) {
623 		u8 elemlen;
624 
625 		if (len < 2)
626 			return false;
627 		len -= 2;
628 
629 		elemlen = pos[1];
630 		if (elemlen > len)
631 			return false;
632 
633 		len -= elemlen;
634 		pos += 2 + elemlen;
635 	}
636 
637 	return true;
638 }
639 
640 /* message building helper */
641 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
642 				   int flags, u8 cmd)
643 {
644 	/* since there is no private header just add the generic one */
645 	return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
646 }
647 
648 static int nl80211_msg_put_channel(struct sk_buff *msg,
649 				   struct ieee80211_channel *chan,
650 				   bool large)
651 {
652 	/* Some channels must be completely excluded from the
653 	 * list to protect old user-space tools from breaking
654 	 */
655 	if (!large && chan->flags &
656 	    (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
657 		return 0;
658 
659 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
660 			chan->center_freq))
661 		goto nla_put_failure;
662 
663 	if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
664 	    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
665 		goto nla_put_failure;
666 	if (chan->flags & IEEE80211_CHAN_NO_IR) {
667 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
668 			goto nla_put_failure;
669 		if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
670 			goto nla_put_failure;
671 	}
672 	if (chan->flags & IEEE80211_CHAN_RADAR) {
673 		if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
674 			goto nla_put_failure;
675 		if (large) {
676 			u32 time;
677 
678 			time = elapsed_jiffies_msecs(chan->dfs_state_entered);
679 
680 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
681 					chan->dfs_state))
682 				goto nla_put_failure;
683 			if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
684 					time))
685 				goto nla_put_failure;
686 			if (nla_put_u32(msg,
687 					NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
688 					chan->dfs_cac_ms))
689 				goto nla_put_failure;
690 		}
691 	}
692 
693 	if (large) {
694 		if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
695 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
696 			goto nla_put_failure;
697 		if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
698 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
699 			goto nla_put_failure;
700 		if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
701 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
702 			goto nla_put_failure;
703 		if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
704 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
705 			goto nla_put_failure;
706 		if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
707 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
708 			goto nla_put_failure;
709 		if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
710 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
711 			goto nla_put_failure;
712 		if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
713 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
714 			goto nla_put_failure;
715 		if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
716 		    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
717 			goto nla_put_failure;
718 	}
719 
720 	if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
721 			DBM_TO_MBM(chan->max_power)))
722 		goto nla_put_failure;
723 
724 	return 0;
725 
726  nla_put_failure:
727 	return -ENOBUFS;
728 }
729 
730 /* netlink command implementations */
731 
732 struct key_parse {
733 	struct key_params p;
734 	int idx;
735 	int type;
736 	bool def, defmgmt;
737 	bool def_uni, def_multi;
738 };
739 
740 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
741 				 struct key_parse *k)
742 {
743 	struct nlattr *tb[NL80211_KEY_MAX + 1];
744 	int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
745 				   nl80211_key_policy, info->extack);
746 	if (err)
747 		return err;
748 
749 	k->def = !!tb[NL80211_KEY_DEFAULT];
750 	k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
751 
752 	if (k->def) {
753 		k->def_uni = true;
754 		k->def_multi = true;
755 	}
756 	if (k->defmgmt)
757 		k->def_multi = true;
758 
759 	if (tb[NL80211_KEY_IDX])
760 		k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
761 
762 	if (tb[NL80211_KEY_DATA]) {
763 		k->p.key = nla_data(tb[NL80211_KEY_DATA]);
764 		k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
765 	}
766 
767 	if (tb[NL80211_KEY_SEQ]) {
768 		k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
769 		k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
770 	}
771 
772 	if (tb[NL80211_KEY_CIPHER])
773 		k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
774 
775 	if (tb[NL80211_KEY_TYPE]) {
776 		k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
777 		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
778 			return genl_err_attr(info, -EINVAL,
779 					     tb[NL80211_KEY_TYPE]);
780 	}
781 
782 	if (tb[NL80211_KEY_DEFAULT_TYPES]) {
783 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
784 
785 		err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
786 				       tb[NL80211_KEY_DEFAULT_TYPES],
787 				       nl80211_key_default_policy,
788 				       info->extack);
789 		if (err)
790 			return err;
791 
792 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
793 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
794 	}
795 
796 	return 0;
797 }
798 
799 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
800 {
801 	if (info->attrs[NL80211_ATTR_KEY_DATA]) {
802 		k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
803 		k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
804 	}
805 
806 	if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
807 		k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
808 		k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
809 	}
810 
811 	if (info->attrs[NL80211_ATTR_KEY_IDX])
812 		k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
813 
814 	if (info->attrs[NL80211_ATTR_KEY_CIPHER])
815 		k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
816 
817 	k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
818 	k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
819 
820 	if (k->def) {
821 		k->def_uni = true;
822 		k->def_multi = true;
823 	}
824 	if (k->defmgmt)
825 		k->def_multi = true;
826 
827 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
828 		k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
829 		if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
830 			GENL_SET_ERR_MSG(info, "key type out of range");
831 			return -EINVAL;
832 		}
833 	}
834 
835 	if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
836 		struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
837 		int err = nla_parse_nested(kdt,
838 					   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
839 					   info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
840 					   nl80211_key_default_policy,
841 					   info->extack);
842 		if (err)
843 			return err;
844 
845 		k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
846 		k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
847 	}
848 
849 	return 0;
850 }
851 
852 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
853 {
854 	int err;
855 
856 	memset(k, 0, sizeof(*k));
857 	k->idx = -1;
858 	k->type = -1;
859 
860 	if (info->attrs[NL80211_ATTR_KEY])
861 		err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
862 	else
863 		err = nl80211_parse_key_old(info, k);
864 
865 	if (err)
866 		return err;
867 
868 	if (k->def && k->defmgmt) {
869 		GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
870 		return -EINVAL;
871 	}
872 
873 	if (k->defmgmt) {
874 		if (k->def_uni || !k->def_multi) {
875 			GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
876 			return -EINVAL;
877 		}
878 	}
879 
880 	if (k->idx != -1) {
881 		if (k->defmgmt) {
882 			if (k->idx < 4 || k->idx > 5) {
883 				GENL_SET_ERR_MSG(info,
884 						 "defmgmt key idx not 4 or 5");
885 				return -EINVAL;
886 			}
887 		} else if (k->def) {
888 			if (k->idx < 0 || k->idx > 3) {
889 				GENL_SET_ERR_MSG(info, "def key idx not 0-3");
890 				return -EINVAL;
891 			}
892 		} else {
893 			if (k->idx < 0 || k->idx > 5) {
894 				GENL_SET_ERR_MSG(info, "key idx not 0-5");
895 				return -EINVAL;
896 			}
897 		}
898 	}
899 
900 	return 0;
901 }
902 
903 static struct cfg80211_cached_keys *
904 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
905 		       struct genl_info *info, bool *no_ht)
906 {
907 	struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
908 	struct key_parse parse;
909 	struct nlattr *key;
910 	struct cfg80211_cached_keys *result;
911 	int rem, err, def = 0;
912 	bool have_key = false;
913 
914 	nla_for_each_nested(key, keys, rem) {
915 		have_key = true;
916 		break;
917 	}
918 
919 	if (!have_key)
920 		return NULL;
921 
922 	result = kzalloc(sizeof(*result), GFP_KERNEL);
923 	if (!result)
924 		return ERR_PTR(-ENOMEM);
925 
926 	result->def = -1;
927 
928 	nla_for_each_nested(key, keys, rem) {
929 		memset(&parse, 0, sizeof(parse));
930 		parse.idx = -1;
931 
932 		err = nl80211_parse_key_new(info, key, &parse);
933 		if (err)
934 			goto error;
935 		err = -EINVAL;
936 		if (!parse.p.key)
937 			goto error;
938 		if (parse.idx < 0 || parse.idx > 3) {
939 			GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
940 			goto error;
941 		}
942 		if (parse.def) {
943 			if (def) {
944 				GENL_SET_ERR_MSG(info,
945 						 "only one key can be default");
946 				goto error;
947 			}
948 			def = 1;
949 			result->def = parse.idx;
950 			if (!parse.def_uni || !parse.def_multi)
951 				goto error;
952 		} else if (parse.defmgmt)
953 			goto error;
954 		err = cfg80211_validate_key_settings(rdev, &parse.p,
955 						     parse.idx, false, NULL);
956 		if (err)
957 			goto error;
958 		if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
959 		    parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
960 			GENL_SET_ERR_MSG(info, "connect key must be WEP");
961 			err = -EINVAL;
962 			goto error;
963 		}
964 		result->params[parse.idx].cipher = parse.p.cipher;
965 		result->params[parse.idx].key_len = parse.p.key_len;
966 		result->params[parse.idx].key = result->data[parse.idx];
967 		memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
968 
969 		/* must be WEP key if we got here */
970 		if (no_ht)
971 			*no_ht = true;
972 	}
973 
974 	if (result->def < 0) {
975 		err = -EINVAL;
976 		GENL_SET_ERR_MSG(info, "need a default/TX key");
977 		goto error;
978 	}
979 
980 	return result;
981  error:
982 	kfree(result);
983 	return ERR_PTR(err);
984 }
985 
986 static int nl80211_key_allowed(struct wireless_dev *wdev)
987 {
988 	ASSERT_WDEV_LOCK(wdev);
989 
990 	switch (wdev->iftype) {
991 	case NL80211_IFTYPE_AP:
992 	case NL80211_IFTYPE_AP_VLAN:
993 	case NL80211_IFTYPE_P2P_GO:
994 	case NL80211_IFTYPE_MESH_POINT:
995 		break;
996 	case NL80211_IFTYPE_ADHOC:
997 	case NL80211_IFTYPE_STATION:
998 	case NL80211_IFTYPE_P2P_CLIENT:
999 		if (!wdev->current_bss)
1000 			return -ENOLINK;
1001 		break;
1002 	case NL80211_IFTYPE_UNSPECIFIED:
1003 	case NL80211_IFTYPE_OCB:
1004 	case NL80211_IFTYPE_MONITOR:
1005 	case NL80211_IFTYPE_NAN:
1006 	case NL80211_IFTYPE_P2P_DEVICE:
1007 	case NL80211_IFTYPE_WDS:
1008 	case NUM_NL80211_IFTYPES:
1009 		return -EINVAL;
1010 	}
1011 
1012 	return 0;
1013 }
1014 
1015 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1016 							struct nlattr *tb)
1017 {
1018 	struct ieee80211_channel *chan;
1019 
1020 	if (tb == NULL)
1021 		return NULL;
1022 	chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1023 	if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1024 		return NULL;
1025 	return chan;
1026 }
1027 
1028 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1029 {
1030 	struct nlattr *nl_modes = nla_nest_start(msg, attr);
1031 	int i;
1032 
1033 	if (!nl_modes)
1034 		goto nla_put_failure;
1035 
1036 	i = 0;
1037 	while (ifmodes) {
1038 		if ((ifmodes & 1) && nla_put_flag(msg, i))
1039 			goto nla_put_failure;
1040 		ifmodes >>= 1;
1041 		i++;
1042 	}
1043 
1044 	nla_nest_end(msg, nl_modes);
1045 	return 0;
1046 
1047 nla_put_failure:
1048 	return -ENOBUFS;
1049 }
1050 
1051 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1052 					  struct sk_buff *msg,
1053 					  bool large)
1054 {
1055 	struct nlattr *nl_combis;
1056 	int i, j;
1057 
1058 	nl_combis = nla_nest_start(msg,
1059 				NL80211_ATTR_INTERFACE_COMBINATIONS);
1060 	if (!nl_combis)
1061 		goto nla_put_failure;
1062 
1063 	for (i = 0; i < wiphy->n_iface_combinations; i++) {
1064 		const struct ieee80211_iface_combination *c;
1065 		struct nlattr *nl_combi, *nl_limits;
1066 
1067 		c = &wiphy->iface_combinations[i];
1068 
1069 		nl_combi = nla_nest_start(msg, i + 1);
1070 		if (!nl_combi)
1071 			goto nla_put_failure;
1072 
1073 		nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1074 		if (!nl_limits)
1075 			goto nla_put_failure;
1076 
1077 		for (j = 0; j < c->n_limits; j++) {
1078 			struct nlattr *nl_limit;
1079 
1080 			nl_limit = nla_nest_start(msg, j + 1);
1081 			if (!nl_limit)
1082 				goto nla_put_failure;
1083 			if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1084 					c->limits[j].max))
1085 				goto nla_put_failure;
1086 			if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1087 						c->limits[j].types))
1088 				goto nla_put_failure;
1089 			nla_nest_end(msg, nl_limit);
1090 		}
1091 
1092 		nla_nest_end(msg, nl_limits);
1093 
1094 		if (c->beacon_int_infra_match &&
1095 		    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1096 			goto nla_put_failure;
1097 		if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1098 				c->num_different_channels) ||
1099 		    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1100 				c->max_interfaces))
1101 			goto nla_put_failure;
1102 		if (large &&
1103 		    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1104 				c->radar_detect_widths) ||
1105 		     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1106 				c->radar_detect_regions)))
1107 			goto nla_put_failure;
1108 		if (c->beacon_int_min_gcd &&
1109 		    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1110 				c->beacon_int_min_gcd))
1111 			goto nla_put_failure;
1112 
1113 		nla_nest_end(msg, nl_combi);
1114 	}
1115 
1116 	nla_nest_end(msg, nl_combis);
1117 
1118 	return 0;
1119 nla_put_failure:
1120 	return -ENOBUFS;
1121 }
1122 
1123 #ifdef CONFIG_PM
1124 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1125 					struct sk_buff *msg)
1126 {
1127 	const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1128 	struct nlattr *nl_tcp;
1129 
1130 	if (!tcp)
1131 		return 0;
1132 
1133 	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1134 	if (!nl_tcp)
1135 		return -ENOBUFS;
1136 
1137 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1138 			tcp->data_payload_max))
1139 		return -ENOBUFS;
1140 
1141 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1142 			tcp->data_payload_max))
1143 		return -ENOBUFS;
1144 
1145 	if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1146 		return -ENOBUFS;
1147 
1148 	if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1149 				sizeof(*tcp->tok), tcp->tok))
1150 		return -ENOBUFS;
1151 
1152 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1153 			tcp->data_interval_max))
1154 		return -ENOBUFS;
1155 
1156 	if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1157 			tcp->wake_payload_max))
1158 		return -ENOBUFS;
1159 
1160 	nla_nest_end(msg, nl_tcp);
1161 	return 0;
1162 }
1163 
1164 static int nl80211_send_wowlan(struct sk_buff *msg,
1165 			       struct cfg80211_registered_device *rdev,
1166 			       bool large)
1167 {
1168 	struct nlattr *nl_wowlan;
1169 
1170 	if (!rdev->wiphy.wowlan)
1171 		return 0;
1172 
1173 	nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1174 	if (!nl_wowlan)
1175 		return -ENOBUFS;
1176 
1177 	if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1178 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1179 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1180 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1181 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1182 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1183 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1184 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1185 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1186 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1187 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1188 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1189 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1190 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1191 	    ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1192 	     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1193 		return -ENOBUFS;
1194 
1195 	if (rdev->wiphy.wowlan->n_patterns) {
1196 		struct nl80211_pattern_support pat = {
1197 			.max_patterns = rdev->wiphy.wowlan->n_patterns,
1198 			.min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1199 			.max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1200 			.max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1201 		};
1202 
1203 		if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1204 			    sizeof(pat), &pat))
1205 			return -ENOBUFS;
1206 	}
1207 
1208 	if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1209 	    nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1210 			rdev->wiphy.wowlan->max_nd_match_sets))
1211 		return -ENOBUFS;
1212 
1213 	if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1214 		return -ENOBUFS;
1215 
1216 	nla_nest_end(msg, nl_wowlan);
1217 
1218 	return 0;
1219 }
1220 #endif
1221 
1222 static int nl80211_send_coalesce(struct sk_buff *msg,
1223 				 struct cfg80211_registered_device *rdev)
1224 {
1225 	struct nl80211_coalesce_rule_support rule;
1226 
1227 	if (!rdev->wiphy.coalesce)
1228 		return 0;
1229 
1230 	rule.max_rules = rdev->wiphy.coalesce->n_rules;
1231 	rule.max_delay = rdev->wiphy.coalesce->max_delay;
1232 	rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1233 	rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1234 	rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1235 	rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1236 
1237 	if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1238 		return -ENOBUFS;
1239 
1240 	return 0;
1241 }
1242 
1243 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1244 				      struct ieee80211_supported_band *sband)
1245 {
1246 	struct nlattr *nl_rates, *nl_rate;
1247 	struct ieee80211_rate *rate;
1248 	int i;
1249 
1250 	/* add HT info */
1251 	if (sband->ht_cap.ht_supported &&
1252 	    (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1253 		     sizeof(sband->ht_cap.mcs),
1254 		     &sband->ht_cap.mcs) ||
1255 	     nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1256 			 sband->ht_cap.cap) ||
1257 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1258 			sband->ht_cap.ampdu_factor) ||
1259 	     nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1260 			sband->ht_cap.ampdu_density)))
1261 		return -ENOBUFS;
1262 
1263 	/* add VHT info */
1264 	if (sband->vht_cap.vht_supported &&
1265 	    (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1266 		     sizeof(sband->vht_cap.vht_mcs),
1267 		     &sband->vht_cap.vht_mcs) ||
1268 	     nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1269 			 sband->vht_cap.cap)))
1270 		return -ENOBUFS;
1271 
1272 	/* add bitrates */
1273 	nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1274 	if (!nl_rates)
1275 		return -ENOBUFS;
1276 
1277 	for (i = 0; i < sband->n_bitrates; i++) {
1278 		nl_rate = nla_nest_start(msg, i);
1279 		if (!nl_rate)
1280 			return -ENOBUFS;
1281 
1282 		rate = &sband->bitrates[i];
1283 		if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1284 				rate->bitrate))
1285 			return -ENOBUFS;
1286 		if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1287 		    nla_put_flag(msg,
1288 				 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1289 			return -ENOBUFS;
1290 
1291 		nla_nest_end(msg, nl_rate);
1292 	}
1293 
1294 	nla_nest_end(msg, nl_rates);
1295 
1296 	return 0;
1297 }
1298 
1299 static int
1300 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1301 			 const struct ieee80211_txrx_stypes *mgmt_stypes)
1302 {
1303 	u16 stypes;
1304 	struct nlattr *nl_ftypes, *nl_ifs;
1305 	enum nl80211_iftype ift;
1306 	int i;
1307 
1308 	if (!mgmt_stypes)
1309 		return 0;
1310 
1311 	nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1312 	if (!nl_ifs)
1313 		return -ENOBUFS;
1314 
1315 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1316 		nl_ftypes = nla_nest_start(msg, ift);
1317 		if (!nl_ftypes)
1318 			return -ENOBUFS;
1319 		i = 0;
1320 		stypes = mgmt_stypes[ift].tx;
1321 		while (stypes) {
1322 			if ((stypes & 1) &&
1323 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1324 					(i << 4) | IEEE80211_FTYPE_MGMT))
1325 				return -ENOBUFS;
1326 			stypes >>= 1;
1327 			i++;
1328 		}
1329 		nla_nest_end(msg, nl_ftypes);
1330 	}
1331 
1332 	nla_nest_end(msg, nl_ifs);
1333 
1334 	nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1335 	if (!nl_ifs)
1336 		return -ENOBUFS;
1337 
1338 	for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1339 		nl_ftypes = nla_nest_start(msg, ift);
1340 		if (!nl_ftypes)
1341 			return -ENOBUFS;
1342 		i = 0;
1343 		stypes = mgmt_stypes[ift].rx;
1344 		while (stypes) {
1345 			if ((stypes & 1) &&
1346 			    nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1347 					(i << 4) | IEEE80211_FTYPE_MGMT))
1348 				return -ENOBUFS;
1349 			stypes >>= 1;
1350 			i++;
1351 		}
1352 		nla_nest_end(msg, nl_ftypes);
1353 	}
1354 	nla_nest_end(msg, nl_ifs);
1355 
1356 	return 0;
1357 }
1358 
1359 #define CMD(op, n)							\
1360 	 do {								\
1361 		if (rdev->ops->op) {					\
1362 			i++;						\
1363 			if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) 	\
1364 				goto nla_put_failure;			\
1365 		}							\
1366 	} while (0)
1367 
1368 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1369 					struct sk_buff *msg)
1370 {
1371 	int i = 0;
1372 
1373 	/*
1374 	 * do *NOT* add anything into this function, new things need to be
1375 	 * advertised only to new versions of userspace that can deal with
1376 	 * the split (and they can't possibly care about new features...
1377 	 */
1378 	CMD(add_virtual_intf, NEW_INTERFACE);
1379 	CMD(change_virtual_intf, SET_INTERFACE);
1380 	CMD(add_key, NEW_KEY);
1381 	CMD(start_ap, START_AP);
1382 	CMD(add_station, NEW_STATION);
1383 	CMD(add_mpath, NEW_MPATH);
1384 	CMD(update_mesh_config, SET_MESH_CONFIG);
1385 	CMD(change_bss, SET_BSS);
1386 	CMD(auth, AUTHENTICATE);
1387 	CMD(assoc, ASSOCIATE);
1388 	CMD(deauth, DEAUTHENTICATE);
1389 	CMD(disassoc, DISASSOCIATE);
1390 	CMD(join_ibss, JOIN_IBSS);
1391 	CMD(join_mesh, JOIN_MESH);
1392 	CMD(set_pmksa, SET_PMKSA);
1393 	CMD(del_pmksa, DEL_PMKSA);
1394 	CMD(flush_pmksa, FLUSH_PMKSA);
1395 	if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1396 		CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1397 	CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1398 	CMD(mgmt_tx, FRAME);
1399 	CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1400 	if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1401 		i++;
1402 		if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1403 			goto nla_put_failure;
1404 	}
1405 	if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1406 	    rdev->ops->join_mesh) {
1407 		i++;
1408 		if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1409 			goto nla_put_failure;
1410 	}
1411 	CMD(set_wds_peer, SET_WDS_PEER);
1412 	if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1413 		CMD(tdls_mgmt, TDLS_MGMT);
1414 		CMD(tdls_oper, TDLS_OPER);
1415 	}
1416 	if (rdev->wiphy.max_sched_scan_reqs)
1417 		CMD(sched_scan_start, START_SCHED_SCAN);
1418 	CMD(probe_client, PROBE_CLIENT);
1419 	CMD(set_noack_map, SET_NOACK_MAP);
1420 	if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1421 		i++;
1422 		if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1423 			goto nla_put_failure;
1424 	}
1425 	CMD(start_p2p_device, START_P2P_DEVICE);
1426 	CMD(set_mcast_rate, SET_MCAST_RATE);
1427 #ifdef CONFIG_NL80211_TESTMODE
1428 	CMD(testmode_cmd, TESTMODE);
1429 #endif
1430 
1431 	if (rdev->ops->connect || rdev->ops->auth) {
1432 		i++;
1433 		if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1434 			goto nla_put_failure;
1435 	}
1436 
1437 	if (rdev->ops->disconnect || rdev->ops->deauth) {
1438 		i++;
1439 		if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1440 			goto nla_put_failure;
1441 	}
1442 
1443 	return i;
1444  nla_put_failure:
1445 	return -ENOBUFS;
1446 }
1447 
1448 struct nl80211_dump_wiphy_state {
1449 	s64 filter_wiphy;
1450 	long start;
1451 	long split_start, band_start, chan_start, capa_start;
1452 	bool split;
1453 };
1454 
1455 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1456 			      enum nl80211_commands cmd,
1457 			      struct sk_buff *msg, u32 portid, u32 seq,
1458 			      int flags, struct nl80211_dump_wiphy_state *state)
1459 {
1460 	void *hdr;
1461 	struct nlattr *nl_bands, *nl_band;
1462 	struct nlattr *nl_freqs, *nl_freq;
1463 	struct nlattr *nl_cmds;
1464 	enum nl80211_band band;
1465 	struct ieee80211_channel *chan;
1466 	int i;
1467 	const struct ieee80211_txrx_stypes *mgmt_stypes =
1468 				rdev->wiphy.mgmt_stypes;
1469 	u32 features;
1470 
1471 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1472 	if (!hdr)
1473 		return -ENOBUFS;
1474 
1475 	if (WARN_ON(!state))
1476 		return -EINVAL;
1477 
1478 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1479 	    nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1480 			   wiphy_name(&rdev->wiphy)) ||
1481 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
1482 			cfg80211_rdev_list_generation))
1483 		goto nla_put_failure;
1484 
1485 	if (cmd != NL80211_CMD_NEW_WIPHY)
1486 		goto finish;
1487 
1488 	switch (state->split_start) {
1489 	case 0:
1490 		if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1491 			       rdev->wiphy.retry_short) ||
1492 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1493 			       rdev->wiphy.retry_long) ||
1494 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1495 				rdev->wiphy.frag_threshold) ||
1496 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1497 				rdev->wiphy.rts_threshold) ||
1498 		    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1499 			       rdev->wiphy.coverage_class) ||
1500 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1501 			       rdev->wiphy.max_scan_ssids) ||
1502 		    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1503 			       rdev->wiphy.max_sched_scan_ssids) ||
1504 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1505 				rdev->wiphy.max_scan_ie_len) ||
1506 		    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1507 				rdev->wiphy.max_sched_scan_ie_len) ||
1508 		    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1509 			       rdev->wiphy.max_match_sets) ||
1510 		    nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1511 				rdev->wiphy.max_sched_scan_plans) ||
1512 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1513 				rdev->wiphy.max_sched_scan_plan_interval) ||
1514 		    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1515 				rdev->wiphy.max_sched_scan_plan_iterations))
1516 			goto nla_put_failure;
1517 
1518 		if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1519 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1520 			goto nla_put_failure;
1521 		if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1522 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1523 			goto nla_put_failure;
1524 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1525 		    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1526 			goto nla_put_failure;
1527 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1528 		    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1529 			goto nla_put_failure;
1530 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1531 		    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1532 			goto nla_put_failure;
1533 		if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1534 		    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1535 			goto nla_put_failure;
1536 		state->split_start++;
1537 		if (state->split)
1538 			break;
1539 	case 1:
1540 		if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1541 			    sizeof(u32) * rdev->wiphy.n_cipher_suites,
1542 			    rdev->wiphy.cipher_suites))
1543 			goto nla_put_failure;
1544 
1545 		if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1546 			       rdev->wiphy.max_num_pmkids))
1547 			goto nla_put_failure;
1548 
1549 		if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1550 		    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1551 			goto nla_put_failure;
1552 
1553 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1554 				rdev->wiphy.available_antennas_tx) ||
1555 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1556 				rdev->wiphy.available_antennas_rx))
1557 			goto nla_put_failure;
1558 
1559 		if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1560 		    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1561 				rdev->wiphy.probe_resp_offload))
1562 			goto nla_put_failure;
1563 
1564 		if ((rdev->wiphy.available_antennas_tx ||
1565 		     rdev->wiphy.available_antennas_rx) &&
1566 		    rdev->ops->get_antenna) {
1567 			u32 tx_ant = 0, rx_ant = 0;
1568 			int res;
1569 
1570 			res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1571 			if (!res) {
1572 				if (nla_put_u32(msg,
1573 						NL80211_ATTR_WIPHY_ANTENNA_TX,
1574 						tx_ant) ||
1575 				    nla_put_u32(msg,
1576 						NL80211_ATTR_WIPHY_ANTENNA_RX,
1577 						rx_ant))
1578 					goto nla_put_failure;
1579 			}
1580 		}
1581 
1582 		state->split_start++;
1583 		if (state->split)
1584 			break;
1585 	case 2:
1586 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1587 					rdev->wiphy.interface_modes))
1588 				goto nla_put_failure;
1589 		state->split_start++;
1590 		if (state->split)
1591 			break;
1592 	case 3:
1593 		nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1594 		if (!nl_bands)
1595 			goto nla_put_failure;
1596 
1597 		for (band = state->band_start;
1598 		     band < NUM_NL80211_BANDS; band++) {
1599 			struct ieee80211_supported_band *sband;
1600 
1601 			sband = rdev->wiphy.bands[band];
1602 
1603 			if (!sband)
1604 				continue;
1605 
1606 			nl_band = nla_nest_start(msg, band);
1607 			if (!nl_band)
1608 				goto nla_put_failure;
1609 
1610 			switch (state->chan_start) {
1611 			case 0:
1612 				if (nl80211_send_band_rateinfo(msg, sband))
1613 					goto nla_put_failure;
1614 				state->chan_start++;
1615 				if (state->split)
1616 					break;
1617 			default:
1618 				/* add frequencies */
1619 				nl_freqs = nla_nest_start(
1620 					msg, NL80211_BAND_ATTR_FREQS);
1621 				if (!nl_freqs)
1622 					goto nla_put_failure;
1623 
1624 				for (i = state->chan_start - 1;
1625 				     i < sband->n_channels;
1626 				     i++) {
1627 					nl_freq = nla_nest_start(msg, i);
1628 					if (!nl_freq)
1629 						goto nla_put_failure;
1630 
1631 					chan = &sband->channels[i];
1632 
1633 					if (nl80211_msg_put_channel(
1634 							msg, chan,
1635 							state->split))
1636 						goto nla_put_failure;
1637 
1638 					nla_nest_end(msg, nl_freq);
1639 					if (state->split)
1640 						break;
1641 				}
1642 				if (i < sband->n_channels)
1643 					state->chan_start = i + 2;
1644 				else
1645 					state->chan_start = 0;
1646 				nla_nest_end(msg, nl_freqs);
1647 			}
1648 
1649 			nla_nest_end(msg, nl_band);
1650 
1651 			if (state->split) {
1652 				/* start again here */
1653 				if (state->chan_start)
1654 					band--;
1655 				break;
1656 			}
1657 		}
1658 		nla_nest_end(msg, nl_bands);
1659 
1660 		if (band < NUM_NL80211_BANDS)
1661 			state->band_start = band + 1;
1662 		else
1663 			state->band_start = 0;
1664 
1665 		/* if bands & channels are done, continue outside */
1666 		if (state->band_start == 0 && state->chan_start == 0)
1667 			state->split_start++;
1668 		if (state->split)
1669 			break;
1670 	case 4:
1671 		nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1672 		if (!nl_cmds)
1673 			goto nla_put_failure;
1674 
1675 		i = nl80211_add_commands_unsplit(rdev, msg);
1676 		if (i < 0)
1677 			goto nla_put_failure;
1678 		if (state->split) {
1679 			CMD(crit_proto_start, CRIT_PROTOCOL_START);
1680 			CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1681 			if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1682 				CMD(channel_switch, CHANNEL_SWITCH);
1683 			CMD(set_qos_map, SET_QOS_MAP);
1684 			if (rdev->wiphy.features &
1685 					NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1686 				CMD(add_tx_ts, ADD_TX_TS);
1687 			CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1688 			CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1689 		}
1690 #undef CMD
1691 
1692 		nla_nest_end(msg, nl_cmds);
1693 		state->split_start++;
1694 		if (state->split)
1695 			break;
1696 	case 5:
1697 		if (rdev->ops->remain_on_channel &&
1698 		    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1699 		    nla_put_u32(msg,
1700 				NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1701 				rdev->wiphy.max_remain_on_channel_duration))
1702 			goto nla_put_failure;
1703 
1704 		if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1705 		    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1706 			goto nla_put_failure;
1707 
1708 		if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1709 			goto nla_put_failure;
1710 		state->split_start++;
1711 		if (state->split)
1712 			break;
1713 	case 6:
1714 #ifdef CONFIG_PM
1715 		if (nl80211_send_wowlan(msg, rdev, state->split))
1716 			goto nla_put_failure;
1717 		state->split_start++;
1718 		if (state->split)
1719 			break;
1720 #else
1721 		state->split_start++;
1722 #endif
1723 	case 7:
1724 		if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1725 					rdev->wiphy.software_iftypes))
1726 			goto nla_put_failure;
1727 
1728 		if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1729 						   state->split))
1730 			goto nla_put_failure;
1731 
1732 		state->split_start++;
1733 		if (state->split)
1734 			break;
1735 	case 8:
1736 		if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1737 		    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1738 				rdev->wiphy.ap_sme_capa))
1739 			goto nla_put_failure;
1740 
1741 		features = rdev->wiphy.features;
1742 		/*
1743 		 * We can only add the per-channel limit information if the
1744 		 * dump is split, otherwise it makes it too big. Therefore
1745 		 * only advertise it in that case.
1746 		 */
1747 		if (state->split)
1748 			features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1749 		if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1750 			goto nla_put_failure;
1751 
1752 		if (rdev->wiphy.ht_capa_mod_mask &&
1753 		    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1754 			    sizeof(*rdev->wiphy.ht_capa_mod_mask),
1755 			    rdev->wiphy.ht_capa_mod_mask))
1756 			goto nla_put_failure;
1757 
1758 		if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1759 		    rdev->wiphy.max_acl_mac_addrs &&
1760 		    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1761 				rdev->wiphy.max_acl_mac_addrs))
1762 			goto nla_put_failure;
1763 
1764 		/*
1765 		 * Any information below this point is only available to
1766 		 * applications that can deal with it being split. This
1767 		 * helps ensure that newly added capabilities don't break
1768 		 * older tools by overrunning their buffers.
1769 		 *
1770 		 * We still increment split_start so that in the split
1771 		 * case we'll continue with more data in the next round,
1772 		 * but break unconditionally so unsplit data stops here.
1773 		 */
1774 		state->split_start++;
1775 		break;
1776 	case 9:
1777 		if (rdev->wiphy.extended_capabilities &&
1778 		    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1779 			     rdev->wiphy.extended_capabilities_len,
1780 			     rdev->wiphy.extended_capabilities) ||
1781 		     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1782 			     rdev->wiphy.extended_capabilities_len,
1783 			     rdev->wiphy.extended_capabilities_mask)))
1784 			goto nla_put_failure;
1785 
1786 		if (rdev->wiphy.vht_capa_mod_mask &&
1787 		    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1788 			    sizeof(*rdev->wiphy.vht_capa_mod_mask),
1789 			    rdev->wiphy.vht_capa_mod_mask))
1790 			goto nla_put_failure;
1791 
1792 		state->split_start++;
1793 		break;
1794 	case 10:
1795 		if (nl80211_send_coalesce(msg, rdev))
1796 			goto nla_put_failure;
1797 
1798 		if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1799 		    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1800 		     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1801 			goto nla_put_failure;
1802 
1803 		if (rdev->wiphy.max_ap_assoc_sta &&
1804 		    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1805 				rdev->wiphy.max_ap_assoc_sta))
1806 			goto nla_put_failure;
1807 
1808 		state->split_start++;
1809 		break;
1810 	case 11:
1811 		if (rdev->wiphy.n_vendor_commands) {
1812 			const struct nl80211_vendor_cmd_info *info;
1813 			struct nlattr *nested;
1814 
1815 			nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1816 			if (!nested)
1817 				goto nla_put_failure;
1818 
1819 			for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1820 				info = &rdev->wiphy.vendor_commands[i].info;
1821 				if (nla_put(msg, i + 1, sizeof(*info), info))
1822 					goto nla_put_failure;
1823 			}
1824 			nla_nest_end(msg, nested);
1825 		}
1826 
1827 		if (rdev->wiphy.n_vendor_events) {
1828 			const struct nl80211_vendor_cmd_info *info;
1829 			struct nlattr *nested;
1830 
1831 			nested = nla_nest_start(msg,
1832 						NL80211_ATTR_VENDOR_EVENTS);
1833 			if (!nested)
1834 				goto nla_put_failure;
1835 
1836 			for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1837 				info = &rdev->wiphy.vendor_events[i];
1838 				if (nla_put(msg, i + 1, sizeof(*info), info))
1839 					goto nla_put_failure;
1840 			}
1841 			nla_nest_end(msg, nested);
1842 		}
1843 		state->split_start++;
1844 		break;
1845 	case 12:
1846 		if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1847 		    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1848 			       rdev->wiphy.max_num_csa_counters))
1849 			goto nla_put_failure;
1850 
1851 		if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1852 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1853 			goto nla_put_failure;
1854 
1855 		if (rdev->wiphy.max_sched_scan_reqs &&
1856 		    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1857 				rdev->wiphy.max_sched_scan_reqs))
1858 			goto nla_put_failure;
1859 
1860 		if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1861 			    sizeof(rdev->wiphy.ext_features),
1862 			    rdev->wiphy.ext_features))
1863 			goto nla_put_failure;
1864 
1865 		if (rdev->wiphy.bss_select_support) {
1866 			struct nlattr *nested;
1867 			u32 bss_select_support = rdev->wiphy.bss_select_support;
1868 
1869 			nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1870 			if (!nested)
1871 				goto nla_put_failure;
1872 
1873 			i = 0;
1874 			while (bss_select_support) {
1875 				if ((bss_select_support & 1) &&
1876 				    nla_put_flag(msg, i))
1877 					goto nla_put_failure;
1878 				i++;
1879 				bss_select_support >>= 1;
1880 			}
1881 			nla_nest_end(msg, nested);
1882 		}
1883 
1884 		state->split_start++;
1885 		break;
1886 	case 13:
1887 		if (rdev->wiphy.num_iftype_ext_capab &&
1888 		    rdev->wiphy.iftype_ext_capab) {
1889 			struct nlattr *nested_ext_capab, *nested;
1890 
1891 			nested = nla_nest_start(msg,
1892 						NL80211_ATTR_IFTYPE_EXT_CAPA);
1893 			if (!nested)
1894 				goto nla_put_failure;
1895 
1896 			for (i = state->capa_start;
1897 			     i < rdev->wiphy.num_iftype_ext_capab; i++) {
1898 				const struct wiphy_iftype_ext_capab *capab;
1899 
1900 				capab = &rdev->wiphy.iftype_ext_capab[i];
1901 
1902 				nested_ext_capab = nla_nest_start(msg, i);
1903 				if (!nested_ext_capab ||
1904 				    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1905 						capab->iftype) ||
1906 				    nla_put(msg, NL80211_ATTR_EXT_CAPA,
1907 					    capab->extended_capabilities_len,
1908 					    capab->extended_capabilities) ||
1909 				    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1910 					    capab->extended_capabilities_len,
1911 					    capab->extended_capabilities_mask))
1912 					goto nla_put_failure;
1913 
1914 				nla_nest_end(msg, nested_ext_capab);
1915 				if (state->split)
1916 					break;
1917 			}
1918 			nla_nest_end(msg, nested);
1919 			if (i < rdev->wiphy.num_iftype_ext_capab) {
1920 				state->capa_start = i + 1;
1921 				break;
1922 			}
1923 		}
1924 
1925 		if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1926 				rdev->wiphy.nan_supported_bands))
1927 			goto nla_put_failure;
1928 
1929 		/* done */
1930 		state->split_start = 0;
1931 		break;
1932 	}
1933  finish:
1934 	genlmsg_end(msg, hdr);
1935 	return 0;
1936 
1937  nla_put_failure:
1938 	genlmsg_cancel(msg, hdr);
1939 	return -EMSGSIZE;
1940 }
1941 
1942 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1943 				    struct netlink_callback *cb,
1944 				    struct nl80211_dump_wiphy_state *state)
1945 {
1946 	struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1947 	int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1948 			      nl80211_fam.maxattr, nl80211_policy, NULL);
1949 	/* ignore parse errors for backward compatibility */
1950 	if (ret)
1951 		return 0;
1952 
1953 	state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1954 	if (tb[NL80211_ATTR_WIPHY])
1955 		state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1956 	if (tb[NL80211_ATTR_WDEV])
1957 		state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1958 	if (tb[NL80211_ATTR_IFINDEX]) {
1959 		struct net_device *netdev;
1960 		struct cfg80211_registered_device *rdev;
1961 		int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1962 
1963 		netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1964 		if (!netdev)
1965 			return -ENODEV;
1966 		if (netdev->ieee80211_ptr) {
1967 			rdev = wiphy_to_rdev(
1968 				netdev->ieee80211_ptr->wiphy);
1969 			state->filter_wiphy = rdev->wiphy_idx;
1970 		}
1971 	}
1972 
1973 	return 0;
1974 }
1975 
1976 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1977 {
1978 	int idx = 0, ret;
1979 	struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1980 	struct cfg80211_registered_device *rdev;
1981 
1982 	rtnl_lock();
1983 	if (!state) {
1984 		state = kzalloc(sizeof(*state), GFP_KERNEL);
1985 		if (!state) {
1986 			rtnl_unlock();
1987 			return -ENOMEM;
1988 		}
1989 		state->filter_wiphy = -1;
1990 		ret = nl80211_dump_wiphy_parse(skb, cb, state);
1991 		if (ret) {
1992 			kfree(state);
1993 			rtnl_unlock();
1994 			return ret;
1995 		}
1996 		cb->args[0] = (long)state;
1997 	}
1998 
1999 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2000 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2001 			continue;
2002 		if (++idx <= state->start)
2003 			continue;
2004 		if (state->filter_wiphy != -1 &&
2005 		    state->filter_wiphy != rdev->wiphy_idx)
2006 			continue;
2007 		/* attempt to fit multiple wiphy data chunks into the skb */
2008 		do {
2009 			ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2010 						 skb,
2011 						 NETLINK_CB(cb->skb).portid,
2012 						 cb->nlh->nlmsg_seq,
2013 						 NLM_F_MULTI, state);
2014 			if (ret < 0) {
2015 				/*
2016 				 * If sending the wiphy data didn't fit (ENOBUFS
2017 				 * or EMSGSIZE returned), this SKB is still
2018 				 * empty (so it's not too big because another
2019 				 * wiphy dataset is already in the skb) and
2020 				 * we've not tried to adjust the dump allocation
2021 				 * yet ... then adjust the alloc size to be
2022 				 * bigger, and return 1 but with the empty skb.
2023 				 * This results in an empty message being RX'ed
2024 				 * in userspace, but that is ignored.
2025 				 *
2026 				 * We can then retry with the larger buffer.
2027 				 */
2028 				if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2029 				    !skb->len && !state->split &&
2030 				    cb->min_dump_alloc < 4096) {
2031 					cb->min_dump_alloc = 4096;
2032 					state->split_start = 0;
2033 					rtnl_unlock();
2034 					return 1;
2035 				}
2036 				idx--;
2037 				break;
2038 			}
2039 		} while (state->split_start > 0);
2040 		break;
2041 	}
2042 	rtnl_unlock();
2043 
2044 	state->start = idx;
2045 
2046 	return skb->len;
2047 }
2048 
2049 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2050 {
2051 	kfree((void *)cb->args[0]);
2052 	return 0;
2053 }
2054 
2055 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2056 {
2057 	struct sk_buff *msg;
2058 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2059 	struct nl80211_dump_wiphy_state state = {};
2060 
2061 	msg = nlmsg_new(4096, GFP_KERNEL);
2062 	if (!msg)
2063 		return -ENOMEM;
2064 
2065 	if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2066 			       info->snd_portid, info->snd_seq, 0,
2067 			       &state) < 0) {
2068 		nlmsg_free(msg);
2069 		return -ENOBUFS;
2070 	}
2071 
2072 	return genlmsg_reply(msg, info);
2073 }
2074 
2075 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2076 	[NL80211_TXQ_ATTR_QUEUE]		= { .type = NLA_U8 },
2077 	[NL80211_TXQ_ATTR_TXOP]			= { .type = NLA_U16 },
2078 	[NL80211_TXQ_ATTR_CWMIN]		= { .type = NLA_U16 },
2079 	[NL80211_TXQ_ATTR_CWMAX]		= { .type = NLA_U16 },
2080 	[NL80211_TXQ_ATTR_AIFS]			= { .type = NLA_U8 },
2081 };
2082 
2083 static int parse_txq_params(struct nlattr *tb[],
2084 			    struct ieee80211_txq_params *txq_params)
2085 {
2086 	u8 ac;
2087 
2088 	if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2089 	    !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2090 	    !tb[NL80211_TXQ_ATTR_AIFS])
2091 		return -EINVAL;
2092 
2093 	ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2094 	txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2095 	txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2096 	txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2097 	txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2098 
2099 	if (ac >= NL80211_NUM_ACS)
2100 		return -EINVAL;
2101 	txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2102 	return 0;
2103 }
2104 
2105 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2106 {
2107 	/*
2108 	 * You can only set the channel explicitly for WDS interfaces,
2109 	 * all others have their channel managed via their respective
2110 	 * "establish a connection" command (connect, join, ...)
2111 	 *
2112 	 * For AP/GO and mesh mode, the channel can be set with the
2113 	 * channel userspace API, but is only stored and passed to the
2114 	 * low-level driver when the AP starts or the mesh is joined.
2115 	 * This is for backward compatibility, userspace can also give
2116 	 * the channel in the start-ap or join-mesh commands instead.
2117 	 *
2118 	 * Monitors are special as they are normally slaved to
2119 	 * whatever else is going on, so they have their own special
2120 	 * operation to set the monitor channel if possible.
2121 	 */
2122 	return !wdev ||
2123 		wdev->iftype == NL80211_IFTYPE_AP ||
2124 		wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2125 		wdev->iftype == NL80211_IFTYPE_MONITOR ||
2126 		wdev->iftype == NL80211_IFTYPE_P2P_GO;
2127 }
2128 
2129 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2130 				 struct genl_info *info,
2131 				 struct cfg80211_chan_def *chandef)
2132 {
2133 	u32 control_freq;
2134 
2135 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2136 		return -EINVAL;
2137 
2138 	control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2139 
2140 	chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2141 	chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2142 	chandef->center_freq1 = control_freq;
2143 	chandef->center_freq2 = 0;
2144 
2145 	/* Primary channel not allowed */
2146 	if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2147 		return -EINVAL;
2148 
2149 	if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2150 		enum nl80211_channel_type chantype;
2151 
2152 		chantype = nla_get_u32(
2153 				info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2154 
2155 		switch (chantype) {
2156 		case NL80211_CHAN_NO_HT:
2157 		case NL80211_CHAN_HT20:
2158 		case NL80211_CHAN_HT40PLUS:
2159 		case NL80211_CHAN_HT40MINUS:
2160 			cfg80211_chandef_create(chandef, chandef->chan,
2161 						chantype);
2162 			/* user input for center_freq is incorrect */
2163 			if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2164 			    chandef->center_freq1 != nla_get_u32(
2165 					info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2166 				return -EINVAL;
2167 			/* center_freq2 must be zero */
2168 			if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2169 			    nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2170 				return -EINVAL;
2171 			break;
2172 		default:
2173 			return -EINVAL;
2174 		}
2175 	} else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2176 		chandef->width =
2177 			nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2178 		if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2179 			chandef->center_freq1 =
2180 				nla_get_u32(
2181 					info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2182 		if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2183 			chandef->center_freq2 =
2184 				nla_get_u32(
2185 					info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2186 	}
2187 
2188 	if (!cfg80211_chandef_valid(chandef))
2189 		return -EINVAL;
2190 
2191 	if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2192 				     IEEE80211_CHAN_DISABLED))
2193 		return -EINVAL;
2194 
2195 	if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2196 	     chandef->width == NL80211_CHAN_WIDTH_10) &&
2197 	    !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2198 		return -EINVAL;
2199 
2200 	return 0;
2201 }
2202 
2203 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2204 				 struct net_device *dev,
2205 				 struct genl_info *info)
2206 {
2207 	struct cfg80211_chan_def chandef;
2208 	int result;
2209 	enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2210 	struct wireless_dev *wdev = NULL;
2211 
2212 	if (dev)
2213 		wdev = dev->ieee80211_ptr;
2214 	if (!nl80211_can_set_dev_channel(wdev))
2215 		return -EOPNOTSUPP;
2216 	if (wdev)
2217 		iftype = wdev->iftype;
2218 
2219 	result = nl80211_parse_chandef(rdev, info, &chandef);
2220 	if (result)
2221 		return result;
2222 
2223 	switch (iftype) {
2224 	case NL80211_IFTYPE_AP:
2225 	case NL80211_IFTYPE_P2P_GO:
2226 		if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2227 						   iftype)) {
2228 			result = -EINVAL;
2229 			break;
2230 		}
2231 		if (wdev->beacon_interval) {
2232 			if (!dev || !rdev->ops->set_ap_chanwidth ||
2233 			    !(rdev->wiphy.features &
2234 			      NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2235 				result = -EBUSY;
2236 				break;
2237 			}
2238 
2239 			/* Only allow dynamic channel width changes */
2240 			if (chandef.chan != wdev->preset_chandef.chan) {
2241 				result = -EBUSY;
2242 				break;
2243 			}
2244 			result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2245 			if (result)
2246 				break;
2247 		}
2248 		wdev->preset_chandef = chandef;
2249 		result = 0;
2250 		break;
2251 	case NL80211_IFTYPE_MESH_POINT:
2252 		result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2253 		break;
2254 	case NL80211_IFTYPE_MONITOR:
2255 		result = cfg80211_set_monitor_channel(rdev, &chandef);
2256 		break;
2257 	default:
2258 		result = -EINVAL;
2259 	}
2260 
2261 	return result;
2262 }
2263 
2264 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2265 {
2266 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2267 	struct net_device *netdev = info->user_ptr[1];
2268 
2269 	return __nl80211_set_channel(rdev, netdev, info);
2270 }
2271 
2272 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2273 {
2274 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2275 	struct net_device *dev = info->user_ptr[1];
2276 	struct wireless_dev *wdev = dev->ieee80211_ptr;
2277 	const u8 *bssid;
2278 
2279 	if (!info->attrs[NL80211_ATTR_MAC])
2280 		return -EINVAL;
2281 
2282 	if (netif_running(dev))
2283 		return -EBUSY;
2284 
2285 	if (!rdev->ops->set_wds_peer)
2286 		return -EOPNOTSUPP;
2287 
2288 	if (wdev->iftype != NL80211_IFTYPE_WDS)
2289 		return -EOPNOTSUPP;
2290 
2291 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2292 	return rdev_set_wds_peer(rdev, dev, bssid);
2293 }
2294 
2295 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2296 {
2297 	struct cfg80211_registered_device *rdev;
2298 	struct net_device *netdev = NULL;
2299 	struct wireless_dev *wdev;
2300 	int result = 0, rem_txq_params = 0;
2301 	struct nlattr *nl_txq_params;
2302 	u32 changed;
2303 	u8 retry_short = 0, retry_long = 0;
2304 	u32 frag_threshold = 0, rts_threshold = 0;
2305 	u8 coverage_class = 0;
2306 
2307 	ASSERT_RTNL();
2308 
2309 	/*
2310 	 * Try to find the wiphy and netdev. Normally this
2311 	 * function shouldn't need the netdev, but this is
2312 	 * done for backward compatibility -- previously
2313 	 * setting the channel was done per wiphy, but now
2314 	 * it is per netdev. Previous userland like hostapd
2315 	 * also passed a netdev to set_wiphy, so that it is
2316 	 * possible to let that go to the right netdev!
2317 	 */
2318 
2319 	if (info->attrs[NL80211_ATTR_IFINDEX]) {
2320 		int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2321 
2322 		netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2323 		if (netdev && netdev->ieee80211_ptr)
2324 			rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2325 		else
2326 			netdev = NULL;
2327 	}
2328 
2329 	if (!netdev) {
2330 		rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2331 						  info->attrs);
2332 		if (IS_ERR(rdev))
2333 			return PTR_ERR(rdev);
2334 		wdev = NULL;
2335 		netdev = NULL;
2336 		result = 0;
2337 	} else
2338 		wdev = netdev->ieee80211_ptr;
2339 
2340 	/*
2341 	 * end workaround code, by now the rdev is available
2342 	 * and locked, and wdev may or may not be NULL.
2343 	 */
2344 
2345 	if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2346 		result = cfg80211_dev_rename(
2347 			rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2348 
2349 	if (result)
2350 		return result;
2351 
2352 	if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2353 		struct ieee80211_txq_params txq_params;
2354 		struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2355 
2356 		if (!rdev->ops->set_txq_params)
2357 			return -EOPNOTSUPP;
2358 
2359 		if (!netdev)
2360 			return -EINVAL;
2361 
2362 		if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2363 		    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2364 			return -EINVAL;
2365 
2366 		if (!netif_running(netdev))
2367 			return -ENETDOWN;
2368 
2369 		nla_for_each_nested(nl_txq_params,
2370 				    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2371 				    rem_txq_params) {
2372 			result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2373 						  nl_txq_params,
2374 						  txq_params_policy,
2375 						  info->extack);
2376 			if (result)
2377 				return result;
2378 			result = parse_txq_params(tb, &txq_params);
2379 			if (result)
2380 				return result;
2381 
2382 			result = rdev_set_txq_params(rdev, netdev,
2383 						     &txq_params);
2384 			if (result)
2385 				return result;
2386 		}
2387 	}
2388 
2389 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2390 		result = __nl80211_set_channel(
2391 			rdev,
2392 			nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2393 			info);
2394 		if (result)
2395 			return result;
2396 	}
2397 
2398 	if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2399 		struct wireless_dev *txp_wdev = wdev;
2400 		enum nl80211_tx_power_setting type;
2401 		int idx, mbm = 0;
2402 
2403 		if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2404 			txp_wdev = NULL;
2405 
2406 		if (!rdev->ops->set_tx_power)
2407 			return -EOPNOTSUPP;
2408 
2409 		idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2410 		type = nla_get_u32(info->attrs[idx]);
2411 
2412 		if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2413 		    (type != NL80211_TX_POWER_AUTOMATIC))
2414 			return -EINVAL;
2415 
2416 		if (type != NL80211_TX_POWER_AUTOMATIC) {
2417 			idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2418 			mbm = nla_get_u32(info->attrs[idx]);
2419 		}
2420 
2421 		result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2422 		if (result)
2423 			return result;
2424 	}
2425 
2426 	if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2427 	    info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2428 		u32 tx_ant, rx_ant;
2429 
2430 		if ((!rdev->wiphy.available_antennas_tx &&
2431 		     !rdev->wiphy.available_antennas_rx) ||
2432 		    !rdev->ops->set_antenna)
2433 			return -EOPNOTSUPP;
2434 
2435 		tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2436 		rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2437 
2438 		/* reject antenna configurations which don't match the
2439 		 * available antenna masks, except for the "all" mask */
2440 		if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2441 		    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2442 			return -EINVAL;
2443 
2444 		tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2445 		rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2446 
2447 		result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2448 		if (result)
2449 			return result;
2450 	}
2451 
2452 	changed = 0;
2453 
2454 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2455 		retry_short = nla_get_u8(
2456 			info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2457 		if (retry_short == 0)
2458 			return -EINVAL;
2459 
2460 		changed |= WIPHY_PARAM_RETRY_SHORT;
2461 	}
2462 
2463 	if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2464 		retry_long = nla_get_u8(
2465 			info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2466 		if (retry_long == 0)
2467 			return -EINVAL;
2468 
2469 		changed |= WIPHY_PARAM_RETRY_LONG;
2470 	}
2471 
2472 	if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2473 		frag_threshold = nla_get_u32(
2474 			info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2475 		if (frag_threshold < 256)
2476 			return -EINVAL;
2477 
2478 		if (frag_threshold != (u32) -1) {
2479 			/*
2480 			 * Fragments (apart from the last one) are required to
2481 			 * have even length. Make the fragmentation code
2482 			 * simpler by stripping LSB should someone try to use
2483 			 * odd threshold value.
