linux/net/wireless/nl80211.c
<<
>>
Prefs
   1// SPDX-License-Identifier: GPL-2.0-only
   2/*
   3 * This is the new netlink-based wireless configuration interface.
   4 *
   5 * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6 * Copyright 2013-2014  Intel Mobile Communications GmbH
   7 * Copyright 2015-2017  Intel Deutschland GmbH
   8 * Copyright (C) 2018-2019 Intel Corporation
   9 */
  10
  11#include <linux/if.h>
  12#include <linux/module.h>
  13#include <linux/err.h>
  14#include <linux/slab.h>
  15#include <linux/list.h>
  16#include <linux/if_ether.h>
  17#include <linux/ieee80211.h>
  18#include <linux/nl80211.h>
  19#include <linux/rtnetlink.h>
  20#include <linux/netlink.h>
  21#include <linux/nospec.h>
  22#include <linux/etherdevice.h>
  23#include <net/net_namespace.h>
  24#include <net/genetlink.h>
  25#include <net/cfg80211.h>
  26#include <net/sock.h>
  27#include <net/inet_connection_sock.h>
  28#include "core.h"
  29#include "nl80211.h"
  30#include "reg.h"
  31#include "rdev-ops.h"
  32
  33static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  34                                   struct genl_info *info,
  35                                   struct cfg80211_crypto_settings *settings,
  36                                   int cipher_limit);
  37
  38/* the netlink family */
  39static struct genl_family nl80211_fam;
  40
  41/* multicast groups */
  42enum nl80211_multicast_groups {
  43        NL80211_MCGRP_CONFIG,
  44        NL80211_MCGRP_SCAN,
  45        NL80211_MCGRP_REGULATORY,
  46        NL80211_MCGRP_MLME,
  47        NL80211_MCGRP_VENDOR,
  48        NL80211_MCGRP_NAN,
  49        NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  50};
  51
  52static const struct genl_multicast_group nl80211_mcgrps[] = {
  53        [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  54        [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  55        [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  56        [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  57        [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  58        [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  59#ifdef CONFIG_NL80211_TESTMODE
  60        [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  61#endif
  62};
  63
  64/* returns ERR_PTR values */
  65static struct wireless_dev *
  66__cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  67{
  68        struct cfg80211_registered_device *rdev;
  69        struct wireless_dev *result = NULL;
  70        bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  71        bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  72        u64 wdev_id;
  73        int wiphy_idx = -1;
  74        int ifidx = -1;
  75
  76        ASSERT_RTNL();
  77
  78        if (!have_ifidx && !have_wdev_id)
  79                return ERR_PTR(-EINVAL);
  80
  81        if (have_ifidx)
  82                ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  83        if (have_wdev_id) {
  84                wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  85                wiphy_idx = wdev_id >> 32;
  86        }
  87
  88        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  89                struct wireless_dev *wdev;
  90
  91                if (wiphy_net(&rdev->wiphy) != netns)
  92                        continue;
  93
  94                if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  95                        continue;
  96
  97                list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  98                        if (have_ifidx && wdev->netdev &&
  99                            wdev->netdev->ifindex == ifidx) {
 100                                result = wdev;
 101                                break