2484 			 */
2485 			frag_threshold &= ~0x1;
2486 		}
2487 		changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2488 	}
2489 
2490 	if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2491 		rts_threshold = nla_get_u32(
2492 			info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2493 		changed |= WIPHY_PARAM_RTS_THRESHOLD;
2494 	}
2495 
2496 	if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2497 		if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2498 			return -EINVAL;
2499 
2500 		coverage_class = nla_get_u8(
2501 			info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2502 		changed |= WIPHY_PARAM_COVERAGE_CLASS;
2503 	}
2504 
2505 	if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2506 		if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2507 			return -EOPNOTSUPP;
2508 
2509 		changed |= WIPHY_PARAM_DYN_ACK;
2510 	}
2511 
2512 	if (changed) {
2513 		u8 old_retry_short, old_retry_long;
2514 		u32 old_frag_threshold, old_rts_threshold;
2515 		u8 old_coverage_class;
2516 
2517 		if (!rdev->ops->set_wiphy_params)
2518 			return -EOPNOTSUPP;
2519 
2520 		old_retry_short = rdev->wiphy.retry_short;
2521 		old_retry_long = rdev->wiphy.retry_long;
2522 		old_frag_threshold = rdev->wiphy.frag_threshold;
2523 		old_rts_threshold = rdev->wiphy.rts_threshold;
2524 		old_coverage_class = rdev->wiphy.coverage_class;
2525 
2526 		if (changed & WIPHY_PARAM_RETRY_SHORT)
2527 			rdev->wiphy.retry_short = retry_short;
2528 		if (changed & WIPHY_PARAM_RETRY_LONG)
2529 			rdev->wiphy.retry_long = retry_long;
2530 		if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2531 			rdev->wiphy.frag_threshold = frag_threshold;
2532 		if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2533 			rdev->wiphy.rts_threshold = rts_threshold;
2534 		if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2535 			rdev->wiphy.coverage_class = coverage_class;
2536 
2537 		result = rdev_set_wiphy_params(rdev, changed);
2538 		if (result) {
2539 			rdev->wiphy.retry_short = old_retry_short;
2540 			rdev->wiphy.retry_long = old_retry_long;
2541 			rdev->wiphy.frag_threshold = old_frag_threshold;
2542 			rdev->wiphy.rts_threshold = old_rts_threshold;
2543 			rdev->wiphy.coverage_class = old_coverage_class;
2544 			return result;
2545 		}
2546 	}
2547 	return 0;
2548 }
2549 
2550 static inline u64 wdev_id(struct wireless_dev *wdev)
2551 {
2552 	return (u64)wdev->identifier |
2553 	       ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2554 }
2555 
2556 static int nl80211_send_chandef(struct sk_buff *msg,
2557 				const struct cfg80211_chan_def *chandef)
2558 {
2559 	if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2560 		return -EINVAL;
2561 
2562 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2563 			chandef->chan->center_freq))
2564 		return -ENOBUFS;
2565 	switch (chandef->width) {
2566 	case NL80211_CHAN_WIDTH_20_NOHT:
2567 	case NL80211_CHAN_WIDTH_20:
2568 	case NL80211_CHAN_WIDTH_40:
2569 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2570 				cfg80211_get_chandef_type(chandef)))
2571 			return -ENOBUFS;
2572 		break;
2573 	default:
2574 		break;
2575 	}
2576 	if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2577 		return -ENOBUFS;
2578 	if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2579 		return -ENOBUFS;
2580 	if (chandef->center_freq2 &&
2581 	    nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2582 		return -ENOBUFS;
2583 	return 0;
2584 }
2585 
2586 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2587 			      struct cfg80211_registered_device *rdev,
2588 			      struct wireless_dev *wdev, bool removal)
2589 {
2590 	struct net_device *dev = wdev->netdev;
2591 	u8 cmd = NL80211_CMD_NEW_INTERFACE;
2592 	void *hdr;
2593 
2594 	if (removal)
2595 		cmd = NL80211_CMD_DEL_INTERFACE;
2596 
2597 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2598 	if (!hdr)
2599 		return -1;
2600 
2601 	if (dev &&
2602 	    (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2603 	     nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2604 		goto nla_put_failure;
2605 
2606 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2607 	    nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2608 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2609 			      NL80211_ATTR_PAD) ||
2610 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2611 	    nla_put_u32(msg, NL80211_ATTR_GENERATION,
2612 			rdev->devlist_generation ^
2613 			(cfg80211_rdev_list_generation << 2)))
2614 		goto nla_put_failure;
2615 
2616 	if (rdev->ops->get_channel) {
2617 		int ret;
2618 		struct cfg80211_chan_def chandef;
2619 
2620 		ret = rdev_get_channel(rdev, wdev, &chandef);
2621 		if (ret == 0) {
2622 			if (nl80211_send_chandef(msg, &chandef))
2623 				goto nla_put_failure;
2624 		}
2625 	}
2626 
2627 	if (rdev->ops->get_tx_power) {
2628 		int dbm, ret;
2629 
2630 		ret = rdev_get_tx_power(rdev, wdev, &dbm);
2631 		if (ret == 0 &&
2632 		    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2633 				DBM_TO_MBM(dbm)))
2634 			goto nla_put_failure;
2635 	}
2636 
2637 	wdev_lock(wdev);
2638 	switch (wdev->iftype) {
2639 	case NL80211_IFTYPE_AP:
2640 		if (wdev->ssid_len &&
2641 		    nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2642 			goto nla_put_failure_locked;
2643 		break;
2644 	case NL80211_IFTYPE_STATION:
2645 	case NL80211_IFTYPE_P2P_CLIENT:
2646 	case NL80211_IFTYPE_ADHOC: {
2647 		const u8 *ssid_ie;
2648 		if (!wdev->current_bss)
2649 			break;
2650 		rcu_read_lock();
2651 		ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2652 					       WLAN_EID_SSID);
2653 		if (ssid_ie &&
2654 		    nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2655 			goto nla_put_failure_rcu_locked;
2656 		rcu_read_unlock();
2657 		break;
2658 		}
2659 	default:
2660 		/* nothing */
2661 		break;
2662 	}
2663 	wdev_unlock(wdev);
2664 
2665 	genlmsg_end(msg, hdr);
2666 	return 0;
2667 
2668  nla_put_failure_rcu_locked:
2669 	rcu_read_unlock();
2670  nla_put_failure_locked:
2671 	wdev_unlock(wdev);
2672  nla_put_failure:
2673 	genlmsg_cancel(msg, hdr);
2674 	return -EMSGSIZE;
2675 }
2676 
2677 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2678 {
2679 	int wp_idx = 0;
2680 	int if_idx = 0;
2681 	int wp_start = cb->args[0];
2682 	int if_start = cb->args[1];
2683 	int filter_wiphy = -1;
2684 	struct cfg80211_registered_device *rdev;
2685 	struct wireless_dev *wdev;
2686 	int ret;
2687 
2688 	rtnl_lock();
2689 	if (!cb->args[2]) {
2690 		struct nl80211_dump_wiphy_state state = {
2691 			.filter_wiphy = -1,
2692 		};
2693 
2694 		ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2695 		if (ret)
2696 			goto out_unlock;
2697 
2698 		filter_wiphy = state.filter_wiphy;
2699 
2700 		/*
2701 		 * if filtering, set cb->args[2] to +1 since 0 is the default
2702 		 * value needed to determine that parsing is necessary.
2703 		 */
2704 		if (filter_wiphy >= 0)
2705 			cb->args[2] = filter_wiphy + 1;
2706 		else
2707 			cb->args[2] = -1;
2708 	} else if (cb->args[2] > 0) {
2709 		filter_wiphy = cb->args[2] - 1;
2710 	}
2711 
2712 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2713 		if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2714 			continue;
2715 		if (wp_idx < wp_start) {
2716 			wp_idx++;
2717 			continue;
2718 		}
2719 
2720 		if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2721 			continue;
2722 
2723 		if_idx = 0;
2724 
2725 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2726 			if (if_idx < if_start) {
2727 				if_idx++;
2728 				continue;
2729 			}
2730 			if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2731 					       cb->nlh->nlmsg_seq, NLM_F_MULTI,
2732 					       rdev, wdev, false) < 0) {
2733 				goto out;
2734 			}
2735 			if_idx++;
2736 		}
2737 
2738 		wp_idx++;
2739 	}
2740  out:
2741 	cb->args[0] = wp_idx;
2742 	cb->args[1] = if_idx;
2743 
2744 	ret = skb->len;
2745  out_unlock:
2746 	rtnl_unlock();
2747 
2748 	return ret;
2749 }
2750 
2751 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2752 {
2753 	struct sk_buff *msg;
2754 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2755 	struct wireless_dev *wdev = info->user_ptr[1];
2756 
2757 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2758 	if (!msg)
2759 		return -ENOMEM;
2760 
2761 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2762 			       rdev, wdev, false) < 0) {
2763 		nlmsg_free(msg);
2764 		return -ENOBUFS;
2765 	}
2766 
2767 	return genlmsg_reply(msg, info);
2768 }
2769 
2770 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2771 	[NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2772 	[NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2773 	[NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2774 	[NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2775 	[NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2776 	[NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2777 };
2778 
2779 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2780 {
2781 	struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2782 	int flag;
2783 
2784 	*mntrflags = 0;
2785 
2786 	if (!nla)
2787 		return -EINVAL;
2788 
2789 	if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2790 			     mntr_flags_policy, NULL))
2791 		return -EINVAL;
2792 
2793 	for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2794 		if (flags[flag])
2795 			*mntrflags |= (1<<flag);
2796 
2797 	*mntrflags |= MONITOR_FLAG_CHANGED;
2798 
2799 	return 0;
2800 }
2801 
2802 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2803 				     enum nl80211_iftype type,
2804 				     struct genl_info *info,
2805 				     struct vif_params *params)
2806 {
2807 	bool change = false;
2808 	int err;
2809 
2810 	if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2811 		if (type != NL80211_IFTYPE_MONITOR)
2812 			return -EINVAL;
2813 
2814 		err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2815 					  &params->flags);
2816 		if (err)
2817 			return err;
2818 
2819 		change = true;
2820 	}
2821 
2822 	if (params->flags & MONITOR_FLAG_ACTIVE &&
2823 	    !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2824 		return -EOPNOTSUPP;
2825 
2826 	if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2827 		const u8 *mumimo_groups;
2828 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2829 
2830 		if (type != NL80211_IFTYPE_MONITOR)
2831 			return -EINVAL;
2832 
2833 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2834 			return -EOPNOTSUPP;
2835 
2836 		mumimo_groups =
2837 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2838 
2839 		/* bits 0 and 63 are reserved and must be zero */
2840 		if ((mumimo_groups[0] & BIT(0)) ||
2841 		    (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2842 			return -EINVAL;
2843 
2844 		params->vht_mumimo_groups = mumimo_groups;
2845 		change = true;
2846 	}
2847 
2848 	if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2849 		u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2850 
2851 		if (type != NL80211_IFTYPE_MONITOR)
2852 			return -EINVAL;
2853 
2854 		if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2855 			return -EOPNOTSUPP;
2856 
2857 		params->vht_mumimo_follow_addr =
2858 			nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2859 		change = true;
2860 	}
2861 
2862 	return change ? 1 : 0;
2863 }
2864 
2865 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2866 			       struct net_device *netdev, u8 use_4addr,
2867 			       enum nl80211_iftype iftype)
2868 {
2869 	if (!use_4addr) {
2870 		if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2871 			return -EBUSY;
2872 		return 0;
2873 	}
2874 
2875 	switch (iftype) {
2876 	case NL80211_IFTYPE_AP_VLAN:
2877 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2878 			return 0;
2879 		break;
2880 	case NL80211_IFTYPE_STATION:
2881 		if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2882 			return 0;
2883 		break;
2884 	default:
2885 		break;
2886 	}
2887 
2888 	return -EOPNOTSUPP;
2889 }
2890 
2891 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2892 {
2893 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2894 	struct vif_params params;
2895 	int err;
2896 	enum nl80211_iftype otype, ntype;
2897 	struct net_device *dev = info->user_ptr[1];
2898 	bool change = false;
2899 
2900 	memset(&params, 0, sizeof(params));
2901 
2902 	otype = ntype = dev->ieee80211_ptr->iftype;
2903 
2904 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2905 		ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2906 		if (otype != ntype)
2907 			change = true;
2908 		if (ntype > NL80211_IFTYPE_MAX)
2909 			return -EINVAL;
2910 	}
2911 
2912 	if (info->attrs[NL80211_ATTR_MESH_ID]) {
2913 		struct wireless_dev *wdev = dev->ieee80211_ptr;
2914 
2915 		if (ntype != NL80211_IFTYPE_MESH_POINT)
2916 			return -EINVAL;
2917 		if (netif_running(dev))
2918 			return -EBUSY;
2919 
2920 		wdev_lock(wdev);
2921 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2922 			     IEEE80211_MAX_MESH_ID_LEN);
2923 		wdev->mesh_id_up_len =
2924 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2925 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2926 		       wdev->mesh_id_up_len);
2927 		wdev_unlock(wdev);
2928 	}
2929 
2930 	if (info->attrs[NL80211_ATTR_4ADDR]) {
2931 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2932 		change = true;
2933 		err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2934 		if (err)
2935 			return err;
2936 	} else {
2937 		params.use_4addr = -1;
2938 	}
2939 
2940 	err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2941 	if (err < 0)
2942 		return err;
2943 	if (err > 0)
2944 		change = true;
2945 
2946 	if (change)
2947 		err = cfg80211_change_iface(rdev, dev, ntype, &params);
2948 	else
2949 		err = 0;
2950 
2951 	if (!err && params.use_4addr != -1)
2952 		dev->ieee80211_ptr->use_4addr = params.use_4addr;
2953 
2954 	return err;
2955 }
2956 
2957 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2958 {
2959 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
2960 	struct vif_params params;
2961 	struct wireless_dev *wdev;
2962 	struct sk_buff *msg;
2963 	int err;
2964 	enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2965 
2966 	/* to avoid failing a new interface creation due to pending removal */
2967 	cfg80211_destroy_ifaces(rdev);
2968 
2969 	memset(&params, 0, sizeof(params));
2970 
2971 	if (!info->attrs[NL80211_ATTR_IFNAME])
2972 		return -EINVAL;
2973 
2974 	if (info->attrs[NL80211_ATTR_IFTYPE]) {
2975 		type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2976 		if (type > NL80211_IFTYPE_MAX)
2977 			return -EINVAL;
2978 	}
2979 
2980 	if (!rdev->ops->add_virtual_intf ||
2981 	    !(rdev->wiphy.interface_modes & (1 << type)))
2982 		return -EOPNOTSUPP;
2983 
2984 	if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2985 	     rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2986 	    info->attrs[NL80211_ATTR_MAC]) {
2987 		nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2988 			   ETH_ALEN);
2989 		if (!is_valid_ether_addr(params.macaddr))
2990 			return -EADDRNOTAVAIL;
2991 	}
2992 
2993 	if (info->attrs[NL80211_ATTR_4ADDR]) {
2994 		params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2995 		err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2996 		if (err)
2997 			return err;
2998 	}
2999 
3000 	err = nl80211_parse_mon_options(rdev, type, info, &params);
3001 	if (err < 0)
3002 		return err;
3003 
3004 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3005 	if (!msg)
3006 		return -ENOMEM;
3007 
3008 	wdev = rdev_add_virtual_intf(rdev,
3009 				nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3010 				NET_NAME_USER, type, &params);
3011 	if (WARN_ON(!wdev)) {
3012 		nlmsg_free(msg);
3013 		return -EPROTO;
3014 	} else if (IS_ERR(wdev)) {
3015 		nlmsg_free(msg);
3016 		return PTR_ERR(wdev);
3017 	}
3018 
3019 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3020 		wdev->owner_nlportid = info->snd_portid;
3021 
3022 	switch (type) {
3023 	case NL80211_IFTYPE_MESH_POINT:
3024 		if (!info->attrs[NL80211_ATTR_MESH_ID])
3025 			break;
3026 		wdev_lock(wdev);
3027 		BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3028 			     IEEE80211_MAX_MESH_ID_LEN);
3029 		wdev->mesh_id_up_len =
3030 			nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3031 		memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3032 		       wdev->mesh_id_up_len);
3033 		wdev_unlock(wdev);
3034 		break;
3035 	case NL80211_IFTYPE_NAN:
3036 	case NL80211_IFTYPE_P2P_DEVICE:
3037 		/*
3038 		 * P2P Device and NAN do not have a netdev, so don't go
3039 		 * through the netdev notifier and must be added here
3040 		 */
3041 		mutex_init(&wdev->mtx);
3042 		INIT_LIST_HEAD(&wdev->event_list);
3043 		spin_lock_init(&wdev->event_lock);
3044 		INIT_LIST_HEAD(&wdev->mgmt_registrations);
3045 		spin_lock_init(&wdev->mgmt_registrations_lock);
3046 
3047 		wdev->identifier = ++rdev->wdev_id;
3048 		list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3049 		rdev->devlist_generation++;
3050 		break;
3051 	default:
3052 		break;
3053 	}
3054 
3055 	if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3056 			       rdev, wdev, false) < 0) {
3057 		nlmsg_free(msg);
3058 		return -ENOBUFS;
3059 	}
3060 
3061 	/*
3062 	 * For wdevs which have no associated netdev object (e.g. of type
3063 	 * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3064 	 * For all other types, the event will be generated from the
3065 	 * netdev notifier
3066 	 */
3067 	if (!wdev->netdev)
3068 		nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3069 
3070 	return genlmsg_reply(msg, info);
3071 }
3072 
3073 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3074 {
3075 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3076 	struct wireless_dev *wdev = info->user_ptr[1];
3077 
3078 	if (!rdev->ops->del_virtual_intf)
3079 		return -EOPNOTSUPP;
3080 
3081 	/*
3082 	 * If we remove a wireless device without a netdev then clear
3083 	 * user_ptr[1] so that nl80211_post_doit won't dereference it
3084 	 * to check if it needs to do dev_put(). Otherwise it crashes
3085 	 * since the wdev has been freed, unlike with a netdev where
3086 	 * we need the dev_put() for the netdev to really be freed.
3087 	 */
3088 	if (!wdev->netdev)
3089 		info->user_ptr[1] = NULL;
3090 
3091 	return rdev_del_virtual_intf(rdev, wdev);
3092 }
3093 
3094 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3095 {
3096 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3097 	struct net_device *dev = info->user_ptr[1];
3098 	u16 noack_map;
3099 
3100 	if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3101 		return -EINVAL;
3102 
3103 	if (!rdev->ops->set_noack_map)
3104 		return -EOPNOTSUPP;
3105 
3106 	noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3107 
3108 	return rdev_set_noack_map(rdev, dev, noack_map);
3109 }
3110 
3111 struct get_key_cookie {
3112 	struct sk_buff *msg;
3113 	int error;
3114 	int idx;
3115 };
3116 
3117 static void get_key_callback(void *c, struct key_params *params)
3118 {
3119 	struct nlattr *key;
3120 	struct get_key_cookie *cookie = c;
3121 
3122 	if ((params->key &&
3123 	     nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3124 		     params->key_len, params->key)) ||
3125 	    (params->seq &&
3126 	     nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3127 		     params->seq_len, params->seq)) ||
3128 	    (params->cipher &&
3129 	     nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3130 			 params->cipher)))
3131 		goto nla_put_failure;
3132 
3133 	key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3134 	if (!key)
3135 		goto nla_put_failure;
3136 
3137 	if ((params->key &&
3138 	     nla_put(cookie->msg, NL80211_KEY_DATA,
3139 		     params->key_len, params->key)) ||
3140 	    (params->seq &&
3141 	     nla_put(cookie->msg, NL80211_KEY_SEQ,
3142 		     params->seq_len, params->seq)) ||
3143 	    (params->cipher &&
3144 	     nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3145 			 params->cipher)))
3146 		goto nla_put_failure;
3147 
3148 	if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3149 		goto nla_put_failure;
3150 
3151 	nla_nest_end(cookie->msg, key);
3152 
3153 	return;
3154  nla_put_failure:
3155 	cookie->error = 1;
3156 }
3157 
3158 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3159 {
3160 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3161 	int err;
3162 	struct net_device *dev = info->user_ptr[1];
3163 	u8 key_idx = 0;
3164 	const u8 *mac_addr = NULL;
3165 	bool pairwise;
3166 	struct get_key_cookie cookie = {
3167 		.error = 0,
3168 	};
3169 	void *hdr;
3170 	struct sk_buff *msg;
3171 
3172 	if (info->attrs[NL80211_ATTR_KEY_IDX])
3173 		key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3174 
3175 	if (key_idx > 5)
3176 		return -EINVAL;
3177 
3178 	if (info->attrs[NL80211_ATTR_MAC])
3179 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3180 
3181 	pairwise = !!mac_addr;
3182 	if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3183 		u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3184 
3185 		if (kt >= NUM_NL80211_KEYTYPES)
3186 			return -EINVAL;
3187 		if (kt != NL80211_KEYTYPE_GROUP &&
3188 		    kt != NL80211_KEYTYPE_PAIRWISE)
3189 			return -EINVAL;
3190 		pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3191 	}
3192 
3193 	if (!rdev->ops->get_key)
3194 		return -EOPNOTSUPP;
3195 
3196 	if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3197 		return -ENOENT;
3198 
3199 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3200 	if (!msg)
3201 		return -ENOMEM;
3202 
3203 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3204 			     NL80211_CMD_NEW_KEY);
3205 	if (!hdr)
3206 		goto nla_put_failure;
3207 
3208 	cookie.msg = msg;
3209 	cookie.idx = key_idx;
3210 
3211 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3212 	    nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3213 		goto nla_put_failure;
3214 	if (mac_addr &&
3215 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3216 		goto nla_put_failure;
3217 
3218 	err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3219 			   get_key_callback);
3220 
3221 	if (err)
3222 		goto free_msg;
3223 
3224 	if (cookie.error)
3225 		goto nla_put_failure;
3226 
3227 	genlmsg_end(msg, hdr);
3228 	return genlmsg_reply(msg, info);
3229 
3230  nla_put_failure:
3231 	err = -ENOBUFS;
3232  free_msg:
3233 	nlmsg_free(msg);
3234 	return err;
3235 }
3236 
3237 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3238 {
3239 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3240 	struct key_parse key;
3241 	int err;
3242 	struct net_device *dev = info->user_ptr[1];
3243 
3244 	err = nl80211_parse_key(info, &key);
3245 	if (err)
3246 		return err;
3247 
3248 	if (key.idx < 0)
3249 		return -EINVAL;
3250 
3251 	/* only support setting default key */
3252 	if (!key.def && !key.defmgmt)
3253 		return -EINVAL;
3254 
3255 	wdev_lock(dev->ieee80211_ptr);
3256 
3257 	if (key.def) {
3258 		if (!rdev->ops->set_default_key) {
3259 			err = -EOPNOTSUPP;
3260 			goto out;
3261 		}
3262 
3263 		err = nl80211_key_allowed(dev->ieee80211_ptr);
3264 		if (err)
3265 			goto out;
3266 
3267 		err = rdev_set_default_key(rdev, dev, key.idx,
3268 						 key.def_uni, key.def_multi);
3269 
3270 		if (err)
3271 			goto out;
3272 
3273 #ifdef CONFIG_CFG80211_WEXT
3274 		dev->ieee80211_ptr->wext.default_key = key.idx;
3275 #endif
3276 	} else {
3277 		if (key.def_uni || !key.def_multi) {
3278 			err = -EINVAL;
3279 			goto out;
3280 		}
3281 
3282 		if (!rdev->ops->set_default_mgmt_key) {
3283 			err = -EOPNOTSUPP;
3284 			goto out;
3285 		}
3286 
3287 		err = nl80211_key_allowed(dev->ieee80211_ptr);
3288 		if (err)
3289 			goto out;
3290 
3291 		err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3292 		if (err)
3293 			goto out;
3294 
3295 #ifdef CONFIG_CFG80211_WEXT
3296 		dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3297 #endif
3298 	}
3299 
3300  out:
3301 	wdev_unlock(dev->ieee80211_ptr);
3302 
3303 	return err;
3304 }
3305 
3306 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3307 {
3308 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3309 	int err;
3310 	struct net_device *dev = info->user_ptr[1];
3311 	struct key_parse key;
3312 	const u8 *mac_addr = NULL;
3313 
3314 	err = nl80211_parse_key(info, &key);
3315 	if (err)
3316 		return err;
3317 
3318 	if (!key.p.key)
3319 		return -EINVAL;
3320 
3321 	if (info->attrs[NL80211_ATTR_MAC])
3322 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3323 
3324 	if (key.type == -1) {
3325 		if (mac_addr)
3326 			key.type = NL80211_KEYTYPE_PAIRWISE;
3327 		else
3328 			key.type = NL80211_KEYTYPE_GROUP;
3329 	}
3330 
3331 	/* for now */
3332 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3333 	    key.type != NL80211_KEYTYPE_GROUP)
3334 		return -EINVAL;
3335 
3336 	if (!rdev->ops->add_key)
3337 		return -EOPNOTSUPP;
3338 
3339 	if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3340 					   key.type == NL80211_KEYTYPE_PAIRWISE,
3341 					   mac_addr))
3342 		return -EINVAL;
3343 
3344 	wdev_lock(dev->ieee80211_ptr);
3345 	err = nl80211_key_allowed(dev->ieee80211_ptr);
3346 	if (!err)
3347 		err = rdev_add_key(rdev, dev, key.idx,
3348 				   key.type == NL80211_KEYTYPE_PAIRWISE,
3349 				    mac_addr, &key.p);
3350 	wdev_unlock(dev->ieee80211_ptr);
3351 
3352 	return err;
3353 }
3354 
3355 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3356 {
3357 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3358 	int err;
3359 	struct net_device *dev = info->user_ptr[1];
3360 	u8 *mac_addr = NULL;
3361 	struct key_parse key;
3362 
3363 	err = nl80211_parse_key(info, &key);
3364 	if (err)
3365 		return err;
3366 
3367 	if (info->attrs[NL80211_ATTR_MAC])
3368 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3369 
3370 	if (key.type == -1) {
3371 		if (mac_addr)
3372 			key.type = NL80211_KEYTYPE_PAIRWISE;
3373 		else
3374 			key.type = NL80211_KEYTYPE_GROUP;
3375 	}
3376 
3377 	/* for now */
3378 	if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3379 	    key.type != NL80211_KEYTYPE_GROUP)
3380 		return -EINVAL;
3381 
3382 	if (!rdev->ops->del_key)
3383 		return -EOPNOTSUPP;
3384 
3385 	wdev_lock(dev->ieee80211_ptr);
3386 	err = nl80211_key_allowed(dev->ieee80211_ptr);
3387 
3388 	if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3389 	    !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3390 		err = -ENOENT;
3391 
3392 	if (!err)
3393 		err = rdev_del_key(rdev, dev, key.idx,
3394 				   key.type == NL80211_KEYTYPE_PAIRWISE,
3395 				   mac_addr);
3396 
3397 #ifdef CONFIG_CFG80211_WEXT
3398 	if (!err) {
3399 		if (key.idx == dev->ieee80211_ptr->wext.default_key)
3400 			dev->ieee80211_ptr->wext.default_key = -1;
3401 		else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3402 			dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3403 	}
3404 #endif
3405 	wdev_unlock(dev->ieee80211_ptr);
3406 
3407 	return err;
3408 }
3409 
3410 /* This function returns an error or the number of nested attributes */
3411 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3412 {
3413 	struct nlattr *attr;
3414 	int n_entries = 0, tmp;
3415 
3416 	nla_for_each_nested(attr, nl_attr, tmp) {
3417 		if (nla_len(attr) != ETH_ALEN)
3418 			return -EINVAL;
3419 
3420 		n_entries++;
3421 	}
3422 
3423 	return n_entries;
3424 }
3425 
3426 /*
3427  * This function parses ACL information and allocates memory for ACL data.
3428  * On successful return, the calling function is responsible to free the
3429  * ACL buffer returned by this function.
3430  */
3431 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3432 						struct genl_info *info)
3433 {
3434 	enum nl80211_acl_policy acl_policy;
3435 	struct nlattr *attr;
3436 	struct cfg80211_acl_data *acl;
3437 	int i = 0, n_entries, tmp;
3438 
3439 	if (!wiphy->max_acl_mac_addrs)
3440 		return ERR_PTR(-EOPNOTSUPP);
3441 
3442 	if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3443 		return ERR_PTR(-EINVAL);
3444 
3445 	acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3446 	if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3447 	    acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3448 		return ERR_PTR(-EINVAL);
3449 
3450 	if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3451 		return ERR_PTR(-EINVAL);
3452 
3453 	n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3454 	if (n_entries < 0)
3455 		return ERR_PTR(n_entries);
3456 
3457 	if (n_entries > wiphy->max_acl_mac_addrs)
3458 		return ERR_PTR(-ENOTSUPP);
3459 
3460 	acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3461 		      GFP_KERNEL);
3462 	if (!acl)
3463 		return ERR_PTR(-ENOMEM);
3464 
3465 	nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3466 		memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3467 		i++;
3468 	}
3469 
3470 	acl->n_acl_entries = n_entries;
3471 	acl->acl_policy = acl_policy;
3472 
3473 	return acl;
3474 }
3475 
3476 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3477 {
3478 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3479 	struct net_device *dev = info->user_ptr[1];
3480 	struct cfg80211_acl_data *acl;
3481 	int err;
3482 
3483 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3484 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3485 		return -EOPNOTSUPP;
3486 
3487 	if (!dev->ieee80211_ptr->beacon_interval)
3488 		return -EINVAL;
3489 
3490 	acl = parse_acl_data(&rdev->wiphy, info);
3491 	if (IS_ERR(acl))
3492 		return PTR_ERR(acl);
3493 
3494 	err = rdev_set_mac_acl(rdev, dev, acl);
3495 
3496 	kfree(acl);
3497 
3498 	return err;
3499 }
3500 
3501 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3502 			   u8 *rates, u8 rates_len)
3503 {
3504 	u8 i;
3505 	u32 mask = 0;
3506 
3507 	for (i = 0; i < rates_len; i++) {
3508 		int rate = (rates[i] & 0x7f) * 5;
3509 		int ridx;
3510 
3511 		for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3512 			struct ieee80211_rate *srate =
3513 				&sband->bitrates[ridx];
3514 			if (rate == srate->bitrate) {
3515 				mask |= 1 << ridx;
3516 				break;
3517 			}
3518 		}
3519 		if (ridx == sband->n_bitrates)
3520 			return 0; /* rate not found */
3521 	}
3522 
3523 	return mask;
3524 }
3525 
3526 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3527 			       u8 *rates, u8 rates_len,
3528 			       u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3529 {
3530 	u8 i;
3531 
3532 	memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3533 
3534 	for (i = 0; i < rates_len; i++) {
3535 		int ridx, rbit;
3536 
3537 		ridx = rates[i] / 8;
3538 		rbit = BIT(rates[i] % 8);
3539 
3540 		/* check validity */
3541 		if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3542 			return false;
3543 
3544 		/* check availability */
3545 		if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3546 			mcs[ridx] |= rbit;
3547 		else
3548 			return false;
3549 	}
3550 
3551 	return true;
3552 }
3553 
3554 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3555 {
3556 	u16 mcs_mask = 0;
3557 
3558 	switch (vht_mcs_map) {
3559 	case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3560 		break;
3561 	case IEEE80211_VHT_MCS_SUPPORT_0_7:
3562 		mcs_mask = 0x00FF;
3563 		break;
3564 	case IEEE80211_VHT_MCS_SUPPORT_0_8:
3565 		mcs_mask = 0x01FF;
3566 		break;
3567 	case IEEE80211_VHT_MCS_SUPPORT_0_9:
3568 		mcs_mask = 0x03FF;
3569 		break;
3570 	default:
3571 		break;
3572 	}
3573 
3574 	return mcs_mask;
3575 }
3576 
3577 static void vht_build_mcs_mask(u16 vht_mcs_map,
3578 			       u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3579 {
3580 	u8 nss;
3581 
3582 	for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3583 		vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3584 		vht_mcs_map >>= 2;
3585 	}
3586 }
3587 
3588 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3589 			     struct nl80211_txrate_vht *txrate,
3590 			     u16 mcs[NL80211_VHT_NSS_MAX])
3591 {
3592 	u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3593 	u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3594 	u8 i;
3595 
3596 	if (!sband->vht_cap.vht_supported)
3597 		return false;
3598 
3599 	memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3600 
3601 	/* Build vht_mcs_mask from VHT capabilities */
3602 	vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3603 
3604 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3605 		if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3606 			mcs[i] = txrate->mcs[i];
3607 		else
3608 			return false;
3609 	}
3610 
3611 	return true;
3612 }
3613 
3614 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3615 	[NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3616 				    .len = NL80211_MAX_SUPP_RATES },
3617 	[NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3618 				.len = NL80211_MAX_SUPP_HT_RATES },
3619 	[NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3620 	[NL80211_TXRATE_GI] = { .type = NLA_U8 },
3621 };
3622 
3623 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3624 					 struct cfg80211_bitrate_mask *mask)
3625 {
3626 	struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3627 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3628 	int rem, i;
3629 	struct nlattr *tx_rates;
3630 	struct ieee80211_supported_band *sband;
3631 	u16 vht_tx_mcs_map;
3632 
3633 	memset(mask, 0, sizeof(*mask));
3634 	/* Default to all rates enabled */
3635 	for (i = 0; i < NUM_NL80211_BANDS; i++) {
3636 		sband = rdev->wiphy.bands[i];
3637 
3638 		if (!sband)
3639 			continue;
3640 
3641 		mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3642 		memcpy(mask->control[i].ht_mcs,
3643 		       sband->ht_cap.mcs.rx_mask,
3644 		       sizeof(mask->control[i].ht_mcs));
3645 
3646 		if (!sband->vht_cap.vht_supported)
3647 			continue;
3648 
3649 		vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3650 		vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3651 	}
3652 
3653 	/* if no rates are given set it back to the defaults */
3654 	if (!info->attrs[NL80211_ATTR_TX_RATES])
3655 		goto out;
3656 
3657 	/* The nested attribute uses enum nl80211_band as the index. This maps
3658 	 * directly to the enum nl80211_band values used in cfg80211.
3659 	 */
3660 	BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3661 	nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3662 		enum nl80211_band band = nla_type(tx_rates);
3663 		int err;
3664 
3665 		if (band < 0 || band >= NUM_NL80211_BANDS)
3666 			return -EINVAL;
3667 		sband = rdev->wiphy.bands[band];
3668 		if (sband == NULL)
3669 			return -EINVAL;
3670 		err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3671 				       nl80211_txattr_policy, info->extack);
3672 		if (err)
3673 			return err;
3674 		if (tb[NL80211_TXRATE_LEGACY]) {
3675 			mask->control[band].legacy = rateset_to_mask(
3676 				sband,
3677 				nla_data(tb[NL80211_TXRATE_LEGACY]),
3678 				nla_len(tb[NL80211_TXRATE_LEGACY]));
3679 			if ((mask->control[band].legacy == 0) &&
3680 			    nla_len(tb[NL80211_TXRATE_LEGACY]))
3681 				return -EINVAL;
3682 		}
3683 		if (tb[NL80211_TXRATE_HT]) {
3684 			if (!ht_rateset_to_mask(
3685 					sband,
3686 					nla_data(tb[NL80211_TXRATE_HT]),
3687 					nla_len(tb[NL80211_TXRATE_HT]),
3688 					mask->control[band].ht_mcs))
3689 				return -EINVAL;
3690 		}
3691 		if (tb[NL80211_TXRATE_VHT]) {
3692 			if (!vht_set_mcs_mask(
3693 					sband,
3694 					nla_data(tb[NL80211_TXRATE_VHT]),
3695 					mask->control[band].vht_mcs))
3696 				return -EINVAL;
3697 		}
3698 		if (tb[NL80211_TXRATE_GI]) {
3699 			mask->control[band].gi =
3700 				nla_get_u8(tb[NL80211_TXRATE_GI]);
3701 			if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3702 				return -EINVAL;
3703 		}
3704 
3705 		if (mask->control[band].legacy == 0) {
3706 			/* don't allow empty legacy rates if HT or VHT
3707 			 * are not even supported.
3708 			 */
3709 			if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3710 			      rdev->wiphy.bands[band]->vht_cap.vht_supported))
3711 				return -EINVAL;
3712 
3713 			for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3714 				if (mask->control[band].ht_mcs[i])
3715 					goto out;
3716 
3717 			for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3718 				if (mask->control[band].vht_mcs[i])
3719 					goto out;
3720 
3721 			/* legacy and mcs rates may not be both empty */
3722 			return -EINVAL;
3723 		}
3724 	}
3725 
3726 out:
3727 	return 0;
3728 }
3729 
3730 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3731 				   enum nl80211_band band,
3732 				   struct cfg80211_bitrate_mask *beacon_rate)
3733 {
3734 	u32 count_ht, count_vht, i;
3735 	u32 rate = beacon_rate->control[band].legacy;
3736 
3737 	/* Allow only one rate */
3738 	if (hweight32(rate) > 1)
3739 		return -EINVAL;
3740 
3741 	count_ht = 0;
3742 	for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3743 		if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3744 			return -EINVAL;
3745 		} else if (beacon_rate->control[band].ht_mcs[i]) {
3746 			count_ht++;
3747 			if (count_ht > 1)
3748 				return -EINVAL;
3749 		}
3750 		if (count_ht && rate)
3751 			return -EINVAL;
3752 	}
3753 
3754 	count_vht = 0;
3755 	for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3756 		if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3757 			return -EINVAL;
3758 		} else if (beacon_rate->control[band].vht_mcs[i]) {
3759 			count_vht++;
3760 			if (count_vht > 1)
3761 				return -EINVAL;
3762 		}
3763 		if (count_vht && rate)
3764 			return -EINVAL;
3765 	}
3766 
3767 	if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3768 		return -EINVAL;
3769 
3770 	if (rate &&
3771 	    !wiphy_ext_feature_isset(&rdev->wiphy,
3772 				     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3773 		return -EINVAL;
3774 	if (count_ht &&
3775 	    !wiphy_ext_feature_isset(&rdev->wiphy,
3776 				     NL80211_EXT_FEATURE_BEACON_RATE_HT))
3777 		return -EINVAL;
3778 	if (count_vht &&
3779 	    !wiphy_ext_feature_isset(&rdev->wiphy,
3780 				     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3781 		return -EINVAL;
3782 
3783 	return 0;
3784 }
3785 
3786 static int nl80211_parse_beacon(struct nlattr *attrs[],
3787 				struct cfg80211_beacon_data *bcn)
3788 {
3789 	bool haveinfo = false;
3790 
3791 	if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3792 	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3793 	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3794 	    !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3795 		return -EINVAL;
3796 
3797 	memset(bcn, 0, sizeof(*bcn));
3798 
3799 	if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3800 		bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3801 		bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3802 		if (!bcn->head_len)
3803 			return -EINVAL;
3804 		haveinfo = true;
3805 	}
3806 
3807 	if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3808 		bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3809 		bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3810 		haveinfo = true;
3811 	}
3812 
3813 	if (!haveinfo)
3814 		return -EINVAL;
3815 
3816 	if (attrs[NL80211_ATTR_IE]) {
3817 		bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3818 		bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3819 	}
3820 
3821 	if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3822 		bcn->proberesp_ies =
3823 			nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3824 		bcn->proberesp_ies_len =
3825 			nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3826 	}
3827 
3828 	if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3829 		bcn->assocresp_ies =
3830 			nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3831 		bcn->assocresp_ies_len =
3832 			nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3833 	}
3834 
3835 	if (attrs[NL80211_ATTR_PROBE_RESP]) {
3836 		bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3837 		bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3838 	}
3839 
3840 	return 0;
3841 }
3842 
3843 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3844 					    const u8 *rates)
3845 {
3846 	int i;
3847 
3848 	if (!rates)
3849 		return;
3850 
3851 	for (i = 0; i < rates[1]; i++) {
3852 		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3853 			params->ht_required = true;
3854 		if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3855 			params->vht_required = true;
3856 	}
3857 }
3858 
3859 /*
3860  * Since the nl80211 API didn't include, from the beginning, attributes about
3861  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3862  * benefit of drivers that rebuild IEs in the firmware.
3863  */
3864 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3865 {
3866 	const struct cfg80211_beacon_data *bcn = &params->beacon;
3867 	size_t ies_len = bcn->tail_len;
3868 	const u8 *ies = bcn->tail;
3869 	const u8 *rates;
3870 	const u8 *cap;
3871 
3872 	rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3873 	nl80211_check_ap_rate_selectors(params, rates);
3874 
3875 	rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3876 	nl80211_check_ap_rate_selectors(params, rates);
3877 
3878 	cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3879 	if (cap && cap[1] >= sizeof(*params->ht_cap))
3880 		params->ht_cap = (void *)(cap + 2);
3881 	cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3882 	if (cap && cap[1] >= sizeof(*params->vht_cap))
3883 		params->vht_cap = (void *)(cap + 2);
3884 }
3885 
3886 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3887 				   struct cfg80211_ap_settings *params)
3888 {
3889 	struct wireless_dev *wdev;
3890 	bool ret = false;
3891 
3892 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3893 		if (wdev->iftype != NL80211_IFTYPE_AP &&
3894 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)
3895 			continue;
3896 
3897 		if (!wdev->preset_chandef.chan)
3898 			continue;
3899 
3900 		params->chandef = wdev->preset_chandef;
3901 		ret = true;
3902 		break;
3903 	}
3904 
3905 	return ret;
3906 }
3907 
3908 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3909 				    enum nl80211_auth_type auth_type,
3910 				    enum nl80211_commands cmd)
3911 {
3912 	if (auth_type > NL80211_AUTHTYPE_MAX)
3913 		return false;
3914 
3915 	switch (cmd) {
3916 	case NL80211_CMD_AUTHENTICATE:
3917 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3918 		    auth_type == NL80211_AUTHTYPE_SAE)
3919 			return false;
3920 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
3921 					     NL80211_EXT_FEATURE_FILS_STA) &&
3922 		    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3923 		     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3924 		     auth_type == NL80211_AUTHTYPE_FILS_PK))
3925 			return false;
3926 		return true;
3927 	case NL80211_CMD_CONNECT:
3928 		if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3929 		    auth_type == NL80211_AUTHTYPE_SAE)
3930 			return false;
3931 
3932 		/* FILS with SK PFS or PK not supported yet */
3933 		if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3934 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
3935 			return false;
3936 		if (!wiphy_ext_feature_isset(
3937 			    &rdev->wiphy,
3938 			    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3939 		    auth_type == NL80211_AUTHTYPE_FILS_SK)
3940 			return false;
3941 		return true;
3942 	case NL80211_CMD_START_AP:
3943 		/* SAE not supported yet */
3944 		if (auth_type == NL80211_AUTHTYPE_SAE)
3945 			return false;
3946 		/* FILS not supported yet */
3947 		if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3948 		    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3949 		    auth_type == NL80211_AUTHTYPE_FILS_PK)
3950 			return false;
3951 		return true;
3952 	default:
3953 		return false;
3954 	}
3955 }
3956 
3957 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3958 {
3959 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
3960 	struct net_device *dev = info->user_ptr[1];
3961 	struct wireless_dev *wdev = dev->ieee80211_ptr;
3962 	struct cfg80211_ap_settings params;
3963 	int err;
3964 
3965 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3966 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3967 		return -EOPNOTSUPP;
3968 
3969 	if (!rdev->ops->start_ap)
3970 		return -EOPNOTSUPP;
3971 
3972 	if (wdev->beacon_interval)
3973 		return -EALREADY;
3974 
3975 	memset(&params, 0, sizeof(params));
3976 
3977 	/* these are required for START_AP */
3978 	if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3979 	    !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3980 	    !info->attrs[NL80211_ATTR_BEACON_HEAD])
3981 		return -EINVAL;
3982 
3983 	err = nl80211_parse_beacon(info->attrs, &params.beacon);
3984 	if (err)
3985 		return err;
3986 
3987 	params.beacon_interval =
3988 		nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3989 	params.dtim_period =
3990 		nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3991 
3992 	err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3993 					   params.beacon_interval);
3994 	if (err)
3995 		return err;
3996 
3997 	/*
3998 	 * In theory, some of these attributes should be required here
3999 	 * but since they were not used when the command was originally
4000 	 * added, keep them optional for old user space programs to let
4001 	 * them continue to work with drivers that do not need the
4002 	 * additional information -- drivers must check!
4003 	 */
4004 	if (info->attrs[NL80211_ATTR_SSID]) {
4005 		params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4006 		params.ssid_len =
4007 			nla_len(info->attrs[NL80211_ATTR_SSID]);
4008 		if (params.ssid_len == 0 ||
4009 		    params.ssid_len > IEEE80211_MAX_SSID_LEN)
4010 			return -EINVAL;
4011 	}
4012 
4013 	if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
4014 		params.hidden_ssid = nla_get_u32(
4015 			info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4016 		if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
4017 		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
4018 		    params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
4019 			return -EINVAL;
4020 	}
4021 
4022 	params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4023 
4024 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4025 		params.auth_type = nla_get_u32(
4026 			info->attrs[NL80211_ATTR_AUTH_TYPE]);
4027 		if (!nl80211_valid_auth_type(rdev, params.auth_type,
4028 					     NL80211_CMD_START_AP))
4029 			return -EINVAL;
4030 	} else
4031 		params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4032 
4033 	err = nl80211_crypto_settings(rdev, info, &params.crypto,
4034 				      NL80211_MAX_NR_CIPHER_SUITES);
4035 	if (err)
4036 		return err;
4037 
4038 	if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4039 		if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4040 			return -EOPNOTSUPP;
4041 		params.inactivity_timeout = nla_get_u16(
4042 			info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4043 	}
4044 
4045 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4046 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4047 			return -EINVAL;
4048 		params.p2p_ctwindow =
4049 			nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4050 		if (params.p2p_ctwindow > 127)
4051 			return -EINVAL;
4052 		if (params.p2p_ctwindow != 0 &&
4053 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4054 			return -EINVAL;
4055 	}
4056 
4057 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4058 		u8 tmp;
4059 
4060 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4061 			return -EINVAL;
4062 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4063 		if (tmp > 1)
4064 			return -EINVAL;
4065 		params.p2p_opp_ps = tmp;
4066 		if (params.p2p_opp_ps != 0 &&
4067 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4068 			return -EINVAL;
4069 	}
4070 
4071 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4072 		err = nl80211_parse_chandef(rdev, info, &params.chandef);
4073 		if (err)
4074 			return err;
4075 	} else if (wdev->preset_chandef.chan) {
4076 		params.chandef = wdev->preset_chandef;
4077 	} else if (!nl80211_get_ap_channel(rdev, &params))
4078 		return -EINVAL;
4079 
4080 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4081 					   wdev->iftype))
4082 		return -EINVAL;
4083 
4084 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
4085 		err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4086 		if (err)
4087 			return err;
4088 
4089 		err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4090 					      &params.beacon_rate);
4091 		if (err)
4092 			return err;
4093 	}
4094 
4095 	if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4096 		params.smps_mode =
4097 			nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4098 		switch (params.smps_mode) {
4099 		case NL80211_SMPS_OFF:
4100 			break;
4101 		case NL80211_SMPS_STATIC:
4102 			if (!(rdev->wiphy.features &
4103 			      NL80211_FEATURE_STATIC_SMPS))
4104 				return -EINVAL;
4105 			break;
4106 		case NL80211_SMPS_DYNAMIC:
4107 			if (!(rdev->wiphy.features &
4108 			      NL80211_FEATURE_DYNAMIC_SMPS))
4109 				return -EINVAL;
4110 			break;
4111 		default:
4112 			return -EINVAL;
4113 		}
4114 	} else {
4115 		params.smps_mode = NL80211_SMPS_OFF;
4116 	}
4117 
4118 	params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4119 	if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4120 		return -EOPNOTSUPP;
4121 
4122 	if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4123 		params.acl = parse_acl_data(&rdev->wiphy, info);
4124 		if (IS_ERR(params.acl))
4125 			return PTR_ERR(params.acl);
4126 	}
4127 
4128 	nl80211_calculate_ap_params(&params);
4129 
4130 	wdev_lock(wdev);
4131 	err = rdev_start_ap(rdev, dev, &params);
4132 	if (!err) {
4133 		wdev->preset_chandef = params.chandef;
4134 		wdev->beacon_interval = params.beacon_interval;
4135 		wdev->chandef = params.chandef;
4136 		wdev->ssid_len = params.ssid_len;
4137 		memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4138 
4139 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4140 			wdev->conn_owner_nlportid = info->snd_portid;
4141 	}
4142 	wdev_unlock(wdev);
4143 
4144 	kfree(params.acl);
4145 
4146 	return err;
4147 }
4148 
4149 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4150 {
4151 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4152 	struct net_device *dev = info->user_ptr[1];
4153 	struct wireless_dev *wdev = dev->ieee80211_ptr;
4154 	struct cfg80211_beacon_data params;
4155 	int err;
4156 
4157 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4158 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4159 		return -EOPNOTSUPP;
4160 
4161 	if (!rdev->ops->change_beacon)
4162 		return -EOPNOTSUPP;
4163 
4164 	if (!wdev->beacon_interval)
4165 		return -EINVAL;
4166 
4167 	err = nl80211_parse_beacon(info->attrs, &params);
4168 	if (err)
4169 		return err;
4170 
4171 	wdev_lock(wdev);
4172 	err = rdev_change_beacon(rdev, dev, &params);
4173 	wdev_unlock(wdev);
4174 
4175 	return err;
4176 }
4177 
4178 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4179 {
4180 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4181 	struct net_device *dev = info->user_ptr[1];
4182 
4183 	return cfg80211_stop_ap(rdev, dev, false);
4184 }
4185 
4186 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4187 	[NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4188 	[NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4189 	[NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4190 	[NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4191 	[NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4192 	[NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4193 };
4194 
4195 static int parse_station_flags(struct genl_info *info,
4196 			       enum nl80211_iftype iftype,
4197 			       struct station_parameters *params)
4198 {
4199 	struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4200 	struct nlattr *nla;
4201 	int flag;
4202 
4203 	/*
4204 	 * Try parsing the new attribute first so userspace
4205 	 * can specify both for older kernels.
4206 	 */
4207 	nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4208 	if (nla) {
4209 		struct nl80211_sta_flag_update *sta_flags;
4210 
4211 		sta_flags = nla_data(nla);
4212 		params->sta_flags_mask = sta_flags->mask;
4213 		params->sta_flags_set = sta_flags->set;
4214 		params->sta_flags_set &= params->sta_flags_mask;
4215 		if ((params->sta_flags_mask |
4216 		     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4217 			return -EINVAL;
4218 		return 0;
4219 	}
4220 
4221 	/* if present, parse the old attribute */
4222 
4223 	nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4224 	if (!nla)
4225 		return 0;
4226 
4227 	if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4228 			     sta_flags_policy, info->extack))
4229 		return -EINVAL;
4230 
4231 	/*
4232 	 * Only allow certain flags for interface types so that
4233 	 * other attributes are silently ignored. Remember that
4234 	 * this is backward compatibility code with old userspace
4235 	 * and shouldn't be hit in other cases anyway.
4236 	 */
4237 	switch (iftype) {
4238 	case NL80211_IFTYPE_AP:
4239 	case NL80211_IFTYPE_AP_VLAN:
4240 	case NL80211_IFTYPE_P2P_GO:
4241 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4242 					 BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4243 					 BIT(NL80211_STA_FLAG_WME) |
4244 					 BIT(NL80211_STA_FLAG_MFP);
4245 		break;
4246 	case NL80211_IFTYPE_P2P_CLIENT:
4247 	case NL80211_IFTYPE_STATION:
4248 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4249 					 BIT(NL80211_STA_FLAG_TDLS_PEER);
4250 		break;
4251 	case NL80211_IFTYPE_MESH_POINT:
4252 		params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4253 					 BIT(NL80211_STA_FLAG_MFP) |
4254 					 BIT(NL80211_STA_FLAG_AUTHORIZED);
4255 	default:
4256 		return -EINVAL;
4257 	}
4258 
4259 	for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4260 		if (flags[flag]) {
4261 			params->sta_flags_set |= (1<<flag);
4262 
4263 			/* no longer support new API additions in old API */
4264 			if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4265 				return -EINVAL;
4266 		}
4267 	}
4268 
4269 	return 0;
4270 }
4271 
4272 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4273 				 int attr)
4274 {
4275 	struct nlattr *rate;
4276 	u32 bitrate;
4277 	u16 bitrate_compat;
4278 	enum nl80211_rate_info rate_flg;
4279 
4280 	rate = nla_nest_start(msg, attr);
4281 	if (!rate)
4282 		return false;
4283 
4284 	/* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4285 	bitrate = cfg80211_calculate_bitrate(info);
4286 	/* report 16-bit bitrate only if we can */
4287 	bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4288 	if (bitrate > 0 &&
4289 	    nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4290 		return false;
4291 	if (bitrate_compat > 0 &&
4292 	    nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4293 		return false;
4294 
4295 	switch (info->bw) {
4296 	case RATE_INFO_BW_5:
4297 		rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4298 		break;
4299 	case RATE_INFO_BW_10:
4300 		rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4301 		break;
4302 	default:
4303 		WARN_ON(1);
4304 		/* fall through */
4305 	case RATE_INFO_BW_20:
4306 		rate_flg = 0;
4307 		break;
4308 	case RATE_INFO_BW_40:
4309 		rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4310 		break;
4311 	case RATE_INFO_BW_80:
4312 		rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4313 		break;
4314 	case RATE_INFO_BW_160:
4315 		rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4316 		break;
4317 	}
4318 
4319 	if (rate_flg && nla_put_flag(msg, rate_flg))
4320 		return false;
4321 
4322 	if (info->flags & RATE_INFO_FLAGS_MCS) {
4323 		if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4324 			return false;
4325 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4326 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4327 			return false;
4328 	} else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4329 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4330 			return false;
4331 		if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4332 			return false;
4333 		if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4334 		    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4335 			return false;
4336 	}
4337 
4338 	nla_nest_end(msg, rate);
4339 	return true;
4340 }
4341 
4342 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4343 			       int id)
4344 {
4345 	void *attr;
4346 	int i = 0;
4347 
4348 	if (!mask)
4349 		return true;
4350 
4351 	attr = nla_nest_start(msg, id);
4352 	if (!attr)
4353 		return false;
4354 
4355 	for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4356 		if (!(mask & BIT(i)))
4357 			continue;
4358 
4359 		if (nla_put_u8(msg, i, signal[i]))
4360 			return false;
4361 	}
4362 
4363 	nla_nest_end(msg, attr);
4364 
4365 	return true;
4366 }
4367 
4368 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4369 				u32 seq, int flags,
4370 				struct cfg80211_registered_device *rdev,
4371 				struct net_device *dev,
4372 				const u8 *mac_addr, struct station_info *sinfo)
4373 {
4374 	void *hdr;
4375 	struct nlattr *sinfoattr, *bss_param;
4376 
4377 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4378 	if (!hdr)
4379 		return -1;
4380 
4381 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4382 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4383 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4384 		goto nla_put_failure;
4385 
4386 	sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4387 	if (!sinfoattr)
4388 		goto nla_put_failure;
4389 
4390 #define PUT_SINFO(attr, memb, type) do {				\
4391 	BUILD_BUG_ON(sizeof(type) == sizeof(u64));			\
4392 	if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&	\
4393 	    nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,		\
4394 			     sinfo->memb))				\
4395 		goto nla_put_failure;					\
4396 	} while (0)
4397 #define PUT_SINFO_U64(attr, memb) do {					\
4398 	if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&	\
4399 	    nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,		\
4400 			      sinfo->memb, NL80211_STA_INFO_PAD))	\
4401 		goto nla_put_failure;					\
4402 	} while (0)
4403 
4404 	PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4405 	PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4406 
4407 	if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4408 			     BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4409 	    nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4410 			(u32)sinfo->rx_bytes))
4411 		goto nla_put_failure;
4412 
4413 	if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4414 			     BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4415 	    nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4416 			(u32)sinfo->tx_bytes))
4417 		goto nla_put_failure;
4418 
4419 	PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4420 	PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4421 	PUT_SINFO(LLID, llid, u16);
4422 	PUT_SINFO(PLID, plid, u16);
4423 	PUT_SINFO(PLINK_STATE, plink_state, u8);
4424 	PUT_SINFO_U64(RX_DURATION, rx_duration);
4425 
4426 	switch (rdev->wiphy.signal_type) {
4427 	case CFG80211_SIGNAL_TYPE_MBM:
4428 		PUT_SINFO(SIGNAL, signal, u8);
4429 		PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4430 		break;
4431 	default:
4432 		break;
4433 	}
4434 	if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4435 		if (!nl80211_put_signal(msg, sinfo->chains,
4436 					sinfo->chain_signal,
4437 					NL80211_STA_INFO_CHAIN_SIGNAL))
4438 			goto nla_put_failure;
4439 	}
4440 	if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4441 		if (!nl80211_put_signal(msg, sinfo->chains,
4442 					sinfo->chain_signal_avg,
4443 					NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4444 			goto nla_put_failure;
4445 	}
4446 	if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4447 		if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4448 					  NL80211_STA_INFO_TX_BITRATE))
4449 			goto nla_put_failure;
4450 	}
4451 	if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4452 		if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4453 					  NL80211_STA_INFO_RX_BITRATE))
4454 			goto nla_put_failure;
4455 	}
4456 
4457 	PUT_SINFO(RX_PACKETS, rx_packets, u32);
4458 	PUT_SINFO(TX_PACKETS, tx_packets, u32);
4459 	PUT_SINFO(TX_RETRIES, tx_retries, u32);
4460 	PUT_SINFO(TX_FAILED, tx_failed, u32);
4461 	PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4462 	PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4463 	PUT_SINFO(LOCAL_PM, local_pm, u32);
4464 	PUT_SINFO(PEER_PM, peer_pm, u32);
4465 	PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4466 
4467 	if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4468 		bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4469 		if (!bss_param)
4470 			goto nla_put_failure;
4471 
4472 		if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4473 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4474 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4475 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4476 		    ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4477 		     nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4478 		    nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4479 			       sinfo->bss_param.dtim_period) ||
4480 		    nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4481 				sinfo->bss_param.beacon_interval))
4482 			goto nla_put_failure;
4483 
4484 		nla_nest_end(msg, bss_param);
4485 	}
4486 	if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4487 	    nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4488 		    sizeof(struct nl80211_sta_flag_update),
4489 		    &sinfo->sta_flags))
4490 		goto nla_put_failure;
4491 
4492 	PUT_SINFO_U64(T_OFFSET, t_offset);
4493 	PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4494 	PUT_SINFO_U64(BEACON_RX, rx_beacon);
4495 	PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4496 	PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4497 
4498 #undef PUT_SINFO
4499 #undef PUT_SINFO_U64
4500 
4501 	if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4502 		struct nlattr *tidsattr;
4503 		int tid;
4504 
4505 		tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4506 		if (!tidsattr)
4507 			goto nla_put_failure;
4508 
4509 		for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4510 			struct cfg80211_tid_stats *tidstats;
4511 			struct nlattr *tidattr;
4512 
4513 			tidstats = &sinfo->pertid[tid];
4514 
4515 			if (!tidstats->filled)
4516 				continue;
4517 
4518 			tidattr = nla_nest_start(msg, tid + 1);
4519 			if (!tidattr)
4520 				goto nla_put_failure;
4521 
4522 #define PUT_TIDVAL_U64(attr, memb) do {					\
4523 	if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&	\
4524 	    nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,		\
4525 			      tidstats->memb, NL80211_TID_STATS_PAD))	\
4526 		goto nla_put_failure;					\
4527 	} while (0)
4528 
4529 			PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4530 			PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4531 			PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4532 			PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4533 
4534 #undef PUT_TIDVAL_U64
4535 			nla_nest_end(msg, tidattr);
4536 		}
4537 
4538 		nla_nest_end(msg, tidsattr);
4539 	}
4540 
4541 	nla_nest_end(msg, sinfoattr);
4542 
4543 	if (sinfo->assoc_req_ies_len &&
4544 	    nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4545 		    sinfo->assoc_req_ies))
4546 		goto nla_put_failure;
4547 
4548 	genlmsg_end(msg, hdr);
4549 	return 0;
4550 
4551  nla_put_failure:
4552 	genlmsg_cancel(msg, hdr);
4553 	return -EMSGSIZE;
4554 }
4555 
4556 static int nl80211_dump_station(struct sk_buff *skb,
4557 				struct netlink_callback *cb)
4558 {
4559 	struct station_info sinfo;
4560 	struct cfg80211_registered_device *rdev;
4561 	struct wireless_dev *wdev;
4562 	u8 mac_addr[ETH_ALEN];
4563 	int sta_idx = cb->args[2];
4564 	int err;
4565 
4566 	rtnl_lock();
4567 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4568 	if (err)
4569 		goto out_err;
4570 
4571 	if (!wdev->netdev) {
4572 		err = -EINVAL;
4573 		goto out_err;
4574 	}
4575 
4576 	if (!rdev->ops->dump_station) {
4577 		err = -EOPNOTSUPP;
4578 		goto out_err;
4579 	}
4580 
4581 	while (1) {
4582 		memset(&sinfo, 0, sizeof(sinfo));
4583 		err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4584 					mac_addr, &sinfo);
4585 		if (err == -ENOENT)
4586 			break;
4587 		if (err)
4588 			goto out_err;
4589 
4590 		if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4591 				NETLINK_CB(cb->skb).portid,
4592 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
4593 				rdev, wdev->netdev, mac_addr,
4594 				&sinfo) < 0)
4595 			goto out;
4596 
4597 		sta_idx++;
4598 	}
4599 
4600  out:
4601 	cb->args[2] = sta_idx;
4602 	err = skb->len;
4603  out_err:
4604 	rtnl_unlock();
4605 
4606 	return err;
4607 }
4608 
4609 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4610 {
4611 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4612 	struct net_device *dev = info->user_ptr[1];
4613 	struct station_info sinfo;
4614 	struct sk_buff *msg;
4615 	u8 *mac_addr = NULL;
4616 	int err;
4617 
4618 	memset(&sinfo, 0, sizeof(sinfo));
4619 
4620 	if (!info->attrs[NL80211_ATTR_MAC])
4621 		return -EINVAL;
4622 
4623 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4624 
4625 	if (!rdev->ops->get_station)
4626 		return -EOPNOTSUPP;
4627 
4628 	err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4629 	if (err)
4630 		return err;
4631 
4632 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4633 	if (!msg)
4634 		return -ENOMEM;
4635 
4636 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4637 				 info->snd_portid, info->snd_seq, 0,
4638 				 rdev, dev, mac_addr, &sinfo) < 0) {
4639 		nlmsg_free(msg);
4640 		return -ENOBUFS;
4641 	}
4642 
4643 	return genlmsg_reply(msg, info);
4644 }
4645 
4646 int cfg80211_check_station_change(struct wiphy *wiphy,
4647 				  struct station_parameters *params,
4648 				  enum cfg80211_station_type statype)
4649 {
4650 	if (params->listen_interval != -1 &&
4651 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4652 		return -EINVAL;
4653 
4654 	if (params->support_p2p_ps != -1 &&
4655 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4656 		return -EINVAL;
4657 
4658 	if (params->aid &&
4659 	    !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4660 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4661 		return -EINVAL;
4662 
4663 	/* When you run into this, adjust the code below for the new flag */
4664 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4665 
4666 	switch (statype) {
4667 	case CFG80211_STA_MESH_PEER_KERNEL:
4668 	case CFG80211_STA_MESH_PEER_USER:
4669 		/*
4670 		 * No ignoring the TDLS flag here -- the userspace mesh
4671 		 * code doesn't have the bug of including TDLS in the
4672 		 * mask everywhere.
4673 		 */
4674 		if (params->sta_flags_mask &
4675 				~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4676 				  BIT(NL80211_STA_FLAG_MFP) |
4677 				  BIT(NL80211_STA_FLAG_AUTHORIZED)))
4678 			return -EINVAL;
4679 		break;
4680 	case CFG80211_STA_TDLS_PEER_SETUP:
4681 	case CFG80211_STA_TDLS_PEER_ACTIVE:
4682 		if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4683 			return -EINVAL;
4684 		/* ignore since it can't change */
4685 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4686 		break;
4687 	default:
4688 		/* disallow mesh-specific things */
4689 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4690 			return -EINVAL;
4691 		if (params->local_pm)
4692 			return -EINVAL;
4693 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4694 			return -EINVAL;
4695 	}
4696 
4697 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4698 	    statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4699 		/* TDLS can't be set, ... */
4700 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4701 			return -EINVAL;
4702 		/*
4703 		 * ... but don't bother the driver with it. This works around
4704 		 * a hostapd/wpa_supplicant issue -- it always includes the
4705 		 * TLDS_PEER flag in the mask even for AP mode.
4706 		 */
4707 		params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4708 	}
4709 
4710 	if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4711 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4712 		/* reject other things that can't change */
4713 		if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4714 			return -EINVAL;
4715 		if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4716 			return -EINVAL;
4717 		if (params->supported_rates)
4718 			return -EINVAL;
4719 		if (params->ext_capab || params->ht_capa || params->vht_capa)
4720 			return -EINVAL;
4721 	}
4722 
4723 	if (statype != CFG80211_STA_AP_CLIENT &&
4724 	    statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4725 		if (params->vlan)
4726 			return -EINVAL;
4727 	}
4728 
4729 	switch (statype) {
4730 	case CFG80211_STA_AP_MLME_CLIENT:
4731 		/* Use this only for authorizing/unauthorizing a station */
4732 		if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4733 			return -EOPNOTSUPP;
4734 		break;
4735 	case CFG80211_STA_AP_CLIENT:
4736 	case CFG80211_STA_AP_CLIENT_UNASSOC:
4737 		/* accept only the listed bits */
4738 		if (params->sta_flags_mask &
4739 				~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4740 				  BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4741 				  BIT(NL80211_STA_FLAG_ASSOCIATED) |
4742 				  BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4743 				  BIT(NL80211_STA_FLAG_WME) |
4744 				  BIT(NL80211_STA_FLAG_MFP)))
4745 			return -EINVAL;
4746 
4747 		/* but authenticated/associated only if driver handles it */
4748 		if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4749 		    params->sta_flags_mask &
4750 				(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4751 				 BIT(NL80211_STA_FLAG_ASSOCIATED)))
4752 			return -EINVAL;
4753 		break;
4754 	case CFG80211_STA_IBSS:
4755 	case CFG80211_STA_AP_STA:
4756 		/* reject any changes other than AUTHORIZED */
4757 		if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4758 			return -EINVAL;
4759 		break;
4760 	case CFG80211_STA_TDLS_PEER_SETUP:
4761 		/* reject any changes other than AUTHORIZED or WME */
4762 		if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4763 					       BIT(NL80211_STA_FLAG_WME)))
4764 			return -EINVAL;
4765 		/* force (at least) rates when authorizing */
4766 		if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4767 		    !params->supported_rates)
4768 			return -EINVAL;
4769 		break;
4770 	case CFG80211_STA_TDLS_PEER_ACTIVE:
4771 		/* reject any changes */
4772 		return -EINVAL;
4773 	case CFG80211_STA_MESH_PEER_KERNEL:
4774 		if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4775 			return -EINVAL;
4776 		break;
4777 	case CFG80211_STA_MESH_PEER_USER:
4778 		if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4779 		    params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4780 			return -EINVAL;
4781 		break;
4782 	}
4783 
4784 	/*
4785 	 * Older kernel versions ignored this attribute entirely, so don't
4786 	 * reject attempts to update it but mark it as unused instead so the
4787 	 * driver won't look at the data.
4788 	 */
4789 	if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4790 	    statype != CFG80211_STA_TDLS_PEER_SETUP)
4791 		params->opmode_notif_used = false;
4792 
4793 	return 0;
4794 }
4795 EXPORT_SYMBOL(cfg80211_check_station_change);
4796 
4797 /*
4798  * Get vlan interface making sure it is running and on the right wiphy.
4799  */
4800 static struct net_device *get_vlan(struct genl_info *info,
4801 				   struct cfg80211_registered_device *rdev)
4802 {
4803 	struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4804 	struct net_device *v;
4805 	int ret;
4806 
4807 	if (!vlanattr)
4808 		return NULL;
4809 
4810 	v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4811 	if (!v)
4812 		return ERR_PTR(-ENODEV);
4813 
4814 	if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4815 		ret = -EINVAL;
4816 		goto error;
4817 	}
4818 
4819 	if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4820 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4821 	    v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4822 		ret = -EINVAL;
4823 		goto error;
4824 	}
4825 
4826 	if (!netif_running(v)) {
4827 		ret = -ENETDOWN;
4828 		goto error;
4829 	}
4830 
4831 	return v;
4832  error:
4833 	dev_put(v);
4834 	return ERR_PTR(ret);
4835 }
4836 
4837 static const struct nla_policy
4838 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4839 	[NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4840 	[NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4841 };
4842 
4843 static int nl80211_parse_sta_wme(struct genl_info *info,
4844 				 struct station_parameters *params)
4845 {
4846 	struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4847 	struct nlattr *nla;
4848 	int err;
4849 
4850 	/* parse WME attributes if present */
4851 	if (!info->attrs[NL80211_ATTR_STA_WME])
4852 		return 0;
4853 
4854 	nla = info->attrs[NL80211_ATTR_STA_WME];
4855 	err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4856 			       nl80211_sta_wme_policy, info->extack);
4857 	if (err)
4858 		return err;
4859 
4860 	if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4861 		params->uapsd_queues = nla_get_u8(
4862 			tb[NL80211_STA_WME_UAPSD_QUEUES]);
4863 	if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4864 		return -EINVAL;
4865 
4866 	if (tb[NL80211_STA_WME_MAX_SP])
4867 		params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4868 
4869 	if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4870 		return -EINVAL;
4871 
4872 	params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4873 
4874 	return 0;
4875 }
4876 
4877 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4878 				      struct station_parameters *params)
4879 {
4880 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4881 		params->supported_channels =
4882 		     nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4883 		params->supported_channels_len =
4884 		     nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4885 		/*
4886 		 * Need to include at least one (first channel, number of
4887 		 * channels) tuple for each subband, and must have proper
4888 		 * tuples for the rest of the data as well.
4889 		 */
4890 		if (params->supported_channels_len < 2)
4891 			return -EINVAL;
4892 		if (params->supported_channels_len % 2)
4893 			return -EINVAL;
4894 	}
4895 
4896 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4897 		params->supported_oper_classes =
4898 		 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4899 		params->supported_oper_classes_len =
4900 		  nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4901 		/*
4902 		 * The value of the Length field of the Supported Operating
4903 		 * Classes element is between 2 and 253.
4904 		 */
4905 		if (params->supported_oper_classes_len < 2 ||
4906 		    params->supported_oper_classes_len > 253)
4907 			return -EINVAL;
4908 	}
4909 	return 0;
4910 }
4911 
4912 static int nl80211_set_station_tdls(struct genl_info *info,
4913 				    struct station_parameters *params)
4914 {
4915 	int err;
4916 	/* Dummy STA entry gets updated once the peer capabilities are known */
4917 	if (info->attrs[NL80211_ATTR_PEER_AID])
4918 		params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4919 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4920 		params->ht_capa =
4921 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4922 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4923 		params->vht_capa =
4924 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4925 
4926 	err = nl80211_parse_sta_channel_info(info, params);
4927 	if (err)
4928 		return err;
4929 
4930 	return nl80211_parse_sta_wme(info, params);
4931 }
4932 
4933 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4934 {
4935 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
4936 	struct net_device *dev = info->user_ptr[1];
4937 	struct station_parameters params;
4938 	u8 *mac_addr;
4939 	int err;
4940 
4941 	memset(&params, 0, sizeof(params));
4942 
4943 	if (!rdev->ops->change_station)
4944 		return -EOPNOTSUPP;
4945 
4946 	/*
4947 	 * AID and listen_interval properties can be set only for unassociated
4948 	 * station. Include these parameters here and will check them in
4949 	 * cfg80211_check_station_change().
4950 	 */
4951 	if (info->attrs[NL80211_ATTR_STA_AID])
4952 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4953 
4954 	if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4955 		params.listen_interval =
4956 		     nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4957 	else
4958 		params.listen_interval = -1;
4959 
4960 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4961 		u8 tmp;
4962 
4963 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4964 		if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4965 			return -EINVAL;
4966 
4967 		params.support_p2p_ps = tmp;
4968 	} else {
4969 		params.support_p2p_ps = -1;
4970 	}
4971 
4972 	if (!info->attrs[NL80211_ATTR_MAC])
4973 		return -EINVAL;
4974 
4975 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4976 
4977 	if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4978 		params.supported_rates =
4979 			nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4980 		params.supported_rates_len =
4981 			nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4982 	}
4983 
4984 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4985 		params.capability =
4986 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4987 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4988 	}
4989 
4990 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4991 		params.ext_capab =
4992 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4993 		params.ext_capab_len =
4994 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4995 	}
4996 
4997 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4998 		return -EINVAL;
4999 
5000 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5001 		params.plink_action =
5002 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5003 		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5004 			return -EINVAL;
5005 	}
5006 
5007 	if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5008 		params.plink_state =
5009 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5010 		if (params.plink_state >= NUM_NL80211_PLINK_STATES)
5011 			return -EINVAL;
5012 		if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
5013 			params.peer_aid = nla_get_u16(
5014 				info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5015 			if (params.peer_aid > IEEE80211_MAX_AID)
5016 				return -EINVAL;
5017 		}
5018 		params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5019 	}
5020 
5021 	if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
5022 		enum nl80211_mesh_power_mode pm = nla_get_u32(
5023 			info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5024 
5025 		if (pm <= NL80211_MESH_POWER_UNKNOWN ||
5026 		    pm > NL80211_MESH_POWER_MAX)
5027 			return -EINVAL;
5028 
5029 		params.local_pm = pm;
5030 	}
5031 
5032 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5033 		params.opmode_notif_used = true;
5034 		params.opmode_notif =
5035 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5036 	}
5037 
5038 	/* Include parameters for TDLS peer (will check later) */
5039 	err = nl80211_set_station_tdls(info, &params);
5040 	if (err)
5041 		return err;
5042 
5043 	params.vlan = get_vlan(info, rdev);
5044 	if (IS_ERR(params.vlan))
5045 		return PTR_ERR(params.vlan);
5046 
5047 	switch (dev->ieee80211_ptr->iftype) {
5048 	case NL80211_IFTYPE_AP:
5049 	case NL80211_IFTYPE_AP_VLAN:
5050 	case NL80211_IFTYPE_P2P_GO:
5051 	case NL80211_IFTYPE_P2P_CLIENT:
5052 	case NL80211_IFTYPE_STATION:
5053 	case NL80211_IFTYPE_ADHOC:
5054 	case NL80211_IFTYPE_MESH_POINT:
5055 		break;
5056 	default:
5057 		err = -EOPNOTSUPP;
5058 		goto out_put_vlan;
5059 	}
5060 
5061 	/* driver will call cfg80211_check_station_change() */
5062 	err = rdev_change_station(rdev, dev, mac_addr, &params);
5063 
5064  out_put_vlan:
5065 	if (params.vlan)
5066 		dev_put(params.vlan);
5067 
5068 	return err;
5069 }
5070 
5071 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5072 {
5073 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5074 	int err;
5075 	struct net_device *dev = info->user_ptr[1];
5076 	struct station_parameters params;
5077 	u8 *mac_addr = NULL;
5078 	u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5079 			 BIT(NL80211_STA_FLAG_ASSOCIATED);
5080 
5081 	memset(&params, 0, sizeof(params));
5082 
5083 	if (!rdev->ops->add_station)
5084 		return -EOPNOTSUPP;
5085 
5086 	if (!info->attrs[NL80211_ATTR_MAC])
5087 		return -EINVAL;
5088 
5089 	if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5090 		return -EINVAL;
5091 
5092 	if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5093 		return -EINVAL;
5094 
5095 	if (!info->attrs[NL80211_ATTR_STA_AID] &&
5096 	    !info->attrs[NL80211_ATTR_PEER_AID])
5097 		return -EINVAL;
5098 
5099 	mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5100 	params.supported_rates =
5101 		nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5102 	params.supported_rates_len =
5103 		nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5104 	params.listen_interval =
5105 		nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5106 
5107 	if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5108 		u8 tmp;
5109 
5110 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5111 		if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5112 			return -EINVAL;
5113 
5114 		params.support_p2p_ps = tmp;
5115 	} else {
5116 		/*
5117 		 * if not specified, assume it's supported for P2P GO interface,
5118 		 * and is NOT supported for AP interface
5119 		 */
5120 		params.support_p2p_ps =
5121 			dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5122 	}
5123 
5124 	if (info->attrs[NL80211_ATTR_PEER_AID])
5125 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5126 	else
5127 		params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5128 	if (!params.aid || params.aid > IEEE80211_MAX_AID)
5129 		return -EINVAL;
5130 
5131 	if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5132 		params.capability =
5133 			nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5134 		params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5135 	}
5136 
5137 	if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5138 		params.ext_capab =
5139 			nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5140 		params.ext_capab_len =
5141 			nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5142 	}
5143 
5144 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5145 		params.ht_capa =
5146 			nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5147 
5148 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5149 		params.vht_capa =
5150 			nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5151 
5152 	if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5153 		params.opmode_notif_used = true;
5154 		params.opmode_notif =
5155 			nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5156 	}
5157 
5158 	if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5159 		params.plink_action =
5160 			nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5161 		if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5162 			return -EINVAL;
5163 	}
5164 
5165 	err = nl80211_parse_sta_channel_info(info, &params);
5166 	if (err)
5167 		return err;
5168 
5169 	err = nl80211_parse_sta_wme(info, &params);
5170 	if (err)
5171 		return err;
5172 
5173 	if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5174 		return -EINVAL;
5175 
5176 	/* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5177 	 * as userspace might just pass through the capabilities from the IEs
5178 	 * directly, rather than enforcing this restriction and returning an
5179 	 * error in this case.
5180 	 */
5181 	if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5182 		params.ht_capa = NULL;
5183 		params.vht_capa = NULL;
5184 	}
5185 
5186 	/* When you run into this, adjust the code below for the new flag */
5187 	BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5188 
5189 	switch (dev->ieee80211_ptr->iftype) {
5190 	case NL80211_IFTYPE_AP:
5191 	case NL80211_IFTYPE_AP_VLAN:
5192 	case NL80211_IFTYPE_P2P_GO:
5193 		/* ignore WME attributes if iface/sta is not capable */
5194 		if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5195 		    !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5196 			params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5197 
5198 		/* TDLS peers cannot be added */
5199 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5200 		    info->attrs[NL80211_ATTR_PEER_AID])
5201 			return -EINVAL;
5202 		/* but don't bother the driver with it */
5203 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5204 
5205 		/* allow authenticated/associated only if driver handles it */
5206 		if (!(rdev->wiphy.features &
5207 				NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5208 		    params.sta_flags_mask & auth_assoc)
5209 			return -EINVAL;
5210 
5211 		/* Older userspace, or userspace wanting to be compatible with
5212 		 * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5213 		 * and assoc flags in the mask, but assumes the station will be
5214 		 * added as associated anyway since this was the required driver
5215 		 * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5216 		 * introduced.
5217 		 * In order to not bother drivers with this quirk in the API
5218 		 * set the flags in both the mask and set for new stations in
5219 		 * this case.
5220 		 */
5221 		if (!(params.sta_flags_mask & auth_assoc)) {
5222 			params.sta_flags_mask |= auth_assoc;
5223 			params.sta_flags_set |= auth_assoc;
5224 		}
5225 
5226 		/* must be last in here for error handling */
5227 		params.vlan = get_vlan(info, rdev);
5228 		if (IS_ERR(params.vlan))
5229 			return PTR_ERR(params.vlan);
5230 		break;
5231 	case NL80211_IFTYPE_MESH_POINT:
5232 		/* ignore uAPSD data */
5233 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5234 
5235 		/* associated is disallowed */
5236 		if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5237 			return -EINVAL;
5238 		/* TDLS peers cannot be added */
5239 		if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5240 		    info->attrs[NL80211_ATTR_PEER_AID])
5241 			return -EINVAL;
5242 		break;
5243 	case NL80211_IFTYPE_STATION:
5244 	case NL80211_IFTYPE_P2P_CLIENT:
5245 		/* ignore uAPSD data */
5246 		params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5247 
5248 		/* these are disallowed */
5249 		if (params.sta_flags_mask &
5250 				(BIT(NL80211_STA_FLAG_ASSOCIATED) |
5251 				 BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5252 			return -EINVAL;
5253 		/* Only TDLS peers can be added */
5254 		if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5255 			return -EINVAL;
5256 		/* Can only add if TDLS ... */
5257 		if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5258 			return -EOPNOTSUPP;
5259 		/* ... with external setup is supported */
5260 		if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5261 			return -EOPNOTSUPP;
5262 		/*
5263 		 * Older wpa_supplicant versions always mark the TDLS peer
5264 		 * as authorized, but it shouldn't yet be.
5265 		 */
5266 		params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5267 		break;
5268 	default:
5269 		return -EOPNOTSUPP;
5270 	}
5271 
5272 	/* be aware of params.vlan when changing code here */
5273 
5274 	err = rdev_add_station(rdev, dev, mac_addr, &params);
5275 
5276 	if (params.vlan)
5277 		dev_put(params.vlan);
5278 	return err;
5279 }
5280 
5281 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5282 {
5283 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5284 	struct net_device *dev = info->user_ptr[1];
5285 	struct station_del_parameters params;
5286 
5287 	memset(&params, 0, sizeof(params));
5288 
5289 	if (info->attrs[NL80211_ATTR_MAC])
5290 		params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5291 
5292 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5293 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5294 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5295 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5296 		return -EINVAL;
5297 
5298 	if (!rdev->ops->del_station)
5299 		return -EOPNOTSUPP;
5300 
5301 	if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5302 		params.subtype =
5303 			nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5304 		if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5305 		    params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5306 			return -EINVAL;
5307 	} else {
5308 		/* Default to Deauthentication frame */
5309 		params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5310 	}
5311 
5312 	if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5313 		params.reason_code =
5314 			nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5315 		if (params.reason_code == 0)
5316 			return -EINVAL; /* 0 is reserved */
5317 	} else {
5318 		/* Default to reason code 2 */
5319 		params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5320 	}
5321 
5322 	return rdev_del_station(rdev, dev, &params);
5323 }
5324 
5325 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5326 				int flags, struct net_device *dev,
5327 				u8 *dst, u8 *next_hop,
5328 				struct mpath_info *pinfo)
5329 {
5330 	void *hdr;
5331 	struct nlattr *pinfoattr;
5332 
5333 	hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5334 	if (!hdr)
5335 		return -1;
5336 
5337 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5338 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5339 	    nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5340 	    nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5341 		goto nla_put_failure;
5342 
5343 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5344 	if (!pinfoattr)
5345 		goto nla_put_failure;
5346 	if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5347 	    nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5348 			pinfo->frame_qlen))
5349 		goto nla_put_failure;
5350 	if (((pinfo->filled & MPATH_INFO_SN) &&
5351 	     nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5352 	    ((pinfo->filled & MPATH_INFO_METRIC) &&
5353 	     nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5354 			 pinfo->metric)) ||
5355 	    ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5356 	     nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5357 			 pinfo->exptime)) ||
5358 	    ((pinfo->filled & MPATH_INFO_FLAGS) &&
5359 	     nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5360 			pinfo->flags)) ||
5361 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5362 	     nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5363 			 pinfo->discovery_timeout)) ||
5364 	    ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5365 	     nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5366 			pinfo->discovery_retries)))
5367 		goto nla_put_failure;
5368 
5369 	nla_nest_end(msg, pinfoattr);
5370 
5371 	genlmsg_end(msg, hdr);
5372 	return 0;
5373 
5374  nla_put_failure:
5375 	genlmsg_cancel(msg, hdr);
5376 	return -EMSGSIZE;
5377 }
5378 
5379 static int nl80211_dump_mpath(struct sk_buff *skb,
5380 			      struct netlink_callback *cb)
5381 {
5382 	struct mpath_info pinfo;
5383 	struct cfg80211_registered_device *rdev;
5384 	struct wireless_dev *wdev;
5385 	u8 dst[ETH_ALEN];
5386 	u8 next_hop[ETH_ALEN];
5387 	int path_idx = cb->args[2];
5388 	int err;
5389 
5390 	rtnl_lock();
5391 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5392 	if (err)
5393 		goto out_err;
5394 
5395 	if (!rdev->ops->dump_mpath) {
5396 		err = -EOPNOTSUPP;
5397 		goto out_err;
5398 	}
5399 
5400 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5401 		err = -EOPNOTSUPP;
5402 		goto out_err;
5403 	}
5404 
5405 	while (1) {
5406 		err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5407 				      next_hop, &pinfo);
5408 		if (err == -ENOENT)
5409 			break;
5410 		if (err)
5411 			goto out_err;
5412 
5413 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5414 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
5415 				       wdev->netdev, dst, next_hop,
5416 				       &pinfo) < 0)
5417 			goto out;
5418 
5419 		path_idx++;
5420 	}
5421 
5422  out:
5423 	cb->args[2] = path_idx;
5424 	err = skb->len;
5425  out_err:
5426 	rtnl_unlock();
5427 	return err;
5428 }
5429 
5430 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5431 {
5432 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5433 	int err;
5434 	struct net_device *dev = info->user_ptr[1];
5435 	struct mpath_info pinfo;
5436 	struct sk_buff *msg;
5437 	u8 *dst = NULL;
5438 	u8 next_hop[ETH_ALEN];
5439 
5440 	memset(&pinfo, 0, sizeof(pinfo));
5441 
5442 	if (!info->attrs[NL80211_ATTR_MAC])
5443 		return -EINVAL;
5444 
5445 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5446 
5447 	if (!rdev->ops->get_mpath)
5448 		return -EOPNOTSUPP;
5449 
5450 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5451 		return -EOPNOTSUPP;
5452 
5453 	err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5454 	if (err)
5455 		return err;
5456 
5457 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5458 	if (!msg)
5459 		return -ENOMEM;
5460 
5461 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5462 				 dev, dst, next_hop, &pinfo) < 0) {
5463 		nlmsg_free(msg);
5464 		return -ENOBUFS;
5465 	}
5466 
5467 	return genlmsg_reply(msg, info);
5468 }
5469 
5470 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5471 {
5472 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5473 	struct net_device *dev = info->user_ptr[1];
5474 	u8 *dst = NULL;
5475 	u8 *next_hop = NULL;
5476 
5477 	if (!info->attrs[NL80211_ATTR_MAC])
5478 		return -EINVAL;
5479 
5480 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5481 		return -EINVAL;
5482 
5483 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5484 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5485 
5486 	if (!rdev->ops->change_mpath)
5487 		return -EOPNOTSUPP;
5488 
5489 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5490 		return -EOPNOTSUPP;
5491 
5492 	return rdev_change_mpath(rdev, dev, dst, next_hop);
5493 }
5494 
5495 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5496 {
5497 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5498 	struct net_device *dev = info->user_ptr[1];
5499 	u8 *dst = NULL;
5500 	u8 *next_hop = NULL;
5501 
5502 	if (!info->attrs[NL80211_ATTR_MAC])
5503 		return -EINVAL;
5504 
5505 	if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5506 		return -EINVAL;
5507 
5508 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5509 	next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5510 
5511 	if (!rdev->ops->add_mpath)
5512 		return -EOPNOTSUPP;
5513 
5514 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5515 		return -EOPNOTSUPP;
5516 
5517 	return rdev_add_mpath(rdev, dev, dst, next_hop);
5518 }
5519 
5520 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5521 {
5522 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5523 	struct net_device *dev = info->user_ptr[1];
5524 	u8 *dst = NULL;
5525 
5526 	if (info->attrs[NL80211_ATTR_MAC])
5527 		dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5528 
5529 	if (!rdev->ops->del_mpath)
5530 		return -EOPNOTSUPP;
5531 
5532 	return rdev_del_mpath(rdev, dev, dst);
5533 }
5534 
5535 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5536 {
5537 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5538 	int err;
5539 	struct net_device *dev = info->user_ptr[1];
5540 	struct mpath_info pinfo;
5541 	struct sk_buff *msg;
5542 	u8 *dst = NULL;
5543 	u8 mpp[ETH_ALEN];
5544 
5545 	memset(&pinfo, 0, sizeof(pinfo));
5546 
5547 	if (!info->attrs[NL80211_ATTR_MAC])
5548 		return -EINVAL;
5549 
5550 	dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5551 
5552 	if (!rdev->ops->get_mpp)
5553 		return -EOPNOTSUPP;
5554 
5555 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5556 		return -EOPNOTSUPP;
5557 
5558 	err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5559 	if (err)
5560 		return err;
5561 
5562 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5563 	if (!msg)
5564 		return -ENOMEM;
5565 
5566 	if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5567 			       dev, dst, mpp, &pinfo) < 0) {
5568 		nlmsg_free(msg);
5569 		return -ENOBUFS;
5570 	}
5571 
5572 	return genlmsg_reply(msg, info);
5573 }
5574 
5575 static int nl80211_dump_mpp(struct sk_buff *skb,
5576 			    struct netlink_callback *cb)
5577 {
5578 	struct mpath_info pinfo;
5579 	struct cfg80211_registered_device *rdev;
5580 	struct wireless_dev *wdev;
5581 	u8 dst[ETH_ALEN];
5582 	u8 mpp[ETH_ALEN];
5583 	int path_idx = cb->args[2];
5584 	int err;
5585 
5586 	rtnl_lock();
5587 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5588 	if (err)
5589 		goto out_err;
5590 
5591 	if (!rdev->ops->dump_mpp) {
5592 		err = -EOPNOTSUPP;
5593 		goto out_err;
5594 	}
5595 
5596 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5597 		err = -EOPNOTSUPP;
5598 		goto out_err;
5599 	}
5600 
5601 	while (1) {
5602 		err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5603 				    mpp, &pinfo);
5604 		if (err == -ENOENT)
5605 			break;
5606 		if (err)
5607 			goto out_err;
5608 
5609 		if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5610 				       cb->nlh->nlmsg_seq, NLM_F_MULTI,
5611 				       wdev->netdev, dst, mpp,
5612 				       &pinfo) < 0)
5613 			goto out;
5614 
5615 		path_idx++;
5616 	}
5617 
5618  out:
5619 	cb->args[2] = path_idx;
5620 	err = skb->len;
5621  out_err:
5622 	rtnl_unlock();
5623 	return err;
5624 }
5625 
5626 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5627 {
5628 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5629 	struct net_device *dev = info->user_ptr[1];
5630 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5631 	struct bss_parameters params;
5632 	int err;
5633 
5634 	memset(&params, 0, sizeof(params));
5635 	/* default to not changing parameters */
5636 	params.use_cts_prot = -1;
5637 	params.use_short_preamble = -1;
5638 	params.use_short_slot_time = -1;
5639 	params.ap_isolate = -1;
5640 	params.ht_opmode = -1;
5641 	params.p2p_ctwindow = -1;
5642 	params.p2p_opp_ps = -1;
5643 
5644 	if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5645 		params.use_cts_prot =
5646 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5647 	if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5648 		params.use_short_preamble =
5649 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5650 	if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5651 		params.use_short_slot_time =
5652 		    nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5653 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5654 		params.basic_rates =
5655 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5656 		params.basic_rates_len =
5657 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5658 	}
5659 	if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5660 		params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5661 	if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5662 		params.ht_opmode =
5663 			nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5664 
5665 	if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5666 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5667 			return -EINVAL;
5668 		params.p2p_ctwindow =
5669 			nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5670 		if (params.p2p_ctwindow < 0)
5671 			return -EINVAL;
5672 		if (params.p2p_ctwindow != 0 &&
5673 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5674 			return -EINVAL;
5675 	}
5676 
5677 	if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5678 		u8 tmp;
5679 
5680 		if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5681 			return -EINVAL;
5682 		tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5683 		if (tmp > 1)
5684 			return -EINVAL;
5685 		params.p2p_opp_ps = tmp;
5686 		if (params.p2p_opp_ps &&
5687 		    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5688 			return -EINVAL;
5689 	}
5690 
5691 	if (!rdev->ops->change_bss)
5692 		return -EOPNOTSUPP;
5693 
5694 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5695 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5696 		return -EOPNOTSUPP;
5697 
5698 	wdev_lock(wdev);
5699 	err = rdev_change_bss(rdev, dev, &params);
5700 	wdev_unlock(wdev);
5701 
5702 	return err;
5703 }
5704 
5705 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5706 {
5707 	char *data = NULL;
5708 	bool is_indoor;
5709 	enum nl80211_user_reg_hint_type user_reg_hint_type;
5710 	u32 owner_nlportid;
5711 
5712 	/*
5713 	 * You should only get this when cfg80211 hasn't yet initialized
5714 	 * completely when built-in to the kernel right between the time
5715 	 * window between nl80211_init() and regulatory_init(), if that is
5716 	 * even possible.
5717 	 */
5718 	if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5719 		return -EINPROGRESS;
5720 
5721 	if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5722 		user_reg_hint_type =
5723 		  nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5724 	else
5725 		user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5726 
5727 	switch (user_reg_hint_type) {
5728 	case NL80211_USER_REG_HINT_USER:
5729 	case NL80211_USER_REG_HINT_CELL_BASE:
5730 		if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5731 			return -EINVAL;
5732 
5733 		data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5734 		return regulatory_hint_user(data, user_reg_hint_type);
5735 	case NL80211_USER_REG_HINT_INDOOR:
5736 		if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5737 			owner_nlportid = info->snd_portid;
5738 			is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5739 		} else {
5740 			owner_nlportid = 0;
5741 			is_indoor = true;
5742 		}
5743 
5744 		return regulatory_hint_indoor(is_indoor, owner_nlportid);
5745 	default:
5746 		return -EINVAL;
5747 	}
5748 }
5749 
5750 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
5751 {
5752 	return reg_reload_regdb();
5753 }
5754 
5755 static int nl80211_get_mesh_config(struct sk_buff *skb,
5756 				   struct genl_info *info)
5757 {
5758 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
5759 	struct net_device *dev = info->user_ptr[1];
5760 	struct wireless_dev *wdev = dev->ieee80211_ptr;
5761 	struct mesh_config cur_params;
5762 	int err = 0;
5763 	void *hdr;
5764 	struct nlattr *pinfoattr;
5765 	struct sk_buff *msg;
5766 
5767 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5768 		return -EOPNOTSUPP;
5769 
5770 	if (!rdev->ops->get_mesh_config)
5771 		return -EOPNOTSUPP;
5772 
5773 	wdev_lock(wdev);
5774 	/* If not connected, get default parameters */
5775 	if (!wdev->mesh_id_len)
5776 		memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5777 	else
5778 		err = rdev_get_mesh_config(rdev, dev, &cur_params);
5779 	wdev_unlock(wdev);
5780 
5781 	if (err)
5782 		return err;
5783 
5784 	/* Draw up a netlink message to send back */
5785 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5786 	if (!msg)
5787 		return -ENOMEM;
5788 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5789 			     NL80211_CMD_GET_MESH_CONFIG);
5790 	if (!hdr)
5791 		goto out;
5792 	pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5793 	if (!pinfoattr)
5794 		goto nla_put_failure;
5795 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5796 	    nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5797 			cur_params.dot11MeshRetryTimeout) ||
5798 	    nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5799 			cur_params.dot11MeshConfirmTimeout) ||
5800 	    nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5801 			cur_params.dot11MeshHoldingTimeout) ||
5802 	    nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5803 			cur_params.dot11MeshMaxPeerLinks) ||
5804 	    nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5805 		       cur_params.dot11MeshMaxRetries) ||
5806 	    nla_put_u8(msg, NL80211_MESHCONF_TTL,
5807 		       cur_params.dot11MeshTTL) ||
5808 	    nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5809 		       cur_params.element_ttl) ||
5810 	    nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5811 		       cur_params.auto_open_plinks) ||
5812 	    nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5813 			cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5814 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5815 		       cur_params.dot11MeshHWMPmaxPREQretries) ||
5816 	    nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5817 			cur_params.path_refresh_time) ||
5818 	    nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5819 			cur_params.min_discovery_timeout) ||
5820 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5821 			cur_params.dot11MeshHWMPactivePathTimeout) ||
5822 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5823 			cur_params.dot11MeshHWMPpreqMinInterval) ||
5824 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5825 			cur_params.dot11MeshHWMPperrMinInterval) ||
5826 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5827 			cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5828 	    nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5829 		       cur_params.dot11MeshHWMPRootMode) ||
5830 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5831 			cur_params.dot11MeshHWMPRannInterval) ||
5832 	    nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5833 		       cur_params.dot11MeshGateAnnouncementProtocol) ||
5834 	    nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5835 		       cur_params.dot11MeshForwarding) ||
5836 	    nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5837 			cur_params.rssi_threshold) ||
5838 	    nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5839 			cur_params.ht_opmode) ||
5840 	    nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5841 			cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5842 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5843 			cur_params.dot11MeshHWMProotInterval) ||
5844 	    nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5845 			cur_params.dot11MeshHWMPconfirmationInterval) ||
5846 	    nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5847 			cur_params.power_mode) ||
5848 	    nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5849 			cur_params.dot11MeshAwakeWindowDuration) ||
5850 	    nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5851 			cur_params.plink_timeout))
5852 		goto nla_put_failure;
5853 	nla_nest_end(msg, pinfoattr);
5854 	genlmsg_end(msg, hdr);
5855 	return genlmsg_reply(msg, info);
5856 
5857  nla_put_failure:
5858  out:
5859 	nlmsg_free(msg);
5860 	return -ENOBUFS;
5861 }
5862 
5863 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5864 	[NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5865 	[NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5866 	[NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5867 	[NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5868 	[NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5869 	[NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5870 	[NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5871 	[NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5872 	[NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5873 	[NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5874 	[NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5875 	[NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5876 	[NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5877 	[NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5878 	[NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5879 	[NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5880 	[NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5881 	[NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5882 	[NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5883 	[NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5884 	[NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5885 	[NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5886 	[NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5887 	[NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5888 	[NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5889 	[NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5890 	[NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5891 	[NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5892 };
5893 
5894 static const struct nla_policy
5895 	nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5896 	[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5897 	[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5898 	[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5899 	[NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5900 	[NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5901 	[NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5902 	[NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5903 				    .len = IEEE80211_MAX_DATA_LEN },
5904 	[NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5905 };
5906 
5907 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5908 {
5909 	u8 val = nla_get_u8(nla);
5910 	if (val < min || val > max)
5911 		return -EINVAL;
5912 	*out = val;
5913 	return 0;
5914 }
5915 
5916 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5917 {
5918 	u8 val = nla_get_u8(nla);
5919 	if (val < min || val > max)
5920 		return -EINVAL;
5921 	*out = val;
5922 	return 0;
5923 }
5924 
5925 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5926 {
5927 	u16 val = nla_get_u16(nla);
5928 	if (val < min || val > max)
5929 		return -EINVAL;
5930 	*out = val;
5931 	return 0;
5932 }
5933 
5934 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5935 {
5936 	u32 val = nla_get_u32(nla);
5937 	if (val < min || val > max)
5938 		return -EINVAL;
5939 	*out = val;
5940 	return 0;
5941 }
5942 
5943 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5944 {
5945 	s32 val = nla_get_s32(nla);
5946 	if (val < min || val > max)
5947 		return -EINVAL;
5948 	*out = val;
5949 	return 0;
5950 }
5951 
5952 static int nl80211_check_power_mode(const struct nlattr *nla,
5953 				    enum nl80211_mesh_power_mode min,
5954 				    enum nl80211_mesh_power_mode max,
5955 				    enum nl80211_mesh_power_mode *out)
5956 {
5957 	u32 val = nla_get_u32(nla);
5958 	if (val < min || val > max)
5959 		return -EINVAL;
5960 	*out = val;
5961 	return 0;
5962 }
5963 
5964 static int nl80211_parse_mesh_config(struct genl_info *info,
5965 				     struct mesh_config *cfg,
5966 				     u32 *mask_out)
5967 {
5968 	struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5969 	u32 mask = 0;
5970 	u16 ht_opmode;
5971 
5972 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5973 do {									    \
5974 	if (tb[attr]) {							    \
5975 		if (fn(tb[attr], min, max, &cfg->param))		    \
5976 			return -EINVAL;					    \
5977 		mask |= (1 << (attr - 1));				    \
5978 	}								    \
5979 } while (0)
5980 
5981 	if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5982 		return -EINVAL;
5983 	if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5984 			     info->attrs[NL80211_ATTR_MESH_CONFIG],
5985 			     nl80211_meshconf_params_policy, info->extack))
5986 		return -EINVAL;
5987 
5988 	/* This makes sure that there aren't more than 32 mesh config
5989 	 * parameters (otherwise our bitfield scheme would not work.) */
5990 	BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5991 
5992 	/* Fill in the params struct */
5993 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5994 				  mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5995 				  nl80211_check_u16);
5996 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5997 				  mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5998 				  nl80211_check_u16);
5999 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
6000 				  mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
6001 				  nl80211_check_u16);
6002 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
6003 				  mask, NL80211_MESHCONF_MAX_PEER_LINKS,
6004 				  nl80211_check_u16);
6005 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
6006 				  mask, NL80211_MESHCONF_MAX_RETRIES,
6007 				  nl80211_check_u8);
6008 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
6009 				  mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
6010 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
6011 				  mask, NL80211_MESHCONF_ELEMENT_TTL,
6012 				  nl80211_check_u8);
6013 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
6014 				  mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6015 				  nl80211_check_bool);
6016 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6017 				  1, 255, mask,
6018 				  NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6019 				  nl80211_check_u32);
6020 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
6021 				  mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6022 				  nl80211_check_u8);
6023 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
6024 				  mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
6025 				  nl80211_check_u32);
6026 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
6027 				  mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6028 				  nl80211_check_u16);
6029 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6030 				  1, 65535, mask,
6031 				  NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6032 				  nl80211_check_u32);
6033 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
6034 				  1, 65535, mask,
6035 				  NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6036 				  nl80211_check_u16);
6037 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6038 				  1, 65535, mask,
6039 				  NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6040 				  nl80211_check_u16);
6041 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6042 				  dot11MeshHWMPnetDiameterTraversalTime,
6043 				  1, 65535, mask,
6044 				  NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6045 				  nl80211_check_u16);
6046 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6047 				  mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6048 				  nl80211_check_u8);
6049 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6050 				  mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6051 				  nl80211_check_u16);
6052 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6053 				  dot11MeshGateAnnouncementProtocol, 0, 1,
6054 				  mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6055 				  nl80211_check_bool);
6056 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6057 				  mask, NL80211_MESHCONF_FORWARDING,
6058 				  nl80211_check_bool);
6059 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6060 				  mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6061 				  nl80211_check_s32);
6062 	/*
6063 	 * Check HT operation mode based on
6064 	 * IEEE 802.11 2012 8.4.2.59 HT Operation element.
6065 	 */
6066 	if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6067 		ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6068 
6069 		if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6070 				  IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6071 				  IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6072 			return -EINVAL;
6073 
6074 		if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
6075 		    (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6076 			return -EINVAL;
6077 
6078 		switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
6079 		case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
6080 		case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
6081 			if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
6082 				return -EINVAL;
6083 			break;
6084 		case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
6085 		case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
6086 			if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6087 				return -EINVAL;
6088 			break;
6089 		}
6090 		cfg->ht_opmode = ht_opmode;
6091 		mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6092 	}
6093 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6094 				  1, 65535, mask,
6095 				  NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6096 				  nl80211_check_u32);
6097 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6098 				  mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6099 				  nl80211_check_u16);
6100 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6101 				  dot11MeshHWMPconfirmationInterval,
6102 				  1, 65535, mask,
6103 				  NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6104 				  nl80211_check_u16);
6105 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6106 				  NL80211_MESH_POWER_ACTIVE,
6107 				  NL80211_MESH_POWER_MAX,
6108 				  mask, NL80211_MESHCONF_POWER_MODE,
6109 				  nl80211_check_power_mode);
6110 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6111 				  0, 65535, mask,
6112 				  NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6113 	FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6114 				  mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6115 				  nl80211_check_u32);
6116 	if (mask_out)
6117 		*mask_out = mask;
6118 
6119 	return 0;
6120 
6121 #undef FILL_IN_MESH_PARAM_IF_SET
6122 }
6123 
6124 static int nl80211_parse_mesh_setup(struct genl_info *info,
6125 				     struct mesh_setup *setup)
6126 {
6127 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6128 	struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6129 
6130 	if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6131 		return -EINVAL;
6132 	if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6133 			     info->attrs[NL80211_ATTR_MESH_SETUP],
6134 			     nl80211_mesh_setup_params_policy, info->extack))
6135 		return -EINVAL;
6136 
6137 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6138 		setup->sync_method =
6139 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6140 		 IEEE80211_SYNC_METHOD_VENDOR :
6141 		 IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6142 
6143 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6144 		setup->path_sel_proto =
6145 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6146 		 IEEE80211_PATH_PROTOCOL_VENDOR :
6147 		 IEEE80211_PATH_PROTOCOL_HWMP;
6148 
6149 	if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6150 		setup->path_metric =
6151 		(nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6152 		 IEEE80211_PATH_METRIC_VENDOR :
6153 		 IEEE80211_PATH_METRIC_AIRTIME;
6154 
6155 	if (tb[NL80211_MESH_SETUP_IE]) {
6156 		struct nlattr *ieattr =
6157 			tb[NL80211_MESH_SETUP_IE];
6158 		if (!is_valid_ie_attr(ieattr))
6159 			return -EINVAL;
6160 		setup->ie = nla_data(ieattr);
6161 		setup->ie_len = nla_len(ieattr);
6162 	}
6163 	if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6164 	    !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6165 		return -EINVAL;
6166 	setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6167 	setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6168 	setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6169 	if (setup->is_secure)
6170 		setup->user_mpm = true;
6171 
6172 	if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6173 		if (!setup->user_mpm)
6174 			return -EINVAL;
6175 		setup->auth_id =
6176 			nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6177 	}
6178 
6179 	return 0;
6180 }
6181 
6182 static int nl80211_update_mesh_config(struct sk_buff *skb,
6183 				      struct genl_info *info)
6184 {
6185 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6186 	struct net_device *dev = info->user_ptr[1];
6187 	struct wireless_dev *wdev = dev->ieee80211_ptr;
6188 	struct mesh_config cfg;
6189 	u32 mask;
6190 	int err;
6191 
6192 	if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6193 		return -EOPNOTSUPP;
6194 
6195 	if (!rdev->ops->update_mesh_config)
6196 		return -EOPNOTSUPP;
6197 
6198 	err = nl80211_parse_mesh_config(info, &cfg, &mask);
6199 	if (err)
6200 		return err;
6201 
6202 	wdev_lock(wdev);
6203 	if (!wdev->mesh_id_len)
6204 		err = -ENOLINK;
6205 
6206 	if (!err)
6207 		err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6208 
6209 	wdev_unlock(wdev);
6210 
6211 	return err;
6212 }
6213 
6214 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6215 			      struct sk_buff *msg)
6216 {
6217 	struct nlattr *nl_reg_rules;
6218 	unsigned int i;
6219 
6220 	if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6221 	    (regdom->dfs_region &&
6222 	     nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6223 		goto nla_put_failure;
6224 
6225 	nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6226 	if (!nl_reg_rules)
6227 		goto nla_put_failure;
6228 
6229 	for (i = 0; i < regdom->n_reg_rules; i++) {
6230 		struct nlattr *nl_reg_rule;
6231 		const struct ieee80211_reg_rule *reg_rule;
6232 		const struct ieee80211_freq_range *freq_range;
6233 		const struct ieee80211_power_rule *power_rule;
6234 		unsigned int max_bandwidth_khz;
6235 
6236 		reg_rule = &regdom->reg_rules[i];
6237 		freq_range = &reg_rule->freq_range;
6238 		power_rule = &reg_rule->power_rule;
6239 
6240 		nl_reg_rule = nla_nest_start(msg, i);
6241 		if (!nl_reg_rule)
6242 			goto nla_put_failure;
6243 
6244 		max_bandwidth_khz = freq_range->max_bandwidth_khz;
6245 		if (!max_bandwidth_khz)
6246 			max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6247 								  reg_rule);
6248 
6249 		if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6250 				reg_rule->flags) ||
6251 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6252 				freq_range->start_freq_khz) ||
6253 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6254 				freq_range->end_freq_khz) ||
6255 		    nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6256 				max_bandwidth_khz) ||
6257 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6258 				power_rule->max_antenna_gain) ||
6259 		    nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6260 				power_rule->max_eirp) ||
6261 		    nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6262 				reg_rule->dfs_cac_ms))
6263 			goto nla_put_failure;
6264 
6265 		nla_nest_end(msg, nl_reg_rule);
6266 	}
6267 
6268 	nla_nest_end(msg, nl_reg_rules);
6269 	return 0;
6270 
6271 nla_put_failure:
6272 	return -EMSGSIZE;
6273 }
6274 
6275 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6276 {
6277 	const struct ieee80211_regdomain *regdom = NULL;
6278 	struct cfg80211_registered_device *rdev;
6279 	struct wiphy *wiphy = NULL;
6280 	struct sk_buff *msg;
6281 	void *hdr;
6282 
6283 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6284 	if (!msg)
6285 		return -ENOBUFS;
6286 
6287 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6288 			     NL80211_CMD_GET_REG);
6289 	if (!hdr)
6290 		goto put_failure;
6291 
6292 	if (info->attrs[NL80211_ATTR_WIPHY]) {
6293 		bool self_managed;
6294 
6295 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6296 		if (IS_ERR(rdev)) {
6297 			nlmsg_free(msg);
6298 			return PTR_ERR(rdev);
6299 		}
6300 
6301 		wiphy = &rdev->wiphy;
6302 		self_managed = wiphy->regulatory_flags &
6303 			       REGULATORY_WIPHY_SELF_MANAGED;
6304 		regdom = get_wiphy_regdom(wiphy);
6305 
6306 		/* a self-managed-reg device must have a private regdom */
6307 		if (WARN_ON(!regdom && self_managed)) {
6308 			nlmsg_free(msg);
6309 			return -EINVAL;
6310 		}
6311 
6312 		if (regdom &&
6313 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6314 			goto nla_put_failure;
6315 	}
6316 
6317 	if (!wiphy && reg_last_request_cell_base() &&
6318 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6319 			NL80211_USER_REG_HINT_CELL_BASE))
6320 		goto nla_put_failure;
6321 
6322 	rcu_read_lock();
6323 
6324 	if (!regdom)
6325 		regdom = rcu_dereference(cfg80211_regdomain);
6326 
6327 	if (nl80211_put_regdom(regdom, msg))
6328 		goto nla_put_failure_rcu;
6329 
6330 	rcu_read_unlock();
6331 
6332 	genlmsg_end(msg, hdr);
6333 	return genlmsg_reply(msg, info);
6334 
6335 nla_put_failure_rcu:
6336 	rcu_read_unlock();
6337 nla_put_failure:
6338 put_failure:
6339 	nlmsg_free(msg);
6340 	return -EMSGSIZE;
6341 }
6342 
6343 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6344 			       u32 seq, int flags, struct wiphy *wiphy,
6345 			       const struct ieee80211_regdomain *regdom)
6346 {
6347 	void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6348 				   NL80211_CMD_GET_REG);
6349 
6350 	if (!hdr)
6351 		return -1;
6352 
6353 	genl_dump_check_consistent(cb, hdr);
6354 
6355 	if (nl80211_put_regdom(regdom, msg))
6356 		goto nla_put_failure;
6357 
6358 	if (!wiphy && reg_last_request_cell_base() &&
6359 	    nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6360 			NL80211_USER_REG_HINT_CELL_BASE))
6361 		goto nla_put_failure;
6362 
6363 	if (wiphy &&
6364 	    nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6365 		goto nla_put_failure;
6366 
6367 	if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6368 	    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6369 		goto nla_put_failure;
6370 
6371 	genlmsg_end(msg, hdr);
6372 	return 0;
6373 
6374 nla_put_failure:
6375 	genlmsg_cancel(msg, hdr);
6376 	return -EMSGSIZE;
6377 }
6378 
6379 static int nl80211_get_reg_dump(struct sk_buff *skb,
6380 				struct netlink_callback *cb)
6381 {
6382 	const struct ieee80211_regdomain *regdom = NULL;
6383 	struct cfg80211_registered_device *rdev;
6384 	int err, reg_idx, start = cb->args[2];
6385 
6386 	rtnl_lock();
6387 
6388 	if (cfg80211_regdomain && start == 0) {
6389 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6390 					  NLM_F_MULTI, NULL,
6391 					  rtnl_dereference(cfg80211_regdomain));
6392 		if (err < 0)
6393 			goto out_err;
6394 	}
6395 
6396 	/* the global regdom is idx 0 */
6397 	reg_idx = 1;
6398 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6399 		regdom = get_wiphy_regdom(&rdev->wiphy);
6400 		if (!regdom)
6401 			continue;
6402 
6403 		if (++reg_idx <= start)
6404 			continue;
6405 
6406 		err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6407 					  NLM_F_MULTI, &rdev->wiphy, regdom);
6408 		if (err < 0) {
6409 			reg_idx--;
6410 			break;
6411 		}
6412 	}
6413 
6414 	cb->args[2] = reg_idx;
6415 	err = skb->len;
6416 out_err:
6417 	rtnl_unlock();
6418 	return err;
6419 }
6420 
6421 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6422 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6423 	[NL80211_ATTR_REG_RULE_FLAGS]		= { .type = NLA_U32 },
6424 	[NL80211_ATTR_FREQ_RANGE_START]		= { .type = NLA_U32 },
6425 	[NL80211_ATTR_FREQ_RANGE_END]		= { .type = NLA_U32 },
6426 	[NL80211_ATTR_FREQ_RANGE_MAX_BW]	= { .type = NLA_U32 },
6427 	[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]	= { .type = NLA_U32 },
6428 	[NL80211_ATTR_POWER_RULE_MAX_EIRP]	= { .type = NLA_U32 },
6429 	[NL80211_ATTR_DFS_CAC_TIME]		= { .type = NLA_U32 },
6430 };
6431 
6432 static int parse_reg_rule(struct nlattr *tb[],
6433 	struct ieee80211_reg_rule *reg_rule)
6434 {
6435 	struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6436 	struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6437 
6438 	if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6439 		return -EINVAL;
6440 	if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6441 		return -EINVAL;
6442 	if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6443 		return -EINVAL;
6444 	if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6445 		return -EINVAL;
6446 	if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6447 		return -EINVAL;
6448 
6449 	reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6450 
6451 	freq_range->start_freq_khz =
6452 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6453 	freq_range->end_freq_khz =
6454 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6455 	freq_range->max_bandwidth_khz =
6456 		nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6457 
6458 	power_rule->max_eirp =
6459 		nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6460 
6461 	if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6462 		power_rule->max_antenna_gain =
6463 			nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6464 
6465 	if (tb[NL80211_ATTR_DFS_CAC_TIME])
6466 		reg_rule->dfs_cac_ms =
6467 			nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6468 
6469 	return 0;
6470 }
6471 
6472 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6473 {
6474 	struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6475 	struct nlattr *nl_reg_rule;
6476 	char *alpha2;
6477 	int rem_reg_rules, r;
6478 	u32 num_rules = 0, rule_idx = 0, size_of_regd;
6479 	enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6480 	struct ieee80211_regdomain *rd;
6481 
6482 	if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6483 		return -EINVAL;
6484 
6485 	if (!info->attrs[NL80211_ATTR_REG_RULES])
6486 		return -EINVAL;
6487 
6488 	alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6489 
6490 	if (info->attrs[NL80211_ATTR_DFS_REGION])
6491 		dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6492 
6493 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6494 			    rem_reg_rules) {
6495 		num_rules++;
6496 		if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6497 			return -EINVAL;
6498 	}
6499 
6500 	if (!reg_is_valid_request(alpha2))
6501 		return -EINVAL;
6502 
6503 	size_of_regd = sizeof(struct ieee80211_regdomain) +
6504 		       num_rules * sizeof(struct ieee80211_reg_rule);
6505 
6506 	rd = kzalloc(size_of_regd, GFP_KERNEL);
6507 	if (!rd)
6508 		return -ENOMEM;
6509 
6510 	rd->n_reg_rules = num_rules;
6511 	rd->alpha2[0] = alpha2[0];
6512 	rd->alpha2[1] = alpha2[1];
6513 
6514 	/*
6515 	 * Disable DFS master mode if the DFS region was
6516 	 * not supported or known on this kernel.
6517 	 */
6518 	if (reg_supported_dfs_region(dfs_region))
6519 		rd->dfs_region = dfs_region;
6520 
6521 	nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6522 			    rem_reg_rules) {
6523 		r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6524 				     nl_reg_rule, reg_rule_policy,
6525 				     info->extack);
6526 		if (r)
6527 			goto bad_reg;
6528 		r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6529 		if (r)
6530 			goto bad_reg;
6531 
6532 		rule_idx++;
6533 
6534 		if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6535 			r = -EINVAL;
6536 			goto bad_reg;
6537 		}
6538 	}
6539 
6540 	/* set_regdom takes ownership of rd */
6541 	return set_regdom(rd, REGD_SOURCE_CRDA);
6542  bad_reg:
6543 	kfree(rd);
6544 	return r;
6545 }
6546 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6547 
6548 static int validate_scan_freqs(struct nlattr *freqs)
6549 {
6550 	struct nlattr *attr1, *attr2;
6551 	int n_channels = 0, tmp1, tmp2;
6552 
6553 	nla_for_each_nested(attr1, freqs, tmp1)
6554 		if (nla_len(attr1) != sizeof(u32))
6555 			return 0;
6556 
6557 	nla_for_each_nested(attr1, freqs, tmp1) {
6558 		n_channels++;
6559 		/*
6560 		 * Some hardware has a limited channel list for
6561 		 * scanning, and it is pretty much nonsensical
6562 		 * to scan for a channel twice, so disallow that
6563 		 * and don't require drivers to check that the
6564 		 * channel list they get isn't longer than what
6565 		 * they can scan, as long as they can scan all
6566 		 * the channels they registered at once.
6567 		 */
6568 		nla_for_each_nested(attr2, freqs, tmp2)
6569 			if (attr1 != attr2 &&
6570 			    nla_get_u32(attr1) == nla_get_u32(attr2))
6571 				return 0;
6572 	}
6573 
6574 	return n_channels;
6575 }
6576 
6577 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6578 {
6579 	return b < NUM_NL80211_BANDS && wiphy->bands[b];
6580 }
6581 
6582 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6583 			    struct cfg80211_bss_selection *bss_select)
6584 {
6585 	struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6586 	struct nlattr *nest;
6587 	int err;
6588 	bool found = false;
6589 	int i;
6590 
6591 	/* only process one nested attribute */
6592 	nest = nla_data(nla);
6593 	if (!nla_ok(nest, nla_len(nest)))
6594 		return -EINVAL;
6595 
6596 	err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6597 			       nl80211_bss_select_policy, NULL);
6598 	if (err)
6599 		return err;
6600 
6601 	/* only one attribute may be given */
6602 	for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6603 		if (attr[i]) {
6604 			if (found)
6605 				return -EINVAL;
6606 			found = true;
6607 		}
6608 	}
6609 
6610 	bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6611 
6612 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6613 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6614 
6615 	if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6616 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6617 		bss_select->param.band_pref =
6618 			nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6619 		if (!is_band_valid(wiphy, bss_select->param.band_pref))
6620 			return -EINVAL;
6621 	}
6622 
6623 	if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6624 		struct nl80211_bss_select_rssi_adjust *adj_param;
6625 
6626 		adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6627 		bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6628 		bss_select->param.adjust.band = adj_param->band;
6629 		bss_select->param.adjust.delta = adj_param->delta;
6630 		if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6631 			return -EINVAL;
6632 	}
6633 
6634 	/* user-space did not provide behaviour attribute */
6635 	if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6636 		return -EINVAL;
6637 
6638 	if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6639 		return -EINVAL;
6640 
6641 	return 0;
6642 }
6643 
6644 static int nl80211_parse_random_mac(struct nlattr **attrs,
6645 				    u8 *mac_addr, u8 *mac_addr_mask)
6646 {
6647 	int i;
6648 
6649 	if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6650 		eth_zero_addr(mac_addr);
6651 		eth_zero_addr(mac_addr_mask);
6652 		mac_addr[0] = 0x2;
6653 		mac_addr_mask[0] = 0x3;
6654 
6655 		return 0;
6656 	}
6657 
6658 	/* need both or none */
6659 	if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6660 		return -EINVAL;
6661 
6662 	memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6663 	memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6664 
6665 	/* don't allow or configure an mcast address */
6666 	if (!is_multicast_ether_addr(mac_addr_mask) ||
6667 	    is_multicast_ether_addr(mac_addr))
6668 		return -EINVAL;
6669 
6670 	/*
6671 	 * allow users to pass a MAC address that has bits set outside
6672 	 * of the mask, but don't bother drivers with having to deal
6673 	 * with such bits
6674 	 */
6675 	for (i = 0; i < ETH_ALEN; i++)
6676 		mac_addr[i] &= mac_addr_mask[i];
6677 
6678 	return 0;
6679 }
6680 
6681 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6682 {
6683 	ASSERT_WDEV_LOCK(wdev);
6684 
6685 	if (!cfg80211_beaconing_iface_active(wdev))
6686 		return true;
6687 
6688 	if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6689 		return true;
6690 
6691 	return regulatory_pre_cac_allowed(wdev->wiphy);
6692 }
6693 
6694 static int
6695 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6696 			 void *request, struct nlattr **attrs,
6697 			 bool is_sched_scan)
6698 {
6699 	u8 *mac_addr, *mac_addr_mask;
6700 	u32 *flags;
6701 	enum nl80211_feature_flags randomness_flag;
6702 
6703 	if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6704 		return 0;
6705 
6706 	if (is_sched_scan) {
6707 		struct cfg80211_sched_scan_request *req = request;
6708 
6709 		randomness_flag = wdev ?
6710 				  NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6711 				  NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6712 		flags = &req->flags;
6713 		mac_addr = req->mac_addr;
6714 		mac_addr_mask = req->mac_addr_mask;
6715 	} else {
6716 		struct cfg80211_scan_request *req = request;
6717 
6718 		randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6719 		flags = &req->flags;
6720 		mac_addr = req->mac_addr;
6721 		mac_addr_mask = req->mac_addr_mask;
6722 	}
6723 
6724 	*flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6725 
6726 	if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6727 	     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6728 	    ((*flags & NL80211_SCAN_FLAG_LOW_SPAN) &&
6729 	     !wiphy_ext_feature_isset(wiphy,
6730 				      NL80211_EXT_FEATURE_LOW_SPAN_SCAN)) ||
6731 	    ((*flags & NL80211_SCAN_FLAG_LOW_POWER) &&
6732 	     !wiphy_ext_feature_isset(wiphy,
6733 				      NL80211_EXT_FEATURE_LOW_POWER_SCAN)) ||
6734 	    ((*flags & NL80211_SCAN_FLAG_HIGH_ACCURACY) &&
6735 	     !wiphy_ext_feature_isset(wiphy,
6736 				      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN)))
6737 		return -EOPNOTSUPP;
6738 
6739 	if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6740 		int err;
6741 
6742 		if (!(wiphy->features & randomness_flag) ||
6743 		    (wdev && wdev->current_bss))
6744 			return -EOPNOTSUPP;
6745 
6746 		err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6747 		if (err)
6748 			return err;
6749 	}
6750 
6751 	if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) &&
6752 	    !wiphy_ext_feature_isset(wiphy,
6753 				     NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME))
6754 		return -EOPNOTSUPP;
6755 
6756 	if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) &&
6757 	   !wiphy_ext_feature_isset(wiphy,
6758 				    NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP))
6759 		return -EOPNOTSUPP;
6760 
6761 	if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
6762 	    !wiphy_ext_feature_isset(wiphy,
6763 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
6764 		return -EOPNOTSUPP;
6765 
6766 	if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) &&
6767 	    !wiphy_ext_feature_isset(wiphy,
6768 				     NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE))
6769 		return -EOPNOTSUPP;
6770 
6771 	return 0;
6772 }
6773 
6774 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6775 {
6776 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
6777 	struct wireless_dev *wdev = info->user_ptr[1];
6778 	struct cfg80211_scan_request *request;
6779 	struct nlattr *attr;
6780 	struct wiphy *wiphy;
6781 	int err, tmp, n_ssids = 0, n_channels, i;
6782 	size_t ie_len;
6783 
6784 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6785 		return -EINVAL;
6786 
6787 	wiphy = &rdev->wiphy;
6788 
6789 	if (wdev->iftype == NL80211_IFTYPE_NAN)
6790 		return -EOPNOTSUPP;
6791 
6792 	if (!rdev->ops->scan)
6793 		return -EOPNOTSUPP;
6794 
6795 	if (rdev->scan_req || rdev->scan_msg) {
6796 		err = -EBUSY;
6797 		goto unlock;
6798 	}
6799 
6800 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6801 		n_channels = validate_scan_freqs(
6802 				info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6803 		if (!n_channels) {
6804 			err = -EINVAL;
6805 			goto unlock;
6806 		}
6807 	} else {
6808 		n_channels = ieee80211_get_num_supported_channels(wiphy);
6809 	}
6810 
6811 	if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6812 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6813 			n_ssids++;
6814 
6815 	if (n_ssids > wiphy->max_scan_ssids) {
6816 		err = -EINVAL;
6817 		goto unlock;
6818 	}
6819 
6820 	if (info->attrs[NL80211_ATTR_IE])
6821 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6822 	else
6823 		ie_len = 0;
6824 
6825 	if (ie_len > wiphy->max_scan_ie_len) {
6826 		err = -EINVAL;
6827 		goto unlock;
6828 	}
6829 
6830 	request = kzalloc(sizeof(*request)
6831 			+ sizeof(*request->ssids) * n_ssids
6832 			+ sizeof(*request->channels) * n_channels
6833 			+ ie_len, GFP_KERNEL);
6834 	if (!request) {
6835 		err = -ENOMEM;
6836 		goto unlock;
6837 	}
6838 
6839 	if (n_ssids)
6840 		request->ssids = (void *)&request->channels[n_channels];
6841 	request->n_ssids = n_ssids;
6842 	if (ie_len) {
6843 		if (n_ssids)
6844 			request->ie = (void *)(request->ssids + n_ssids);
6845 		else
6846 			request->ie = (void *)(request->channels + n_channels);
6847 	}
6848 
6849 	i = 0;
6850 	if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6851 		/* user specified, bail out if channel not found */
6852 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6853 			struct ieee80211_channel *chan;
6854 
6855 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6856 
6857 			if (!chan) {
6858 				err = -EINVAL;
6859 				goto out_free;
6860 			}
6861 
6862 			/* ignore disabled channels */
6863 			if (chan->flags & IEEE80211_CHAN_DISABLED)
6864 				continue;
6865 
6866 			request->channels[i] = chan;
6867 			i++;
6868 		}
6869 	} else {
6870 		enum nl80211_band band;
6871 
6872 		/* all channels */
6873 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
6874 			int j;
6875 
6876 			if (!wiphy->bands[band])
6877 				continue;
6878 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6879 				struct ieee80211_channel *chan;
6880 
6881 				chan = &wiphy->bands[band]->channels[j];
6882 
6883 				if (chan->flags & IEEE80211_CHAN_DISABLED)
6884 					continue;
6885 
6886 				request->channels[i] = chan;
6887 				i++;
6888 			}
6889 		}
6890 	}
6891 
6892 	if (!i) {
6893 		err = -EINVAL;
6894 		goto out_free;
6895 	}
6896 
6897 	request->n_channels = i;
6898 
6899 	wdev_lock(wdev);
6900 	if (!cfg80211_off_channel_oper_allowed(wdev)) {
6901 		struct ieee80211_channel *chan;
6902 
6903 		if (request->n_channels != 1) {
6904 			wdev_unlock(wdev);
6905 			err = -EBUSY;
6906 			goto out_free;
6907 		}
6908 
6909 		chan = request->channels[0];
6910 		if (chan->center_freq != wdev->chandef.chan->center_freq) {
6911 			wdev_unlock(wdev);
6912 			err = -EBUSY;
6913 			goto out_free;
6914 		}
6915 	}
6916 	wdev_unlock(wdev);
6917 
6918 	i = 0;
6919 	if (n_ssids) {
6920 		nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6921 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6922 				err = -EINVAL;
6923 				goto out_free;
6924 			}
6925 			request->ssids[i].ssid_len = nla_len(attr);
6926 			memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6927 			i++;
6928 		}
6929 	}
6930 
6931 	if (info->attrs[NL80211_ATTR_IE]) {
6932 		request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6933 		memcpy((void *)request->ie,
6934 		       nla_data(info->attrs[NL80211_ATTR_IE]),
6935 		       request->ie_len);
6936 	}
6937 
6938 	for (i = 0; i < NUM_NL80211_BANDS; i++)
6939 		if (wiphy->bands[i])
6940 			request->rates[i] =
6941 				(1 << wiphy->bands[i]->n_bitrates) - 1;
6942 
6943 	if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6944 		nla_for_each_nested(attr,
6945 				    info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6946 				    tmp) {
6947 			enum nl80211_band band = nla_type(attr);
6948 
6949 			if (band < 0 || band >= NUM_NL80211_BANDS) {
6950 				err = -EINVAL;
6951 				goto out_free;
6952 			}
6953 
6954 			if (!wiphy->bands[band])
6955 				continue;
6956 
6957 			err = ieee80211_get_ratemask(wiphy->bands[band],
6958 						     nla_data(attr),
6959 						     nla_len(attr),
6960 						     &request->rates[band]);
6961 			if (err)
6962 				goto out_free;
6963 		}
6964 	}
6965 
6966 	if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6967 		if (!wiphy_ext_feature_isset(wiphy,
6968 					NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6969 			err = -EOPNOTSUPP;
6970 			goto out_free;
6971 		}
6972 
6973 		request->duration =
6974 			nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6975 		request->duration_mandatory =
6976 			nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6977 	}
6978 
6979 	err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
6980 				       false);
6981 	if (err)
6982 		goto out_free;
6983 
6984 	request->no_cck =
6985 		nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6986 
6987 	/* Initial implementation used NL80211_ATTR_MAC to set the specific
6988 	 * BSSID to scan for. This was problematic because that same attribute
6989 	 * was already used for another purpose (local random MAC address). The
6990 	 * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6991 	 * compatibility with older userspace components, also use the
6992 	 * NL80211_ATTR_MAC value here if it can be determined to be used for
6993 	 * the specific BSSID use case instead of the random MAC address
6994 	 * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6995 	 */
6996 	if (info->attrs[NL80211_ATTR_BSSID])
6997 		memcpy(request->bssid,
6998 		       nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6999 	else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7000 		 info->attrs[NL80211_ATTR_MAC])
7001 		memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7002 		       ETH_ALEN);
7003 	else
7004 		eth_broadcast_addr(request->bssid);
7005 
7006 	request->wdev = wdev;
7007 	request->wiphy = &rdev->wiphy;
7008 	request->scan_start = jiffies;
7009 
7010 	rdev->scan_req = request;
7011 	err = rdev_scan(rdev, request);
7012 
7013 	if (!err) {
7014 		nl80211_send_scan_start(rdev, wdev);
7015 		if (wdev->netdev)
7016 			dev_hold(wdev->netdev);
7017 	} else {
7018  out_free:
7019 		rdev->scan_req = NULL;
7020 		kfree(request);
7021 	}
7022 
7023  unlock:
7024 	return err;
7025 }
7026 
7027 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7028 {
7029 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7030 	struct wireless_dev *wdev = info->user_ptr[1];
7031 
7032 	if (!rdev->ops->abort_scan)
7033 		return -EOPNOTSUPP;
7034 
7035 	if (rdev->scan_msg)
7036 		return 0;
7037 
7038 	if (!rdev->scan_req)
7039 		return -ENOENT;
7040 
7041 	rdev_abort_scan(rdev, wdev);
7042 	return 0;
7043 }
7044 
7045 static int
7046 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7047 			       struct cfg80211_sched_scan_request *request,
7048 			       struct nlattr **attrs)
7049 {
7050 	int tmp, err, i = 0;
7051 	struct nlattr *attr;
7052 
7053 	if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7054 		u32 interval;
7055 
7056 		/*
7057 		 * If scan plans are not specified,
7058 		 * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7059 		 * case one scan plan will be set with the specified scan
7060 		 * interval and infinite number of iterations.
7061 		 */
7062 		interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7063 		if (!interval)
7064 			return -EINVAL;
7065 
7066 		request->scan_plans[0].interval =
7067 			DIV_ROUND_UP(interval, MSEC_PER_SEC);
7068 		if (!request->scan_plans[0].interval)
7069 			return -EINVAL;
7070 
7071 		if (request->scan_plans[0].interval >
7072 		    wiphy->max_sched_scan_plan_interval)
7073 			request->scan_plans[0].interval =
7074 				wiphy->max_sched_scan_plan_interval;
7075 
7076 		return 0;
7077 	}
7078 
7079 	nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7080 		struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7081 
7082 		if (WARN_ON(i >= n_plans))
7083 			return -EINVAL;
7084 
7085 		err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7086 				       attr, nl80211_plan_policy, NULL);
7087 		if (err)
7088 			return err;
7089 
7090 		if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7091 			return -EINVAL;
7092 
7093 		request->scan_plans[i].interval =
7094 			nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7095 		if (!request->scan_plans[i].interval ||
7096 		    request->scan_plans[i].interval >
7097 		    wiphy->max_sched_scan_plan_interval)
7098 			return -EINVAL;
7099 
7100 		if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7101 			request->scan_plans[i].iterations =
7102 				nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7103 			if (!request->scan_plans[i].iterations ||
7104 			    (request->scan_plans[i].iterations >
7105 			     wiphy->max_sched_scan_plan_iterations))
7106 				return -EINVAL;
7107 		} else if (i < n_plans - 1) {
7108 			/*
7109 			 * All scan plans but the last one must specify
7110 			 * a finite number of iterations
7111 			 */
7112 			return -EINVAL;
7113 		}
7114 
7115 		i++;
7116 	}
7117 
7118 	/*
7119 	 * The last scan plan must not specify the number of
7120 	 * iterations, it is supposed to run infinitely
7121 	 */
7122 	if (request->scan_plans[n_plans - 1].iterations)
7123 		return  -EINVAL;
7124 
7125 	return 0;
7126 }
7127 
7128 static struct cfg80211_sched_scan_request *
7129 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7130 			 struct nlattr **attrs, int max_match_sets)
7131 {
7132 	struct cfg80211_sched_scan_request *request;
7133 	struct nlattr *attr;
7134 	int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7135 	enum nl80211_band band;
7136 	size_t ie_len;
7137 	struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7138 	s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7139 
7140 	if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7141 		return ERR_PTR(-EINVAL);
7142 
7143 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7144 		n_channels = validate_scan_freqs(
7145 				attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7146 		if (!n_channels)
7147 			return ERR_PTR(-EINVAL);
7148 	} else {
7149 		n_channels = ieee80211_get_num_supported_channels(wiphy);
7150 	}
7151 
7152 	if (attrs[NL80211_ATTR_SCAN_SSIDS])
7153 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7154 				    tmp)
7155 			n_ssids++;
7156 
7157 	if (n_ssids > wiphy->max_sched_scan_ssids)
7158 		return ERR_PTR(-EINVAL);
7159 
7160 	/*
7161 	 * First, count the number of 'real' matchsets. Due to an issue with
7162 	 * the old implementation, matchsets containing only the RSSI attribute
7163 	 * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7164 	 * RSSI for all matchsets, rather than their own matchset for reporting
7165 	 * all APs with a strong RSSI. This is needed to be compatible with
7166 	 * older userspace that treated a matchset with only the RSSI as the
7167 	 * global RSSI for all other matchsets - if there are other matchsets.
7168 	 */
7169 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7170 		nla_for_each_nested(attr,
7171 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7172 				    tmp) {
7173 			struct nlattr *rssi;
7174 
7175 			err = nla_parse_nested(tb,
7176 					       NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7177 					       attr, nl80211_match_policy,
7178 					       NULL);
7179 			if (err)
7180 				return ERR_PTR(err);
7181 
7182 			/* SSID and BSSID are mutually exclusive */
7183 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7184 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7185 				return ERR_PTR(-EINVAL);
7186 
7187 			/* add other standalone attributes here */
7188 			if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7189 			    tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7190 				n_match_sets++;
7191 				continue;
7192 			}
7193 			rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7194 			if (rssi)
7195 				default_match_rssi = nla_get_s32(rssi);
7196 		}
7197 	}
7198 
7199 	/* However, if there's no other matchset, add the RSSI one */
7200 	if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7201 		n_match_sets = 1;
7202 
7203 	if (n_match_sets > max_match_sets)
7204 		return ERR_PTR(-EINVAL);
7205 
7206 	if (attrs[NL80211_ATTR_IE])
7207 		ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7208 	else
7209 		ie_len = 0;
7210 
7211 	if (ie_len > wiphy->max_sched_scan_ie_len)
7212 		return ERR_PTR(-EINVAL);
7213 
7214 	if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7215 		/*
7216 		 * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7217 		 * each scan plan already specifies its own interval
7218 		 */
7219 		if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7220 			return ERR_PTR(-EINVAL);
7221 
7222 		nla_for_each_nested(attr,
7223 				    attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7224 			n_plans++;
7225 	} else {
7226 		/*
7227 		 * The scan interval attribute is kept for backward
7228 		 * compatibility. If no scan plans are specified and sched scan
7229 		 * interval is specified, one scan plan will be set with this
7230 		 * scan interval and infinite number of iterations.
7231 		 */
7232 		if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7233 			return ERR_PTR(-EINVAL);
7234 
7235 		n_plans = 1;
7236 	}
7237 
7238 	if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7239 		return ERR_PTR(-EINVAL);
7240 
7241 	if (!wiphy_ext_feature_isset(
7242 		    wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7243 	    (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7244 	     attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7245 		return ERR_PTR(-EINVAL);
7246 
7247 	request = kzalloc(sizeof(*request)
7248 			+ sizeof(*request->ssids) * n_ssids
7249 			+ sizeof(*request->match_sets) * n_match_sets
7250 			+ sizeof(*request->scan_plans) * n_plans
7251 			+ sizeof(*request->channels) * n_channels
7252 			+ ie_len, GFP_KERNEL);
7253 	if (!request)
7254 		return ERR_PTR(-ENOMEM);
7255 
7256 	if (n_ssids)
7257 		request->ssids = (void *)&request->channels[n_channels];
7258 	request->n_ssids = n_ssids;
7259 	if (ie_len) {
7260 		if (n_ssids)
7261 			request->ie = (void *)(request->ssids + n_ssids);
7262 		else
7263 			request->ie = (void *)(request->channels + n_channels);
7264 	}
7265 
7266 	if (n_match_sets) {
7267 		if (request->ie)
7268 			request->match_sets = (void *)(request->ie + ie_len);
7269 		else if (n_ssids)
7270 			request->match_sets =
7271 				(void *)(request->ssids + n_ssids);
7272 		else
7273 			request->match_sets =
7274 				(void *)(request->channels + n_channels);
7275 	}
7276 	request->n_match_sets = n_match_sets;
7277 
7278 	if (n_match_sets)
7279 		request->scan_plans = (void *)(request->match_sets +
7280 					       n_match_sets);
7281 	else if (request->ie)
7282 		request->scan_plans = (void *)(request->ie + ie_len);
7283 	else if (n_ssids)
7284 		request->scan_plans = (void *)(request->ssids + n_ssids);
7285 	else
7286 		request->scan_plans = (void *)(request->channels + n_channels);
7287 
7288 	request->n_scan_plans = n_plans;
7289 
7290 	i = 0;
7291 	if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7292 		/* user specified, bail out if channel not found */
7293 		nla_for_each_nested(attr,
7294 				    attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7295 				    tmp) {
7296 			struct ieee80211_channel *chan;
7297 
7298 			chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7299 
7300 			if (!chan) {
7301 				err = -EINVAL;
7302 				goto out_free;
7303 			}
7304 
7305 			/* ignore disabled channels */
7306 			if (chan->flags & IEEE80211_CHAN_DISABLED)
7307 				continue;
7308 
7309 			request->channels[i] = chan;
7310 			i++;
7311 		}
7312 	} else {
7313 		/* all channels */
7314 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
7315 			int j;
7316 
7317 			if (!wiphy->bands[band])
7318 				continue;
7319 			for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7320 				struct ieee80211_channel *chan;
7321 
7322 				chan = &wiphy->bands[band]->channels[j];
7323 
7324 				if (chan->flags & IEEE80211_CHAN_DISABLED)
7325 					continue;
7326 
7327 				request->channels[i] = chan;
7328 				i++;
7329 			}
7330 		}
7331 	}
7332 
7333 	if (!i) {
7334 		err = -EINVAL;
7335 		goto out_free;
7336 	}
7337 
7338 	request->n_channels = i;
7339 
7340 	i = 0;
7341 	if (n_ssids) {
7342 		nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7343 				    tmp) {
7344 			if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7345 				err = -EINVAL;
7346 				goto out_free;
7347 			}
7348 			request->ssids[i].ssid_len = nla_len(attr);
7349 			memcpy(request->ssids[i].ssid, nla_data(attr),
7350 			       nla_len(attr));
7351 			i++;
7352 		}
7353 	}
7354 
7355 	i = 0;
7356 	if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7357 		nla_for_each_nested(attr,
7358 				    attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7359 				    tmp) {
7360 			struct nlattr *ssid, *bssid, *rssi;
7361 
7362 			err = nla_parse_nested(tb,
7363 					       NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7364 					       attr, nl80211_match_policy,
7365 					       NULL);
7366 			if (err)
7367 				goto out_free;
7368 			ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7369 			bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7370 			if (ssid || bssid) {
7371 				if (WARN_ON(i >= n_match_sets)) {
7372 					/* this indicates a programming error,
7373 					 * the loop above should have verified
7374 					 * things properly
7375 					 */
7376 					err = -EINVAL;
7377 					goto out_free;
7378 				}
7379 
7380 				if (ssid) {
7381 					if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7382 						err = -EINVAL;
7383 						goto out_free;
7384 					}
7385 					memcpy(request->match_sets[i].ssid.ssid,
7386 					       nla_data(ssid), nla_len(ssid));
7387 					request->match_sets[i].ssid.ssid_len =
7388 						nla_len(ssid);
7389 				}
7390 				if (bssid) {
7391 					if (nla_len(bssid) != ETH_ALEN) {
7392 						err = -EINVAL;
7393 						goto out_free;
7394 					}
7395 					memcpy(request->match_sets[i].bssid,
7396 					       nla_data(bssid), ETH_ALEN);
7397 				}
7398 
7399 				/* special attribute - old implementation w/a */
7400 				request->match_sets[i].rssi_thold =
7401 					default_match_rssi;
7402 				rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7403 				if (rssi)
7404 					request->match_sets[i].rssi_thold =
7405 						nla_get_s32(rssi);
7406 			}
7407 			i++;
7408 		}
7409 
7410 		/* there was no other matchset, so the RSSI one is alone */
7411 		if (i == 0 && n_match_sets)
7412 			request->match_sets[0].rssi_thold = default_match_rssi;
7413 
7414 		request->min_rssi_thold = INT_MAX;
7415 		for (i = 0; i < n_match_sets; i++)
7416 			request->min_rssi_thold =
7417 				min(request->match_sets[i].rssi_thold,
7418 				    request->min_rssi_thold);
7419 	} else {
7420 		request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7421 	}
7422 
7423 	if (ie_len) {
7424 		request->ie_len = ie_len;
7425 		memcpy((void *)request->ie,
7426 		       nla_data(attrs[NL80211_ATTR_IE]),
7427 		       request->ie_len);
7428 	}
7429 
7430 	err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7431 	if (err)
7432 		goto out_free;
7433 
7434 	if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7435 		request->delay =
7436 			nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7437 
7438 	if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7439 		request->relative_rssi = nla_get_s8(
7440 			attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7441 		request->relative_rssi_set = true;
7442 	}
7443 
7444 	if (request->relative_rssi_set &&
7445 	    attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7446 		struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7447 
7448 		rssi_adjust = nla_data(
7449 			attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7450 		request->rssi_adjust.band = rssi_adjust->band;
7451 		request->rssi_adjust.delta = rssi_adjust->delta;
7452 		if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7453 			err = -EINVAL;
7454 			goto out_free;
7455 		}
7456 	}
7457 
7458 	err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7459 	if (err)
7460 		goto out_free;
7461 
7462 	request->scan_start = jiffies;
7463 
7464 	return request;
7465 
7466 out_free:
7467 	kfree(request);
7468 	return ERR_PTR(err);
7469 }
7470 
7471 static int nl80211_start_sched_scan(struct sk_buff *skb,
7472 				    struct genl_info *info)
7473 {
7474 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7475 	struct net_device *dev = info->user_ptr[1];
7476 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7477 	struct cfg80211_sched_scan_request *sched_scan_req;
7478 	bool want_multi;
7479 	int err;
7480 
7481 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7482 		return -EOPNOTSUPP;
7483 
7484 	want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7485 	err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7486 	if (err)
7487 		return err;
7488 
7489 	sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7490 						  info->attrs,
7491 						  rdev->wiphy.max_match_sets);
7492 
7493 	err = PTR_ERR_OR_ZERO(sched_scan_req);
7494 	if (err)
7495 		goto out_err;
7496 
7497 	/* leave request id zero for legacy request
7498 	 * or if driver does not support multi-scheduled scan
7499 	 */
7500 	if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7501 		while (!sched_scan_req->reqid)
7502 			sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7503 	}
7504 
7505 	err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7506 	if (err)
7507 		goto out_free;
7508 
7509 	sched_scan_req->dev = dev;
7510 	sched_scan_req->wiphy = &rdev->wiphy;
7511 
7512 	if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7513 		sched_scan_req->owner_nlportid = info->snd_portid;
7514 
7515 	cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7516 
7517 	nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7518 	return 0;
7519 
7520 out_free:
7521 	kfree(sched_scan_req);
7522 out_err:
7523 	return err;
7524 }
7525 
7526 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7527 				   struct genl_info *info)
7528 {
7529 	struct cfg80211_sched_scan_request *req;
7530 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7531 	u64 cookie;
7532 
7533 	if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7534 		return -EOPNOTSUPP;
7535 
7536 	if (info->attrs[NL80211_ATTR_COOKIE]) {
7537 		cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7538 		return __cfg80211_stop_sched_scan(rdev, cookie, false);
7539 	}
7540 
7541 	req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7542 				     struct cfg80211_sched_scan_request,
7543 				     list);
7544 	if (!req || req->reqid ||
7545 	    (req->owner_nlportid &&
7546 	     req->owner_nlportid != info->snd_portid))
7547 		return -ENOENT;
7548 
7549 	return cfg80211_stop_sched_scan_req(rdev, req, false);
7550 }
7551 
7552 static int nl80211_start_radar_detection(struct sk_buff *skb,
7553 					 struct genl_info *info)
7554 {
7555 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7556 	struct net_device *dev = info->user_ptr[1];
7557 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7558 	struct wiphy *wiphy = wdev->wiphy;
7559 	struct cfg80211_chan_def chandef;
7560 	enum nl80211_dfs_regions dfs_region;
7561 	unsigned int cac_time_ms;
7562 	int err;
7563 
7564 	dfs_region = reg_get_dfs_region(wiphy);
7565 	if (dfs_region == NL80211_DFS_UNSET)
7566 		return -EINVAL;
7567 
7568 	err = nl80211_parse_chandef(rdev, info, &chandef);
7569 	if (err)
7570 		return err;
7571 
7572 	if (netif_carrier_ok(dev))
7573 		return -EBUSY;
7574 
7575 	if (wdev->cac_started)
7576 		return -EBUSY;
7577 
7578 	err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7579 	if (err < 0)
7580 		return err;
7581 
7582 	if (err == 0)
7583 		return -EINVAL;
7584 
7585 	if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7586 		return -EINVAL;
7587 
7588 	/* CAC start is offloaded to HW and can't be started manually */
7589 	if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7590 		return -EOPNOTSUPP;
7591 
7592 	if (!rdev->ops->start_radar_detection)
7593 		return -EOPNOTSUPP;
7594 
7595 	cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7596 	if (WARN_ON(!cac_time_ms))
7597 		cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7598 
7599 	err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7600 	if (!err) {
7601 		wdev->chandef = chandef;
7602 		wdev->cac_started = true;
7603 		wdev->cac_start_time = jiffies;
7604 		wdev->cac_time_ms = cac_time_ms;
7605 	}
7606 	return err;
7607 }
7608 
7609 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7610 {
7611 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
7612 	struct net_device *dev = info->user_ptr[1];
7613 	struct wireless_dev *wdev = dev->ieee80211_ptr;
7614 	struct cfg80211_csa_settings params;
7615 	/* csa_attrs is defined static to avoid waste of stack size - this
7616 	 * function is called under RTNL lock, so this should not be a problem.
7617 	 */
7618 	static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7619 	int err;
7620 	bool need_new_beacon = false;
7621 	bool need_handle_dfs_flag = true;
7622 	int len, i;
7623 	u32 cs_count;
7624 
7625 	if (!rdev->ops->channel_switch ||
7626 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7627 		return -EOPNOTSUPP;
7628 
7629 	switch (dev->ieee80211_ptr->iftype) {
7630 	case NL80211_IFTYPE_AP:
7631 	case NL80211_IFTYPE_P2P_GO:
7632 		need_new_beacon = true;
7633 		/* For all modes except AP the handle_dfs flag needs to be
7634 		 * supplied to tell the kernel that userspace will handle radar
7635 		 * events when they happen. Otherwise a switch to a channel
7636 		 * requiring DFS will be rejected.
7637 		 */
7638 		need_handle_dfs_flag = false;
7639 
7640 		/* useless if AP is not running */
7641 		if (!wdev->beacon_interval)
7642 			return -ENOTCONN;
7643 		break;
7644 	case NL80211_IFTYPE_ADHOC:
7645 		if (!wdev->ssid_len)
7646 			return -ENOTCONN;
7647 		break;
7648 	case NL80211_IFTYPE_MESH_POINT:
7649 		if (!wdev->mesh_id_len)
7650 			return -ENOTCONN;
7651 		break;
7652 	default:
7653 		return -EOPNOTSUPP;
7654 	}
7655 
7656 	memset(&params, 0, sizeof(params));
7657 
7658 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7659 	    !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7660 		return -EINVAL;
7661 
7662 	/* only important for AP, IBSS and mesh create IEs internally */
7663 	if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7664 		return -EINVAL;
7665 
7666 	/* Even though the attribute is u32, the specification says
7667 	 * u8, so let's make sure we don't overflow.
7668 	 */
7669 	cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7670 	if (cs_count > 255)
7671 		return -EINVAL;
7672 
7673 	params.count = cs_count;
7674 
7675 	if (!need_new_beacon)
7676 		goto skip_beacons;
7677 
7678 	err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7679 	if (err)
7680 		return err;
7681 
7682 	err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7683 			       info->attrs[NL80211_ATTR_CSA_IES],
7684 			       nl80211_policy, info->extack);
7685 	if (err)
7686 		return err;
7687 
7688 	err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7689 	if (err)
7690 		return err;
7691 
7692 	if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7693 		return -EINVAL;
7694 
7695 	len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7696 	if (!len || (len % sizeof(u16)))
7697 		return -EINVAL;
7698 
7699 	params.n_counter_offsets_beacon = len / sizeof(u16);
7700 	if (rdev->wiphy.max_num_csa_counters &&
7701 	    (params.n_counter_offsets_beacon >
7702 	     rdev->wiphy.max_num_csa_counters))
7703 		return -EINVAL;
7704 
7705 	params.counter_offsets_beacon =
7706 		nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7707 
7708 	/* sanity checks - counters should fit and be the same */
7709 	for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7710 		u16 offset = params.counter_offsets_beacon[i];
7711 
7712 		if (offset >= params.beacon_csa.tail_len)
7713 			return -EINVAL;
7714 
7715 		if (params.beacon_csa.tail[offset] != params.count)
7716 			return -EINVAL;
7717 	}
7718 
7719 	if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7720 		len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7721 		if (!len || (len % sizeof(u16)))
7722 			return -EINVAL;
7723 
7724 		params.n_counter_offsets_presp = len / sizeof(u16);
7725 		if (rdev->wiphy.max_num_csa_counters &&
7726 		    (params.n_counter_offsets_presp >
7727 		     rdev->wiphy.max_num_csa_counters))
7728 			return -EINVAL;
7729 
7730 		params.counter_offsets_presp =
7731 			nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7732 
7733 		/* sanity checks - counters should fit and be the same */
7734 		for (i = 0; i < params.n_counter_offsets_presp; i++) {
7735 			u16 offset = params.counter_offsets_presp[i];
7736 
7737 			if (offset >= params.beacon_csa.probe_resp_len)
7738 				return -EINVAL;
7739 
7740 			if (params.beacon_csa.probe_resp[offset] !=
7741 			    params.count)
7742 				return -EINVAL;
7743 		}
7744 	}
7745 
7746 skip_beacons:
7747 	err = nl80211_parse_chandef(rdev, info, &params.chandef);
7748 	if (err)
7749 		return err;
7750 
7751 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7752 					   wdev->iftype))
7753 		return -EINVAL;
7754 
7755 	err = cfg80211_chandef_dfs_required(wdev->wiphy,
7756 					    &params.chandef,
7757 					    wdev->iftype);
7758 	if (err < 0)
7759 		return err;
7760 
7761 	if (err > 0) {
7762 		params.radar_required = true;
7763 		if (need_handle_dfs_flag &&
7764 		    !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7765 			return -EINVAL;
7766 		}
7767 	}
7768 
7769 	if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7770 		params.block_tx = true;
7771 
7772 	wdev_lock(wdev);
7773 	err = rdev_channel_switch(rdev, dev, &params);
7774 	wdev_unlock(wdev);
7775 
7776 	return err;
7777 }
7778 
7779 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7780 			    u32 seq, int flags,
7781 			    struct cfg80211_registered_device *rdev,
7782 			    struct wireless_dev *wdev,
7783 			    struct cfg80211_internal_bss *intbss)
7784 {
7785 	struct cfg80211_bss *res = &intbss->pub;
7786 	const struct cfg80211_bss_ies *ies;
7787 	void *hdr;
7788 	struct nlattr *bss;
7789 
7790 	ASSERT_WDEV_LOCK(wdev);
7791 
7792 	hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7793 			     NL80211_CMD_NEW_SCAN_RESULTS);
7794 	if (!hdr)
7795 		return -1;
7796 
7797 	genl_dump_check_consistent(cb, hdr);
7798 
7799 	if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7800 		goto nla_put_failure;
7801 	if (wdev->netdev &&
7802 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7803 		goto nla_put_failure;
7804 	if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7805 			      NL80211_ATTR_PAD))
7806 		goto nla_put_failure;
7807 
7808 	bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7809 	if (!bss)
7810 		goto nla_put_failure;
7811 	if ((!is_zero_ether_addr(res->bssid) &&
7812 	     nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7813 		goto nla_put_failure;
7814 
7815 	rcu_read_lock();
7816 	/* indicate whether we have probe response data or not */
7817 	if (rcu_access_pointer(res->proberesp_ies) &&
7818 	    nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7819 		goto fail_unlock_rcu;
7820 
7821 	/* this pointer prefers to be pointed to probe response data
7822 	 * but is always valid
7823 	 */
7824 	ies = rcu_dereference(res->ies);
7825 	if (ies) {
7826 		if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7827 				      NL80211_BSS_PAD))
7828 			goto fail_unlock_rcu;
7829 		if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7830 					ies->len, ies->data))
7831 			goto fail_unlock_rcu;
7832 	}
7833 
7834 	/* and this pointer is always (unless driver didn't know) beacon data */
7835 	ies = rcu_dereference(res->beacon_ies);
7836 	if (ies && ies->from_beacon) {
7837 		if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7838 				      NL80211_BSS_PAD))
7839 			goto fail_unlock_rcu;
7840 		if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7841 					ies->len, ies->data))
7842 			goto fail_unlock_rcu;
7843 	}
7844 	rcu_read_unlock();
7845 
7846 	if (res->beacon_interval &&
7847 	    nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7848 		goto nla_put_failure;
7849 	if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7850 	    nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7851 	    nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7852 	    nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7853 			jiffies_to_msecs(jiffies - intbss->ts)))
7854 		goto nla_put_failure;
7855 
7856 	if (intbss->parent_tsf &&
7857 	    (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7858 			       intbss->parent_tsf, NL80211_BSS_PAD) ||
7859 	     nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7860 		     intbss->parent_bssid)))
7861 		goto nla_put_failure;
7862 
7863 	if (intbss->ts_boottime &&
7864 	    nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7865 			      intbss->ts_boottime, NL80211_BSS_PAD))
7866 		goto nla_put_failure;
7867 
7868 	if (!nl80211_put_signal(msg, intbss->pub.chains,
7869 				intbss->pub.chain_signal,
7870 				NL80211_BSS_CHAIN_SIGNAL))
7871 		goto nla_put_failure;
7872 
7873 	switch (rdev->wiphy.signal_type) {
7874 	case CFG80211_SIGNAL_TYPE_MBM:
7875 		if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7876 			goto nla_put_failure;
7877 		break;
7878 	case CFG80211_SIGNAL_TYPE_UNSPEC:
7879 		if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7880 			goto nla_put_failure;
7881 		break;
7882 	default:
7883 		break;
7884 	}
7885 
7886 	switch (wdev->iftype) {
7887 	case NL80211_IFTYPE_P2P_CLIENT:
7888 	case NL80211_IFTYPE_STATION:
7889 		if (intbss == wdev->current_bss &&
7890 		    nla_put_u32(msg, NL80211_BSS_STATUS,
7891 				NL80211_BSS_STATUS_ASSOCIATED))
7892 			goto nla_put_failure;
7893 		break;
7894 	case NL80211_IFTYPE_ADHOC:
7895 		if (intbss == wdev->current_bss &&
7896 		    nla_put_u32(msg, NL80211_BSS_STATUS,
7897 				NL80211_BSS_STATUS_IBSS_JOINED))
7898 			goto nla_put_failure;
7899 		break;
7900 	default:
7901 		break;
7902 	}
7903 
7904 	nla_nest_end(msg, bss);
7905 
7906 	genlmsg_end(msg, hdr);
7907 	return 0;
7908 
7909  fail_unlock_rcu:
7910 	rcu_read_unlock();
7911  nla_put_failure:
7912 	genlmsg_cancel(msg, hdr);
7913 	return -EMSGSIZE;
7914 }
7915 
7916 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7917 {
7918 	struct cfg80211_registered_device *rdev;
7919 	struct cfg80211_internal_bss *scan;
7920 	struct wireless_dev *wdev;
7921 	int start = cb->args[2], idx = 0;
7922 	int err;
7923 
7924 	rtnl_lock();
7925 	err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7926 	if (err) {
7927 		rtnl_unlock();
7928 		return err;
7929 	}
7930 
7931 	wdev_lock(wdev);
7932 	spin_lock_bh(&rdev->bss_lock);
7933 	cfg80211_bss_expire(rdev);
7934 
7935 	cb->seq = rdev->bss_generation;
7936 
7937 	list_for_each_entry(scan, &rdev->bss_list, list) {
7938 		if (++idx <= start)
7939 			continue;
7940 		if (nl80211_send_bss(skb, cb,
7941 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
7942 				rdev, wdev, scan) < 0) {
7943 			idx--;
7944 			break;
7945 		}
7946 	}
7947 
7948 	spin_unlock_bh(&rdev->bss_lock);
7949 	wdev_unlock(wdev);
7950 
7951 	cb->args[2] = idx;
7952 	rtnl_unlock();
7953 
7954 	return skb->len;
7955 }
7956 
7957 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7958 			       int flags, struct net_device *dev,
7959 			       bool allow_radio_stats,
7960 			       struct survey_info *survey)
7961 {
7962 	void *hdr;
7963 	struct nlattr *infoattr;
7964 
7965 	/* skip radio stats if userspace didn't request them */
7966 	if (!survey->channel && !allow_radio_stats)
7967 		return 0;
7968 
7969 	hdr = nl80211hdr_put(msg, portid, seq, flags,
7970 			     NL80211_CMD_NEW_SURVEY_RESULTS);
7971 	if (!hdr)
7972 		return -ENOMEM;
7973 
7974 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7975 		goto nla_put_failure;
7976 
7977 	infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7978 	if (!infoattr)
7979 		goto nla_put_failure;
7980 
7981 	if (survey->channel &&
7982 	    nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7983 			survey->channel->center_freq))
7984 		goto nla_put_failure;
7985 
7986 	if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7987 	    nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7988 		goto nla_put_failure;
7989 	if ((survey->filled & SURVEY_INFO_IN_USE) &&
7990 	    nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7991 		goto nla_put_failure;
7992 	if ((survey->filled & SURVEY_INFO_TIME) &&
7993 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7994 			survey->time, NL80211_SURVEY_INFO_PAD))
7995 		goto nla_put_failure;
7996 	if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7997 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7998 			      survey->time_busy, NL80211_SURVEY_INFO_PAD))
7999 		goto nla_put_failure;
8000 	if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8001 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8002 			      survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8003 		goto nla_put_failure;
8004 	if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8005 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8006 			      survey->time_rx, NL80211_SURVEY_INFO_PAD))
8007 		goto nla_put_failure;
8008 	if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8009 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8010 			      survey->time_tx, NL80211_SURVEY_INFO_PAD))
8011 		goto nla_put_failure;
8012 	if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8013 	    nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8014 			      survey->time_scan, NL80211_SURVEY_INFO_PAD))
8015 		goto nla_put_failure;
8016 
8017 	nla_nest_end(msg, infoattr);
8018 
8019 	genlmsg_end(msg, hdr);
8020 	return 0;
8021 
8022  nla_put_failure:
8023 	genlmsg_cancel(msg, hdr);
8024 	return -EMSGSIZE;
8025 }
8026 
8027 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8028 {
8029 	struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8030 	struct survey_info survey;
8031 	struct cfg80211_registered_device *rdev;
8032 	struct wireless_dev *wdev;
8033 	int survey_idx = cb->args[2];
8034 	int res;
8035 	bool radio_stats;
8036 
8037 	rtnl_lock();
8038 	res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8039 	if (res)
8040 		goto out_err;
8041 
8042 	/* prepare_wdev_dump parsed the attributes */
8043 	radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8044 
8045 	if (!wdev->netdev) {
8046 		res = -EINVAL;
8047 		goto out_err;
8048 	}
8049 
8050 	if (!rdev->ops->dump_survey) {
8051 		res = -EOPNOTSUPP;
8052 		goto out_err;
8053 	}
8054 
8055 	while (1) {
8056 		res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8057 		if (res == -ENOENT)
8058 			break;
8059 		if (res)
8060 			goto out_err;
8061 
8062 		/* don't send disabled channels, but do send non-channel data */
8063 		if (survey.channel &&
8064 		    survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8065 			survey_idx++;
8066 			continue;
8067 		}
8068 
8069 		if (nl80211_send_survey(skb,
8070 				NETLINK_CB(cb->skb).portid,
8071 				cb->nlh->nlmsg_seq, NLM_F_MULTI,
8072 				wdev->netdev, radio_stats, &survey) < 0)
8073 			goto out;
8074 		survey_idx++;
8075 	}
8076 
8077  out:
8078 	cb->args[2] = survey_idx;
8079 	res = skb->len;
8080  out_err:
8081 	rtnl_unlock();
8082 	return res;
8083 }
8084 
8085 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8086 {
8087 	return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8088 				  NL80211_WPA_VERSION_2));
8089 }
8090 
8091 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8092 {
8093 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8094 	struct net_device *dev = info->user_ptr[1];
8095 	struct ieee80211_channel *chan;
8096 	const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8097 	int err, ssid_len, ie_len = 0, auth_data_len = 0;
8098 	enum nl80211_auth_type auth_type;
8099 	struct key_parse key;
8100 	bool local_state_change;
8101 
8102 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8103 		return -EINVAL;
8104 
8105 	if (!info->attrs[NL80211_ATTR_MAC])
8106 		return -EINVAL;
8107 
8108 	if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8109 		return -EINVAL;
8110 
8111 	if (!info->attrs[NL80211_ATTR_SSID])
8112 		return -EINVAL;
8113 
8114 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8115 		return -EINVAL;
8116 
8117 	err = nl80211_parse_key(info, &key);
8118 	if (err)
8119 		return err;
8120 
8121 	if (key.idx >= 0) {
8122 		if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8123 			return -EINVAL;
8124 		if (!key.p.key || !key.p.key_len)
8125 			return -EINVAL;
8126 		if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8127 		     key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8128 		    (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8129 		     key.p.key_len != WLAN_KEY_LEN_WEP104))
8130 			return -EINVAL;
8131 		if (key.idx > 3)
8132 			return -EINVAL;
8133 	} else {
8134 		key.p.key_len = 0;
8135 		key.p.key = NULL;
8136 	}
8137 
8138 	if (key.idx >= 0) {
8139 		int i;
8140 		bool ok = false;
8141 
8142 		for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8143 			if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8144 				ok = true;
8145 				break;
8146 			}
8147 		}
8148 		if (!ok)
8149 			return -EINVAL;
8150 	}
8151 
8152 	if (!rdev->ops->auth)
8153 		return -EOPNOTSUPP;
8154 
8155 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8156 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8157 		return -EOPNOTSUPP;
8158 
8159 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8160 	chan = nl80211_get_valid_chan(&rdev->wiphy,
8161 				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8162 	if (!chan)
8163 		return -EINVAL;
8164 
8165 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8166 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8167 
8168 	if (info->attrs[NL80211_ATTR_IE]) {
8169 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8170 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8171 	}
8172 
8173 	auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8174 	if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8175 		return -EINVAL;
8176 
8177 	if ((auth_type == NL80211_AUTHTYPE_SAE ||
8178 	     auth_type == NL80211_AUTHTYPE_FILS_SK ||
8179 	     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8180 	     auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8181 	    !info->attrs[NL80211_ATTR_AUTH_DATA])
8182 		return -EINVAL;
8183 
8184 	if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8185 		if (auth_type != NL80211_AUTHTYPE_SAE &&
8186 		    auth_type != NL80211_AUTHTYPE_FILS_SK &&
8187 		    auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8188 		    auth_type != NL80211_AUTHTYPE_FILS_PK)
8189 			return -EINVAL;
8190 		auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8191 		auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8192 		/* need to include at least Auth Transaction and Status Code */
8193 		if (auth_data_len < 4)
8194 			return -EINVAL;
8195 	}
8196 
8197 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8198 
8199 	/*
8200 	 * Since we no longer track auth state, ignore
8201 	 * requests to only change local state.
8202 	 */
8203 	if (local_state_change)
8204 		return 0;
8205 
8206 	wdev_lock(dev->ieee80211_ptr);
8207 	err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8208 				 ssid, ssid_len, ie, ie_len,
8209 				 key.p.key, key.p.key_len, key.idx,
8210 				 auth_data, auth_data_len);
8211 	wdev_unlock(dev->ieee80211_ptr);
8212 	return err;
8213 }
8214 
8215 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8216 				     struct genl_info *info)
8217 {
8218 	if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8219 		GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8220 		return -EINVAL;
8221 	}
8222 
8223 	if (!rdev->ops->tx_control_port ||
8224 	    !wiphy_ext_feature_isset(&rdev->wiphy,
8225 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8226 		return -EOPNOTSUPP;
8227 
8228 	return 0;
8229 }
8230 
8231 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8232 				   struct genl_info *info,
8233 				   struct cfg80211_crypto_settings *settings,
8234 				   int cipher_limit)
8235 {
8236 	memset(settings, 0, sizeof(*settings));
8237 
8238 	settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8239 
8240 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8241 		u16 proto;
8242 
8243 		proto = nla_get_u16(
8244 			info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8245 		settings->control_port_ethertype = cpu_to_be16(proto);
8246 		if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8247 		    proto != ETH_P_PAE)
8248 			return -EINVAL;
8249 		if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8250 			settings->control_port_no_encrypt = true;
8251 	} else
8252 		settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8253 
8254 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8255 		int r = validate_pae_over_nl80211(rdev, info);
8256 
8257 		if (r < 0)
8258 			return r;
8259 
8260 		settings->control_port_over_nl80211 = true;
8261 	}
8262 
8263 	if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8264 		void *data;
8265 		int len, i;
8266 
8267 		data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8268 		len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8269 		settings->n_ciphers_pairwise = len / sizeof(u32);
8270 
8271 		if (len % sizeof(u32))
8272 			return -EINVAL;
8273 
8274 		if (settings->n_ciphers_pairwise > cipher_limit)
8275 			return -EINVAL;
8276 
8277 		memcpy(settings->ciphers_pairwise, data, len);
8278 
8279 		for (i = 0; i < settings->n_ciphers_pairwise; i++)
8280 			if (!cfg80211_supported_cipher_suite(
8281 					&rdev->wiphy,
8282 					settings->ciphers_pairwise[i]))
8283 				return -EINVAL;
8284 	}
8285 
8286 	if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8287 		settings->cipher_group =
8288 			nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8289 		if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8290 						     settings->cipher_group))
8291 			return -EINVAL;
8292 	}
8293 
8294 	if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8295 		settings->wpa_versions =
8296 			nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8297 		if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8298 			return -EINVAL;
8299 	}
8300 
8301 	if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8302 		void *data;
8303 		int len;
8304 
8305 		data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8306 		len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8307 		settings->n_akm_suites = len / sizeof(u32);
8308 
8309 		if (len % sizeof(u32))
8310 			return -EINVAL;
8311 
8312 		if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8313 			return -EINVAL;
8314 
8315 		memcpy(settings->akm_suites, data, len);
8316 	}
8317 
8318 	if (info->attrs[NL80211_ATTR_PMK]) {
8319 		if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8320 			return -EINVAL;
8321 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
8322 					     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8323 			return -EINVAL;
8324 		settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8325 	}
8326 
8327 	return 0;
8328 }
8329 
8330 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8331 {
8332 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8333 	struct net_device *dev = info->user_ptr[1];
8334 	struct ieee80211_channel *chan;
8335 	struct cfg80211_assoc_request req = {};
8336 	const u8 *bssid, *ssid;
8337 	int err, ssid_len = 0;
8338 
8339 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8340 		return -EINVAL;
8341 
8342 	if (!info->attrs[NL80211_ATTR_MAC] ||
8343 	    !info->attrs[NL80211_ATTR_SSID] ||
8344 	    !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8345 		return -EINVAL;
8346 
8347 	if (!rdev->ops->assoc)
8348 		return -EOPNOTSUPP;
8349 
8350 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8351 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8352 		return -EOPNOTSUPP;
8353 
8354 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8355 
8356 	chan = nl80211_get_valid_chan(&rdev->wiphy,
8357 				      info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8358 	if (!chan)
8359 		return -EINVAL;
8360 
8361 	ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8362 	ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8363 
8364 	if (info->attrs[NL80211_ATTR_IE]) {
8365 		req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8366 		req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8367 	}
8368 
8369 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
8370 		enum nl80211_mfp mfp =
8371 			nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8372 		if (mfp == NL80211_MFP_REQUIRED)
8373 			req.use_mfp = true;
8374 		else if (mfp != NL80211_MFP_NO)
8375 			return -EINVAL;
8376 	}
8377 
8378 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
8379 		req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8380 
8381 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8382 		req.flags |= ASSOC_REQ_DISABLE_HT;
8383 
8384 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8385 		memcpy(&req.ht_capa_mask,
8386 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8387 		       sizeof(req.ht_capa_mask));
8388 
8389 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8390 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8391 			return -EINVAL;
8392 		memcpy(&req.ht_capa,
8393 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8394 		       sizeof(req.ht_capa));
8395 	}
8396 
8397 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8398 		req.flags |= ASSOC_REQ_DISABLE_VHT;
8399 
8400 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8401 		memcpy(&req.vht_capa_mask,
8402 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8403 		       sizeof(req.vht_capa_mask));
8404 
8405 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8406 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8407 			return -EINVAL;
8408 		memcpy(&req.vht_capa,
8409 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8410 		       sizeof(req.vht_capa));
8411 	}
8412 
8413 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8414 		if (!((rdev->wiphy.features &
8415 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8416 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8417 		    !wiphy_ext_feature_isset(&rdev->wiphy,
8418 					     NL80211_EXT_FEATURE_RRM))
8419 			return -EINVAL;
8420 		req.flags |= ASSOC_REQ_USE_RRM;
8421 	}
8422 
8423 	if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8424 		req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8425 		req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8426 		if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8427 			return -EINVAL;
8428 		req.fils_nonces =
8429 			nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8430 	}
8431 
8432 	err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8433 	if (!err) {
8434 		wdev_lock(dev->ieee80211_ptr);
8435 
8436 		err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8437 					  ssid, ssid_len, &req);
8438 
8439 		if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8440 			dev->ieee80211_ptr->conn_owner_nlportid =
8441 				info->snd_portid;
8442 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
8443 			       bssid, ETH_ALEN);
8444 		}
8445 
8446 		wdev_unlock(dev->ieee80211_ptr);
8447 	}
8448 
8449 	return err;
8450 }
8451 
8452 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8453 {
8454 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8455 	struct net_device *dev = info->user_ptr[1];
8456 	const u8 *ie = NULL, *bssid;
8457 	int ie_len = 0, err;
8458 	u16 reason_code;
8459 	bool local_state_change;
8460 
8461 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8462 		return -EINVAL;
8463 
8464 	if (!info->attrs[NL80211_ATTR_MAC])
8465 		return -EINVAL;
8466 
8467 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
8468 		return -EINVAL;
8469 
8470 	if (!rdev->ops->deauth)
8471 		return -EOPNOTSUPP;
8472 
8473 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8474 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8475 		return -EOPNOTSUPP;
8476 
8477 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8478 
8479 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8480 	if (reason_code == 0) {
8481 		/* Reason Code 0 is reserved */
8482 		return -EINVAL;
8483 	}
8484 
8485 	if (info->attrs[NL80211_ATTR_IE]) {
8486 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8487 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8488 	}
8489 
8490 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8491 
8492 	wdev_lock(dev->ieee80211_ptr);
8493 	err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8494 				   local_state_change);
8495 	wdev_unlock(dev->ieee80211_ptr);
8496 	return err;
8497 }
8498 
8499 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8500 {
8501 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8502 	struct net_device *dev = info->user_ptr[1];
8503 	const u8 *ie = NULL, *bssid;
8504 	int ie_len = 0, err;
8505 	u16 reason_code;
8506 	bool local_state_change;
8507 
8508 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8509 		return -EINVAL;
8510 
8511 	if (!info->attrs[NL80211_ATTR_MAC])
8512 		return -EINVAL;
8513 
8514 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
8515 		return -EINVAL;
8516 
8517 	if (!rdev->ops->disassoc)
8518 		return -EOPNOTSUPP;
8519 
8520 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8521 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8522 		return -EOPNOTSUPP;
8523 
8524 	bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8525 
8526 	reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8527 	if (reason_code == 0) {
8528 		/* Reason Code 0 is reserved */
8529 		return -EINVAL;
8530 	}
8531 
8532 	if (info->attrs[NL80211_ATTR_IE]) {
8533 		ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8534 		ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8535 	}
8536 
8537 	local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8538 
8539 	wdev_lock(dev->ieee80211_ptr);
8540 	err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8541 				     local_state_change);
8542 	wdev_unlock(dev->ieee80211_ptr);
8543 	return err;
8544 }
8545 
8546 static bool
8547 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8548 			 int mcast_rate[NUM_NL80211_BANDS],
8549 			 int rateval)
8550 {
8551 	struct wiphy *wiphy = &rdev->wiphy;
8552 	bool found = false;
8553 	int band, i;
8554 
8555 	for (band = 0; band < NUM_NL80211_BANDS; band++) {
8556 		struct ieee80211_supported_band *sband;
8557 
8558 		sband = wiphy->bands[band];
8559 		if (!sband)
8560 			continue;
8561 
8562 		for (i = 0; i < sband->n_bitrates; i++) {
8563 			if (sband->bitrates[i].bitrate == rateval) {
8564 				mcast_rate[band] = i + 1;
8565 				found = true;
8566 				break;
8567 			}
8568 		}
8569 	}
8570 
8571 	return found;
8572 }
8573 
8574 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8575 {
8576 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8577 	struct net_device *dev = info->user_ptr[1];
8578 	struct cfg80211_ibss_params ibss;
8579 	struct wiphy *wiphy;
8580 	struct cfg80211_cached_keys *connkeys = NULL;
8581 	int err;
8582 
8583 	memset(&ibss, 0, sizeof(ibss));
8584 
8585 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8586 		return -EINVAL;
8587 
8588 	if (!info->attrs[NL80211_ATTR_SSID] ||
8589 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
8590 		return -EINVAL;
8591 
8592 	ibss.beacon_interval = 100;
8593 
8594 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8595 		ibss.beacon_interval =
8596 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8597 
8598 	err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8599 					   ibss.beacon_interval);
8600 	if (err)
8601 		return err;
8602 
8603 	if (!rdev->ops->join_ibss)
8604 		return -EOPNOTSUPP;
8605 
8606 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8607 		return -EOPNOTSUPP;
8608 
8609 	wiphy = &rdev->wiphy;
8610 
8611 	if (info->attrs[NL80211_ATTR_MAC]) {
8612 		ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8613 
8614 		if (!is_valid_ether_addr(ibss.bssid))
8615 			return -EINVAL;
8616 	}
8617 	ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8618 	ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8619 
8620 	if (info->attrs[NL80211_ATTR_IE]) {
8621 		ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8622 		ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8623 	}
8624 
8625 	err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8626 	if (err)
8627 		return err;
8628 
8629 	if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8630 				     NL80211_IFTYPE_ADHOC))
8631 		return -EINVAL;
8632 
8633 	switch (ibss.chandef.width) {
8634 	case NL80211_CHAN_WIDTH_5:
8635 	case NL80211_CHAN_WIDTH_10:
8636 	case NL80211_CHAN_WIDTH_20_NOHT:
8637 		break;
8638 	case NL80211_CHAN_WIDTH_20:
8639 	case NL80211_CHAN_WIDTH_40:
8640 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8641 			return -EINVAL;
8642 		break;
8643 	case NL80211_CHAN_WIDTH_80:
8644 	case NL80211_CHAN_WIDTH_80P80:
8645 	case NL80211_CHAN_WIDTH_160:
8646 		if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8647 			return -EINVAL;
8648 		if (!wiphy_ext_feature_isset(&rdev->wiphy,
8649 					     NL80211_EXT_FEATURE_VHT_IBSS))
8650 			return -EINVAL;
8651 		break;
8652 	default:
8653 		return -EINVAL;
8654 	}
8655 
8656 	ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8657 	ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8658 
8659 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8660 		u8 *rates =
8661 			nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8662 		int n_rates =
8663 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8664 		struct ieee80211_supported_band *sband =
8665 			wiphy->bands[ibss.chandef.chan->band];
8666 
8667 		err = ieee80211_get_ratemask(sband, rates, n_rates,
8668 					     &ibss.basic_rates);
8669 		if (err)
8670 			return err;
8671 	}
8672 
8673 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8674 		memcpy(&ibss.ht_capa_mask,
8675 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8676 		       sizeof(ibss.ht_capa_mask));
8677 
8678 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8679 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8680 			return -EINVAL;
8681 		memcpy(&ibss.ht_capa,
8682 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8683 		       sizeof(ibss.ht_capa));
8684 	}
8685 
8686 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8687 	    !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8688 			nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8689 		return -EINVAL;
8690 
8691 	if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8692 		bool no_ht = false;
8693 
8694 		connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8695 		if (IS_ERR(connkeys))
8696 			return PTR_ERR(connkeys);
8697 
8698 		if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8699 		    no_ht) {
8700 			kzfree(connkeys);
8701 			return -EINVAL;
8702 		}
8703 	}
8704 
8705 	ibss.control_port =
8706 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8707 
8708 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8709 		int r = validate_pae_over_nl80211(rdev, info);
8710 
8711 		if (r < 0)
8712 			return r;
8713 
8714 		ibss.control_port_over_nl80211 = true;
8715 	}
8716 
8717 	ibss.userspace_handles_dfs =
8718 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8719 
8720 	wdev_lock(dev->ieee80211_ptr);
8721 	err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8722 	if (err)
8723 		kzfree(connkeys);
8724 	else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8725 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
8726 	wdev_unlock(dev->ieee80211_ptr);
8727 
8728 	return err;
8729 }
8730 
8731 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8732 {
8733 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8734 	struct net_device *dev = info->user_ptr[1];
8735 
8736 	if (!rdev->ops->leave_ibss)
8737 		return -EOPNOTSUPP;
8738 
8739 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8740 		return -EOPNOTSUPP;
8741 
8742 	return cfg80211_leave_ibss(rdev, dev, false);
8743 }
8744 
8745 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8746 {
8747 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8748 	struct net_device *dev = info->user_ptr[1];
8749 	int mcast_rate[NUM_NL80211_BANDS];
8750 	u32 nla_rate;
8751 	int err;
8752 
8753 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8754 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8755 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8756 		return -EOPNOTSUPP;
8757 
8758 	if (!rdev->ops->set_mcast_rate)
8759 		return -EOPNOTSUPP;
8760 
8761 	memset(mcast_rate, 0, sizeof(mcast_rate));
8762 
8763 	if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8764 		return -EINVAL;
8765 
8766 	nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8767 	if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8768 		return -EINVAL;
8769 
8770 	err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8771 
8772 	return err;
8773 }
8774 
8775 static struct sk_buff *
8776 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8777 			    struct wireless_dev *wdev, int approxlen,
8778 			    u32 portid, u32 seq, enum nl80211_commands cmd,
8779 			    enum nl80211_attrs attr,
8780 			    const struct nl80211_vendor_cmd_info *info,
8781 			    gfp_t gfp)
8782 {
8783 	struct sk_buff *skb;
8784 	void *hdr;
8785 	struct nlattr *data;
8786 
8787 	skb = nlmsg_new(approxlen + 100, gfp);
8788 	if (!skb)
8789 		return NULL;
8790 
8791 	hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8792 	if (!hdr) {
8793 		kfree_skb(skb);
8794 		return NULL;
8795 	}
8796 
8797 	if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8798 		goto nla_put_failure;
8799 
8800 	if (info) {
8801 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8802 				info->vendor_id))
8803 			goto nla_put_failure;
8804 		if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8805 				info->subcmd))
8806 			goto nla_put_failure;
8807 	}
8808 
8809 	if (wdev) {
8810 		if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8811 				      wdev_id(wdev), NL80211_ATTR_PAD))
8812 			goto nla_put_failure;
8813 		if (wdev->netdev &&
8814 		    nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8815 				wdev->netdev->ifindex))
8816 			goto nla_put_failure;
8817 	}
8818 
8819 	data = nla_nest_start(skb, attr);
8820 	if (!data)
8821 		goto nla_put_failure;
8822 
8823 	((void **)skb->cb)[0] = rdev;
8824 	((void **)skb->cb)[1] = hdr;
8825 	((void **)skb->cb)[2] = data;
8826 
8827 	return skb;
8828 
8829  nla_put_failure:
8830 	kfree_skb(skb);
8831 	return NULL;
8832 }
8833 
8834 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8835 					   struct wireless_dev *wdev,
8836 					   enum nl80211_commands cmd,
8837 					   enum nl80211_attrs attr,
8838 					   int vendor_event_idx,
8839 					   int approxlen, gfp_t gfp)
8840 {
8841 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8842 	const struct nl80211_vendor_cmd_info *info;
8843 
8844 	switch (cmd) {
8845 	case NL80211_CMD_TESTMODE:
8846 		if (WARN_ON(vendor_event_idx != -1))
8847 			return NULL;
8848 		info = NULL;
8849 		break;
8850 	case NL80211_CMD_VENDOR:
8851 		if (WARN_ON(vendor_event_idx < 0 ||
8852 			    vendor_event_idx >= wiphy->n_vendor_events))
8853 			return NULL;
8854 		info = &wiphy->vendor_events[vendor_event_idx];
8855 		break;
8856 	default:
8857 		WARN_ON(1);
8858 		return NULL;
8859 	}
8860 
8861 	return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8862 					   cmd, attr, info, gfp);
8863 }
8864 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8865 
8866 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8867 {
8868 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8869 	void *hdr = ((void **)skb->cb)[1];
8870 	struct nlattr *data = ((void **)skb->cb)[2];
8871 	enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8872 
8873 	/* clear CB data for netlink core to own from now on */
8874 	memset(skb->cb, 0, sizeof(skb->cb));
8875 
8876 	nla_nest_end(skb, data);
8877 	genlmsg_end(skb, hdr);
8878 
8879 	if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8880 		mcgrp = NL80211_MCGRP_VENDOR;
8881 
8882 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8883 				mcgrp, gfp);
8884 }
8885 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8886 
8887 #ifdef CONFIG_NL80211_TESTMODE
8888 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8889 {
8890 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
8891 	struct wireless_dev *wdev =
8892 		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8893 	int err;
8894 
8895 	if (!rdev->ops->testmode_cmd)
8896 		return -EOPNOTSUPP;
8897 
8898 	if (IS_ERR(wdev)) {
8899 		err = PTR_ERR(wdev);
8900 		if (err != -EINVAL)
8901 			return err;
8902 		wdev = NULL;
8903 	} else if (wdev->wiphy != &rdev->wiphy) {
8904 		return -EINVAL;
8905 	}
8906 
8907 	if (!info->attrs[NL80211_ATTR_TESTDATA])
8908 		return -EINVAL;
8909 
8910 	rdev->cur_cmd_info = info;
8911 	err = rdev_testmode_cmd(rdev, wdev,
8912 				nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8913 				nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8914 	rdev->cur_cmd_info = NULL;
8915 
8916 	return err;
8917 }
8918 
8919 static int nl80211_testmode_dump(struct sk_buff *skb,
8920 				 struct netlink_callback *cb)
8921 {
8922 	struct cfg80211_registered_device *rdev;
8923 	int err;
8924 	long phy_idx;
8925 	void *data = NULL;
8926 	int data_len = 0;
8927 
8928 	rtnl_lock();
8929 
8930 	if (cb->args[0]) {
8931 		/*
8932 		 * 0 is a valid index, but not valid for args[0],
8933 		 * so we need to offset by 1.
8934 		 */
8935 		phy_idx = cb->args[0] - 1;
8936 
8937 		rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8938 		if (!rdev) {
8939 			err = -ENOENT;
8940 			goto out_err;
8941 		}
8942 	} else {
8943 		struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8944 
8945 		err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8946 				  attrbuf, nl80211_fam.maxattr,
8947 				  nl80211_policy, NULL);
8948 		if (err)
8949 			goto out_err;
8950 
8951 		rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8952 		if (IS_ERR(rdev)) {
8953 			err = PTR_ERR(rdev);
8954 			goto out_err;
8955 		}
8956 		phy_idx = rdev->wiphy_idx;
8957 
8958 		if (attrbuf[NL80211_ATTR_TESTDATA])
8959 			cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8960 	}
8961 
8962 	if (cb->args[1]) {
8963 		data = nla_data((void *)cb->args[1]);
8964 		data_len = nla_len((void *)cb->args[1]);
8965 	}
8966 
8967 	if (!rdev->ops->testmode_dump) {
8968 		err = -EOPNOTSUPP;
8969 		goto out_err;
8970 	}
8971 
8972 	while (1) {
8973 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8974 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
8975 					   NL80211_CMD_TESTMODE);
8976 		struct nlattr *tmdata;
8977 
8978 		if (!hdr)
8979 			break;
8980 
8981 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8982 			genlmsg_cancel(skb, hdr);
8983 			break;
8984 		}
8985 
8986 		tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8987 		if (!tmdata) {
8988 			genlmsg_cancel(skb, hdr);
8989 			break;
8990 		}
8991 		err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8992 		nla_nest_end(skb, tmdata);
8993 
8994 		if (err == -ENOBUFS || err == -ENOENT) {
8995 			genlmsg_cancel(skb, hdr);
8996 			break;
8997 		} else if (err) {
8998 			genlmsg_cancel(skb, hdr);
8999 			goto out_err;
9000 		}
9001 
9002 		genlmsg_end(skb, hdr);
9003 	}
9004 
9005 	err = skb->len;
9006 	/* see above */
9007 	cb->args[0] = phy_idx + 1;
9008  out_err:
9009 	rtnl_unlock();
9010 	return err;
9011 }
9012 #endif
9013 
9014 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9015 {
9016 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9017 	struct net_device *dev = info->user_ptr[1];
9018 	struct cfg80211_connect_params connect;
9019 	struct wiphy *wiphy;
9020 	struct cfg80211_cached_keys *connkeys = NULL;
9021 	int err;
9022 
9023 	memset(&connect, 0, sizeof(connect));
9024 
9025 	if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9026 		return -EINVAL;
9027 
9028 	if (!info->attrs[NL80211_ATTR_SSID] ||
9029 	    !nla_len(info->attrs[NL80211_ATTR_SSID]))
9030 		return -EINVAL;
9031 
9032 	if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9033 		connect.auth_type =
9034 			nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9035 		if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9036 					     NL80211_CMD_CONNECT))
9037 			return -EINVAL;
9038 	} else
9039 		connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9040 
9041 	connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9042 
9043 	if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9044 	    !wiphy_ext_feature_isset(&rdev->wiphy,
9045 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9046 		return -EINVAL;
9047 	connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9048 
9049 	err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9050 				      NL80211_MAX_NR_CIPHER_SUITES);
9051 	if (err)
9052 		return err;
9053 
9054 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9055 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9056 		return -EOPNOTSUPP;
9057 
9058 	wiphy = &rdev->wiphy;
9059 
9060 	connect.bg_scan_period = -1;
9061 	if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9062 		(wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9063 		connect.bg_scan_period =
9064 			nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9065 	}
9066 
9067 	if (info->attrs[NL80211_ATTR_MAC])
9068 		connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9069 	else if (info->attrs[NL80211_ATTR_MAC_HINT])
9070 		connect.bssid_hint =
9071 			nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9072 	connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9073 	connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9074 
9075 	if (info->attrs[NL80211_ATTR_IE]) {
9076 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9077 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9078 	}
9079 
9080 	if (info->attrs[NL80211_ATTR_USE_MFP]) {
9081 		connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9082 		if (connect.mfp == NL80211_MFP_OPTIONAL &&
9083 		    !wiphy_ext_feature_isset(&rdev->wiphy,
9084 					     NL80211_EXT_FEATURE_MFP_OPTIONAL))
9085 			return -EOPNOTSUPP;
9086 
9087 		if (connect.mfp != NL80211_MFP_REQUIRED &&
9088 		    connect.mfp != NL80211_MFP_NO &&
9089 		    connect.mfp != NL80211_MFP_OPTIONAL)
9090 			return -EINVAL;
9091 	} else {
9092 		connect.mfp = NL80211_MFP_NO;
9093 	}
9094 
9095 	if (info->attrs[NL80211_ATTR_PREV_BSSID])
9096 		connect.prev_bssid =
9097 			nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9098 
9099 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9100 		connect.channel = nl80211_get_valid_chan(
9101 			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9102 		if (!connect.channel)
9103 			return -EINVAL;
9104 	} else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9105 		connect.channel_hint = nl80211_get_valid_chan(
9106 			wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9107 		if (!connect.channel_hint)
9108 			return -EINVAL;
9109 	}
9110 
9111 	if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9112 		connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9113 		if (IS_ERR(connkeys))
9114 			return PTR_ERR(connkeys);
9115 	}
9116 
9117 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9118 		connect.flags |= ASSOC_REQ_DISABLE_HT;
9119 
9120 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9121 		memcpy(&connect.ht_capa_mask,
9122 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9123 		       sizeof(connect.ht_capa_mask));
9124 
9125 	if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9126 		if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9127 			kzfree(connkeys);
9128 			return -EINVAL;
9129 		}
9130 		memcpy(&connect.ht_capa,
9131 		       nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9132 		       sizeof(connect.ht_capa));
9133 	}
9134 
9135 	if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9136 		connect.flags |= ASSOC_REQ_DISABLE_VHT;
9137 
9138 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9139 		memcpy(&connect.vht_capa_mask,
9140 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9141 		       sizeof(connect.vht_capa_mask));
9142 
9143 	if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9144 		if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9145 			kzfree(connkeys);
9146 			return -EINVAL;
9147 		}
9148 		memcpy(&connect.vht_capa,
9149 		       nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9150 		       sizeof(connect.vht_capa));
9151 	}
9152 
9153 	if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9154 		if (!((rdev->wiphy.features &
9155 			NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9156 		       (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9157 		    !wiphy_ext_feature_isset(&rdev->wiphy,
9158 					     NL80211_EXT_FEATURE_RRM)) {
9159 			kzfree(connkeys);
9160 			return -EINVAL;
9161 		}
9162 		connect.flags |= ASSOC_REQ_USE_RRM;
9163 	}
9164 
9165 	connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9166 	if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9167 		kzfree(connkeys);
9168 		return -EOPNOTSUPP;
9169 	}
9170 
9171 	if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9172 		/* bss selection makes no sense if bssid is set */
9173 		if (connect.bssid) {
9174 			kzfree(connkeys);
9175 			return -EINVAL;
9176 		}
9177 
9178 		err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9179 				       wiphy, &connect.bss_select);
9180 		if (err) {
9181 			kzfree(connkeys);
9182 			return err;
9183 		}
9184 	}
9185 
9186 	if (wiphy_ext_feature_isset(&rdev->wiphy,
9187 				    NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9188 	    info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9189 	    info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9190 	    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9191 	    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9192 		connect.fils_erp_username =
9193 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9194 		connect.fils_erp_username_len =
9195 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9196 		connect.fils_erp_realm =
9197 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9198 		connect.fils_erp_realm_len =
9199 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9200 		connect.fils_erp_next_seq_num =
9201 			nla_get_u16(
9202 			   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9203 		connect.fils_erp_rrk =
9204 			nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9205 		connect.fils_erp_rrk_len =
9206 			nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9207 	} else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9208 		   info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9209 		   info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9210 		   info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9211 		kzfree(connkeys);
9212 		return -EINVAL;
9213 	}
9214 
9215 	if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9216 		if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9217 			GENL_SET_ERR_MSG(info,
9218 					 "external auth requires connection ownership");
9219 			return -EINVAL;
9220 		}
9221 		connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9222 	}
9223 
9224 	wdev_lock(dev->ieee80211_ptr);
9225 
9226 	err = cfg80211_connect(rdev, dev, &connect, connkeys,
9227 			       connect.prev_bssid);
9228 	if (err)
9229 		kzfree(connkeys);
9230 
9231 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9232 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9233 		if (connect.bssid)
9234 			memcpy(dev->ieee80211_ptr->disconnect_bssid,
9235 			       connect.bssid, ETH_ALEN);
9236 		else
9237 			memset(dev->ieee80211_ptr->disconnect_bssid,
9238 			       0, ETH_ALEN);
9239 	}
9240 
9241 	wdev_unlock(dev->ieee80211_ptr);
9242 
9243 	return err;
9244 }
9245 
9246 static int nl80211_update_connect_params(struct sk_buff *skb,
9247 					 struct genl_info *info)
9248 {
9249 	struct cfg80211_connect_params connect = {};
9250 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9251 	struct net_device *dev = info->user_ptr[1];
9252 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9253 	u32 changed = 0;
9254 	int ret;
9255 
9256 	if (!rdev->ops->update_connect_params)
9257 		return -EOPNOTSUPP;
9258 
9259 	if (info->attrs[NL80211_ATTR_IE]) {
9260 		if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9261 			return -EINVAL;
9262 		connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9263 		connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9264 		changed |= UPDATE_ASSOC_IES;
9265 	}
9266 
9267 	wdev_lock(dev->ieee80211_ptr);
9268 	if (!wdev->current_bss)
9269 		ret = -ENOLINK;
9270 	else
9271 		ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9272 	wdev_unlock(dev->ieee80211_ptr);
9273 
9274 	return ret;
9275 }
9276 
9277 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9278 {
9279 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9280 	struct net_device *dev = info->user_ptr[1];
9281 	u16 reason;
9282 	int ret;
9283 
9284 	if (!info->attrs[NL80211_ATTR_REASON_CODE])
9285 		reason = WLAN_REASON_DEAUTH_LEAVING;
9286 	else
9287 		reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9288 
9289 	if (reason == 0)
9290 		return -EINVAL;
9291 
9292 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9293 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9294 		return -EOPNOTSUPP;
9295 
9296 	wdev_lock(dev->ieee80211_ptr);
9297 	ret = cfg80211_disconnect(rdev, dev, reason, true);
9298 	wdev_unlock(dev->ieee80211_ptr);
9299 	return ret;
9300 }
9301 
9302 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9303 {
9304 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9305 	struct net *net;
9306 	int err;
9307 
9308 	if (info->attrs[NL80211_ATTR_PID]) {
9309 		u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9310 
9311 		net = get_net_ns_by_pid(pid);
9312 	} else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9313 		u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9314 
9315 		net = get_net_ns_by_fd(fd);
9316 	} else {
9317 		return -EINVAL;
9318 	}
9319 
9320 	if (IS_ERR(net))
9321 		return PTR_ERR(net);
9322 
9323 	err = 0;
9324 
9325 	/* check if anything to do */
9326 	if (!net_eq(wiphy_net(&rdev->wiphy), net))
9327 		err = cfg80211_switch_netns(rdev, net);
9328 
9329 	put_net(net);
9330 	return err;
9331 }
9332 
9333 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9334 {
9335 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9336 	int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9337 			struct cfg80211_pmksa *pmksa) = NULL;
9338 	struct net_device *dev = info->user_ptr[1];
9339 	struct cfg80211_pmksa pmksa;
9340 
9341 	memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9342 
9343 	if (!info->attrs[NL80211_ATTR_PMKID])
9344 		return -EINVAL;
9345 
9346 	pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9347 
9348 	if (info->attrs[NL80211_ATTR_MAC]) {
9349 		pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9350 	} else if (info->attrs[NL80211_ATTR_SSID] &&
9351 		   info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9352 		   (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9353 		    info->attrs[NL80211_ATTR_PMK])) {
9354 		pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9355 		pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9356 		pmksa.cache_id =
9357 			nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9358 	} else {
9359 		return -EINVAL;
9360 	}
9361 	if (info->attrs[NL80211_ATTR_PMK]) {
9362 		pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9363 		pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9364 	}
9365 
9366 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9367 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9368 		return -EOPNOTSUPP;
9369 
9370 	switch (info->genlhdr->cmd) {
9371 	case NL80211_CMD_SET_PMKSA:
9372 		rdev_ops = rdev->ops->set_pmksa;
9373 		break;
9374 	case NL80211_CMD_DEL_PMKSA:
9375 		rdev_ops = rdev->ops->del_pmksa;
9376 		break;
9377 	default:
9378 		WARN_ON(1);
9379 		break;
9380 	}
9381 
9382 	if (!rdev_ops)
9383 		return -EOPNOTSUPP;
9384 
9385 	return rdev_ops(&rdev->wiphy, dev, &pmksa);
9386 }
9387 
9388 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9389 {
9390 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9391 	struct net_device *dev = info->user_ptr[1];
9392 
9393 	if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9394 	    dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9395 		return -EOPNOTSUPP;
9396 
9397 	if (!rdev->ops->flush_pmksa)
9398 		return -EOPNOTSUPP;
9399 
9400 	return rdev_flush_pmksa(rdev, dev);
9401 }
9402 
9403 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9404 {
9405 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9406 	struct net_device *dev = info->user_ptr[1];
9407 	u8 action_code, dialog_token;
9408 	u32 peer_capability = 0;
9409 	u16 status_code;
9410 	u8 *peer;
9411 	bool initiator;
9412 
9413 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9414 	    !rdev->ops->tdls_mgmt)
9415 		return -EOPNOTSUPP;
9416 
9417 	if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9418 	    !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9419 	    !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9420 	    !info->attrs[NL80211_ATTR_IE] ||
9421 	    !info->attrs[NL80211_ATTR_MAC])
9422 		return -EINVAL;
9423 
9424 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9425 	action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9426 	status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9427 	dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9428 	initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9429 	if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9430 		peer_capability =
9431 			nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9432 
9433 	return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9434 			      dialog_token, status_code, peer_capability,
9435 			      initiator,
9436 			      nla_data(info->attrs[NL80211_ATTR_IE]),
9437 			      nla_len(info->attrs[NL80211_ATTR_IE]));
9438 }
9439 
9440 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9441 {
9442 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9443 	struct net_device *dev = info->user_ptr[1];
9444 	enum nl80211_tdls_operation operation;
9445 	u8 *peer;
9446 
9447 	if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9448 	    !rdev->ops->tdls_oper)
9449 		return -EOPNOTSUPP;
9450 
9451 	if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9452 	    !info->attrs[NL80211_ATTR_MAC])
9453 		return -EINVAL;
9454 
9455 	operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9456 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9457 
9458 	return rdev_tdls_oper(rdev, dev, peer, operation);
9459 }
9460 
9461 static int nl80211_remain_on_channel(struct sk_buff *skb,
9462 				     struct genl_info *info)
9463 {
9464 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9465 	struct wireless_dev *wdev = info->user_ptr[1];
9466 	struct cfg80211_chan_def chandef;
9467 	const struct cfg80211_chan_def *compat_chandef;
9468 	struct sk_buff *msg;
9469 	void *hdr;
9470 	u64 cookie;
9471 	u32 duration;
9472 	int err;
9473 
9474 	if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9475 	    !info->attrs[NL80211_ATTR_DURATION])
9476 		return -EINVAL;
9477 
9478 	duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9479 
9480 	if (!rdev->ops->remain_on_channel ||
9481 	    !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9482 		return -EOPNOTSUPP;
9483 
9484 	/*
9485 	 * We should be on that channel for at least a minimum amount of
9486 	 * time (10ms) but no longer than the driver supports.
9487 	 */
9488 	if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9489 	    duration > rdev->wiphy.max_remain_on_channel_duration)
9490 		return -EINVAL;
9491 
9492 	err = nl80211_parse_chandef(rdev, info, &chandef);
9493 	if (err)
9494 		return err;
9495 
9496 	wdev_lock(wdev);
9497 	if (!cfg80211_off_channel_oper_allowed(wdev) &&
9498 	    !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9499 		compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9500 							     &chandef);
9501 		if (compat_chandef != &chandef) {
9502 			wdev_unlock(wdev);
9503 			return -EBUSY;
9504 		}
9505 	}
9506 	wdev_unlock(wdev);
9507 
9508 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9509 	if (!msg)
9510 		return -ENOMEM;
9511 
9512 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9513 			     NL80211_CMD_REMAIN_ON_CHANNEL);
9514 	if (!hdr) {
9515 		err = -ENOBUFS;
9516 		goto free_msg;
9517 	}
9518 
9519 	err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9520 				     duration, &cookie);
9521 
9522 	if (err)
9523 		goto free_msg;
9524 
9525 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9526 			      NL80211_ATTR_PAD))
9527 		goto nla_put_failure;
9528 
9529 	genlmsg_end(msg, hdr);
9530 
9531 	return genlmsg_reply(msg, info);
9532 
9533  nla_put_failure:
9534 	err = -ENOBUFS;
9535  free_msg:
9536 	nlmsg_free(msg);
9537 	return err;
9538 }
9539 
9540 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9541 					    struct genl_info *info)
9542 {
9543 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9544 	struct wireless_dev *wdev = info->user_ptr[1];
9545 	u64 cookie;
9546 
9547 	if (!info->attrs[NL80211_ATTR_COOKIE])
9548 		return -EINVAL;
9549 
9550 	if (!rdev->ops->cancel_remain_on_channel)
9551 		return -EOPNOTSUPP;
9552 
9553 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9554 
9555 	return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9556 }
9557 
9558 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9559 				       struct genl_info *info)
9560 {
9561 	struct cfg80211_bitrate_mask mask;
9562 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9563 	struct net_device *dev = info->user_ptr[1];
9564 	int err;
9565 
9566 	if (!rdev->ops->set_bitrate_mask)
9567 		return -EOPNOTSUPP;
9568 
9569 	err = nl80211_parse_tx_bitrate_mask(info, &mask);
9570 	if (err)
9571 		return err;
9572 
9573 	return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9574 }
9575 
9576 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9577 {
9578 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9579 	struct wireless_dev *wdev = info->user_ptr[1];
9580 	u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9581 
9582 	if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9583 		return -EINVAL;
9584 
9585 	if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9586 		frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9587 
9588 	switch (wdev->iftype) {
9589 	case NL80211_IFTYPE_STATION:
9590 	case NL80211_IFTYPE_ADHOC:
9591 	case NL80211_IFTYPE_P2P_CLIENT:
9592 	case NL80211_IFTYPE_AP:
9593 	case NL80211_IFTYPE_AP_VLAN:
9594 	case NL80211_IFTYPE_MESH_POINT:
9595 	case NL80211_IFTYPE_P2P_GO:
9596 	case NL80211_IFTYPE_P2P_DEVICE:
9597 		break;
9598 	case NL80211_IFTYPE_NAN:
9599 	default:
9600 		return -EOPNOTSUPP;
9601 	}
9602 
9603 	/* not much point in registering if we can't reply */
9604 	if (!rdev->ops->mgmt_tx)
9605 		return -EOPNOTSUPP;
9606 
9607 	return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9608 			nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9609 			nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9610 }
9611 
9612 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9613 {
9614 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9615 	struct wireless_dev *wdev = info->user_ptr[1];
9616 	struct cfg80211_chan_def chandef;
9617 	int err;
9618 	void *hdr = NULL;
9619 	u64 cookie;
9620 	struct sk_buff *msg = NULL;
9621 	struct cfg80211_mgmt_tx_params params = {
9622 		.dont_wait_for_ack =
9623 			info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9624 	};
9625 
9626 	if (!info->attrs[NL80211_ATTR_FRAME])
9627 		return -EINVAL;
9628 
9629 	if (!rdev->ops->mgmt_tx)
9630 		return -EOPNOTSUPP;
9631 
9632 	switch (wdev->iftype) {
9633 	case NL80211_IFTYPE_P2P_DEVICE:
9634 		if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9635 			return -EINVAL;
9636 	case NL80211_IFTYPE_STATION:
9637 	case NL80211_IFTYPE_ADHOC:
9638 	case NL80211_IFTYPE_P2P_CLIENT:
9639 	case NL80211_IFTYPE_AP:
9640 	case NL80211_IFTYPE_AP_VLAN:
9641 	case NL80211_IFTYPE_MESH_POINT:
9642 	case NL80211_IFTYPE_P2P_GO:
9643 		break;
9644 	case NL80211_IFTYPE_NAN:
9645 	default:
9646 		return -EOPNOTSUPP;
9647 	}
9648 
9649 	if (info->attrs[NL80211_ATTR_DURATION]) {
9650 		if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9651 			return -EINVAL;
9652 		params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9653 
9654 		/*
9655 		 * We should wait on the channel for at least a minimum amount
9656 		 * of time (10ms) but no longer than the driver supports.
9657 		 */
9658 		if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9659 		    params.wait > rdev->wiphy.max_remain_on_channel_duration)
9660 			return -EINVAL;
9661 	}
9662 
9663 	params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9664 
9665 	if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9666 		return -EINVAL;
9667 
9668 	params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9669 
9670 	/* get the channel if any has been specified, otherwise pass NULL to
9671 	 * the driver. The latter will use the current one
9672 	 */
9673 	chandef.chan = NULL;
9674 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9675 		err = nl80211_parse_chandef(rdev, info, &chandef);
9676 		if (err)
9677 			return err;
9678 	}
9679 
9680 	if (!chandef.chan && params.offchan)
9681 		return -EINVAL;
9682 
9683 	wdev_lock(wdev);
9684 	if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9685 		wdev_unlock(wdev);
9686 		return -EBUSY;
9687 	}
9688 	wdev_unlock(wdev);
9689 
9690 	params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9691 	params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9692 
9693 	if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9694 		int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9695 		int i;
9696 
9697 		if (len % sizeof(u16))
9698 			return -EINVAL;
9699 
9700 		params.n_csa_offsets = len / sizeof(u16);
9701 		params.csa_offsets =
9702 			nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9703 
9704 		/* check that all the offsets fit the frame */
9705 		for (i = 0; i < params.n_csa_offsets; i++) {
9706 			if (params.csa_offsets[i] >= params.len)
9707 				return -EINVAL;
9708 		}
9709 	}
9710 
9711 	if (!params.dont_wait_for_ack) {
9712 		msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9713 		if (!msg)
9714 			return -ENOMEM;
9715 
9716 		hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9717 				     NL80211_CMD_FRAME);
9718 		if (!hdr) {
9719 			err = -ENOBUFS;
9720 			goto free_msg;
9721 		}
9722 	}
9723 
9724 	params.chan = chandef.chan;
9725 	err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9726 	if (err)
9727 		goto free_msg;
9728 
9729 	if (msg) {
9730 		if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9731 				      NL80211_ATTR_PAD))
9732 			goto nla_put_failure;
9733 
9734 		genlmsg_end(msg, hdr);
9735 		return genlmsg_reply(msg, info);
9736 	}
9737 
9738 	return 0;
9739 
9740  nla_put_failure:
9741 	err = -ENOBUFS;
9742  free_msg:
9743 	nlmsg_free(msg);
9744 	return err;
9745 }
9746 
9747 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9748 {
9749 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9750 	struct wireless_dev *wdev = info->user_ptr[1];
9751 	u64 cookie;
9752 
9753 	if (!info->attrs[NL80211_ATTR_COOKIE])
9754 		return -EINVAL;
9755 
9756 	if (!rdev->ops->mgmt_tx_cancel_wait)
9757 		return -EOPNOTSUPP;
9758 
9759 	switch (wdev->iftype) {
9760 	case NL80211_IFTYPE_STATION:
9761 	case NL80211_IFTYPE_ADHOC:
9762 	case NL80211_IFTYPE_P2P_CLIENT:
9763 	case NL80211_IFTYPE_AP:
9764 	case NL80211_IFTYPE_AP_VLAN:
9765 	case NL80211_IFTYPE_P2P_GO:
9766 	case NL80211_IFTYPE_P2P_DEVICE:
9767 		break;
9768 	case NL80211_IFTYPE_NAN:
9769 	default:
9770 		return -EOPNOTSUPP;
9771 	}
9772 
9773 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9774 
9775 	return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9776 }
9777 
9778 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9779 {
9780 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9781 	struct wireless_dev *wdev;
9782 	struct net_device *dev = info->user_ptr[1];
9783 	u8 ps_state;
9784 	bool state;
9785 	int err;
9786 
9787 	if (!info->attrs[NL80211_ATTR_PS_STATE])
9788 		return -EINVAL;
9789 
9790 	ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9791 
9792 	if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9793 		return -EINVAL;
9794 
9795 	wdev = dev->ieee80211_ptr;
9796 
9797 	if (!rdev->ops->set_power_mgmt)
9798 		return -EOPNOTSUPP;
9799 
9800 	state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9801 
9802 	if (state == wdev->ps)
9803 		return 0;
9804 
9805 	err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9806 	if (!err)
9807 		wdev->ps = state;
9808 	return err;
9809 }
9810 
9811 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9812 {
9813 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9814 	enum nl80211_ps_state ps_state;
9815 	struct wireless_dev *wdev;
9816 	struct net_device *dev = info->user_ptr[1];
9817 	struct sk_buff *msg;
9818 	void *hdr;
9819 	int err;
9820 
9821 	wdev = dev->ieee80211_ptr;
9822 
9823 	if (!rdev->ops->set_power_mgmt)
9824 		return -EOPNOTSUPP;
9825 
9826 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9827 	if (!msg)
9828 		return -ENOMEM;
9829 
9830 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9831 			     NL80211_CMD_GET_POWER_SAVE);
9832 	if (!hdr) {
9833 		err = -ENOBUFS;
9834 		goto free_msg;
9835 	}
9836 
9837 	if (wdev->ps)
9838 		ps_state = NL80211_PS_ENABLED;
9839 	else
9840 		ps_state = NL80211_PS_DISABLED;
9841 
9842 	if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9843 		goto nla_put_failure;
9844 
9845 	genlmsg_end(msg, hdr);
9846 	return genlmsg_reply(msg, info);
9847 
9848  nla_put_failure:
9849 	err = -ENOBUFS;
9850  free_msg:
9851 	nlmsg_free(msg);
9852 	return err;
9853 }
9854 
9855 static const struct nla_policy
9856 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9857 	[NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
9858 	[NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9859 	[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9860 	[NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9861 	[NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9862 	[NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9863 	[NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9864 };
9865 
9866 static int nl80211_set_cqm_txe(struct genl_info *info,
9867 			       u32 rate, u32 pkts, u32 intvl)
9868 {
9869 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9870 	struct net_device *dev = info->user_ptr[1];
9871 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9872 
9873 	if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9874 		return -EINVAL;
9875 
9876 	if (!rdev->ops->set_cqm_txe_config)
9877 		return -EOPNOTSUPP;
9878 
9879 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
9880 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9881 		return -EOPNOTSUPP;
9882 
9883 	return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9884 }
9885 
9886 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
9887 				    struct net_device *dev)
9888 {
9889 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9890 	s32 last, low, high;
9891 	u32 hyst;
9892 	int i, n;
9893 	int err;
9894 
9895 	/* RSSI reporting disabled? */
9896 	if (!wdev->cqm_config)
9897 		return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
9898 
9899 	/*
9900 	 * Obtain current RSSI value if possible, if not and no RSSI threshold
9901 	 * event has been received yet, we should receive an event after a
9902 	 * connection is established and enough beacons received to calculate
9903 	 * the average.
9904 	 */
9905 	if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
9906 	    rdev->ops->get_station) {
9907 		struct station_info sinfo = {};
9908 		u8 *mac_addr;
9909 
9910 		mac_addr = wdev->current_bss->pub.bssid;
9911 
9912 		err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
9913 		if (err)
9914 			return err;
9915 
9916 		if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
9917 			wdev->cqm_config->last_rssi_event_value =
9918 				(s8) sinfo.rx_beacon_signal_avg;
9919 	}
9920 
9921 	last = wdev->cqm_config->last_rssi_event_value;
9922 	hyst = wdev->cqm_config->rssi_hyst;
9923 	n = wdev->cqm_config->n_rssi_thresholds;
9924 
9925 	for (i = 0; i < n; i++)
9926 		if (last < wdev->cqm_config->rssi_thresholds[i])
9927 			break;
9928 
9929 	low = i > 0 ?
9930 		(wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
9931 	high = i < n ?
9932 		(wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
9933 
9934 	return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
9935 }
9936 
9937 static int nl80211_set_cqm_rssi(struct genl_info *info,
9938 				const s32 *thresholds, int n_thresholds,
9939 				u32 hysteresis)
9940 {
9941 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
9942 	struct net_device *dev = info->user_ptr[1];
9943 	struct wireless_dev *wdev = dev->ieee80211_ptr;
9944 	int i, err;
9945 	s32 prev = S32_MIN;
9946 
9947 	/* Check all values negative and sorted */
9948 	for (i = 0; i < n_thresholds; i++) {
9949 		if (thresholds[i] > 0 || thresholds[i] <= prev)
9950 			return -EINVAL;
9951 
9952 		prev = thresholds[i];
9953 	}
9954 
9955 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
9956 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9957 		return -EOPNOTSUPP;
9958 
9959 	wdev_lock(wdev);
9960 	cfg80211_cqm_config_free(wdev);
9961 	wdev_unlock(wdev);
9962 
9963 	if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
9964 		if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
9965 			return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
9966 
9967 		return rdev_set_cqm_rssi_config(rdev, dev,
9968 						thresholds[0], hysteresis);
9969 	}
9970 
9971 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
9972 				     NL80211_EXT_FEATURE_CQM_RSSI_LIST))
9973 		return -EOPNOTSUPP;
9974 
9975 	if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
9976 		n_thresholds = 0;
9977 
9978 	wdev_lock(wdev);
9979 	if (n_thresholds) {
9980 		struct cfg80211_cqm_config *cqm_config;
9981 
9982 		cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
9983 				     n_thresholds * sizeof(s32), GFP_KERNEL);
9984 		if (!cqm_config) {
9985 			err = -ENOMEM;
9986 			goto unlock;
9987 		}
9988 
9989 		cqm_config->rssi_hyst = hysteresis;
9990 		cqm_config->n_rssi_thresholds = n_thresholds;
9991 		memcpy(cqm_config->rssi_thresholds, thresholds,
9992 		       n_thresholds * sizeof(s32));
9993 
9994 		wdev->cqm_config = cqm_config;
9995 	}
9996 
9997 	err = cfg80211_cqm_rssi_update(rdev, dev);
9998 
9999 unlock:
10000 	wdev_unlock(wdev);
10001 
10002 	return err;
10003 }
10004 
10005 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10006 {
10007 	struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10008 	struct nlattr *cqm;
10009 	int err;
10010 
10011 	cqm = info->attrs[NL80211_ATTR_CQM];
10012 	if (!cqm)
10013 		return -EINVAL;
10014 
10015 	err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10016 			       nl80211_attr_cqm_policy, info->extack);
10017 	if (err)
10018 		return err;
10019 
10020 	if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10021 	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10022 		const s32 *thresholds =
10023 			nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10024 		int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10025 		u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10026 
10027 		if (len % 4)
10028 			return -EINVAL;
10029 
10030 		return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10031 					    hysteresis);
10032 	}
10033 
10034 	if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10035 	    attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10036 	    attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10037 		u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10038 		u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10039 		u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10040 
10041 		return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10042 	}
10043 
10044 	return -EINVAL;
10045 }
10046 
10047 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10048 {
10049 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10050 	struct net_device *dev = info->user_ptr[1];
10051 	struct ocb_setup setup = {};
10052 	int err;
10053 
10054 	err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10055 	if (err)
10056 		return err;
10057 
10058 	return cfg80211_join_ocb(rdev, dev, &setup);
10059 }
10060 
10061 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10062 {
10063 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10064 	struct net_device *dev = info->user_ptr[1];
10065 
10066 	return cfg80211_leave_ocb(rdev, dev);
10067 }
10068 
10069 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10070 {
10071 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10072 	struct net_device *dev = info->user_ptr[1];
10073 	struct mesh_config cfg;
10074 	struct mesh_setup setup;
10075 	int err;
10076 
10077 	/* start with default */
10078 	memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10079 	memcpy(&setup, &default_mesh_setup, sizeof(setup));
10080 
10081 	if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10082 		/* and parse parameters if given */
10083 		err = nl80211_parse_mesh_config(info, &cfg, NULL);
10084 		if (err)
10085 			return err;
10086 	}
10087 
10088 	if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10089 	    !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10090 		return -EINVAL;
10091 
10092 	setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10093 	setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10094 
10095 	if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10096 	    !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10097 			    nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10098 			return -EINVAL;
10099 
10100 	if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10101 		setup.beacon_interval =
10102 			nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10103 
10104 		err = cfg80211_validate_beacon_int(rdev,
10105 						   NL80211_IFTYPE_MESH_POINT,
10106 						   setup.beacon_interval);
10107 		if (err)
10108 			return err;
10109 	}
10110 
10111 	if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10112 		setup.dtim_period =
10113 			nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10114 		if (setup.dtim_period < 1 || setup.dtim_period > 100)
10115 			return -EINVAL;
10116 	}
10117 
10118 	if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10119 		/* parse additional setup parameters if given */
10120 		err = nl80211_parse_mesh_setup(info, &setup);
10121 		if (err)
10122 			return err;
10123 	}
10124 
10125 	if (setup.user_mpm)
10126 		cfg.auto_open_plinks = false;
10127 
10128 	if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10129 		err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10130 		if (err)
10131 			return err;
10132 	} else {
10133 		/* __cfg80211_join_mesh() will sort it out */
10134 		setup.chandef.chan = NULL;
10135 	}
10136 
10137 	if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10138 		u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10139 		int n_rates =
10140 			nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10141 		struct ieee80211_supported_band *sband;
10142 
10143 		if (!setup.chandef.chan)
10144 			return -EINVAL;
10145 
10146 		sband = rdev->wiphy.bands[setup.chandef.chan->band];
10147 
10148 		err = ieee80211_get_ratemask(sband, rates, n_rates,
10149 					     &setup.basic_rates);
10150 		if (err)
10151 			return err;
10152 	}
10153 
10154 	if (info->attrs[NL80211_ATTR_TX_RATES]) {
10155 		err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10156 		if (err)
10157 			return err;
10158 
10159 		if (!setup.chandef.chan)
10160 			return -EINVAL;
10161 
10162 		err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10163 					      &setup.beacon_rate);
10164 		if (err)
10165 			return err;
10166 	}
10167 
10168 	setup.userspace_handles_dfs =
10169 		nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10170 
10171 	if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10172 		int r = validate_pae_over_nl80211(rdev, info);
10173 
10174 		if (r < 0)
10175 			return r;
10176 
10177 		setup.control_port_over_nl80211 = true;
10178 	}
10179 
10180 	wdev_lock(dev->ieee80211_ptr);
10181 	err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10182 	if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10183 		dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10184 	wdev_unlock(dev->ieee80211_ptr);
10185 
10186 	return err;
10187 }
10188 
10189 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10190 {
10191 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10192 	struct net_device *dev = info->user_ptr[1];
10193 
10194 	return cfg80211_leave_mesh(rdev, dev);
10195 }
10196 
10197 #ifdef CONFIG_PM
10198 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10199 					struct cfg80211_registered_device *rdev)
10200 {
10201 	struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10202 	struct nlattr *nl_pats, *nl_pat;
10203 	int i, pat_len;
10204 
10205 	if (!wowlan->n_patterns)
10206 		return 0;
10207 
10208 	nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10209 	if (!nl_pats)
10210 		return -ENOBUFS;
10211 
10212 	for (i = 0; i < wowlan->n_patterns; i++) {
10213 		nl_pat = nla_nest_start(msg, i + 1);
10214 		if (!nl_pat)
10215 			return -ENOBUFS;
10216 		pat_len = wowlan->patterns[i].pattern_len;
10217 		if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10218 			    wowlan->patterns[i].mask) ||
10219 		    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10220 			    wowlan->patterns[i].pattern) ||
10221 		    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10222 				wowlan->patterns[i].pkt_offset))
10223 			return -ENOBUFS;
10224 		nla_nest_end(msg, nl_pat);
10225 	}
10226 	nla_nest_end(msg, nl_pats);
10227 
10228 	return 0;
10229 }
10230 
10231 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10232 				   struct cfg80211_wowlan_tcp *tcp)
10233 {
10234 	struct nlattr *nl_tcp;
10235 
10236 	if (!tcp)
10237 		return 0;
10238 
10239 	nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10240 	if (!nl_tcp)
10241 		return -ENOBUFS;
10242 
10243 	if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10244 	    nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10245 	    nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10246 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10247 	    nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10248 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10249 		    tcp->payload_len, tcp->payload) ||
10250 	    nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10251 			tcp->data_interval) ||
10252 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10253 		    tcp->wake_len, tcp->wake_data) ||
10254 	    nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10255 		    DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10256 		return -ENOBUFS;
10257 
10258 	if (tcp->payload_seq.len &&
10259 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10260 		    sizeof(tcp->payload_seq), &tcp->payload_seq))
10261 		return -ENOBUFS;
10262 
10263 	if (tcp->payload_tok.len &&
10264 	    nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10265 		    sizeof(tcp->payload_tok) + tcp->tokens_size,
10266 		    &tcp->payload_tok))
10267 		return -ENOBUFS;
10268 
10269 	nla_nest_end(msg, nl_tcp);
10270 
10271 	return 0;
10272 }
10273 
10274 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10275 				  struct cfg80211_sched_scan_request *req)
10276 {
10277 	struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10278 	int i;
10279 
10280 	if (!req)
10281 		return 0;
10282 
10283 	nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10284 	if (!nd)
10285 		return -ENOBUFS;
10286 
10287 	if (req->n_scan_plans == 1 &&
10288 	    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10289 			req->scan_plans[0].interval * 1000))
10290 		return -ENOBUFS;
10291 
10292 	if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10293 		return -ENOBUFS;
10294 
10295 	if (req->relative_rssi_set) {
10296 		struct nl80211_bss_select_rssi_adjust rssi_adjust;
10297 
10298 		if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10299 			       req->relative_rssi))
10300 			return -ENOBUFS;
10301 
10302 		rssi_adjust.band = req->rssi_adjust.band;
10303 		rssi_adjust.delta = req->rssi_adjust.delta;
10304 		if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10305 			    sizeof(rssi_adjust), &rssi_adjust))
10306 			return -ENOBUFS;
10307 	}
10308 
10309 	freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10310 	if (!freqs)
10311 		return -ENOBUFS;
10312 
10313 	for (i = 0; i < req->n_channels; i++) {
10314 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10315 			return -ENOBUFS;
10316 	}
10317 
10318 	nla_nest_end(msg, freqs);
10319 
10320 	if (req->n_match_sets) {
10321 		matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10322 		if (!matches)
10323 			return -ENOBUFS;
10324 
10325 		for (i = 0; i < req->n_match_sets; i++) {
10326 			match = nla_nest_start(msg, i);
10327 			if (!match)
10328 				return -ENOBUFS;
10329 
10330 			if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10331 				    req->match_sets[i].ssid.ssid_len,
10332 				    req->match_sets[i].ssid.ssid))
10333 				return -ENOBUFS;
10334 			nla_nest_end(msg, match);
10335 		}
10336 		nla_nest_end(msg, matches);
10337 	}
10338 
10339 	scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10340 	if (!scan_plans)
10341 		return -ENOBUFS;
10342 
10343 	for (i = 0; i < req->n_scan_plans; i++) {
10344 		scan_plan = nla_nest_start(msg, i + 1);
10345 		if (!scan_plan)
10346 			return -ENOBUFS;
10347 
10348 		if (!scan_plan ||
10349 		    nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10350 				req->scan_plans[i].interval) ||
10351 		    (req->scan_plans[i].iterations &&
10352 		     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10353 				 req->scan_plans[i].iterations)))
10354 			return -ENOBUFS;
10355 		nla_nest_end(msg, scan_plan);
10356 	}
10357 	nla_nest_end(msg, scan_plans);
10358 
10359 	nla_nest_end(msg, nd);
10360 
10361 	return 0;
10362 }
10363 
10364 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10365 {
10366 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10367 	struct sk_buff *msg;
10368 	void *hdr;
10369 	u32 size = NLMSG_DEFAULT_SIZE;
10370 
10371 	if (!rdev->wiphy.wowlan)
10372 		return -EOPNOTSUPP;
10373 
10374 	if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10375 		/* adjust size to have room for all the data */
10376 		size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10377 			rdev->wiphy.wowlan_config->tcp->payload_len +
10378 			rdev->wiphy.wowlan_config->tcp->wake_len +
10379 			rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10380 	}
10381 
10382 	msg = nlmsg_new(size, GFP_KERNEL);
10383 	if (!msg)
10384 		return -ENOMEM;
10385 
10386 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10387 			     NL80211_CMD_GET_WOWLAN);
10388 	if (!hdr)
10389 		goto nla_put_failure;
10390 
10391 	if (rdev->wiphy.wowlan_config) {
10392 		struct nlattr *nl_wowlan;
10393 
10394 		nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10395 		if (!nl_wowlan)
10396 			goto nla_put_failure;
10397 
10398 		if ((rdev->wiphy.wowlan_config->any &&
10399 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10400 		    (rdev->wiphy.wowlan_config->disconnect &&
10401 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10402 		    (rdev->wiphy.wowlan_config->magic_pkt &&
10403 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10404 		    (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10405 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10406 		    (rdev->wiphy.wowlan_config->eap_identity_req &&
10407 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10408 		    (rdev->wiphy.wowlan_config->four_way_handshake &&
10409 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10410 		    (rdev->wiphy.wowlan_config->rfkill_release &&
10411 		     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10412 			goto nla_put_failure;
10413 
10414 		if (nl80211_send_wowlan_patterns(msg, rdev))
10415 			goto nla_put_failure;
10416 
10417 		if (nl80211_send_wowlan_tcp(msg,
10418 					    rdev->wiphy.wowlan_config->tcp))
10419 			goto nla_put_failure;
10420 
10421 		if (nl80211_send_wowlan_nd(
10422 			    msg,
10423 			    rdev->wiphy.wowlan_config->nd_config))
10424 			goto nla_put_failure;
10425 
10426 		nla_nest_end(msg, nl_wowlan);
10427 	}
10428 
10429 	genlmsg_end(msg, hdr);
10430 	return genlmsg_reply(msg, info);
10431 
10432 nla_put_failure:
10433 	nlmsg_free(msg);
10434 	return -ENOBUFS;
10435 }
10436 
10437 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10438 				    struct nlattr *attr,
10439 				    struct cfg80211_wowlan *trig)
10440 {
10441 	struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10442 	struct cfg80211_wowlan_tcp *cfg;
10443 	struct nl80211_wowlan_tcp_data_token *tok = NULL;
10444 	struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10445 	u32 size;
10446 	u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10447 	int err, port;
10448 
10449 	if (!rdev->wiphy.wowlan->tcp)
10450 		return -EINVAL;
10451 
10452 	err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10453 			       nl80211_wowlan_tcp_policy, NULL);
10454 	if (err)
10455 		return err;
10456 
10457 	if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10458 	    !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10459 	    !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10460 	    !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10461 	    !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10462 	    !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10463 	    !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10464 	    !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10465 		return -EINVAL;
10466 
10467 	data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10468 	if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10469 		return -EINVAL;
10470 
10471 	if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10472 			rdev->wiphy.wowlan->tcp->data_interval_max ||
10473 	    nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10474 		return -EINVAL;
10475 
10476 	wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10477 	if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10478 		return -EINVAL;
10479 
10480 	wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10481 	if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10482 		return -EINVAL;
10483 
10484 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10485 		u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10486 
10487 		tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10488 		tokens_size = tokln - sizeof(*tok);
10489 
10490 		if (!tok->len || tokens_size % tok->len)
10491 			return -EINVAL;
10492 		if (!rdev->wiphy.wowlan->tcp->tok)
10493 			return -EINVAL;
10494 		if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10495 			return -EINVAL;
10496 		if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10497 			return -EINVAL;
10498 		if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10499 			return -EINVAL;
10500 		if (tok->offset + tok->len > data_size)
10501 			return -EINVAL;
10502 	}
10503 
10504 	if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10505 		seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10506 		if (!rdev->wiphy.wowlan->tcp->seq)
10507 			return -EINVAL;
10508 		if (seq->len == 0 || seq->len > 4)
10509 			return -EINVAL;
10510 		if (seq->len + seq->offset > data_size)
10511 			return -EINVAL;
10512 	}
10513 
10514 	size = sizeof(*cfg);
10515 	size += data_size;
10516 	size += wake_size + wake_mask_size;
10517 	size += tokens_size;
10518 
10519 	cfg = kzalloc(size, GFP_KERNEL);
10520 	if (!cfg)
10521 		return -ENOMEM;
10522 	cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10523 	cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10524 	memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10525 	       ETH_ALEN);
10526 	if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10527 		port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10528 	else
10529 		port = 0;
10530 #ifdef CONFIG_INET
10531 	/* allocate a socket and port for it and use it */
10532 	err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10533 			    IPPROTO_TCP, &cfg->sock, 1);
10534 	if (err) {
10535 		kfree(cfg);
10536 		return err;
10537 	}
10538 	if (inet_csk_get_port(cfg->sock->sk, port)) {
10539 		sock_release(cfg->sock);
10540 		kfree(cfg);
10541 		return -EADDRINUSE;
10542 	}
10543 	cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10544 #else
10545 	if (!port) {
10546 		kfree(cfg);
10547 		return -EINVAL;
10548 	}
10549 	cfg->src_port = port;
10550 #endif
10551 
10552 	cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10553 	cfg->payload_len = data_size;
10554 	cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10555 	memcpy((void *)cfg->payload,
10556 	       nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10557 	       data_size);
10558 	if (seq)
10559 		cfg->payload_seq = *seq;
10560 	cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10561 	cfg->wake_len = wake_size;
10562 	cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10563 	memcpy((void *)cfg->wake_data,
10564 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10565 	       wake_size);
10566 	cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10567 			 data_size + wake_size;
10568 	memcpy((void *)cfg->wake_mask,
10569 	       nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10570 	       wake_mask_size);
10571 	if (tok) {
10572 		cfg->tokens_size = tokens_size;
10573 		memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10574 	}
10575 
10576 	trig->tcp = cfg;
10577 
10578 	return 0;
10579 }
10580 
10581 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10582 				   const struct wiphy_wowlan_support *wowlan,
10583 				   struct nlattr *attr,
10584 				   struct cfg80211_wowlan *trig)
10585 {
10586 	struct nlattr **tb;
10587 	int err;
10588 
10589 	tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10590 	if (!tb)
10591 		return -ENOMEM;
10592 
10593 	if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10594 		err = -EOPNOTSUPP;
10595 		goto out;
10596 	}
10597 
10598 	err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10599 			       NULL);
10600 	if (err)
10601 		goto out;
10602 
10603 	trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10604 						   wowlan->max_nd_match_sets);
10605 	err = PTR_ERR_OR_ZERO(trig->nd_config);
10606 	if (err)
10607 		trig->nd_config = NULL;
10608 
10609 out:
10610 	kfree(tb);
10611 	return err;
10612 }
10613 
10614 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10615 {
10616 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10617 	struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10618 	struct cfg80211_wowlan new_triggers = {};
10619 	struct cfg80211_wowlan *ntrig;
10620 	const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10621 	int err, i;
10622 	bool prev_enabled = rdev->wiphy.wowlan_config;
10623 	bool regular = false;
10624 
10625 	if (!wowlan)
10626 		return -EOPNOTSUPP;
10627 
10628 	if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10629 		cfg80211_rdev_free_wowlan(rdev);
10630 		rdev->wiphy.wowlan_config = NULL;
10631 		goto set_wakeup;
10632 	}
10633 
10634 	err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10635 			       info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10636 			       nl80211_wowlan_policy, info->extack);
10637 	if (err)
10638 		return err;
10639 
10640 	if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10641 		if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10642 			return -EINVAL;
10643 		new_triggers.any = true;
10644 	}
10645 
10646 	if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10647 		if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10648 			return -EINVAL;
10649 		new_triggers.disconnect = true;
10650 		regular = true;
10651 	}
10652 
10653 	if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10654 		if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10655 			return -EINVAL;
10656 		new_triggers.magic_pkt = true;
10657 		regular = true;
10658 	}
10659 
10660 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10661 		return -EINVAL;
10662 
10663 	if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10664 		if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10665 			return -EINVAL;
10666 		new_triggers.gtk_rekey_failure = true;
10667 		regular = true;
10668 	}
10669 
10670 	if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10671 		if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10672 			return -EINVAL;
10673 		new_triggers.eap_identity_req = true;
10674 		regular = true;
10675 	}
10676 
10677 	if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10678 		if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10679 			return -EINVAL;
10680 		new_triggers.four_way_handshake = true;
10681 		regular = true;
10682 	}
10683 
10684 	if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10685 		if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10686 			return -EINVAL;
10687 		new_triggers.rfkill_release = true;
10688 		regular = true;
10689 	}
10690 
10691 	if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10692 		struct nlattr *pat;
10693 		int n_patterns = 0;
10694 		int rem, pat_len, mask_len, pkt_offset;
10695 		struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10696 
10697 		regular = true;
10698 
10699 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10700 				    rem)
10701 			n_patterns++;
10702 		if (n_patterns > wowlan->n_patterns)
10703 			return -EINVAL;
10704 
10705 		new_triggers.patterns = kcalloc(n_patterns,
10706 						sizeof(new_triggers.patterns[0]),
10707 						GFP_KERNEL);
10708 		if (!new_triggers.patterns)
10709 			return -ENOMEM;
10710 
10711 		new_triggers.n_patterns = n_patterns;
10712 		i = 0;
10713 
10714 		nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10715 				    rem) {
10716 			u8 *mask_pat;
10717 
10718 			nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10719 					 nl80211_packet_pattern_policy,
10720 					 info->extack);
10721 			err = -EINVAL;
10722 			if (!pat_tb[NL80211_PKTPAT_MASK] ||
10723 			    !pat_tb[NL80211_PKTPAT_PATTERN])
10724 				goto error;
10725 			pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10726 			mask_len = DIV_ROUND_UP(pat_len, 8);
10727 			if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10728 				goto error;
10729 			if (pat_len > wowlan->pattern_max_len ||
10730 			    pat_len < wowlan->pattern_min_len)
10731 				goto error;
10732 
10733 			if (!pat_tb[NL80211_PKTPAT_OFFSET])
10734 				pkt_offset = 0;
10735 			else
10736 				pkt_offset = nla_get_u32(
10737 					pat_tb[NL80211_PKTPAT_OFFSET]);
10738 			if (pkt_offset > wowlan->max_pkt_offset)
10739 				goto error;
10740 			new_triggers.patterns[i].pkt_offset = pkt_offset;
10741 
10742 			mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10743 			if (!mask_pat) {
10744 				err = -ENOMEM;
10745 				goto error;
10746 			}
10747 			new_triggers.patterns[i].mask = mask_pat;
10748 			memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10749 			       mask_len);
10750 			mask_pat += mask_len;
10751 			new_triggers.patterns[i].pattern = mask_pat;
10752 			new_triggers.patterns[i].pattern_len = pat_len;
10753 			memcpy(mask_pat,
10754 			       nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10755 			       pat_len);
10756 			i++;
10757 		}
10758 	}
10759 
10760 	if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10761 		regular = true;
10762 		err = nl80211_parse_wowlan_tcp(
10763 			rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10764 			&new_triggers);
10765 		if (err)
10766 			goto error;
10767 	}
10768 
10769 	if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10770 		regular = true;
10771 		err = nl80211_parse_wowlan_nd(
10772 			rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10773 			&new_triggers);
10774 		if (err)
10775 			goto error;
10776 	}
10777 
10778 	/* The 'any' trigger means the device continues operating more or less
10779 	 * as in its normal operation mode and wakes up the host on most of the
10780 	 * normal interrupts (like packet RX, ...)
10781 	 * It therefore makes little sense to combine with the more constrained
10782 	 * wakeup trigger modes.
10783 	 */
10784 	if (new_triggers.any && regular) {
10785 		err = -EINVAL;
10786 		goto error;
10787 	}
10788 
10789 	ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10790 	if (!ntrig) {
10791 		err = -ENOMEM;
10792 		goto error;
10793 	}
10794 	cfg80211_rdev_free_wowlan(rdev);
10795 	rdev->wiphy.wowlan_config = ntrig;
10796 
10797  set_wakeup:
10798 	if (rdev->ops->set_wakeup &&
10799 	    prev_enabled != !!rdev->wiphy.wowlan_config)
10800 		rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10801 
10802 	return 0;
10803  error:
10804 	for (i = 0; i < new_triggers.n_patterns; i++)
10805 		kfree(new_triggers.patterns[i].mask);
10806 	kfree(new_triggers.patterns);
10807 	if (new_triggers.tcp && new_triggers.tcp->sock)
10808 		sock_release(new_triggers.tcp->sock);
10809 	kfree(new_triggers.tcp);
10810 	kfree(new_triggers.nd_config);
10811 	return err;
10812 }
10813 #endif
10814 
10815 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10816 				       struct cfg80211_registered_device *rdev)
10817 {
10818 	struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10819 	int i, j, pat_len;
10820 	struct cfg80211_coalesce_rules *rule;
10821 
10822 	if (!rdev->coalesce->n_rules)
10823 		return 0;
10824 
10825 	nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10826 	if (!nl_rules)
10827 		return -ENOBUFS;
10828 
10829 	for (i = 0; i < rdev->coalesce->n_rules; i++) {
10830 		nl_rule = nla_nest_start(msg, i + 1);
10831 		if (!nl_rule)
10832 			return -ENOBUFS;
10833 
10834 		rule = &rdev->coalesce->rules[i];
10835 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10836 				rule->delay))
10837 			return -ENOBUFS;
10838 
10839 		if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10840 				rule->condition))
10841 			return -ENOBUFS;
10842 
10843 		nl_pats = nla_nest_start(msg,
10844 				NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10845 		if (!nl_pats)
10846 			return -ENOBUFS;
10847 
10848 		for (j = 0; j < rule->n_patterns; j++) {
10849 			nl_pat = nla_nest_start(msg, j + 1);
10850 			if (!nl_pat)
10851 				return -ENOBUFS;
10852 			pat_len = rule->patterns[j].pattern_len;
10853 			if (nla_put(msg, NL80211_PKTPAT_MASK,
10854 				    DIV_ROUND_UP(pat_len, 8),
10855 				    rule->patterns[j].mask) ||
10856 			    nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10857 				    rule->patterns[j].pattern) ||
10858 			    nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10859 					rule->patterns[j].pkt_offset))
10860 				return -ENOBUFS;
10861 			nla_nest_end(msg, nl_pat);
10862 		}
10863 		nla_nest_end(msg, nl_pats);
10864 		nla_nest_end(msg, nl_rule);
10865 	}
10866 	nla_nest_end(msg, nl_rules);
10867 
10868 	return 0;
10869 }
10870 
10871 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10872 {
10873 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
10874 	struct sk_buff *msg;
10875 	void *hdr;
10876 
10877 	if (!rdev->wiphy.coalesce)
10878 		return -EOPNOTSUPP;
10879 
10880 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10881 	if (!msg)
10882 		return -ENOMEM;
10883 
10884 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10885 			     NL80211_CMD_GET_COALESCE);
10886 	if (!hdr)
10887 		goto nla_put_failure;
10888 
10889 	if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10890 		goto nla_put_failure;
10891 
10892 	genlmsg_end(msg, hdr);
10893 	return genlmsg_reply(msg, info);
10894 
10895 nla_put_failure:
10896 	nlmsg_free(msg);
10897 	return -ENOBUFS;
10898 }
10899 
10900 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10901 {
10902 	struct cfg80211_coalesce *coalesce = rdev->coalesce;
10903 	int i, j;
10904 	struct cfg80211_coalesce_rules *rule;
10905 
10906 	if (!coalesce)
10907 		return;
10908 
10909 	for (i = 0; i < coalesce->n_rules; i++) {
10910 		rule = &coalesce->rules[i];
10911 		for (j = 0; j < rule->n_patterns; j++)
10912 			kfree(rule->patterns[j].mask);
10913 		kfree(rule->patterns);
10914 	}
10915 	kfree(coalesce->rules);
10916 	kfree(coalesce);
10917 	rdev->coalesce = NULL;
10918 }
10919 
10920 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10921 				       struct nlattr *rule,
10922 				       struct cfg80211_coalesce_rules *new_rule)
10923 {
10924 	int err, i;
10925 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10926 	struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10927 	int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10928 	struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10929 
10930 	err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10931 			       nl80211_coalesce_policy, NULL);
10932 	if (err)
10933 		return err;
10934 
10935 	if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10936 		new_rule->delay =
10937 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10938 	if (new_rule->delay > coalesce->max_delay)
10939 		return -EINVAL;
10940 
10941 	if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10942 		new_rule->condition =
10943 			nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10944 	if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10945 	    new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10946 		return -EINVAL;
10947 
10948 	if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10949 		return -EINVAL;
10950 
10951 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10952 			    rem)
10953 		n_patterns++;
10954 	if (n_patterns > coalesce->n_patterns)
10955 		return -EINVAL;
10956 
10957 	new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10958 				     GFP_KERNEL);
10959 	if (!new_rule->patterns)
10960 		return -ENOMEM;
10961 
10962 	new_rule->n_patterns = n_patterns;
10963 	i = 0;
10964 
10965 	nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10966 			    rem) {
10967 		u8 *mask_pat;
10968 
10969 		nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10970 				 nl80211_packet_pattern_policy, NULL);
10971 		if (!pat_tb[NL80211_PKTPAT_MASK] ||
10972 		    !pat_tb[NL80211_PKTPAT_PATTERN])
10973 			return -EINVAL;
10974 		pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10975 		mask_len = DIV_ROUND_UP(pat_len, 8);
10976 		if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10977 			return -EINVAL;
10978 		if (pat_len > coalesce->pattern_max_len ||
10979 		    pat_len < coalesce->pattern_min_len)
10980 			return -EINVAL;
10981 
10982 		if (!pat_tb[NL80211_PKTPAT_OFFSET])
10983 			pkt_offset = 0;
10984 		else
10985 			pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10986 		if (pkt_offset > coalesce->max_pkt_offset)
10987 			return -EINVAL;
10988 		new_rule->patterns[i].pkt_offset = pkt_offset;
10989 
10990 		mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10991 		if (!mask_pat)
10992 			return -ENOMEM;
10993 
10994 		new_rule->patterns[i].mask = mask_pat;
10995 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10996 		       mask_len);
10997 
10998 		mask_pat += mask_len;
10999 		new_rule->patterns[i].pattern = mask_pat;
11000 		new_rule->patterns[i].pattern_len = pat_len;
11001 		memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11002 		       pat_len);
11003 		i++;
11004 	}
11005 
11006 	return 0;
11007 }
11008 
11009 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11010 {
11011 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11012 	const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11013 	struct cfg80211_coalesce new_coalesce = {};
11014 	struct cfg80211_coalesce *n_coalesce;
11015 	int err, rem_rule, n_rules = 0, i, j;
11016 	struct nlattr *rule;
11017 	struct cfg80211_coalesce_rules *tmp_rule;
11018 
11019 	if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11020 		return -EOPNOTSUPP;
11021 
11022 	if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11023 		cfg80211_rdev_free_coalesce(rdev);
11024 		rdev_set_coalesce(rdev, NULL);
11025 		return 0;
11026 	}
11027 
11028 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11029 			    rem_rule)
11030 		n_rules++;
11031 	if (n_rules > coalesce->n_rules)
11032 		return -EINVAL;
11033 
11034 	new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11035 				     GFP_KERNEL);
11036 	if (!new_coalesce.rules)
11037 		return -ENOMEM;
11038 
11039 	new_coalesce.n_rules = n_rules;
11040 	i = 0;
11041 
11042 	nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11043 			    rem_rule) {
11044 		err = nl80211_parse_coalesce_rule(rdev, rule,
11045 						  &new_coalesce.rules[i]);
11046 		if (err)
11047 			goto error;
11048 
11049 		i++;
11050 	}
11051 
11052 	err = rdev_set_coalesce(rdev, &new_coalesce);
11053 	if (err)
11054 		goto error;
11055 
11056 	n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11057 	if (!n_coalesce) {
11058 		err = -ENOMEM;
11059 		goto error;
11060 	}
11061 	cfg80211_rdev_free_coalesce(rdev);
11062 	rdev->coalesce = n_coalesce;
11063 
11064 	return 0;
11065 error:
11066 	for (i = 0; i < new_coalesce.n_rules; i++) {
11067 		tmp_rule = &new_coalesce.rules[i];
11068 		for (j = 0; j < tmp_rule->n_patterns; j++)
11069 			kfree(tmp_rule->patterns[j].mask);
11070 		kfree(tmp_rule->patterns);
11071 	}
11072 	kfree(new_coalesce.rules);
11073 
11074 	return err;
11075 }
11076 
11077 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11078 {
11079 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11080 	struct net_device *dev = info->user_ptr[1];
11081 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11082 	struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11083 	struct cfg80211_gtk_rekey_data rekey_data;
11084 	int err;
11085 
11086 	if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11087 		return -EINVAL;
11088 
11089 	err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11090 			       info->attrs[NL80211_ATTR_REKEY_DATA],
11091 			       nl80211_rekey_policy, info->extack);
11092 	if (err)
11093 		return err;
11094 
11095 	if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11096 	    !tb[NL80211_REKEY_DATA_KCK])
11097 		return -EINVAL;
11098 	if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11099 		return -ERANGE;
11100 	if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11101 		return -ERANGE;
11102 	if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11103 		return -ERANGE;
11104 
11105 	rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11106 	rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11107 	rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11108 
11109 	wdev_lock(wdev);
11110 	if (!wdev->current_bss) {
11111 		err = -ENOTCONN;
11112 		goto out;
11113 	}
11114 
11115 	if (!rdev->ops->set_rekey_data) {
11116 		err = -EOPNOTSUPP;
11117 		goto out;
11118 	}
11119 
11120 	err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11121  out:
11122 	wdev_unlock(wdev);
11123 	return err;
11124 }
11125 
11126 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11127 					     struct genl_info *info)
11128 {
11129 	struct net_device *dev = info->user_ptr[1];
11130 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11131 
11132 	if (wdev->iftype != NL80211_IFTYPE_AP &&
11133 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
11134 		return -EINVAL;
11135 
11136 	if (wdev->ap_unexpected_nlportid)
11137 		return -EBUSY;
11138 
11139 	wdev->ap_unexpected_nlportid = info->snd_portid;
11140 	return 0;
11141 }
11142 
11143 static int nl80211_probe_client(struct sk_buff *skb,
11144 				struct genl_info *info)
11145 {
11146 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11147 	struct net_device *dev = info->user_ptr[1];
11148 	struct wireless_dev *wdev = dev->ieee80211_ptr;
11149 	struct sk_buff *msg;
11150 	void *hdr;
11151 	const u8 *addr;
11152 	u64 cookie;
11153 	int err;
11154 
11155 	if (wdev->iftype != NL80211_IFTYPE_AP &&
11156 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
11157 		return -EOPNOTSUPP;
11158 
11159 	if (!info->attrs[NL80211_ATTR_MAC])
11160 		return -EINVAL;
11161 
11162 	if (!rdev->ops->probe_client)
11163 		return -EOPNOTSUPP;
11164 
11165 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11166 	if (!msg)
11167 		return -ENOMEM;
11168 
11169 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11170 			     NL80211_CMD_PROBE_CLIENT);
11171 	if (!hdr) {
11172 		err = -ENOBUFS;
11173 		goto free_msg;
11174 	}
11175 
11176 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11177 
11178 	err = rdev_probe_client(rdev, dev, addr, &cookie);
11179 	if (err)
11180 		goto free_msg;
11181 
11182 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11183 			      NL80211_ATTR_PAD))
11184 		goto nla_put_failure;
11185 
11186 	genlmsg_end(msg, hdr);
11187 
11188 	return genlmsg_reply(msg, info);
11189 
11190  nla_put_failure:
11191 	err = -ENOBUFS;
11192  free_msg:
11193 	nlmsg_free(msg);
11194 	return err;
11195 }
11196 
11197 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11198 {
11199 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11200 	struct cfg80211_beacon_registration *reg, *nreg;
11201 	int rv;
11202 
11203 	if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11204 		return -EOPNOTSUPP;
11205 
11206 	nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11207 	if (!nreg)
11208 		return -ENOMEM;
11209 
11210 	/* First, check if already registered. */
11211 	spin_lock_bh(&rdev->beacon_registrations_lock);
11212 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11213 		if (reg->nlportid == info->snd_portid) {
11214 			rv = -EALREADY;
11215 			goto out_err;
11216 		}
11217 	}
11218 	/* Add it to the list */
11219 	nreg->nlportid = info->snd_portid;
11220 	list_add(&nreg->list, &rdev->beacon_registrations);
11221 
11222 	spin_unlock_bh(&rdev->beacon_registrations_lock);
11223 
11224 	return 0;
11225 out_err:
11226 	spin_unlock_bh(&rdev->beacon_registrations_lock);
11227 	kfree(nreg);
11228 	return rv;
11229 }
11230 
11231 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11232 {
11233 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11234 	struct wireless_dev *wdev = info->user_ptr[1];
11235 	int err;
11236 
11237 	if (!rdev->ops->start_p2p_device)
11238 		return -EOPNOTSUPP;
11239 
11240 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11241 		return -EOPNOTSUPP;
11242 
11243 	if (wdev_running(wdev))
11244 		return 0;
11245 
11246 	if (rfkill_blocked(rdev->rfkill))
11247 		return -ERFKILL;
11248 
11249 	err = rdev_start_p2p_device(rdev, wdev);
11250 	if (err)
11251 		return err;
11252 
11253 	wdev->is_running = true;
11254 	rdev->opencount++;
11255 
11256 	return 0;
11257 }
11258 
11259 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11260 {
11261 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11262 	struct wireless_dev *wdev = info->user_ptr[1];
11263 
11264 	if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11265 		return -EOPNOTSUPP;
11266 
11267 	if (!rdev->ops->stop_p2p_device)
11268 		return -EOPNOTSUPP;
11269 
11270 	cfg80211_stop_p2p_device(rdev, wdev);
11271 
11272 	return 0;
11273 }
11274 
11275 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11276 {
11277 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11278 	struct wireless_dev *wdev = info->user_ptr[1];
11279 	struct cfg80211_nan_conf conf = {};
11280 	int err;
11281 
11282 	if (wdev->iftype != NL80211_IFTYPE_NAN)
11283 		return -EOPNOTSUPP;
11284 
11285 	if (wdev_running(wdev))
11286 		return -EEXIST;
11287 
11288 	if (rfkill_blocked(rdev->rfkill))
11289 		return -ERFKILL;
11290 
11291 	if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11292 		return -EINVAL;
11293 
11294 	conf.master_pref =
11295 		nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11296 	if (!conf.master_pref)
11297 		return -EINVAL;
11298 
11299 	if (info->attrs[NL80211_ATTR_BANDS]) {
11300 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11301 
11302 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11303 			return -EOPNOTSUPP;
11304 
11305 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11306 			return -EINVAL;
11307 
11308 		conf.bands = bands;
11309 	}
11310 
11311 	err = rdev_start_nan(rdev, wdev, &conf);
11312 	if (err)
11313 		return err;
11314 
11315 	wdev->is_running = true;
11316 	rdev->opencount++;
11317 
11318 	return 0;
11319 }
11320 
11321 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11322 {
11323 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11324 	struct wireless_dev *wdev = info->user_ptr[1];
11325 
11326 	if (wdev->iftype != NL80211_IFTYPE_NAN)
11327 		return -EOPNOTSUPP;
11328 
11329 	cfg80211_stop_nan(rdev, wdev);
11330 
11331 	return 0;
11332 }
11333 
11334 static int validate_nan_filter(struct nlattr *filter_attr)
11335 {
11336 	struct nlattr *attr;
11337 	int len = 0, n_entries = 0, rem;
11338 
11339 	nla_for_each_nested(attr, filter_attr, rem) {
11340 		len += nla_len(attr);
11341 		n_entries++;
11342 	}
11343 
11344 	if (len >= U8_MAX)
11345 		return -EINVAL;
11346 
11347 	return n_entries;
11348 }
11349 
11350 static int handle_nan_filter(struct nlattr *attr_filter,
11351 			     struct cfg80211_nan_func *func,
11352 			     bool tx)
11353 {
11354 	struct nlattr *attr;
11355 	int n_entries, rem, i;
11356 	struct cfg80211_nan_func_filter *filter;
11357 
11358 	n_entries = validate_nan_filter(attr_filter);
11359 	if (n_entries < 0)
11360 		return n_entries;
11361 
11362 	BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11363 
11364 	filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11365 	if (!filter)
11366 		return -ENOMEM;
11367 
11368 	i = 0;
11369 	nla_for_each_nested(attr, attr_filter, rem) {
11370 		filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11371 		filter[i].len = nla_len(attr);
11372 		i++;
11373 	}
11374 	if (tx) {
11375 		func->num_tx_filters = n_entries;
11376 		func->tx_filters = filter;
11377 	} else {
11378 		func->num_rx_filters = n_entries;
11379 		func->rx_filters = filter;
11380 	}
11381 
11382 	return 0;
11383 }
11384 
11385 static int nl80211_nan_add_func(struct sk_buff *skb,
11386 				struct genl_info *info)
11387 {
11388 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11389 	struct wireless_dev *wdev = info->user_ptr[1];
11390 	struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11391 	struct cfg80211_nan_func *func;
11392 	struct sk_buff *msg = NULL;
11393 	void *hdr = NULL;
11394 	int err = 0;
11395 
11396 	if (wdev->iftype != NL80211_IFTYPE_NAN)
11397 		return -EOPNOTSUPP;
11398 
11399 	if (!wdev_running(wdev))
11400 		return -ENOTCONN;
11401 
11402 	if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11403 		return -EINVAL;
11404 
11405 	err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11406 			       info->attrs[NL80211_ATTR_NAN_FUNC],
11407 			       nl80211_nan_func_policy, info->extack);
11408 	if (err)
11409 		return err;
11410 
11411 	func = kzalloc(sizeof(*func), GFP_KERNEL);
11412 	if (!func)
11413 		return -ENOMEM;
11414 
11415 	func->cookie = wdev->wiphy->cookie_counter++;
11416 
11417 	if (!tb[NL80211_NAN_FUNC_TYPE] ||
11418 	    nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11419 		err = -EINVAL;
11420 		goto out;
11421 	}
11422 
11423 
11424 	func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11425 
11426 	if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11427 		err = -EINVAL;
11428 		goto out;
11429 	}
11430 
11431 	memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11432 	       sizeof(func->service_id));
11433 
11434 	func->close_range =
11435 		nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11436 
11437 	if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11438 		func->serv_spec_info_len =
11439 			nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11440 		func->serv_spec_info =
11441 			kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11442 				func->serv_spec_info_len,
11443 				GFP_KERNEL);
11444 		if (!func->serv_spec_info) {
11445 			err = -ENOMEM;
11446 			goto out;
11447 		}
11448 	}
11449 
11450 	if (tb[NL80211_NAN_FUNC_TTL])
11451 		func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11452 
11453 	switch (func->type) {
11454 	case NL80211_NAN_FUNC_PUBLISH:
11455 		if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11456 			err = -EINVAL;
11457 			goto out;
11458 		}
11459 
11460 		func->publish_type =
11461 			nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11462 		func->publish_bcast =
11463 			nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11464 
11465 		if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11466 			func->publish_bcast) {
11467 			err = -EINVAL;
11468 			goto out;
11469 		}
11470 		break;
11471 	case NL80211_NAN_FUNC_SUBSCRIBE:
11472 		func->subscribe_active =
11473 			nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11474 		break;
11475 	case NL80211_NAN_FUNC_FOLLOW_UP:
11476 		if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11477 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11478 		    !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11479 			err = -EINVAL;
11480 			goto out;
11481 		}
11482 
11483 		func->followup_id =
11484 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11485 		func->followup_reqid =
11486 			nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11487 		memcpy(func->followup_dest.addr,
11488 		       nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11489 		       sizeof(func->followup_dest.addr));
11490 		if (func->ttl) {
11491 			err = -EINVAL;
11492 			goto out;
11493 		}
11494 		break;
11495 	default:
11496 		err = -EINVAL;
11497 		goto out;
11498 	}
11499 
11500 	if (tb[NL80211_NAN_FUNC_SRF]) {
11501 		struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11502 
11503 		err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11504 				       tb[NL80211_NAN_FUNC_SRF],
11505 				       nl80211_nan_srf_policy, info->extack);
11506 		if (err)
11507 			goto out;
11508 
11509 		func->srf_include =
11510 			nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11511 
11512 		if (srf_tb[NL80211_NAN_SRF_BF]) {
11513 			if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11514 			    !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11515 				err = -EINVAL;
11516 				goto out;
11517 			}
11518 
11519 			func->srf_bf_len =
11520 				nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11521 			func->srf_bf =
11522 				kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11523 					func->srf_bf_len, GFP_KERNEL);
11524 			if (!func->srf_bf) {
11525 				err = -ENOMEM;
11526 				goto out;
11527 			}
11528 
11529 			func->srf_bf_idx =
11530 				nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11531 		} else {
11532 			struct nlattr *attr, *mac_attr =
11533 				srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11534 			int n_entries, rem, i = 0;
11535 
11536 			if (!mac_attr) {
11537 				err = -EINVAL;
11538 				goto out;
11539 			}
11540 
11541 			n_entries = validate_acl_mac_addrs(mac_attr);
11542 			if (n_entries <= 0) {
11543 				err = -EINVAL;
11544 				goto out;
11545 			}
11546 
11547 			func->srf_num_macs = n_entries;
11548 			func->srf_macs =
11549 				kzalloc(sizeof(*func->srf_macs) * n_entries,
11550 					GFP_KERNEL);
11551 			if (!func->srf_macs) {
11552 				err = -ENOMEM;
11553 				goto out;
11554 			}
11555 
11556 			nla_for_each_nested(attr, mac_attr, rem)
11557 				memcpy(func->srf_macs[i++].addr, nla_data(attr),
11558 				       sizeof(*func->srf_macs));
11559 		}
11560 	}
11561 
11562 	if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11563 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11564 					func, true);
11565 		if (err)
11566 			goto out;
11567 	}
11568 
11569 	if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11570 		err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11571 					func, false);
11572 		if (err)
11573 			goto out;
11574 	}
11575 
11576 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11577 	if (!msg) {
11578 		err = -ENOMEM;
11579 		goto out;
11580 	}
11581 
11582 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11583 			     NL80211_CMD_ADD_NAN_FUNCTION);
11584 	/* This can't really happen - we just allocated 4KB */
11585 	if (WARN_ON(!hdr)) {
11586 		err = -ENOMEM;
11587 		goto out;
11588 	}
11589 
11590 	err = rdev_add_nan_func(rdev, wdev, func);
11591 out:
11592 	if (err < 0) {
11593 		cfg80211_free_nan_func(func);
11594 		nlmsg_free(msg);
11595 		return err;
11596 	}
11597 
11598 	/* propagate the instance id and cookie to userspace  */
11599 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11600 			      NL80211_ATTR_PAD))
11601 		goto nla_put_failure;
11602 
11603 	func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11604 	if (!func_attr)
11605 		goto nla_put_failure;
11606 
11607 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11608 		       func->instance_id))
11609 		goto nla_put_failure;
11610 
11611 	nla_nest_end(msg, func_attr);
11612 
11613 	genlmsg_end(msg, hdr);
11614 	return genlmsg_reply(msg, info);
11615 
11616 nla_put_failure:
11617 	nlmsg_free(msg);
11618 	return -ENOBUFS;
11619 }
11620 
11621 static int nl80211_nan_del_func(struct sk_buff *skb,
11622 			       struct genl_info *info)
11623 {
11624 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11625 	struct wireless_dev *wdev = info->user_ptr[1];
11626 	u64 cookie;
11627 
11628 	if (wdev->iftype != NL80211_IFTYPE_NAN)
11629 		return -EOPNOTSUPP;
11630 
11631 	if (!wdev_running(wdev))
11632 		return -ENOTCONN;
11633 
11634 	if (!info->attrs[NL80211_ATTR_COOKIE])
11635 		return -EINVAL;
11636 
11637 	cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11638 
11639 	rdev_del_nan_func(rdev, wdev, cookie);
11640 
11641 	return 0;
11642 }
11643 
11644 static int nl80211_nan_change_config(struct sk_buff *skb,
11645 				     struct genl_info *info)
11646 {
11647 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11648 	struct wireless_dev *wdev = info->user_ptr[1];
11649 	struct cfg80211_nan_conf conf = {};
11650 	u32 changed = 0;
11651 
11652 	if (wdev->iftype != NL80211_IFTYPE_NAN)
11653 		return -EOPNOTSUPP;
11654 
11655 	if (!wdev_running(wdev))
11656 		return -ENOTCONN;
11657 
11658 	if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11659 		conf.master_pref =
11660 			nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11661 		if (conf.master_pref <= 1 || conf.master_pref == 255)
11662 			return -EINVAL;
11663 
11664 		changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11665 	}
11666 
11667 	if (info->attrs[NL80211_ATTR_BANDS]) {
11668 		u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11669 
11670 		if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11671 			return -EOPNOTSUPP;
11672 
11673 		if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11674 			return -EINVAL;
11675 
11676 		conf.bands = bands;
11677 		changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11678 	}
11679 
11680 	if (!changed)
11681 		return -EINVAL;
11682 
11683 	return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11684 }
11685 
11686 void cfg80211_nan_match(struct wireless_dev *wdev,
11687 			struct cfg80211_nan_match_params *match, gfp_t gfp)
11688 {
11689 	struct wiphy *wiphy = wdev->wiphy;
11690 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11691 	struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11692 	struct sk_buff *msg;
11693 	void *hdr;
11694 
11695 	if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11696 		return;
11697 
11698 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11699 	if (!msg)
11700 		return;
11701 
11702 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11703 	if (!hdr) {
11704 		nlmsg_free(msg);
11705 		return;
11706 	}
11707 
11708 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11709 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11710 					 wdev->netdev->ifindex)) ||
11711 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11712 			      NL80211_ATTR_PAD))
11713 		goto nla_put_failure;
11714 
11715 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11716 			      NL80211_ATTR_PAD) ||
11717 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11718 		goto nla_put_failure;
11719 
11720 	match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11721 	if (!match_attr)
11722 		goto nla_put_failure;
11723 
11724 	local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11725 	if (!local_func_attr)
11726 		goto nla_put_failure;
11727 
11728 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11729 		goto nla_put_failure;
11730 
11731 	nla_nest_end(msg, local_func_attr);
11732 
11733 	peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11734 	if (!peer_func_attr)
11735 		goto nla_put_failure;
11736 
11737 	if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11738 	    nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11739 		goto nla_put_failure;
11740 
11741 	if (match->info && match->info_len &&
11742 	    nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11743 		    match->info))
11744 		goto nla_put_failure;
11745 
11746 	nla_nest_end(msg, peer_func_attr);
11747 	nla_nest_end(msg, match_attr);
11748 	genlmsg_end(msg, hdr);
11749 
11750 	if (!wdev->owner_nlportid)
11751 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11752 					msg, 0, NL80211_MCGRP_NAN, gfp);
11753 	else
11754 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11755 				wdev->owner_nlportid);
11756 
11757 	return;
11758 
11759 nla_put_failure:
11760 	nlmsg_free(msg);
11761 }
11762 EXPORT_SYMBOL(cfg80211_nan_match);
11763 
11764 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11765 				  u8 inst_id,
11766 				  enum nl80211_nan_func_term_reason reason,
11767 				  u64 cookie, gfp_t gfp)
11768 {
11769 	struct wiphy *wiphy = wdev->wiphy;
11770 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11771 	struct sk_buff *msg;
11772 	struct nlattr *func_attr;
11773 	void *hdr;
11774 
11775 	if (WARN_ON(!inst_id))
11776 		return;
11777 
11778 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11779 	if (!msg)
11780 		return;
11781 
11782 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11783 	if (!hdr) {
11784 		nlmsg_free(msg);
11785 		return;
11786 	}
11787 
11788 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11789 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11790 					 wdev->netdev->ifindex)) ||
11791 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11792 			      NL80211_ATTR_PAD))
11793 		goto nla_put_failure;
11794 
11795 	if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11796 			      NL80211_ATTR_PAD))
11797 		goto nla_put_failure;
11798 
11799 	func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11800 	if (!func_attr)
11801 		goto nla_put_failure;
11802 
11803 	if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11804 	    nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11805 		goto nla_put_failure;
11806 
11807 	nla_nest_end(msg, func_attr);
11808 	genlmsg_end(msg, hdr);
11809 
11810 	if (!wdev->owner_nlportid)
11811 		genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11812 					msg, 0, NL80211_MCGRP_NAN, gfp);
11813 	else
11814 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11815 				wdev->owner_nlportid);
11816 
11817 	return;
11818 
11819 nla_put_failure:
11820 	nlmsg_free(msg);
11821 }
11822 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11823 
11824 static int nl80211_get_protocol_features(struct sk_buff *skb,
11825 					 struct genl_info *info)
11826 {
11827 	void *hdr;
11828 	struct sk_buff *msg;
11829 
11830 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11831 	if (!msg)
11832 		return -ENOMEM;
11833 
11834 	hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11835 			     NL80211_CMD_GET_PROTOCOL_FEATURES);
11836 	if (!hdr)
11837 		goto nla_put_failure;
11838 
11839 	if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11840 			NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11841 		goto nla_put_failure;
11842 
11843 	genlmsg_end(msg, hdr);
11844 	return genlmsg_reply(msg, info);
11845 
11846  nla_put_failure:
11847 	kfree_skb(msg);
11848 	return -ENOBUFS;
11849 }
11850 
11851 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11852 {
11853 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11854 	struct cfg80211_update_ft_ies_params ft_params;
11855 	struct net_device *dev = info->user_ptr[1];
11856 
11857 	if (!rdev->ops->update_ft_ies)
11858 		return -EOPNOTSUPP;
11859 
11860 	if (!info->attrs[NL80211_ATTR_MDID] ||
11861 	    !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11862 		return -EINVAL;
11863 
11864 	memset(&ft_params, 0, sizeof(ft_params));
11865 	ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11866 	ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11867 	ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11868 
11869 	return rdev_update_ft_ies(rdev, dev, &ft_params);
11870 }
11871 
11872 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11873 				       struct genl_info *info)
11874 {
11875 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11876 	struct wireless_dev *wdev = info->user_ptr[1];
11877 	enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11878 	u16 duration;
11879 	int ret;
11880 
11881 	if (!rdev->ops->crit_proto_start)
11882 		return -EOPNOTSUPP;
11883 
11884 	if (WARN_ON(!rdev->ops->crit_proto_stop))
11885 		return -EINVAL;
11886 
11887 	if (rdev->crit_proto_nlportid)
11888 		return -EBUSY;
11889 
11890 	/* determine protocol if provided */
11891 	if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11892 		proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11893 
11894 	if (proto >= NUM_NL80211_CRIT_PROTO)
11895 		return -EINVAL;
11896 
11897 	/* timeout must be provided */
11898 	if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11899 		return -EINVAL;
11900 
11901 	duration =
11902 		nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11903 
11904 	if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11905 		return -ERANGE;
11906 
11907 	ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11908 	if (!ret)
11909 		rdev->crit_proto_nlportid = info->snd_portid;
11910 
11911 	return ret;
11912 }
11913 
11914 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11915 				      struct genl_info *info)
11916 {
11917 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11918 	struct wireless_dev *wdev = info->user_ptr[1];
11919 
11920 	if (!rdev->ops->crit_proto_stop)
11921 		return -EOPNOTSUPP;
11922 
11923 	if (rdev->crit_proto_nlportid) {
11924 		rdev->crit_proto_nlportid = 0;
11925 		rdev_crit_proto_stop(rdev, wdev);
11926 	}
11927 	return 0;
11928 }
11929 
11930 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11931 {
11932 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
11933 	struct wireless_dev *wdev =
11934 		__cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11935 	int i, err;
11936 	u32 vid, subcmd;
11937 
11938 	if (!rdev->wiphy.vendor_commands)
11939 		return -EOPNOTSUPP;
11940 
11941 	if (IS_ERR(wdev)) {
11942 		err = PTR_ERR(wdev);
11943 		if (err != -EINVAL)
11944 			return err;
11945 		wdev = NULL;
11946 	} else if (wdev->wiphy != &rdev->wiphy) {
11947 		return -EINVAL;
11948 	}
11949 
11950 	if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11951 	    !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11952 		return -EINVAL;
11953 
11954 	vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11955 	subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11956 	for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11957 		const struct wiphy_vendor_command *vcmd;
11958 		void *data = NULL;
11959 		int len = 0;
11960 
11961 		vcmd = &rdev->wiphy.vendor_commands[i];
11962 
11963 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11964 			continue;
11965 
11966 		if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11967 				   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11968 			if (!wdev)
11969 				return -EINVAL;
11970 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11971 			    !wdev->netdev)
11972 				return -EINVAL;
11973 
11974 			if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11975 				if (!wdev_running(wdev))
11976 					return -ENETDOWN;
11977 			}
11978 
11979 			if (!vcmd->doit)
11980 				return -EOPNOTSUPP;
11981 		} else {
11982 			wdev = NULL;
11983 		}
11984 
11985 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11986 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11987 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11988 		}
11989 
11990 		rdev->cur_cmd_info = info;
11991 		err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11992 							  data, len);
11993 		rdev->cur_cmd_info = NULL;
11994 		return err;
11995 	}
11996 
11997 	return -EOPNOTSUPP;
11998 }
11999 
12000 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12001 				       struct netlink_callback *cb,
12002 				       struct cfg80211_registered_device **rdev,
12003 				       struct wireless_dev **wdev)
12004 {
12005 	struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12006 	u32 vid, subcmd;
12007 	unsigned int i;
12008 	int vcmd_idx = -1;
12009 	int err;
12010 	void *data = NULL;
12011 	unsigned int data_len = 0;
12012 
12013 	if (cb->args[0]) {
12014 		/* subtract the 1 again here */
12015 		struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12016 		struct wireless_dev *tmp;
12017 
12018 		if (!wiphy)
12019 			return -ENODEV;
12020 		*rdev = wiphy_to_rdev(wiphy);
12021 		*wdev = NULL;
12022 
12023 		if (cb->args[1]) {
12024 			list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12025 				if (tmp->identifier == cb->args[1] - 1) {
12026 					*wdev = tmp;
12027 					break;
12028 				}
12029 			}
12030 		}
12031 
12032 		/* keep rtnl locked in successful case */
12033 		return 0;
12034 	}
12035 
12036 	err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12037 			  nl80211_fam.maxattr, nl80211_policy, NULL);
12038 	if (err)
12039 		return err;
12040 
12041 	if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12042 	    !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12043 		return -EINVAL;
12044 
12045 	*wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12046 	if (IS_ERR(*wdev))
12047 		*wdev = NULL;
12048 
12049 	*rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12050 	if (IS_ERR(*rdev))
12051 		return PTR_ERR(*rdev);
12052 
12053 	vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12054 	subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12055 
12056 	for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12057 		const struct wiphy_vendor_command *vcmd;
12058 
12059 		vcmd = &(*rdev)->wiphy.vendor_commands[i];
12060 
12061 		if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12062 			continue;
12063 
12064 		if (!vcmd->dumpit)
12065 			return -EOPNOTSUPP;
12066 
12067 		vcmd_idx = i;
12068 		break;
12069 	}
12070 
12071 	if (vcmd_idx < 0)
12072 		return -EOPNOTSUPP;
12073 
12074 	if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12075 		data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12076 		data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12077 	}
12078 
12079 	/* 0 is the first index - add 1 to parse only once */
12080 	cb->args[0] = (*rdev)->wiphy_idx + 1;
12081 	/* add 1 to know if it was NULL */
12082 	cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12083 	cb->args[2] = vcmd_idx;
12084 	cb->args[3] = (unsigned long)data;
12085 	cb->args[4] = data_len;
12086 
12087 	/* keep rtnl locked in successful case */
12088 	return 0;
12089 }
12090 
12091 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12092 				   struct netlink_callback *cb)
12093 {
12094 	struct cfg80211_registered_device *rdev;
12095 	struct wireless_dev *wdev;
12096 	unsigned int vcmd_idx;
12097 	const struct wiphy_vendor_command *vcmd;
12098 	void *data;
12099 	int data_len;
12100 	int err;
12101 	struct nlattr *vendor_data;
12102 
12103 	rtnl_lock();
12104 	err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12105 	if (err)
12106 		goto out;
12107 
12108 	vcmd_idx = cb->args[2];
12109 	data = (void *)cb->args[3];
12110 	data_len = cb->args[4];
12111 	vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12112 
12113 	if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12114 			   WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12115 		if (!wdev) {
12116 			err = -EINVAL;
12117 			goto out;
12118 		}
12119 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12120 		    !wdev->netdev) {
12121 			err = -EINVAL;
12122 			goto out;
12123 		}
12124 
12125 		if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12126 			if (!wdev_running(wdev)) {
12127 				err = -ENETDOWN;
12128 				goto out;
12129 			}
12130 		}
12131 	}
12132 
12133 	while (1) {
12134 		void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12135 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
12136 					   NL80211_CMD_VENDOR);
12137 		if (!hdr)
12138 			break;
12139 
12140 		if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12141 		    (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12142 					       wdev_id(wdev),
12143 					       NL80211_ATTR_PAD))) {
12144 			genlmsg_cancel(skb, hdr);
12145 			break;
12146 		}
12147 
12148 		vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12149 		if (!vendor_data) {
12150 			genlmsg_cancel(skb, hdr);
12151 			break;
12152 		}
12153 
12154 		err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12155 				   (unsigned long *)&cb->args[5]);
12156 		nla_nest_end(skb, vendor_data);
12157 
12158 		if (err == -ENOBUFS || err == -ENOENT) {
12159 			genlmsg_cancel(skb, hdr);
12160 			break;
12161 		} else if (err) {
12162 			genlmsg_cancel(skb, hdr);
12163 			goto out;
12164 		}
12165 
12166 		genlmsg_end(skb, hdr);
12167 	}
12168 
12169 	err = skb->len;
12170  out:
12171 	rtnl_unlock();
12172 	return err;
12173 }
12174 
12175 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12176 					   enum nl80211_commands cmd,
12177 					   enum nl80211_attrs attr,
12178 					   int approxlen)
12179 {
12180 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12181 
12182 	if (WARN_ON(!rdev->cur_cmd_info))
12183 		return NULL;
12184 
12185 	return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12186 					   rdev->cur_cmd_info->snd_portid,
12187 					   rdev->cur_cmd_info->snd_seq,
12188 					   cmd, attr, NULL, GFP_KERNEL);
12189 }
12190 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12191 
12192 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12193 {
12194 	struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12195 	void *hdr = ((void **)skb->cb)[1];
12196 	struct nlattr *data = ((void **)skb->cb)[2];
12197 
12198 	/* clear CB data for netlink core to own from now on */
12199 	memset(skb->cb, 0, sizeof(skb->cb));
12200 
12201 	if (WARN_ON(!rdev->cur_cmd_info)) {
12202 		kfree_skb(skb);
12203 		return -EINVAL;
12204 	}
12205 
12206 	nla_nest_end(skb, data);
12207 	genlmsg_end(skb, hdr);
12208 	return genlmsg_reply(skb, rdev->cur_cmd_info);
12209 }
12210 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12211 
12212 static int nl80211_set_qos_map(struct sk_buff *skb,
12213 			       struct genl_info *info)
12214 {
12215 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12216 	struct cfg80211_qos_map *qos_map = NULL;
12217 	struct net_device *dev = info->user_ptr[1];
12218 	u8 *pos, len, num_des, des_len, des;
12219 	int ret;
12220 
12221 	if (!rdev->ops->set_qos_map)
12222 		return -EOPNOTSUPP;
12223 
12224 	if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12225 		pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12226 		len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12227 
12228 		if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12229 		    len > IEEE80211_QOS_MAP_LEN_MAX)
12230 			return -EINVAL;
12231 
12232 		qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12233 		if (!qos_map)
12234 			return -ENOMEM;
12235 
12236 		num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12237 		if (num_des) {
12238 			des_len = num_des *
12239 				sizeof(struct cfg80211_dscp_exception);
12240 			memcpy(qos_map->dscp_exception, pos, des_len);
12241 			qos_map->num_des = num_des;
12242 			for (des = 0; des < num_des; des++) {
12243 				if (qos_map->dscp_exception[des].up > 7) {
12244 					kfree(qos_map);
12245 					return -EINVAL;
12246 				}
12247 			}
12248 			pos += des_len;
12249 		}
12250 		memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12251 	}
12252 
12253 	wdev_lock(dev->ieee80211_ptr);
12254 	ret = nl80211_key_allowed(dev->ieee80211_ptr);
12255 	if (!ret)
12256 		ret = rdev_set_qos_map(rdev, dev, qos_map);
12257 	wdev_unlock(dev->ieee80211_ptr);
12258 
12259 	kfree(qos_map);
12260 	return ret;
12261 }
12262 
12263 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12264 {
12265 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12266 	struct net_device *dev = info->user_ptr[1];
12267 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12268 	const u8 *peer;
12269 	u8 tsid, up;
12270 	u16 admitted_time = 0;
12271 	int err;
12272 
12273 	if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12274 		return -EOPNOTSUPP;
12275 
12276 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12277 	    !info->attrs[NL80211_ATTR_USER_PRIO])
12278 		return -EINVAL;
12279 
12280 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12281 	if (tsid >= IEEE80211_NUM_TIDS)
12282 		return -EINVAL;
12283 
12284 	up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12285 	if (up >= IEEE80211_NUM_UPS)
12286 		return -EINVAL;
12287 
12288 	/* WMM uses TIDs 0-7 even for TSPEC */
12289 	if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12290 		/* TODO: handle 802.11 TSPEC/admission control
12291 		 * need more attributes for that (e.g. BA session requirement);
12292 		 * change the WMM adminssion test above to allow both then
12293 		 */
12294 		return -EINVAL;
12295 	}
12296 
12297 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12298 
12299 	if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12300 		admitted_time =
12301 			nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12302 		if (!admitted_time)
12303 			return -EINVAL;
12304 	}
12305 
12306 	wdev_lock(wdev);
12307 	switch (wdev->iftype) {
12308 	case NL80211_IFTYPE_STATION:
12309 	case NL80211_IFTYPE_P2P_CLIENT:
12310 		if (wdev->current_bss)
12311 			break;
12312 		err = -ENOTCONN;
12313 		goto out;
12314 	default:
12315 		err = -EOPNOTSUPP;
12316 		goto out;
12317 	}
12318 
12319 	err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12320 
12321  out:
12322 	wdev_unlock(wdev);
12323 	return err;
12324 }
12325 
12326 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12327 {
12328 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12329 	struct net_device *dev = info->user_ptr[1];
12330 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12331 	const u8 *peer;
12332 	u8 tsid;
12333 	int err;
12334 
12335 	if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12336 		return -EINVAL;
12337 
12338 	tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12339 	peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12340 
12341 	wdev_lock(wdev);
12342 	err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12343 	wdev_unlock(wdev);
12344 
12345 	return err;
12346 }
12347 
12348 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12349 				       struct genl_info *info)
12350 {
12351 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12352 	struct net_device *dev = info->user_ptr[1];
12353 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12354 	struct cfg80211_chan_def chandef = {};
12355 	const u8 *addr;
12356 	u8 oper_class;
12357 	int err;
12358 
12359 	if (!rdev->ops->tdls_channel_switch ||
12360 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12361 		return -EOPNOTSUPP;
12362 
12363 	switch (dev->ieee80211_ptr->iftype) {
12364 	case NL80211_IFTYPE_STATION:
12365 	case NL80211_IFTYPE_P2P_CLIENT:
12366 		break;
12367 	default:
12368 		return -EOPNOTSUPP;
12369 	}
12370 
12371 	if (!info->attrs[NL80211_ATTR_MAC] ||
12372 	    !info->attrs[NL80211_ATTR_OPER_CLASS])
12373 		return -EINVAL;
12374 
12375 	err = nl80211_parse_chandef(rdev, info, &chandef);
12376 	if (err)
12377 		return err;
12378 
12379 	/*
12380 	 * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12381 	 * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12382 	 * specification is not defined for them.
12383 	 */
12384 	if (chandef.chan->band == NL80211_BAND_2GHZ &&
12385 	    chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12386 	    chandef.width != NL80211_CHAN_WIDTH_20)
12387 		return -EINVAL;
12388 
12389 	/* we will be active on the TDLS link */
12390 	if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12391 					   wdev->iftype))
12392 		return -EINVAL;
12393 
12394 	/* don't allow switching to DFS channels */
12395 	if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12396 		return -EINVAL;
12397 
12398 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12399 	oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12400 
12401 	wdev_lock(wdev);
12402 	err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12403 	wdev_unlock(wdev);
12404 
12405 	return err;
12406 }
12407 
12408 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12409 					      struct genl_info *info)
12410 {
12411 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12412 	struct net_device *dev = info->user_ptr[1];
12413 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12414 	const u8 *addr;
12415 
12416 	if (!rdev->ops->tdls_channel_switch ||
12417 	    !rdev->ops->tdls_cancel_channel_switch ||
12418 	    !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12419 		return -EOPNOTSUPP;
12420 
12421 	switch (dev->ieee80211_ptr->iftype) {
12422 	case NL80211_IFTYPE_STATION:
12423 	case NL80211_IFTYPE_P2P_CLIENT:
12424 		break;
12425 	default:
12426 		return -EOPNOTSUPP;
12427 	}
12428 
12429 	if (!info->attrs[NL80211_ATTR_MAC])
12430 		return -EINVAL;
12431 
12432 	addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12433 
12434 	wdev_lock(wdev);
12435 	rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12436 	wdev_unlock(wdev);
12437 
12438 	return 0;
12439 }
12440 
12441 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12442 					    struct genl_info *info)
12443 {
12444 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12445 	struct net_device *dev = info->user_ptr[1];
12446 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12447 	const struct nlattr *nla;
12448 	bool enabled;
12449 
12450 	if (!rdev->ops->set_multicast_to_unicast)
12451 		return -EOPNOTSUPP;
12452 
12453 	if (wdev->iftype != NL80211_IFTYPE_AP &&
12454 	    wdev->iftype != NL80211_IFTYPE_P2P_GO)
12455 		return -EOPNOTSUPP;
12456 
12457 	nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12458 	enabled = nla_get_flag(nla);
12459 
12460 	return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12461 }
12462 
12463 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12464 {
12465 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12466 	struct net_device *dev = info->user_ptr[1];
12467 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12468 	struct cfg80211_pmk_conf pmk_conf = {};
12469 	int ret;
12470 
12471 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
12472 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12473 		return -EOPNOTSUPP;
12474 
12475 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
12476 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12477 		return -EOPNOTSUPP;
12478 
12479 	if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12480 		return -EINVAL;
12481 
12482 	wdev_lock(wdev);
12483 	if (!wdev->current_bss) {
12484 		ret = -ENOTCONN;
12485 		goto out;
12486 	}
12487 
12488 	pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12489 	if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12490 		ret = -EINVAL;
12491 		goto out;
12492 	}
12493 
12494 	pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12495 	pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12496 	if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12497 	    pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12498 		ret = -EINVAL;
12499 		goto out;
12500 	}
12501 
12502 	if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12503 		int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12504 
12505 		if (r0_name_len != WLAN_PMK_NAME_LEN) {
12506 			ret = -EINVAL;
12507 			goto out;
12508 		}
12509 
12510 		pmk_conf.pmk_r0_name =
12511 			nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12512 	}
12513 
12514 	ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12515 out:
12516 	wdev_unlock(wdev);
12517 	return ret;
12518 }
12519 
12520 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12521 {
12522 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12523 	struct net_device *dev = info->user_ptr[1];
12524 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12525 	const u8 *aa;
12526 	int ret;
12527 
12528 	if (wdev->iftype != NL80211_IFTYPE_STATION &&
12529 	    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12530 		return -EOPNOTSUPP;
12531 
12532 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
12533 				     NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12534 		return -EOPNOTSUPP;
12535 
12536 	if (!info->attrs[NL80211_ATTR_MAC])
12537 		return -EINVAL;
12538 
12539 	wdev_lock(wdev);
12540 	aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12541 	ret = rdev_del_pmk(rdev, dev, aa);
12542 	wdev_unlock(wdev);
12543 
12544 	return ret;
12545 }
12546 
12547 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12548 {
12549 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12550 	struct net_device *dev = info->user_ptr[1];
12551 	struct cfg80211_external_auth_params params;
12552 
12553 	if (!rdev->ops->external_auth)
12554 		return -EOPNOTSUPP;
12555 
12556 	if (!info->attrs[NL80211_ATTR_SSID])
12557 		return -EINVAL;
12558 
12559 	if (!info->attrs[NL80211_ATTR_BSSID])
12560 		return -EINVAL;
12561 
12562 	if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12563 		return -EINVAL;
12564 
12565 	memset(&params, 0, sizeof(params));
12566 
12567 	params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12568 	if (params.ssid.ssid_len == 0 ||
12569 	    params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12570 		return -EINVAL;
12571 	memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12572 	       params.ssid.ssid_len);
12573 
12574 	memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12575 	       ETH_ALEN);
12576 
12577 	params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12578 
12579 	return rdev_external_auth(rdev, dev, &params);
12580 }
12581 
12582 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12583 {
12584 	struct cfg80211_registered_device *rdev = info->user_ptr[0];
12585 	struct net_device *dev = info->user_ptr[1];
12586 	struct wireless_dev *wdev = dev->ieee80211_ptr;
12587 	const u8 *buf;
12588 	size_t len;
12589 	u8 *dest;
12590 	u16 proto;
12591 	bool noencrypt;
12592 	int err;
12593 
12594 	if (!wiphy_ext_feature_isset(&rdev->wiphy,
12595 				     NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12596 		return -EOPNOTSUPP;
12597 
12598 	if (!rdev->ops->tx_control_port)
12599 		return -EOPNOTSUPP;
12600 
12601 	if (!info->attrs[NL80211_ATTR_FRAME] ||
12602 	    !info->attrs[NL80211_ATTR_MAC] ||
12603 	    !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12604 		GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12605 		return -EINVAL;
12606 	}
12607 
12608 	wdev_lock(wdev);
12609 
12610 	switch (wdev->iftype) {
12611 	case NL80211_IFTYPE_AP:
12612 	case NL80211_IFTYPE_P2P_GO:
12613 	case NL80211_IFTYPE_MESH_POINT:
12614 		break;
12615 	case NL80211_IFTYPE_ADHOC:
12616 	case NL80211_IFTYPE_STATION:
12617 	case NL80211_IFTYPE_P2P_CLIENT:
12618 		if (wdev->current_bss)
12619 			break;
12620 		err = -ENOTCONN;
12621 		goto out;
12622 	default:
12623 		err = -EOPNOTSUPP;
12624 		goto out;
12625 	}
12626 
12627 	wdev_unlock(wdev);
12628 
12629 	buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12630 	len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12631 	dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12632 	proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12633 	noencrypt =
12634 		nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12635 
12636 	return rdev_tx_control_port(rdev, dev, buf, len,
12637 				    dest, cpu_to_be16(proto), noencrypt);
12638 
12639  out:
12640 	wdev_unlock(wdev);
12641 	return err;
12642 }
12643 
12644 #define NL80211_FLAG_NEED_WIPHY		0x01
12645 #define NL80211_FLAG_NEED_NETDEV	0x02
12646 #define NL80211_FLAG_NEED_RTNL		0x04
12647 #define NL80211_FLAG_CHECK_NETDEV_UP	0x08
12648 #define NL80211_FLAG_NEED_NETDEV_UP	(NL80211_FLAG_NEED_NETDEV |\
12649 					 NL80211_FLAG_CHECK_NETDEV_UP)
12650 #define NL80211_FLAG_NEED_WDEV		0x10
12651 /* If a netdev is associated, it must be UP, P2P must be started */
12652 #define NL80211_FLAG_NEED_WDEV_UP	(NL80211_FLAG_NEED_WDEV |\
12653 					 NL80211_FLAG_CHECK_NETDEV_UP)
12654 #define NL80211_FLAG_CLEAR_SKB		0x20
12655 
12656 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12657 			    struct genl_info *info)
12658 {
12659 	struct cfg80211_registered_device *rdev;
12660 	struct wireless_dev *wdev;
12661 	struct net_device *dev;
12662 	bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
12663 
12664 	if (rtnl)
12665 		rtnl_lock();
12666 
12667 	if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
12668 		rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
12669 		if (IS_ERR(rdev)) {
12670 			if (rtnl)
12671 				rtnl_unlock();
12672 			return PTR_ERR(rdev);
12673 		}
12674 		info->user_ptr[0] = rdev;
12675 	} else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12676 		   ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12677 		ASSERT_RTNL();
12678 
12679 		wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12680 						  info->attrs);
12681 		if (IS_ERR(wdev)) {
12682 			if (rtnl)
12683 				rtnl_unlock();
12684 			return PTR_ERR(wdev);
12685 		}
12686 
12687 		dev = wdev->netdev;
12688 		rdev = wiphy_to_rdev(wdev->wiphy);
12689 
12690 		if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12691 			if (!dev) {
12692 				if (rtnl)
12693 					rtnl_unlock();
12694 				return -EINVAL;
12695 			}
12696 
12697 			info->user_ptr[1] = dev;
12698 		} else {
12699 			info->user_ptr[1] = wdev;
12700 		}
12701 
12702 		if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12703 		    !wdev_running(wdev)) {
12704 			if (rtnl)
12705 				rtnl_unlock();
12706 			return -ENETDOWN;
12707 		}
12708 
12709 		if (dev)
12710 			dev_hold(dev);
12711 
12712 		info->user_ptr[0] = rdev;
12713 	}
12714 
12715 	return 0;
12716 }
12717 
12718 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12719 			      struct genl_info *info)
12720 {
12721 	if (info->user_ptr[1]) {
12722 		if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12723 			struct wireless_dev *wdev = info->user_ptr[1];
12724 
12725 			if (wdev->netdev)
12726 				dev_put(wdev->netdev);
12727 		} else {
12728 			dev_put(info->user_ptr[1]);
12729 		}
12730 	}
12731 
12732 	if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12733 		rtnl_unlock();
12734 
12735 	/* If needed, clear the netlink message payload from the SKB
12736 	 * as it might contain key data that shouldn't stick around on
12737 	 * the heap after the SKB is freed. The netlink message header
12738 	 * is still needed for further processing, so leave it intact.
12739 	 */
12740 	if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12741 		struct nlmsghdr *nlh = nlmsg_hdr(skb);
12742 
12743 		memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12744 	}
12745 }
12746 
12747 static const struct genl_ops nl80211_ops[] = {
12748 	{
12749 		.cmd = NL80211_CMD_GET_WIPHY,
12750 		.doit = nl80211_get_wiphy,
12751 		.dumpit = nl80211_dump_wiphy,
12752 		.done = nl80211_dump_wiphy_done,
12753 		.policy = nl80211_policy,
12754 		/* can be retrieved by unprivileged users */
12755 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
12756 				  NL80211_FLAG_NEED_RTNL,
12757 	},
12758 	{
12759 		.cmd = NL80211_CMD_SET_WIPHY,
12760 		.doit = nl80211_set_wiphy,
12761 		.policy = nl80211_policy,
12762 		.flags = GENL_UNS_ADMIN_PERM,
12763 		.internal_flags = NL80211_FLAG_NEED_RTNL,
12764 	},
12765 	{
12766 		.cmd = NL80211_CMD_GET_INTERFACE,
12767 		.doit = nl80211_get_interface,
12768 		.dumpit = nl80211_dump_interface,
12769 		.policy = nl80211_policy,
12770 		/* can be retrieved by unprivileged users */
12771 		.internal_flags = NL80211_FLAG_NEED_WDEV |
12772 				  NL80211_FLAG_NEED_RTNL,
12773 	},
12774 	{
12775 		.cmd = NL80211_CMD_SET_INTERFACE,
12776 		.doit = nl80211_set_interface,
12777 		.policy = nl80211_policy,
12778 		.flags = GENL_UNS_ADMIN_PERM,
12779 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
12780 				  NL80211_FLAG_NEED_RTNL,
12781 	},
12782 	{
12783 		.cmd = NL80211_CMD_NEW_INTERFACE,
12784 		.doit = nl80211_new_interface,
12785 		.policy = nl80211_policy,
12786 		.flags = GENL_UNS_ADMIN_PERM,
12787 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
12788 				  NL80211_FLAG_NEED_RTNL,
12789 	},
12790 	{
12791 		.cmd = NL80211_CMD_DEL_INTERFACE,
12792 		.doit = nl80211_del_interface,
12793 		.policy = nl80211_policy,
12794 		.flags = GENL_UNS_ADMIN_PERM,
12795 		.internal_flags = NL80211_FLAG_NEED_WDEV |
12796 				  NL80211_FLAG_NEED_RTNL,
12797 	},
12798 	{
12799 		.cmd = NL80211_CMD_GET_KEY,
12800 		.doit = nl80211_get_key,
12801 		.policy = nl80211_policy,
12802 		.flags = GENL_UNS_ADMIN_PERM,
12803 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12804 				  NL80211_FLAG_NEED_RTNL,
12805 	},
12806 	{
12807 		.cmd = NL80211_CMD_SET_KEY,
12808 		.doit = nl80211_set_key,
12809 		.policy = nl80211_policy,
12810 		.flags = GENL_UNS_ADMIN_PERM,
12811 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12812 				  NL80211_FLAG_NEED_RTNL |
12813 				  NL80211_FLAG_CLEAR_SKB,
12814 	},
12815 	{
12816 		.cmd = NL80211_CMD_NEW_KEY,
12817 		.doit = nl80211_new_key,
12818 		.policy = nl80211_policy,
12819 		.flags = GENL_UNS_ADMIN_PERM,
12820 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12821 				  NL80211_FLAG_NEED_RTNL |
12822 				  NL80211_FLAG_CLEAR_SKB,
12823 	},
12824 	{
12825 		.cmd = NL80211_CMD_DEL_KEY,
12826 		.doit = nl80211_del_key,
12827 		.policy = nl80211_policy,
12828 		.flags = GENL_UNS_ADMIN_PERM,
12829 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12830 				  NL80211_FLAG_NEED_RTNL,
12831 	},
12832 	{
12833 		.cmd = NL80211_CMD_SET_BEACON,
12834 		.policy = nl80211_policy,
12835 		.flags = GENL_UNS_ADMIN_PERM,
12836 		.doit = nl80211_set_beacon,
12837 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12838 				  NL80211_FLAG_NEED_RTNL,
12839 	},
12840 	{
12841 		.cmd = NL80211_CMD_START_AP,
12842 		.policy = nl80211_policy,
12843 		.flags = GENL_UNS_ADMIN_PERM,
12844 		.doit = nl80211_start_ap,
12845 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12846 				  NL80211_FLAG_NEED_RTNL,
12847 	},
12848 	{
12849 		.cmd = NL80211_CMD_STOP_AP,
12850 		.policy = nl80211_policy,
12851 		.flags = GENL_UNS_ADMIN_PERM,
12852 		.doit = nl80211_stop_ap,
12853 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12854 				  NL80211_FLAG_NEED_RTNL,
12855 	},
12856 	{
12857 		.cmd = NL80211_CMD_GET_STATION,
12858 		.doit = nl80211_get_station,
12859 		.dumpit = nl80211_dump_station,
12860 		.policy = nl80211_policy,
12861 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
12862 				  NL80211_FLAG_NEED_RTNL,
12863 	},
12864 	{
12865 		.cmd = NL80211_CMD_SET_STATION,
12866 		.doit = nl80211_set_station,
12867 		.policy = nl80211_policy,
12868 		.flags = GENL_UNS_ADMIN_PERM,
12869 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12870 				  NL80211_FLAG_NEED_RTNL,
12871 	},
12872 	{
12873 		.cmd = NL80211_CMD_NEW_STATION,
12874 		.doit = nl80211_new_station,
12875 		.policy = nl80211_policy,
12876 		.flags = GENL_UNS_ADMIN_PERM,
12877 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12878 				  NL80211_FLAG_NEED_RTNL,
12879 	},
12880 	{
12881 		.cmd = NL80211_CMD_DEL_STATION,
12882 		.doit = nl80211_del_station,
12883 		.policy = nl80211_policy,
12884 		.flags = GENL_UNS_ADMIN_PERM,
12885 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12886 				  NL80211_FLAG_NEED_RTNL,
12887 	},
12888 	{
12889 		.cmd = NL80211_CMD_GET_MPATH,
12890 		.doit = nl80211_get_mpath,
12891 		.dumpit = nl80211_dump_mpath,
12892 		.policy = nl80211_policy,
12893 		.flags = GENL_UNS_ADMIN_PERM,
12894 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12895 				  NL80211_FLAG_NEED_RTNL,
12896 	},
12897 	{
12898 		.cmd = NL80211_CMD_GET_MPP,
12899 		.doit = nl80211_get_mpp,
12900 		.dumpit = nl80211_dump_mpp,
12901 		.policy = nl80211_policy,
12902 		.flags = GENL_UNS_ADMIN_PERM,
12903 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12904 				  NL80211_FLAG_NEED_RTNL,
12905 	},
12906 	{
12907 		.cmd = NL80211_CMD_SET_MPATH,
12908 		.doit = nl80211_set_mpath,
12909 		.policy = nl80211_policy,
12910 		.flags = GENL_UNS_ADMIN_PERM,
12911 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12912 				  NL80211_FLAG_NEED_RTNL,
12913 	},
12914 	{
12915 		.cmd = NL80211_CMD_NEW_MPATH,
12916 		.doit = nl80211_new_mpath,
12917 		.policy = nl80211_policy,
12918 		.flags = GENL_UNS_ADMIN_PERM,
12919 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12920 				  NL80211_FLAG_NEED_RTNL,
12921 	},
12922 	{
12923 		.cmd = NL80211_CMD_DEL_MPATH,
12924 		.doit = nl80211_del_mpath,
12925 		.policy = nl80211_policy,
12926 		.flags = GENL_UNS_ADMIN_PERM,
12927 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12928 				  NL80211_FLAG_NEED_RTNL,
12929 	},
12930 	{
12931 		.cmd = NL80211_CMD_SET_BSS,
12932 		.doit = nl80211_set_bss,
12933 		.policy = nl80211_policy,
12934 		.flags = GENL_UNS_ADMIN_PERM,
12935 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12936 				  NL80211_FLAG_NEED_RTNL,
12937 	},
12938 	{
12939 		.cmd = NL80211_CMD_GET_REG,
12940 		.doit = nl80211_get_reg_do,
12941 		.dumpit = nl80211_get_reg_dump,
12942 		.policy = nl80211_policy,
12943 		.internal_flags = NL80211_FLAG_NEED_RTNL,
12944 		/* can be retrieved by unprivileged users */
12945 	},
12946 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12947 	{
12948 		.cmd = NL80211_CMD_SET_REG,
12949 		.doit = nl80211_set_reg,
12950 		.policy = nl80211_policy,
12951 		.flags = GENL_ADMIN_PERM,
12952 		.internal_flags = NL80211_FLAG_NEED_RTNL,
12953 	},
12954 #endif
12955 	{
12956 		.cmd = NL80211_CMD_REQ_SET_REG,
12957 		.doit = nl80211_req_set_reg,
12958 		.policy = nl80211_policy,
12959 		.flags = GENL_ADMIN_PERM,
12960 	},
12961 	{
12962 		.cmd = NL80211_CMD_RELOAD_REGDB,
12963 		.doit = nl80211_reload_regdb,
12964 		.policy = nl80211_policy,
12965 		.flags = GENL_ADMIN_PERM,
12966 	},
12967 	{
12968 		.cmd = NL80211_CMD_GET_MESH_CONFIG,
12969 		.doit = nl80211_get_mesh_config,
12970 		.policy = nl80211_policy,
12971 		/* can be retrieved by unprivileged users */
12972 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12973 				  NL80211_FLAG_NEED_RTNL,
12974 	},
12975 	{
12976 		.cmd = NL80211_CMD_SET_MESH_CONFIG,
12977 		.doit = nl80211_update_mesh_config,
12978 		.policy = nl80211_policy,
12979 		.flags = GENL_UNS_ADMIN_PERM,
12980 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12981 				  NL80211_FLAG_NEED_RTNL,
12982 	},
12983 	{
12984 		.cmd = NL80211_CMD_TRIGGER_SCAN,
12985 		.doit = nl80211_trigger_scan,
12986 		.policy = nl80211_policy,
12987 		.flags = GENL_UNS_ADMIN_PERM,
12988 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12989 				  NL80211_FLAG_NEED_RTNL,
12990 	},
12991 	{
12992 		.cmd = NL80211_CMD_ABORT_SCAN,
12993 		.doit = nl80211_abort_scan,
12994 		.policy = nl80211_policy,
12995 		.flags = GENL_UNS_ADMIN_PERM,
12996 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12997 				  NL80211_FLAG_NEED_RTNL,
12998 	},
12999 	{
13000 		.cmd = NL80211_CMD_GET_SCAN,
13001 		.policy = nl80211_policy,
13002 		.dumpit = nl80211_dump_scan,
13003 	},
13004 	{
13005 		.cmd = NL80211_CMD_START_SCHED_SCAN,
13006 		.doit = nl80211_start_sched_scan,
13007 		.policy = nl80211_policy,
13008 		.flags = GENL_UNS_ADMIN_PERM,
13009 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13010 				  NL80211_FLAG_NEED_RTNL,
13011 	},
13012 	{
13013 		.cmd = NL80211_CMD_STOP_SCHED_SCAN,
13014 		.doit = nl80211_stop_sched_scan,
13015 		.policy = nl80211_policy,
13016 		.flags = GENL_UNS_ADMIN_PERM,
13017 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13018 				  NL80211_FLAG_NEED_RTNL,
13019 	},
13020 	{
13021 		.cmd = NL80211_CMD_AUTHENTICATE,
13022 		.doit = nl80211_authenticate,
13023 		.policy = nl80211_policy,
13024 		.flags = GENL_UNS_ADMIN_PERM,
13025 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13026 				  NL80211_FLAG_NEED_RTNL |
13027 				  NL80211_FLAG_CLEAR_SKB,
13028 	},
13029 	{
13030 		.cmd = NL80211_CMD_ASSOCIATE,
13031 		.doit = nl80211_associate,
13032 		.policy = nl80211_policy,
13033 		.flags = GENL_UNS_ADMIN_PERM,
13034 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13035 				  NL80211_FLAG_NEED_RTNL,
13036 	},
13037 	{
13038 		.cmd = NL80211_CMD_DEAUTHENTICATE,
13039 		.doit = nl80211_deauthenticate,
13040 		.policy = nl80211_policy,
13041 		.flags = GENL_UNS_ADMIN_PERM,
13042 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13043 				  NL80211_FLAG_NEED_RTNL,
13044 	},
13045 	{
13046 		.cmd = NL80211_CMD_DISASSOCIATE,
13047 		.doit = nl80211_disassociate,
13048 		.policy = nl80211_policy,
13049 		.flags = GENL_UNS_ADMIN_PERM,
13050 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13051 				  NL80211_FLAG_NEED_RTNL,
13052 	},
13053 	{
13054 		.cmd = NL80211_CMD_JOIN_IBSS,
13055 		.doit = nl80211_join_ibss,
13056 		.policy = nl80211_policy,
13057 		.flags = GENL_UNS_ADMIN_PERM,
13058 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13059 				  NL80211_FLAG_NEED_RTNL,
13060 	},
13061 	{
13062 		.cmd = NL80211_CMD_LEAVE_IBSS,
13063 		.doit = nl80211_leave_ibss,
13064 		.policy = nl80211_policy,
13065 		.flags = GENL_UNS_ADMIN_PERM,
13066 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13067 				  NL80211_FLAG_NEED_RTNL,
13068 	},
13069 #ifdef CONFIG_NL80211_TESTMODE
13070 	{
13071 		.cmd = NL80211_CMD_TESTMODE,
13072 		.doit = nl80211_testmode_do,
13073 		.dumpit = nl80211_testmode_dump,
13074 		.policy = nl80211_policy,
13075 		.flags = GENL_UNS_ADMIN_PERM,
13076 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13077 				  NL80211_FLAG_NEED_RTNL,
13078 	},
13079 #endif
13080 	{
13081 		.cmd = NL80211_CMD_CONNECT,
13082 		.doit = nl80211_connect,
13083 		.policy = nl80211_policy,
13084 		.flags = GENL_UNS_ADMIN_PERM,
13085 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13086 				  NL80211_FLAG_NEED_RTNL,
13087 	},
13088 	{
13089 		.cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13090 		.doit = nl80211_update_connect_params,
13091 		.policy = nl80211_policy,
13092 		.flags = GENL_ADMIN_PERM,
13093 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13094 				  NL80211_FLAG_NEED_RTNL,
13095 	},
13096 	{
13097 		.cmd = NL80211_CMD_DISCONNECT,
13098 		.doit = nl80211_disconnect,
13099 		.policy = nl80211_policy,
13100 		.flags = GENL_UNS_ADMIN_PERM,
13101 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13102 				  NL80211_FLAG_NEED_RTNL,
13103 	},
13104 	{
13105 		.cmd = NL80211_CMD_SET_WIPHY_NETNS,
13106 		.doit = nl80211_wiphy_netns,
13107 		.policy = nl80211_policy,
13108 		.flags = GENL_UNS_ADMIN_PERM,
13109 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13110 				  NL80211_FLAG_NEED_RTNL,
13111 	},
13112 	{
13113 		.cmd = NL80211_CMD_GET_SURVEY,
13114 		.policy = nl80211_policy,
13115 		.dumpit = nl80211_dump_survey,
13116 	},
13117 	{
13118 		.cmd = NL80211_CMD_SET_PMKSA,
13119 		.doit = nl80211_setdel_pmksa,
13120 		.policy = nl80211_policy,
13121 		.flags = GENL_UNS_ADMIN_PERM,
13122 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13123 				  NL80211_FLAG_NEED_RTNL,
13124 	},
13125 	{
13126 		.cmd = NL80211_CMD_DEL_PMKSA,
13127 		.doit = nl80211_setdel_pmksa,
13128 		.policy = nl80211_policy,
13129 		.flags = GENL_UNS_ADMIN_PERM,
13130 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13131 				  NL80211_FLAG_NEED_RTNL,
13132 	},
13133 	{
13134 		.cmd = NL80211_CMD_FLUSH_PMKSA,
13135 		.doit = nl80211_flush_pmksa,
13136 		.policy = nl80211_policy,
13137 		.flags = GENL_UNS_ADMIN_PERM,
13138 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13139 				  NL80211_FLAG_NEED_RTNL,
13140 	},
13141 	{
13142 		.cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13143 		.doit = nl80211_remain_on_channel,
13144 		.policy = nl80211_policy,
13145 		.flags = GENL_UNS_ADMIN_PERM,
13146 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13147 				  NL80211_FLAG_NEED_RTNL,
13148 	},
13149 	{
13150 		.cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13151 		.doit = nl80211_cancel_remain_on_channel,
13152 		.policy = nl80211_policy,
13153 		.flags = GENL_UNS_ADMIN_PERM,
13154 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13155 				  NL80211_FLAG_NEED_RTNL,
13156 	},
13157 	{
13158 		.cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13159 		.doit = nl80211_set_tx_bitrate_mask,
13160 		.policy = nl80211_policy,
13161 		.flags = GENL_UNS_ADMIN_PERM,
13162 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13163 				  NL80211_FLAG_NEED_RTNL,
13164 	},
13165 	{
13166 		.cmd = NL80211_CMD_REGISTER_FRAME,
13167 		.doit = nl80211_register_mgmt,
13168 		.policy = nl80211_policy,
13169 		.flags = GENL_UNS_ADMIN_PERM,
13170 		.internal_flags = NL80211_FLAG_NEED_WDEV |
13171 				  NL80211_FLAG_NEED_RTNL,
13172 	},
13173 	{
13174 		.cmd = NL80211_CMD_FRAME,
13175 		.doit = nl80211_tx_mgmt,
13176 		.policy = nl80211_policy,
13177 		.flags = GENL_UNS_ADMIN_PERM,
13178 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13179 				  NL80211_FLAG_NEED_RTNL,
13180 	},
13181 	{
13182 		.cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13183 		.doit = nl80211_tx_mgmt_cancel_wait,
13184 		.policy = nl80211_policy,
13185 		.flags = GENL_UNS_ADMIN_PERM,
13186 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13187 				  NL80211_FLAG_NEED_RTNL,
13188 	},
13189 	{
13190 		.cmd = NL80211_CMD_SET_POWER_SAVE,
13191 		.doit = nl80211_set_power_save,
13192 		.policy = nl80211_policy,
13193 		.flags = GENL_UNS_ADMIN_PERM,
13194 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13195 				  NL80211_FLAG_NEED_RTNL,
13196 	},
13197 	{
13198 		.cmd = NL80211_CMD_GET_POWER_SAVE,
13199 		.doit = nl80211_get_power_save,
13200 		.policy = nl80211_policy,
13201 		/* can be retrieved by unprivileged users */
13202 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13203 				  NL80211_FLAG_NEED_RTNL,
13204 	},
13205 	{
13206 		.cmd = NL80211_CMD_SET_CQM,
13207 		.doit = nl80211_set_cqm,
13208 		.policy = nl80211_policy,
13209 		.flags = GENL_UNS_ADMIN_PERM,
13210 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13211 				  NL80211_FLAG_NEED_RTNL,
13212 	},
13213 	{
13214 		.cmd = NL80211_CMD_SET_CHANNEL,
13215 		.doit = nl80211_set_channel,
13216 		.policy = nl80211_policy,
13217 		.flags = GENL_UNS_ADMIN_PERM,
13218 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13219 				  NL80211_FLAG_NEED_RTNL,
13220 	},
13221 	{
13222 		.cmd = NL80211_CMD_SET_WDS_PEER,
13223 		.doit = nl80211_set_wds_peer,
13224 		.policy = nl80211_policy,
13225 		.flags = GENL_UNS_ADMIN_PERM,
13226 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13227 				  NL80211_FLAG_NEED_RTNL,
13228 	},
13229 	{
13230 		.cmd = NL80211_CMD_JOIN_MESH,
13231 		.doit = nl80211_join_mesh,
13232 		.policy = nl80211_policy,
13233 		.flags = GENL_UNS_ADMIN_PERM,
13234 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13235 				  NL80211_FLAG_NEED_RTNL,
13236 	},
13237 	{
13238 		.cmd = NL80211_CMD_LEAVE_MESH,
13239 		.doit = nl80211_leave_mesh,
13240 		.policy = nl80211_policy,
13241 		.flags = GENL_UNS_ADMIN_PERM,
13242 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13243 				  NL80211_FLAG_NEED_RTNL,
13244 	},
13245 	{
13246 		.cmd = NL80211_CMD_JOIN_OCB,
13247 		.doit = nl80211_join_ocb,
13248 		.policy = nl80211_policy,
13249 		.flags = GENL_UNS_ADMIN_PERM,
13250 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13251 				  NL80211_FLAG_NEED_RTNL,
13252 	},
13253 	{
13254 		.cmd = NL80211_CMD_LEAVE_OCB,
13255 		.doit = nl80211_leave_ocb,
13256 		.policy = nl80211_policy,
13257 		.flags = GENL_UNS_ADMIN_PERM,
13258 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13259 				  NL80211_FLAG_NEED_RTNL,
13260 	},
13261 #ifdef CONFIG_PM
13262 	{
13263 		.cmd = NL80211_CMD_GET_WOWLAN,
13264 		.doit = nl80211_get_wowlan,
13265 		.policy = nl80211_policy,
13266 		/* can be retrieved by unprivileged users */
13267 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13268 				  NL80211_FLAG_NEED_RTNL,
13269 	},
13270 	{
13271 		.cmd = NL80211_CMD_SET_WOWLAN,
13272 		.doit = nl80211_set_wowlan,
13273 		.policy = nl80211_policy,
13274 		.flags = GENL_UNS_ADMIN_PERM,
13275 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13276 				  NL80211_FLAG_NEED_RTNL,
13277 	},
13278 #endif
13279 	{
13280 		.cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13281 		.doit = nl80211_set_rekey_data,
13282 		.policy = nl80211_policy,
13283 		.flags = GENL_UNS_ADMIN_PERM,
13284 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13285 				  NL80211_FLAG_NEED_RTNL |
13286 				  NL80211_FLAG_CLEAR_SKB,
13287 	},
13288 	{
13289 		.cmd = NL80211_CMD_TDLS_MGMT,
13290 		.doit = nl80211_tdls_mgmt,
13291 		.policy = nl80211_policy,
13292 		.flags = GENL_UNS_ADMIN_PERM,
13293 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13294 				  NL80211_FLAG_NEED_RTNL,
13295 	},
13296 	{
13297 		.cmd = NL80211_CMD_TDLS_OPER,
13298 		.doit = nl80211_tdls_oper,
13299 		.policy = nl80211_policy,
13300 		.flags = GENL_UNS_ADMIN_PERM,
13301 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13302 				  NL80211_FLAG_NEED_RTNL,
13303 	},
13304 	{
13305 		.cmd = NL80211_CMD_UNEXPECTED_FRAME,
13306 		.doit = nl80211_register_unexpected_frame,
13307 		.policy = nl80211_policy,
13308 		.flags = GENL_UNS_ADMIN_PERM,
13309 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13310 				  NL80211_FLAG_NEED_RTNL,
13311 	},
13312 	{
13313 		.cmd = NL80211_CMD_PROBE_CLIENT,
13314 		.doit = nl80211_probe_client,
13315 		.policy = nl80211_policy,
13316 		.flags = GENL_UNS_ADMIN_PERM,
13317 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13318 				  NL80211_FLAG_NEED_RTNL,
13319 	},
13320 	{
13321 		.cmd = NL80211_CMD_REGISTER_BEACONS,
13322 		.doit = nl80211_register_beacons,
13323 		.policy = nl80211_policy,
13324 		.flags = GENL_UNS_ADMIN_PERM,
13325 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13326 				  NL80211_FLAG_NEED_RTNL,
13327 	},
13328 	{
13329 		.cmd = NL80211_CMD_SET_NOACK_MAP,
13330 		.doit = nl80211_set_noack_map,
13331 		.policy = nl80211_policy,
13332 		.flags = GENL_UNS_ADMIN_PERM,
13333 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13334 				  NL80211_FLAG_NEED_RTNL,
13335 	},
13336 	{
13337 		.cmd = NL80211_CMD_START_P2P_DEVICE,
13338 		.doit = nl80211_start_p2p_device,
13339 		.policy = nl80211_policy,
13340 		.flags = GENL_UNS_ADMIN_PERM,
13341 		.internal_flags = NL80211_FLAG_NEED_WDEV |
13342 				  NL80211_FLAG_NEED_RTNL,
13343 	},
13344 	{
13345 		.cmd = NL80211_CMD_STOP_P2P_DEVICE,
13346 		.doit = nl80211_stop_p2p_device,
13347 		.policy = nl80211_policy,
13348 		.flags = GENL_UNS_ADMIN_PERM,
13349 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13350 				  NL80211_FLAG_NEED_RTNL,
13351 	},
13352 	{
13353 		.cmd = NL80211_CMD_START_NAN,
13354 		.doit = nl80211_start_nan,
13355 		.policy = nl80211_policy,
13356 		.flags = GENL_ADMIN_PERM,
13357 		.internal_flags = NL80211_FLAG_NEED_WDEV |
13358 				  NL80211_FLAG_NEED_RTNL,
13359 	},
13360 	{
13361 		.cmd = NL80211_CMD_STOP_NAN,
13362 		.doit = nl80211_stop_nan,
13363 		.policy = nl80211_policy,
13364 		.flags = GENL_ADMIN_PERM,
13365 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13366 				  NL80211_FLAG_NEED_RTNL,
13367 	},
13368 	{
13369 		.cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13370 		.doit = nl80211_nan_add_func,
13371 		.policy = nl80211_policy,
13372 		.flags = GENL_ADMIN_PERM,
13373 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13374 				  NL80211_FLAG_NEED_RTNL,
13375 	},
13376 	{
13377 		.cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13378 		.doit = nl80211_nan_del_func,
13379 		.policy = nl80211_policy,
13380 		.flags = GENL_ADMIN_PERM,
13381 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13382 				  NL80211_FLAG_NEED_RTNL,
13383 	},
13384 	{
13385 		.cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13386 		.doit = nl80211_nan_change_config,
13387 		.policy = nl80211_policy,
13388 		.flags = GENL_ADMIN_PERM,
13389 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13390 				  NL80211_FLAG_NEED_RTNL,
13391 	},
13392 	{
13393 		.cmd = NL80211_CMD_SET_MCAST_RATE,
13394 		.doit = nl80211_set_mcast_rate,
13395 		.policy = nl80211_policy,
13396 		.flags = GENL_UNS_ADMIN_PERM,
13397 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13398 				  NL80211_FLAG_NEED_RTNL,
13399 	},
13400 	{
13401 		.cmd = NL80211_CMD_SET_MAC_ACL,
13402 		.doit = nl80211_set_mac_acl,
13403 		.policy = nl80211_policy,
13404 		.flags = GENL_UNS_ADMIN_PERM,
13405 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13406 				  NL80211_FLAG_NEED_RTNL,
13407 	},
13408 	{
13409 		.cmd = NL80211_CMD_RADAR_DETECT,
13410 		.doit = nl80211_start_radar_detection,
13411 		.policy = nl80211_policy,
13412 		.flags = GENL_UNS_ADMIN_PERM,
13413 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13414 				  NL80211_FLAG_NEED_RTNL,
13415 	},
13416 	{
13417 		.cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13418 		.doit = nl80211_get_protocol_features,
13419 		.policy = nl80211_policy,
13420 	},
13421 	{
13422 		.cmd = NL80211_CMD_UPDATE_FT_IES,
13423 		.doit = nl80211_update_ft_ies,
13424 		.policy = nl80211_policy,
13425 		.flags = GENL_UNS_ADMIN_PERM,
13426 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13427 				  NL80211_FLAG_NEED_RTNL,
13428 	},
13429 	{
13430 		.cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13431 		.doit = nl80211_crit_protocol_start,
13432 		.policy = nl80211_policy,
13433 		.flags = GENL_UNS_ADMIN_PERM,
13434 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13435 				  NL80211_FLAG_NEED_RTNL,
13436 	},
13437 	{
13438 		.cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13439 		.doit = nl80211_crit_protocol_stop,
13440 		.policy = nl80211_policy,
13441 		.flags = GENL_UNS_ADMIN_PERM,
13442 		.internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13443 				  NL80211_FLAG_NEED_RTNL,
13444 	},
13445 	{
13446 		.cmd = NL80211_CMD_GET_COALESCE,
13447 		.doit = nl80211_get_coalesce,
13448 		.policy = nl80211_policy,
13449 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13450 				  NL80211_FLAG_NEED_RTNL,
13451 	},
13452 	{
13453 		.cmd = NL80211_CMD_SET_COALESCE,
13454 		.doit = nl80211_set_coalesce,
13455 		.policy = nl80211_policy,
13456 		.flags = GENL_UNS_ADMIN_PERM,
13457 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13458 				  NL80211_FLAG_NEED_RTNL,
13459 	},
13460 	{
13461 		.cmd = NL80211_CMD_CHANNEL_SWITCH,
13462 		.doit = nl80211_channel_switch,
13463 		.policy = nl80211_policy,
13464 		.flags = GENL_UNS_ADMIN_PERM,
13465 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13466 				  NL80211_FLAG_NEED_RTNL,
13467 	},
13468 	{
13469 		.cmd = NL80211_CMD_VENDOR,
13470 		.doit = nl80211_vendor_cmd,
13471 		.dumpit = nl80211_vendor_cmd_dump,
13472 		.policy = nl80211_policy,
13473 		.flags = GENL_UNS_ADMIN_PERM,
13474 		.internal_flags = NL80211_FLAG_NEED_WIPHY |
13475 				  NL80211_FLAG_NEED_RTNL,
13476 	},
13477 	{
13478 		.cmd = NL80211_CMD_SET_QOS_MAP,
13479 		.doit = nl80211_set_qos_map,
13480 		.policy = nl80211_policy,
13481 		.flags = GENL_UNS_ADMIN_PERM,
13482 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13483 				  NL80211_FLAG_NEED_RTNL,
13484 	},
13485 	{
13486 		.cmd = NL80211_CMD_ADD_TX_TS,
13487 		.doit = nl80211_add_tx_ts,
13488 		.policy = nl80211_policy,
13489 		.flags = GENL_UNS_ADMIN_PERM,
13490 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13491 				  NL80211_FLAG_NEED_RTNL,
13492 	},
13493 	{
13494 		.cmd = NL80211_CMD_DEL_TX_TS,
13495 		.doit = nl80211_del_tx_ts,
13496 		.policy = nl80211_policy,
13497 		.flags = GENL_UNS_ADMIN_PERM,
13498 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13499 				  NL80211_FLAG_NEED_RTNL,
13500 	},
13501 	{
13502 		.cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13503 		.doit = nl80211_tdls_channel_switch,
13504 		.policy = nl80211_policy,
13505 		.flags = GENL_UNS_ADMIN_PERM,
13506 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13507 				  NL80211_FLAG_NEED_RTNL,
13508 	},
13509 	{
13510 		.cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13511 		.doit = nl80211_tdls_cancel_channel_switch,
13512 		.policy = nl80211_policy,
13513 		.flags = GENL_UNS_ADMIN_PERM,
13514 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13515 				  NL80211_FLAG_NEED_RTNL,
13516 	},
13517 	{
13518 		.cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13519 		.doit = nl80211_set_multicast_to_unicast,
13520 		.policy = nl80211_policy,
13521 		.flags = GENL_UNS_ADMIN_PERM,
13522 		.internal_flags = NL80211_FLAG_NEED_NETDEV |
13523 				  NL80211_FLAG_NEED_RTNL,
13524 	},
13525 	{
13526 		.cmd = NL80211_CMD_SET_PMK,
13527 		.doit = nl80211_set_pmk,
13528 		.policy = nl80211_policy,
13529 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13530 				  NL80211_FLAG_NEED_RTNL,
13531 	},
13532 	{
13533 		.cmd = NL80211_CMD_DEL_PMK,
13534 		.doit = nl80211_del_pmk,
13535 		.policy = nl80211_policy,
13536 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13537 				  NL80211_FLAG_NEED_RTNL,
13538 	},
13539 	{
13540 		.cmd = NL80211_CMD_EXTERNAL_AUTH,
13541 		.doit = nl80211_external_auth,
13542 		.policy = nl80211_policy,
13543 		.flags = GENL_ADMIN_PERM,
13544 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13545 				  NL80211_FLAG_NEED_RTNL,
13546 	},
13547 	{
13548 		.cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13549 		.doit = nl80211_tx_control_port,
13550 		.policy = nl80211_policy,
13551 		.flags = GENL_UNS_ADMIN_PERM,
13552 		.internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13553 				  NL80211_FLAG_NEED_RTNL,
13554 	},
13555 };
13556 
13557 static struct genl_family nl80211_fam __ro_after_init = {
13558 	.name = NL80211_GENL_NAME,	/* have users key off the name instead */
13559 	.hdrsize = 0,			/* no private header */
13560 	.version = 1,			/* no particular meaning now */
13561 	.maxattr = NL80211_ATTR_MAX,
13562 	.netnsok = true,
13563 	.pre_doit = nl80211_pre_doit,
13564 	.post_doit = nl80211_post_doit,
13565 	.module = THIS_MODULE,
13566 	.ops = nl80211_ops,
13567 	.n_ops = ARRAY_SIZE(nl80211_ops),
13568 	.mcgrps = nl80211_mcgrps,
13569 	.n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13570 };
13571 
13572 /* notification functions */
13573 
13574 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13575 			  enum nl80211_commands cmd)
13576 {
13577 	struct sk_buff *msg;
13578 	struct nl80211_dump_wiphy_state state = {};
13579 
13580 	WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13581 		cmd != NL80211_CMD_DEL_WIPHY);
13582 
13583 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13584 	if (!msg)
13585 		return;
13586 
13587 	if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13588 		nlmsg_free(msg);
13589 		return;
13590 	}
13591 
13592 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13593 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
13594 }
13595 
13596 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13597 				struct wireless_dev *wdev,
13598 				enum nl80211_commands cmd)
13599 {
13600 	struct sk_buff *msg;
13601 
13602 	WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13603 		cmd != NL80211_CMD_DEL_INTERFACE);
13604 
13605 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13606 	if (!msg)
13607 		return;
13608 
13609 	if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13610 			       cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13611 		nlmsg_free(msg);
13612 		return;
13613 	}
13614 
13615 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13616 				NL80211_MCGRP_CONFIG, GFP_KERNEL);
13617 }
13618 
13619 static int nl80211_add_scan_req(struct sk_buff *msg,
13620 				struct cfg80211_registered_device *rdev)
13621 {
13622 	struct cfg80211_scan_request *req = rdev->scan_req;
13623 	struct nlattr *nest;
13624 	int i;
13625 
13626 	if (WARN_ON(!req))
13627 		return 0;
13628 
13629 	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13630 	if (!nest)
13631 		goto nla_put_failure;
13632 	for (i = 0; i < req->n_ssids; i++) {
13633 		if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13634 			goto nla_put_failure;
13635 	}
13636 	nla_nest_end(msg, nest);
13637 
13638 	nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13639 	if (!nest)
13640 		goto nla_put_failure;
13641 	for (i = 0; i < req->n_channels; i++) {
13642 		if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13643 			goto nla_put_failure;
13644 	}
13645 	nla_nest_end(msg, nest);
13646 
13647 	if (req->ie &&
13648 	    nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13649 		goto nla_put_failure;
13650 
13651 	if (req->flags &&
13652 	    nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13653 		goto nla_put_failure;
13654 
13655 	if (req->info.scan_start_tsf &&
13656 	    (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
13657 			       req->info.scan_start_tsf, NL80211_BSS_PAD) ||
13658 	     nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
13659 		     req->info.tsf_bssid)))
13660 		goto nla_put_failure;
13661 
13662 	return 0;
13663  nla_put_failure:
13664 	return -ENOBUFS;
13665 }
13666 
13667 static int nl80211_prep_scan_msg(struct sk_buff *msg,
13668 				 struct cfg80211_registered_device *rdev,
13669 				 struct wireless_dev *wdev,
13670 				 u32 portid, u32 seq, int flags,
13671 				 u32 cmd)
13672 {
13673 	void *hdr;
13674 
13675 	hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
13676 	if (!hdr)
13677 		return -1;
13678 
13679 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13680 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13681 					 wdev->netdev->ifindex)) ||
13682 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13683 			      NL80211_ATTR_PAD))
13684 		goto nla_put_failure;
13685 
13686 	/* ignore errors and send incomplete event anyway */
13687 	nl80211_add_scan_req(msg, rdev);
13688 
13689 	genlmsg_end(msg, hdr);
13690 	return 0;
13691 
13692  nla_put_failure:
13693 	genlmsg_cancel(msg, hdr);
13694 	return -EMSGSIZE;
13695 }
13696 
13697 static int
13698 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
13699 			    struct cfg80211_sched_scan_request *req, u32 cmd)
13700 {
13701 	void *hdr;
13702 
13703 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13704 	if (!hdr)
13705 		return -1;
13706 
13707 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
13708 			wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
13709 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
13710 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
13711 			      NL80211_ATTR_PAD))
13712 		goto nla_put_failure;
13713 
13714 	genlmsg_end(msg, hdr);
13715 	return 0;
13716 
13717  nla_put_failure:
13718 	genlmsg_cancel(msg, hdr);
13719 	return -EMSGSIZE;
13720 }
13721 
13722 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13723 			     struct wireless_dev *wdev)
13724 {
13725 	struct sk_buff *msg;
13726 
13727 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13728 	if (!msg)
13729 		return;
13730 
13731 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13732 				  NL80211_CMD_TRIGGER_SCAN) < 0) {
13733 		nlmsg_free(msg);
13734 		return;
13735 	}
13736 
13737 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13738 				NL80211_MCGRP_SCAN, GFP_KERNEL);
13739 }
13740 
13741 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13742 				       struct wireless_dev *wdev, bool aborted)
13743 {
13744 	struct sk_buff *msg;
13745 
13746 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13747 	if (!msg)
13748 		return NULL;
13749 
13750 	if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13751 				  aborted ? NL80211_CMD_SCAN_ABORTED :
13752 					    NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13753 		nlmsg_free(msg);
13754 		return NULL;
13755 	}
13756 
13757 	return msg;
13758 }
13759 
13760 /* send message created by nl80211_build_scan_msg() */
13761 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13762 			   struct sk_buff *msg)
13763 {
13764 	if (!msg)
13765 		return;
13766 
13767 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13768 				NL80211_MCGRP_SCAN, GFP_KERNEL);
13769 }
13770 
13771 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
13772 {
13773 	struct sk_buff *msg;
13774 
13775 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13776 	if (!msg)
13777 		return;
13778 
13779 	if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
13780 		nlmsg_free(msg);
13781 		return;
13782 	}
13783 
13784 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
13785 				NL80211_MCGRP_SCAN, GFP_KERNEL);
13786 }
13787 
13788 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13789 					  struct regulatory_request *request)
13790 {
13791 	/* Userspace can always count this one always being set */
13792 	if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13793 		goto nla_put_failure;
13794 
13795 	if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13796 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13797 			       NL80211_REGDOM_TYPE_WORLD))
13798 			goto nla_put_failure;
13799 	} else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13800 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13801 			       NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13802 			goto nla_put_failure;
13803 	} else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13804 		   request->intersect) {
13805 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13806 			       NL80211_REGDOM_TYPE_INTERSECTION))
13807 			goto nla_put_failure;
13808 	} else {
13809 		if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13810 			       NL80211_REGDOM_TYPE_COUNTRY) ||
13811 		    nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13812 				   request->alpha2))
13813 			goto nla_put_failure;
13814 	}
13815 
13816 	if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13817 		struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13818 
13819 		if (wiphy &&
13820 		    nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13821 			goto nla_put_failure;
13822 
13823 		if (wiphy &&
13824 		    wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13825 		    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13826 			goto nla_put_failure;
13827 	}
13828 
13829 	return true;
13830 
13831 nla_put_failure:
13832 	return false;
13833 }
13834 
13835 /*
13836  * This can happen on global regulatory changes or device specific settings
13837  * based on custom regulatory domains.
13838  */
13839 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13840 				     struct regulatory_request *request)
13841 {
13842 	struct sk_buff *msg;
13843 	void *hdr;
13844 
13845 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13846 	if (!msg)
13847 		return;
13848 
13849 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13850 	if (!hdr) {
13851 		nlmsg_free(msg);
13852 		return;
13853 	}
13854 
13855 	if (nl80211_reg_change_event_fill(msg, request) == false)
13856 		goto nla_put_failure;
13857 
13858 	genlmsg_end(msg, hdr);
13859 
13860 	rcu_read_lock();
13861 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13862 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13863 	rcu_read_unlock();
13864 
13865 	return;
13866 
13867 nla_put_failure:
13868 	nlmsg_free(msg);
13869 }
13870 
13871 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13872 				    struct net_device *netdev,
13873 				    const u8 *buf, size_t len,
13874 				    enum nl80211_commands cmd, gfp_t gfp,
13875 				    int uapsd_queues)
13876 {
13877 	struct sk_buff *msg;
13878 	void *hdr;
13879 
13880 	msg = nlmsg_new(100 + len, gfp);
13881 	if (!msg)
13882 		return;
13883 
13884 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13885 	if (!hdr) {
13886 		nlmsg_free(msg);
13887 		return;
13888 	}
13889 
13890 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13891 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13892 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13893 		goto nla_put_failure;
13894 
13895 	if (uapsd_queues >= 0) {
13896 		struct nlattr *nla_wmm =
13897 			nla_nest_start(msg, NL80211_ATTR_STA_WME);
13898 		if (!nla_wmm)
13899 			goto nla_put_failure;
13900 
13901 		if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13902 			       uapsd_queues))
13903 			goto nla_put_failure;
13904 
13905 		nla_nest_end(msg, nla_wmm);
13906 	}
13907 
13908 	genlmsg_end(msg, hdr);
13909 
13910 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13911 				NL80211_MCGRP_MLME, gfp);
13912 	return;
13913 
13914  nla_put_failure:
13915 	nlmsg_free(msg);
13916 }
13917 
13918 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13919 			  struct net_device *netdev, const u8 *buf,
13920 			  size_t len, gfp_t gfp)
13921 {
13922 	nl80211_send_mlme_event(rdev, netdev, buf, len,
13923 				NL80211_CMD_AUTHENTICATE, gfp, -1);
13924 }
13925 
13926 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13927 			   struct net_device *netdev, const u8 *buf,
13928 			   size_t len, gfp_t gfp, int uapsd_queues)
13929 {
13930 	nl80211_send_mlme_event(rdev, netdev, buf, len,
13931 				NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13932 }
13933 
13934 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13935 			 struct net_device *netdev, const u8 *buf,
13936 			 size_t len, gfp_t gfp)
13937 {
13938 	nl80211_send_mlme_event(rdev, netdev, buf, len,
13939 				NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13940 }
13941 
13942 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13943 			   struct net_device *netdev, const u8 *buf,
13944 			   size_t len, gfp_t gfp)
13945 {
13946 	nl80211_send_mlme_event(rdev, netdev, buf, len,
13947 				NL80211_CMD_DISASSOCIATE, gfp, -1);
13948 }
13949 
13950 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13951 				  size_t len)
13952 {
13953 	struct wireless_dev *wdev = dev->ieee80211_ptr;
13954 	struct wiphy *wiphy = wdev->wiphy;
13955 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13956 	const struct ieee80211_mgmt *mgmt = (void *)buf;
13957 	u32 cmd;
13958 
13959 	if (WARN_ON(len < 2))
13960 		return;
13961 
13962 	if (ieee80211_is_deauth(mgmt->frame_control))
13963 		cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13964 	else
13965 		cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13966 
13967 	trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13968 	nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13969 }
13970 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13971 
13972 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13973 				      struct net_device *netdev, int cmd,
13974 				      const u8 *addr, gfp_t gfp)
13975 {
13976 	struct sk_buff *msg;
13977 	void *hdr;
13978 
13979 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13980 	if (!msg)
13981 		return;
13982 
13983 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13984 	if (!hdr) {
13985 		nlmsg_free(msg);
13986 		return;
13987 	}
13988 
13989 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13990 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13991 	    nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13992 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13993 		goto nla_put_failure;
13994 
13995 	genlmsg_end(msg, hdr);
13996 
13997 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13998 				NL80211_MCGRP_MLME, gfp);
13999 	return;
14000 
14001  nla_put_failure:
14002 	nlmsg_free(msg);
14003 }
14004 
14005 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14006 			       struct net_device *netdev, const u8 *addr,
14007 			       gfp_t gfp)
14008 {
14009 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14010 				  addr, gfp);
14011 }
14012 
14013 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14014 				struct net_device *netdev, const u8 *addr,
14015 				gfp_t gfp)
14016 {
14017 	nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14018 				  addr, gfp);
14019 }
14020 
14021 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14022 				 struct net_device *netdev,
14023 				 struct cfg80211_connect_resp_params *cr,
14024 				 gfp_t gfp)
14025 {
14026 	struct sk_buff *msg;
14027 	void *hdr;
14028 
14029 	msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14030 			cr->fils_kek_len + cr->pmk_len +
14031 			(cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
14032 	if (!msg)
14033 		return;
14034 
14035 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14036 	if (!hdr) {
14037 		nlmsg_free(msg);
14038 		return;
14039 	}
14040 
14041 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14042 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14043 	    (cr->bssid &&
14044 	     nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14045 	    nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14046 			cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14047 			cr->status) ||
14048 	    (cr->status < 0 &&
14049 	     (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14050 	      nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14051 			  cr->timeout_reason))) ||
14052 	    (cr->req_ie &&
14053 	     nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14054 	    (cr->resp_ie &&
14055 	     nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14056 		     cr->resp_ie)) ||
14057 	    (cr->update_erp_next_seq_num &&
14058 	     nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14059 			 cr->fils_erp_next_seq_num)) ||
14060 	    (cr->status == WLAN_STATUS_SUCCESS &&
14061 	     ((cr->fils_kek &&
14062 	       nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
14063 		       cr->fils_kek)) ||
14064 	      (cr->pmk &&
14065 	       nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
14066 	      (cr->pmkid &&
14067 	       nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
14068 		goto nla_put_failure;
14069 
14070 	genlmsg_end(msg, hdr);
14071 
14072 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14073 				NL80211_MCGRP_MLME, gfp);
14074 	return;
14075 
14076  nla_put_failure:
14077 	nlmsg_free(msg);
14078 }
14079 
14080 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14081 			 struct net_device *netdev,
14082 			 struct cfg80211_roam_info *info, gfp_t gfp)
14083 {
14084 	struct sk_buff *msg;
14085 	void *hdr;
14086 	const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14087 
14088 	msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp);
14089 	if (!msg)
14090 		return;
14091 
14092 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14093 	if (!hdr) {
14094 		nlmsg_free(msg);
14095 		return;
14096 	}
14097 
14098 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14099 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14100 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14101 	    (info->req_ie &&
14102 	     nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14103 		     info->req_ie)) ||
14104 	    (info->resp_ie &&
14105 	     nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14106 		     info->resp_ie)))
14107 		goto nla_put_failure;
14108 
14109 	genlmsg_end(msg, hdr);
14110 
14111 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14112 				NL80211_MCGRP_MLME, gfp);
14113 	return;
14114 
14115  nla_put_failure:
14116 	nlmsg_free(msg);
14117 }
14118 
14119 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14120 				  struct net_device *netdev, const u8 *bssid)
14121 {
14122 	struct sk_buff *msg;
14123 	void *hdr;
14124 
14125 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14126 	if (!msg)
14127 		return;
14128 
14129 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14130 	if (!hdr) {
14131 		nlmsg_free(msg);
14132 		return;
14133 	}
14134 
14135 	if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14136 		goto nla_put_failure;
14137 
14138 	genlmsg_end(msg, hdr);
14139 
14140 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14141 				NL80211_MCGRP_MLME, GFP_KERNEL);
14142 	return;
14143 
14144  nla_put_failure:
14145 	nlmsg_free(msg);
14146 }
14147 
14148 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14149 			       struct net_device *netdev, u16 reason,
14150 			       const u8 *ie, size_t ie_len, bool from_ap)
14151 {
14152 	struct sk_buff *msg;
14153 	void *hdr;
14154 
14155 	msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14156 	if (!msg)
14157 		return;
14158 
14159 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14160 	if (!hdr) {
14161 		nlmsg_free(msg);
14162 		return;
14163 	}
14164 
14165 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14166 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14167 	    (reason &&
14168 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14169 	    (from_ap &&
14170 	     nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14171 	    (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14172 		goto nla_put_failure;
14173 
14174 	genlmsg_end(msg, hdr);
14175 
14176 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14177 				NL80211_MCGRP_MLME, GFP_KERNEL);
14178 	return;
14179 
14180  nla_put_failure:
14181 	nlmsg_free(msg);
14182 }
14183 
14184 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14185 			     struct net_device *netdev, const u8 *bssid,
14186 			     gfp_t gfp)
14187 {
14188 	struct sk_buff *msg;
14189 	void *hdr;
14190 
14191 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14192 	if (!msg)
14193 		return;
14194 
14195 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14196 	if (!hdr) {
14197 		nlmsg_free(msg);
14198 		return;
14199 	}
14200 
14201 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14202 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14203 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14204 		goto nla_put_failure;
14205 
14206 	genlmsg_end(msg, hdr);
14207 
14208 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14209 				NL80211_MCGRP_MLME, gfp);
14210 	return;
14211 
14212  nla_put_failure:
14213 	nlmsg_free(msg);
14214 }
14215 
14216 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14217 					const u8* ie, u8 ie_len, gfp_t gfp)
14218 {
14219 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14220 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14221 	struct sk_buff *msg;
14222 	void *hdr;
14223 
14224 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14225 		return;
14226 
14227 	trace_cfg80211_notify_new_peer_candidate(dev, addr);
14228 
14229 	msg = nlmsg_new(100 + ie_len, gfp);
14230 	if (!msg)
14231 		return;
14232 
14233 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14234 	if (!hdr) {
14235 		nlmsg_free(msg);
14236 		return;
14237 	}
14238 
14239 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14240 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14241 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14242 	    (ie_len && ie &&
14243 	     nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14244 		goto nla_put_failure;
14245 
14246 	genlmsg_end(msg, hdr);
14247 
14248 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14249 				NL80211_MCGRP_MLME, gfp);
14250 	return;
14251 
14252  nla_put_failure:
14253 	nlmsg_free(msg);
14254 }
14255 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14256 
14257 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14258 				 struct net_device *netdev, const u8 *addr,
14259 				 enum nl80211_key_type key_type, int key_id,
14260 				 const u8 *tsc, gfp_t gfp)
14261 {
14262 	struct sk_buff *msg;
14263 	void *hdr;
14264 
14265 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14266 	if (!msg)
14267 		return;
14268 
14269 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14270 	if (!hdr) {
14271 		nlmsg_free(msg);
14272 		return;
14273 	}
14274 
14275 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14276 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14277 	    (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14278 	    nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14279 	    (key_id != -1 &&
14280 	     nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14281 	    (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14282 		goto nla_put_failure;
14283 
14284 	genlmsg_end(msg, hdr);
14285 
14286 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14287 				NL80211_MCGRP_MLME, gfp);
14288 	return;
14289 
14290  nla_put_failure:
14291 	nlmsg_free(msg);
14292 }
14293 
14294 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14295 				    struct ieee80211_channel *channel_before,
14296 				    struct ieee80211_channel *channel_after)
14297 {
14298 	struct sk_buff *msg;
14299 	void *hdr;
14300 	struct nlattr *nl_freq;
14301 
14302 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14303 	if (!msg)
14304 		return;
14305 
14306 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14307 	if (!hdr) {
14308 		nlmsg_free(msg);
14309 		return;
14310 	}
14311 
14312 	/*
14313 	 * Since we are applying the beacon hint to a wiphy we know its
14314 	 * wiphy_idx is valid
14315 	 */
14316 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14317 		goto nla_put_failure;
14318 
14319 	/* Before */
14320 	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14321 	if (!nl_freq)
14322 		goto nla_put_failure;
14323 	if (nl80211_msg_put_channel(msg, channel_before, false))
14324 		goto nla_put_failure;
14325 	nla_nest_end(msg, nl_freq);
14326 
14327 	/* After */
14328 	nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14329 	if (!nl_freq)
14330 		goto nla_put_failure;
14331 	if (nl80211_msg_put_channel(msg, channel_after, false))
14332 		goto nla_put_failure;
14333 	nla_nest_end(msg, nl_freq);
14334 
14335 	genlmsg_end(msg, hdr);
14336 
14337 	rcu_read_lock();
14338 	genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14339 				NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14340 	rcu_read_unlock();
14341 
14342 	return;
14343 
14344 nla_put_failure:
14345 	nlmsg_free(msg);
14346 }
14347 
14348 static void nl80211_send_remain_on_chan_event(
14349 	int cmd, struct cfg80211_registered_device *rdev,
14350 	struct wireless_dev *wdev, u64 cookie,
14351 	struct ieee80211_channel *chan,
14352 	unsigned int duration, gfp_t gfp)
14353 {
14354 	struct sk_buff *msg;
14355 	void *hdr;
14356 
14357 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14358 	if (!msg)
14359 		return;
14360 
14361 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14362 	if (!hdr) {
14363 		nlmsg_free(msg);
14364 		return;
14365 	}
14366 
14367 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14368 	    (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14369 					 wdev->netdev->ifindex)) ||
14370 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14371 			      NL80211_ATTR_PAD) ||
14372 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14373 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14374 			NL80211_CHAN_NO_HT) ||
14375 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14376 			      NL80211_ATTR_PAD))
14377 		goto nla_put_failure;
14378 
14379 	if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14380 	    nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14381 		goto nla_put_failure;
14382 
14383 	genlmsg_end(msg, hdr);
14384 
14385 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14386 				NL80211_MCGRP_MLME, gfp);
14387 	return;
14388 
14389  nla_put_failure:
14390 	nlmsg_free(msg);
14391 }
14392 
14393 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14394 			       struct ieee80211_channel *chan,
14395 			       unsigned int duration, gfp_t gfp)
14396 {
14397 	struct wiphy *wiphy = wdev->wiphy;
14398 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14399 
14400 	trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14401 	nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14402 					  rdev, wdev, cookie, chan,
14403 					  duration, gfp);
14404 }
14405 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14406 
14407 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14408 					struct ieee80211_channel *chan,
14409 					gfp_t gfp)
14410 {
14411 	struct wiphy *wiphy = wdev->wiphy;
14412 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14413 
14414 	trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14415 	nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14416 					  rdev, wdev, cookie, chan, 0, gfp);
14417 }
14418 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14419 
14420 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14421 		      struct station_info *sinfo, gfp_t gfp)
14422 {
14423 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14424 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14425 	struct sk_buff *msg;
14426 
14427 	trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14428 
14429 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14430 	if (!msg)
14431 		return;
14432 
14433 	if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14434 				 rdev, dev, mac_addr, sinfo) < 0) {
14435 		nlmsg_free(msg);
14436 		return;
14437 	}
14438 
14439 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14440 				NL80211_MCGRP_MLME, gfp);
14441 }
14442 EXPORT_SYMBOL(cfg80211_new_sta);
14443 
14444 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14445 			    struct station_info *sinfo, gfp_t gfp)
14446 {
14447 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14448 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14449 	struct sk_buff *msg;
14450 	struct station_info empty_sinfo = {};
14451 
14452 	if (!sinfo)
14453 		sinfo = &empty_sinfo;
14454 
14455 	trace_cfg80211_del_sta(dev, mac_addr);
14456 
14457 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14458 	if (!msg)
14459 		return;
14460 
14461 	if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14462 				 rdev, dev, mac_addr, sinfo) < 0) {
14463 		nlmsg_free(msg);
14464 		return;
14465 	}
14466 
14467 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14468 				NL80211_MCGRP_MLME, gfp);
14469 }
14470 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14471 
14472 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14473 			  enum nl80211_connect_failed_reason reason,
14474 			  gfp_t gfp)
14475 {
14476 	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14477 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14478 	struct sk_buff *msg;
14479 	void *hdr;
14480 
14481 	msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14482 	if (!msg)
14483 		return;
14484 
14485 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14486 	if (!hdr) {
14487 		nlmsg_free(msg);
14488 		return;
14489 	}
14490 
14491 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14492 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14493 	    nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14494 		goto nla_put_failure;
14495 
14496 	genlmsg_end(msg, hdr);
14497 
14498 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14499 				NL80211_MCGRP_MLME, gfp);
14500 	return;
14501 
14502  nla_put_failure:
14503 	nlmsg_free(msg);
14504 }
14505 EXPORT_SYMBOL(cfg80211_conn_failed);
14506 
14507 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14508 				       const u8 *addr, gfp_t gfp)
14509 {
14510 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14511 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14512 	struct sk_buff *msg;
14513 	void *hdr;
14514 	u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14515 
14516 	if (!nlportid)
14517 		return false;
14518 
14519 	msg = nlmsg_new(100, gfp);
14520 	if (!msg)
14521 		return true;
14522 
14523 	hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14524 	if (!hdr) {
14525 		nlmsg_free(msg);
14526 		return true;
14527 	}
14528 
14529 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14530 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14531 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14532 		goto nla_put_failure;
14533 
14534 	genlmsg_end(msg, hdr);
14535 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14536 	return true;
14537 
14538  nla_put_failure:
14539 	nlmsg_free(msg);
14540 	return true;
14541 }
14542 
14543 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14544 				const u8 *addr, gfp_t gfp)
14545 {
14546 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14547 	bool ret;
14548 
14549 	trace_cfg80211_rx_spurious_frame(dev, addr);
14550 
14551 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14552 		    wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14553 		trace_cfg80211_return_bool(false);
14554 		return false;
14555 	}
14556 	ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14557 					 addr, gfp);
14558 	trace_cfg80211_return_bool(ret);
14559 	return ret;
14560 }
14561 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14562 
14563 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14564 					const u8 *addr, gfp_t gfp)
14565 {
14566 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14567 	bool ret;
14568 
14569 	trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14570 
14571 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14572 		    wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14573 		    wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14574 		trace_cfg80211_return_bool(false);
14575 		return false;
14576 	}
14577 	ret = __nl80211_unexpected_frame(dev,
14578 					 NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14579 					 addr, gfp);
14580 	trace_cfg80211_return_bool(ret);
14581 	return ret;
14582 }
14583 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14584 
14585 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14586 		      struct wireless_dev *wdev, u32 nlportid,
14587 		      int freq, int sig_dbm,
14588 		      const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14589 {
14590 	struct net_device *netdev = wdev->netdev;
14591 	struct sk_buff *msg;
14592 	void *hdr;
14593 
14594 	msg = nlmsg_new(100 + len, gfp);
14595 	if (!msg)
14596 		return -ENOMEM;
14597 
14598 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14599 	if (!hdr) {
14600 		nlmsg_free(msg);
14601 		return -ENOMEM;
14602 	}
14603 
14604 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14605 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14606 					netdev->ifindex)) ||
14607 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14608 			      NL80211_ATTR_PAD) ||
14609 	    nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14610 	    (sig_dbm &&
14611 	     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14612 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14613 	    (flags &&
14614 	     nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14615 		goto nla_put_failure;
14616 
14617 	genlmsg_end(msg, hdr);
14618 
14619 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14620 
14621  nla_put_failure:
14622 	nlmsg_free(msg);
14623 	return -ENOBUFS;
14624 }
14625 
14626 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14627 			     const u8 *buf, size_t len, bool ack, gfp_t gfp)
14628 {
14629 	struct wiphy *wiphy = wdev->wiphy;
14630 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14631 	struct net_device *netdev = wdev->netdev;
14632 	struct sk_buff *msg;
14633 	void *hdr;
14634 
14635 	trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14636 
14637 	msg = nlmsg_new(100 + len, gfp);
14638 	if (!msg)
14639 		return;
14640 
14641 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
14642 	if (!hdr) {
14643 		nlmsg_free(msg);
14644 		return;
14645 	}
14646 
14647 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14648 	    (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14649 				   netdev->ifindex)) ||
14650 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14651 			      NL80211_ATTR_PAD) ||
14652 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14653 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14654 			      NL80211_ATTR_PAD) ||
14655 	    (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
14656 		goto nla_put_failure;
14657 
14658 	genlmsg_end(msg, hdr);
14659 
14660 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14661 				NL80211_MCGRP_MLME, gfp);
14662 	return;
14663 
14664  nla_put_failure:
14665 	nlmsg_free(msg);
14666 }
14667 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
14668 
14669 static int __nl80211_rx_control_port(struct net_device *dev,
14670 				     const u8 *buf, size_t len,
14671 				     const u8 *addr, u16 proto,
14672 				     bool unencrypted, gfp_t gfp)
14673 {
14674 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14675 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14676 	struct sk_buff *msg;
14677 	void *hdr;
14678 	u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
14679 
14680 	if (!nlportid)
14681 		return -ENOENT;
14682 
14683 	msg = nlmsg_new(100 + len, gfp);
14684 	if (!msg)
14685 		return -ENOMEM;
14686 
14687 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
14688 	if (!hdr) {
14689 		nlmsg_free(msg);
14690 		return -ENOBUFS;
14691 	}
14692 
14693 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14694 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14695 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14696 			      NL80211_ATTR_PAD) ||
14697 	    nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14698 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14699 	    nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
14700 	    (unencrypted && nla_put_flag(msg,
14701 					 NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
14702 		goto nla_put_failure;
14703 
14704 	genlmsg_end(msg, hdr);
14705 
14706 	return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14707 
14708  nla_put_failure:
14709 	nlmsg_free(msg);
14710 	return -ENOBUFS;
14711 }
14712 
14713 bool cfg80211_rx_control_port(struct net_device *dev,
14714 			      const u8 *buf, size_t len,
14715 			      const u8 *addr, u16 proto, bool unencrypted)
14716 {
14717 	int ret;
14718 
14719 	trace_cfg80211_rx_control_port(dev, buf, len, addr, proto, unencrypted);
14720 	ret = __nl80211_rx_control_port(dev, buf, len, addr, proto,
14721 					unencrypted, GFP_ATOMIC);
14722 	trace_cfg80211_return_bool(ret == 0);
14723 	return ret == 0;
14724 }
14725 EXPORT_SYMBOL(cfg80211_rx_control_port);
14726 
14727 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
14728 					    const char *mac, gfp_t gfp)
14729 {
14730 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14731 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14732 	struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14733 	void **cb;
14734 
14735 	if (!msg)
14736 		return NULL;
14737 
14738 	cb = (void **)msg->cb;
14739 
14740 	cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
14741 	if (!cb[0]) {
14742 		nlmsg_free(msg);
14743 		return NULL;
14744 	}
14745 
14746 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14747 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14748 		goto nla_put_failure;
14749 
14750 	if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
14751 		goto nla_put_failure;
14752 
14753 	cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
14754 	if (!cb[1])
14755 		goto nla_put_failure;
14756 
14757 	cb[2] = rdev;
14758 
14759 	return msg;
14760  nla_put_failure:
14761 	nlmsg_free(msg);
14762 	return NULL;
14763 }
14764 
14765 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
14766 {
14767 	void **cb = (void **)msg->cb;
14768 	struct cfg80211_registered_device *rdev = cb[2];
14769 
14770 	nla_nest_end(msg, cb[1]);
14771 	genlmsg_end(msg, cb[0]);
14772 
14773 	memset(msg->cb, 0, sizeof(msg->cb));
14774 
14775 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14776 				NL80211_MCGRP_MLME, gfp);
14777 }
14778 
14779 void cfg80211_cqm_rssi_notify(struct net_device *dev,
14780 			      enum nl80211_cqm_rssi_threshold_event rssi_event,
14781 			      s32 rssi_level, gfp_t gfp)
14782 {
14783 	struct sk_buff *msg;
14784 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14785 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14786 
14787 	trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
14788 
14789 	if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
14790 		    rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
14791 		return;
14792 
14793 	if (wdev->cqm_config) {
14794 		wdev->cqm_config->last_rssi_event_value = rssi_level;
14795 
14796 		cfg80211_cqm_rssi_update(rdev, dev);
14797 
14798 		if (rssi_level == 0)
14799 			rssi_level = wdev->cqm_config->last_rssi_event_value;
14800 	}
14801 
14802 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14803 	if (!msg)
14804 		return;
14805 
14806 	if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
14807 			rssi_event))
14808 		goto nla_put_failure;
14809 
14810 	if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14811 				      rssi_level))
14812 		goto nla_put_failure;
14813 
14814 	cfg80211_send_cqm(msg, gfp);
14815 
14816 	return;
14817 
14818  nla_put_failure:
14819 	nlmsg_free(msg);
14820 }
14821 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14822 
14823 void cfg80211_cqm_txe_notify(struct net_device *dev,
14824 			     const u8 *peer, u32 num_packets,
14825 			     u32 rate, u32 intvl, gfp_t gfp)
14826 {
14827 	struct sk_buff *msg;
14828 
14829 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
14830 	if (!msg)
14831 		return;
14832 
14833 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14834 		goto nla_put_failure;
14835 
14836 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14837 		goto nla_put_failure;
14838 
14839 	if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14840 		goto nla_put_failure;
14841 
14842 	cfg80211_send_cqm(msg, gfp);
14843 	return;
14844 
14845  nla_put_failure:
14846 	nlmsg_free(msg);
14847 }
14848 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14849 
14850 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14851 				 const u8 *peer, u32 num_packets, gfp_t gfp)
14852 {
14853 	struct sk_buff *msg;
14854 
14855 	trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14856 
14857 	msg = cfg80211_prepare_cqm(dev, peer, gfp);
14858 	if (!msg)
14859 		return;
14860 
14861 	if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14862 		goto nla_put_failure;
14863 
14864 	cfg80211_send_cqm(msg, gfp);
14865 	return;
14866 
14867  nla_put_failure:
14868 	nlmsg_free(msg);
14869 }
14870 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14871 
14872 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14873 {
14874 	struct sk_buff *msg;
14875 
14876 	msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14877 	if (!msg)
14878 		return;
14879 
14880 	if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14881 		goto nla_put_failure;
14882 
14883 	cfg80211_send_cqm(msg, gfp);
14884 	return;
14885 
14886  nla_put_failure:
14887 	nlmsg_free(msg);
14888 }
14889 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14890 
14891 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14892 				     struct net_device *netdev, const u8 *bssid,
14893 				     const u8 *replay_ctr, gfp_t gfp)
14894 {
14895 	struct sk_buff *msg;
14896 	struct nlattr *rekey_attr;
14897 	void *hdr;
14898 
14899 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14900 	if (!msg)
14901 		return;
14902 
14903 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14904 	if (!hdr) {
14905 		nlmsg_free(msg);
14906 		return;
14907 	}
14908 
14909 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14910 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14911 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14912 		goto nla_put_failure;
14913 
14914 	rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14915 	if (!rekey_attr)
14916 		goto nla_put_failure;
14917 
14918 	if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14919 		    NL80211_REPLAY_CTR_LEN, replay_ctr))
14920 		goto nla_put_failure;
14921 
14922 	nla_nest_end(msg, rekey_attr);
14923 
14924 	genlmsg_end(msg, hdr);
14925 
14926 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14927 				NL80211_MCGRP_MLME, gfp);
14928 	return;
14929 
14930  nla_put_failure:
14931 	nlmsg_free(msg);
14932 }
14933 
14934 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14935 			       const u8 *replay_ctr, gfp_t gfp)
14936 {
14937 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14938 	struct wiphy *wiphy = wdev->wiphy;
14939 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14940 
14941 	trace_cfg80211_gtk_rekey_notify(dev, bssid);
14942 	nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14943 }
14944 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14945 
14946 static void
14947 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14948 			       struct net_device *netdev, int index,
14949 			       const u8 *bssid, bool preauth, gfp_t gfp)
14950 {
14951 	struct sk_buff *msg;
14952 	struct nlattr *attr;
14953 	void *hdr;
14954 
14955 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14956 	if (!msg)
14957 		return;
14958 
14959 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14960 	if (!hdr) {
14961 		nlmsg_free(msg);
14962 		return;
14963 	}
14964 
14965 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14966 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14967 		goto nla_put_failure;
14968 
14969 	attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14970 	if (!attr)
14971 		goto nla_put_failure;
14972 
14973 	if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14974 	    nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14975 	    (preauth &&
14976 	     nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14977 		goto nla_put_failure;
14978 
14979 	nla_nest_end(msg, attr);
14980 
14981 	genlmsg_end(msg, hdr);
14982 
14983 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14984 				NL80211_MCGRP_MLME, gfp);
14985 	return;
14986 
14987  nla_put_failure:
14988 	nlmsg_free(msg);
14989 }
14990 
14991 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14992 				     const u8 *bssid, bool preauth, gfp_t gfp)
14993 {
14994 	struct wireless_dev *wdev = dev->ieee80211_ptr;
14995 	struct wiphy *wiphy = wdev->wiphy;
14996 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14997 
14998 	trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14999 	nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15000 }
15001 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15002 
15003 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15004 				     struct net_device *netdev,
15005 				     struct cfg80211_chan_def *chandef,
15006 				     gfp_t gfp,
15007 				     enum nl80211_commands notif,
15008 				     u8 count)
15009 {
15010 	struct sk_buff *msg;
15011 	void *hdr;
15012 
15013 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15014 	if (!msg)
15015 		return;
15016 
15017 	hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15018 	if (!hdr) {
15019 		nlmsg_free(msg);
15020 		return;
15021 	}
15022 
15023 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15024 		goto nla_put_failure;
15025 
15026 	if (nl80211_send_chandef(msg, chandef))
15027 		goto nla_put_failure;
15028 
15029 	if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15030 	    (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15031 			goto nla_put_failure;
15032 
15033 	genlmsg_end(msg, hdr);
15034 
15035 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15036 				NL80211_MCGRP_MLME, gfp);
15037 	return;
15038 
15039  nla_put_failure:
15040 	nlmsg_free(msg);
15041 }
15042 
15043 void cfg80211_ch_switch_notify(struct net_device *dev,
15044 			       struct cfg80211_chan_def *chandef)
15045 {
15046 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15047 	struct wiphy *wiphy = wdev->wiphy;
15048 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15049 
15050 	ASSERT_WDEV_LOCK(wdev);
15051 
15052 	trace_cfg80211_ch_switch_notify(dev, chandef);
15053 
15054 	wdev->chandef = *chandef;
15055 	wdev->preset_chandef = *chandef;
15056 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15057 				 NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15058 }
15059 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15060 
15061 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15062 				       struct cfg80211_chan_def *chandef,
15063 				       u8 count)
15064 {
15065 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15066 	struct wiphy *wiphy = wdev->wiphy;
15067 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15068 
15069 	trace_cfg80211_ch_switch_started_notify(dev, chandef);
15070 
15071 	nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15072 				 NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15073 }
15074 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15075 
15076 void
15077 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15078 		     const struct cfg80211_chan_def *chandef,
15079 		     enum nl80211_radar_event event,
15080 		     struct net_device *netdev, gfp_t gfp)
15081 {
15082 	struct sk_buff *msg;
15083 	void *hdr;
15084 
15085 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15086 	if (!msg)
15087 		return;
15088 
15089 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15090 	if (!hdr) {
15091 		nlmsg_free(msg);
15092 		return;
15093 	}
15094 
15095 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15096 		goto nla_put_failure;
15097 
15098 	/* NOP and radar events don't need a netdev parameter */
15099 	if (netdev) {
15100 		struct wireless_dev *wdev = netdev->ieee80211_ptr;
15101 
15102 		if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15103 		    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15104 				      NL80211_ATTR_PAD))
15105 			goto nla_put_failure;
15106 	}
15107 
15108 	if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15109 		goto nla_put_failure;
15110 
15111 	if (nl80211_send_chandef(msg, chandef))
15112 		goto nla_put_failure;
15113 
15114 	genlmsg_end(msg, hdr);
15115 
15116 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15117 				NL80211_MCGRP_MLME, gfp);
15118 	return;
15119 
15120  nla_put_failure:
15121 	nlmsg_free(msg);
15122 }
15123 
15124 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15125 				       struct sta_opmode_info *sta_opmode,
15126 				       gfp_t gfp)
15127 {
15128 	struct sk_buff *msg;
15129 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15130 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15131 	void *hdr;
15132 
15133 	if (WARN_ON(!mac))
15134 		return;
15135 
15136 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15137 	if (!msg)
15138 		return;
15139 
15140 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15141 	if (!hdr) {
15142 		nlmsg_free(msg);
15143 		return;
15144 	}
15145 
15146 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15147 		goto nla_put_failure;
15148 
15149 	if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15150 		goto nla_put_failure;
15151 
15152 	if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15153 		goto nla_put_failure;
15154 
15155 	if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15156 	    nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15157 		goto nla_put_failure;
15158 
15159 	if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15160 	    nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15161 		goto nla_put_failure;
15162 
15163 	if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15164 	    nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15165 		goto nla_put_failure;
15166 
15167 	genlmsg_end(msg, hdr);
15168 
15169 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15170 				NL80211_MCGRP_MLME, gfp);
15171 
15172 	return;
15173 
15174 nla_put_failure:
15175 	nlmsg_free(msg);
15176 }
15177 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15178 
15179 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15180 			   u64 cookie, bool acked, s32 ack_signal,
15181 			   bool is_valid_ack_signal, gfp_t gfp)
15182 {
15183 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15184 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15185 	struct sk_buff *msg;
15186 	void *hdr;
15187 
15188 	trace_cfg80211_probe_status(dev, addr, cookie, acked);
15189 
15190 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15191 
15192 	if (!msg)
15193 		return;
15194 
15195 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15196 	if (!hdr) {
15197 		nlmsg_free(msg);
15198 		return;
15199 	}
15200 
15201 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15202 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15203 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15204 	    nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15205 			      NL80211_ATTR_PAD) ||
15206 	    (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15207 	    (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15208 						ack_signal)))
15209 		goto nla_put_failure;
15210 
15211 	genlmsg_end(msg, hdr);
15212 
15213 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15214 				NL80211_MCGRP_MLME, gfp);
15215 	return;
15216 
15217  nla_put_failure:
15218 	nlmsg_free(msg);
15219 }
15220 EXPORT_SYMBOL(cfg80211_probe_status);
15221 
15222 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15223 				 const u8 *frame, size_t len,
15224 				 int freq, int sig_dbm)
15225 {
15226 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15227 	struct sk_buff *msg;
15228 	void *hdr;
15229 	struct cfg80211_beacon_registration *reg;
15230 
15231 	trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15232 
15233 	spin_lock_bh(&rdev->beacon_registrations_lock);
15234 	list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15235 		msg = nlmsg_new(len + 100, GFP_ATOMIC);
15236 		if (!msg) {
15237 			spin_unlock_bh(&rdev->beacon_registrations_lock);
15238 			return;
15239 		}
15240 
15241 		hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15242 		if (!hdr)
15243 			goto nla_put_failure;
15244 
15245 		if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15246 		    (freq &&
15247 		     nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15248 		    (sig_dbm &&
15249 		     nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15250 		    nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15251 			goto nla_put_failure;
15252 
15253 		genlmsg_end(msg, hdr);
15254 
15255 		genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15256 	}
15257 	spin_unlock_bh(&rdev->beacon_registrations_lock);
15258 	return;
15259 
15260  nla_put_failure:
15261 	spin_unlock_bh(&rdev->beacon_registrations_lock);
15262 	nlmsg_free(msg);
15263 }
15264 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15265 
15266 #ifdef CONFIG_PM
15267 static int cfg80211_net_detect_results(struct sk_buff *msg,
15268 				       struct cfg80211_wowlan_wakeup *wakeup)
15269 {
15270 	struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15271 	struct nlattr *nl_results, *nl_match, *nl_freqs;
15272 	int i, j;
15273 
15274 	nl_results = nla_nest_start(
15275 		msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15276 	if (!nl_results)
15277 		return -EMSGSIZE;
15278 
15279 	for (i = 0; i < nd->n_matches; i++) {
15280 		struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15281 
15282 		nl_match = nla_nest_start(msg, i);
15283 		if (!nl_match)
15284 			break;
15285 
15286 		/* The SSID attribute is optional in nl80211, but for
15287 		 * simplicity reasons it's always present in the
15288 		 * cfg80211 structure.  If a driver can't pass the
15289 		 * SSID, that needs to be changed.  A zero length SSID
15290 		 * is still a valid SSID (wildcard), so it cannot be
15291 		 * used for this purpose.
15292 		 */
15293 		if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15294 			    match->ssid.ssid)) {
15295 			nla_nest_cancel(msg, nl_match);
15296 			goto out;
15297 		}
15298 
15299 		if (match->n_channels) {
15300 			nl_freqs = nla_nest_start(
15301 				msg, NL80211_ATTR_SCAN_FREQUENCIES);
15302 			if (!nl_freqs) {
15303 				nla_nest_cancel(msg, nl_match);
15304 				goto out;
15305 			}
15306 
15307 			for (j = 0; j < match->n_channels; j++) {
15308 				if (nla_put_u32(msg, j, match->channels[j])) {
15309 					nla_nest_cancel(msg, nl_freqs);
15310 					nla_nest_cancel(msg, nl_match);
15311 					goto out;
15312 				}
15313 			}
15314 
15315 			nla_nest_end(msg, nl_freqs);
15316 		}
15317 
15318 		nla_nest_end(msg, nl_match);
15319 	}
15320 
15321 out:
15322 	nla_nest_end(msg, nl_results);
15323 	return 0;
15324 }
15325 
15326 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15327 				   struct cfg80211_wowlan_wakeup *wakeup,
15328 				   gfp_t gfp)
15329 {
15330 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15331 	struct sk_buff *msg;
15332 	void *hdr;
15333 	int size = 200;
15334 
15335 	trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15336 
15337 	if (wakeup)
15338 		size += wakeup->packet_present_len;
15339 
15340 	msg = nlmsg_new(size, gfp);
15341 	if (!msg)
15342 		return;
15343 
15344 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15345 	if (!hdr)
15346 		goto free_msg;
15347 
15348 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15349 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15350 			      NL80211_ATTR_PAD))
15351 		goto free_msg;
15352 
15353 	if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15354 					wdev->netdev->ifindex))
15355 		goto free_msg;
15356 
15357 	if (wakeup) {
15358 		struct nlattr *reasons;
15359 
15360 		reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15361 		if (!reasons)
15362 			goto free_msg;
15363 
15364 		if (wakeup->disconnect &&
15365 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15366 			goto free_msg;
15367 		if (wakeup->magic_pkt &&
15368 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15369 			goto free_msg;
15370 		if (wakeup->gtk_rekey_failure &&
15371 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15372 			goto free_msg;
15373 		if (wakeup->eap_identity_req &&
15374 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15375 			goto free_msg;
15376 		if (wakeup->four_way_handshake &&
15377 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15378 			goto free_msg;
15379 		if (wakeup->rfkill_release &&
15380 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15381 			goto free_msg;
15382 
15383 		if (wakeup->pattern_idx >= 0 &&
15384 		    nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15385 				wakeup->pattern_idx))
15386 			goto free_msg;
15387 
15388 		if (wakeup->tcp_match &&
15389 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15390 			goto free_msg;
15391 
15392 		if (wakeup->tcp_connlost &&
15393 		    nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15394 			goto free_msg;
15395 
15396 		if (wakeup->tcp_nomoretokens &&
15397 		    nla_put_flag(msg,
15398 				 NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15399 			goto free_msg;
15400 
15401 		if (wakeup->packet) {
15402 			u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15403 			u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15404 
15405 			if (!wakeup->packet_80211) {
15406 				pkt_attr =
15407 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15408 				len_attr =
15409 					NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15410 			}
15411 
15412 			if (wakeup->packet_len &&
15413 			    nla_put_u32(msg, len_attr, wakeup->packet_len))
15414 				goto free_msg;
15415 
15416 			if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15417 				    wakeup->packet))
15418 				goto free_msg;
15419 		}
15420 
15421 		if (wakeup->net_detect &&
15422 		    cfg80211_net_detect_results(msg, wakeup))
15423 				goto free_msg;
15424 
15425 		nla_nest_end(msg, reasons);
15426 	}
15427 
15428 	genlmsg_end(msg, hdr);
15429 
15430 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15431 				NL80211_MCGRP_MLME, gfp);
15432 	return;
15433 
15434  free_msg:
15435 	nlmsg_free(msg);
15436 }
15437 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15438 #endif
15439 
15440 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15441 				enum nl80211_tdls_operation oper,
15442 				u16 reason_code, gfp_t gfp)
15443 {
15444 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15445 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15446 	struct sk_buff *msg;
15447 	void *hdr;
15448 
15449 	trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15450 					 reason_code);
15451 
15452 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15453 	if (!msg)
15454 		return;
15455 
15456 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15457 	if (!hdr) {
15458 		nlmsg_free(msg);
15459 		return;
15460 	}
15461 
15462 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15463 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15464 	    nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15465 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15466 	    (reason_code > 0 &&
15467 	     nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15468 		goto nla_put_failure;
15469 
15470 	genlmsg_end(msg, hdr);
15471 
15472 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15473 				NL80211_MCGRP_MLME, gfp);
15474 	return;
15475 
15476  nla_put_failure:
15477 	nlmsg_free(msg);
15478 }
15479 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15480 
15481 static int nl80211_netlink_notify(struct notifier_block * nb,
15482 				  unsigned long state,
15483 				  void *_notify)
15484 {
15485 	struct netlink_notify *notify = _notify;
15486 	struct cfg80211_registered_device *rdev;
15487 	struct wireless_dev *wdev;
15488 	struct cfg80211_beacon_registration *reg, *tmp;
15489 
15490 	if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15491 		return NOTIFY_DONE;
15492 
15493 	rcu_read_lock();
15494 
15495 	list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15496 		struct cfg80211_sched_scan_request *sched_scan_req;
15497 
15498 		list_for_each_entry_rcu(sched_scan_req,
15499 					&rdev->sched_scan_req_list,
15500 					list) {
15501 			if (sched_scan_req->owner_nlportid == notify->portid) {
15502 				sched_scan_req->nl_owner_dead = true;
15503 				schedule_work(&rdev->sched_scan_stop_wk);
15504 			}
15505 		}
15506 
15507 		list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15508 			cfg80211_mlme_unregister_socket(wdev, notify->portid);
15509 
15510 			if (wdev->owner_nlportid == notify->portid) {
15511 				wdev->nl_owner_dead = true;
15512 				schedule_work(&rdev->destroy_work);
15513 			} else if (wdev->conn_owner_nlportid == notify->portid) {
15514 				schedule_work(&wdev->disconnect_wk);
15515 			}
15516 		}
15517 
15518 		spin_lock_bh(&rdev->beacon_registrations_lock);
15519 		list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15520 					 list) {
15521 			if (reg->nlportid == notify->portid) {
15522 				list_del(&reg->list);
15523 				kfree(reg);
15524 				break;
15525 			}
15526 		}
15527 		spin_unlock_bh(&rdev->beacon_registrations_lock);
15528 	}
15529 
15530 	rcu_read_unlock();
15531 
15532 	/*
15533 	 * It is possible that the user space process that is controlling the
15534 	 * indoor setting disappeared, so notify the regulatory core.
15535 	 */
15536 	regulatory_netlink_notify(notify->portid);
15537 	return NOTIFY_OK;
15538 }
15539 
15540 static struct notifier_block nl80211_netlink_notifier = {
15541 	.notifier_call = nl80211_netlink_notify,
15542 };
15543 
15544 void cfg80211_ft_event(struct net_device *netdev,
15545 		       struct cfg80211_ft_event_params *ft_event)
15546 {
15547 	struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15548 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15549 	struct sk_buff *msg;
15550 	void *hdr;
15551 
15552 	trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15553 
15554 	if (!ft_event->target_ap)
15555 		return;
15556 
15557 	msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
15558 	if (!msg)
15559 		return;
15560 
15561 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15562 	if (!hdr)
15563 		goto out;
15564 
15565 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15566 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15567 	    nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15568 		goto out;
15569 
15570 	if (ft_event->ies &&
15571 	    nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15572 		goto out;
15573 	if (ft_event->ric_ies &&
15574 	    nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15575 		    ft_event->ric_ies))
15576 		goto out;
15577 
15578 	genlmsg_end(msg, hdr);
15579 
15580 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15581 				NL80211_MCGRP_MLME, GFP_KERNEL);
15582 	return;
15583  out:
15584 	nlmsg_free(msg);
15585 }
15586 EXPORT_SYMBOL(cfg80211_ft_event);
15587 
15588 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15589 {
15590 	struct cfg80211_registered_device *rdev;
15591 	struct sk_buff *msg;
15592 	void *hdr;
15593 	u32 nlportid;
15594 
15595 	rdev = wiphy_to_rdev(wdev->wiphy);
15596 	if (!rdev->crit_proto_nlportid)
15597 		return;
15598 
15599 	nlportid = rdev->crit_proto_nlportid;
15600 	rdev->crit_proto_nlportid = 0;
15601 
15602 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15603 	if (!msg)
15604 		return;
15605 
15606 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15607 	if (!hdr)
15608 		goto nla_put_failure;
15609 
15610 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15611 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15612 			      NL80211_ATTR_PAD))
15613 		goto nla_put_failure;
15614 
15615 	genlmsg_end(msg, hdr);
15616 
15617 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15618 	return;
15619 
15620  nla_put_failure:
15621 	nlmsg_free(msg);
15622 }
15623 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15624 
15625 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15626 {
15627 	struct wiphy *wiphy = wdev->wiphy;
15628 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15629 	struct sk_buff *msg;
15630 	void *hdr;
15631 
15632 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15633 	if (!msg)
15634 		return;
15635 
15636 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
15637 	if (!hdr)
15638 		goto out;
15639 
15640 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15641 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
15642 	    nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15643 			      NL80211_ATTR_PAD))
15644 		goto out;
15645 
15646 	genlmsg_end(msg, hdr);
15647 
15648 	genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
15649 				NL80211_MCGRP_MLME, GFP_KERNEL);
15650 	return;
15651  out:
15652 	nlmsg_free(msg);
15653 }
15654 
15655 int cfg80211_external_auth_request(struct net_device *dev,
15656 				   struct cfg80211_external_auth_params *params,
15657 				   gfp_t gfp)
15658 {
15659 	struct wireless_dev *wdev = dev->ieee80211_ptr;
15660 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15661 	struct sk_buff *msg;
15662 	void *hdr;
15663 
15664 	if (!wdev->conn_owner_nlportid)
15665 		return -EINVAL;
15666 
15667 	msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15668 	if (!msg)
15669 		return -ENOMEM;
15670 
15671 	hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
15672 	if (!hdr)
15673 		goto nla_put_failure;
15674 
15675 	if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15676 	    nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15677 	    nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
15678 	    nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
15679 			params->action) ||
15680 	    nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
15681 	    nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
15682 		    params->ssid.ssid))
15683 		goto nla_put_failure;
15684 
15685 	genlmsg_end(msg, hdr);
15686 	genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
15687 			wdev->conn_owner_nlportid);
15688 	return 0;
15689 
15690  nla_put_failure:
15691 	nlmsg_free(msg);
15692 	return -ENOBUFS;
15693 }
15694 EXPORT_SYMBOL(cfg80211_external_auth_request);
15695 
15696 /* initialisation/exit functions */
15697 
15698 int __init nl80211_init(void)
15699 {
15700 	int err;
15701 
15702 	err = genl_register_family(&nl80211_fam);
15703 	if (err)
15704 		return err;
15705 
15706 	err = netlink_register_notifier(&nl80211_netlink_notifier);
15707 	if (err)
15708 		goto err_out;
15709 
15710 	return 0;
15711  err_out:
15712 	genl_unregister_family(&nl80211_fam);
15713 	return err;
15714 }
15715 
15716 void nl80211_exit(void)
15717 {
15718 	netlink_unregister_notifier(&nl80211_netlink_notifier);
15719 	genl_unregister_family(&nl80211_fam);
15720 }
15721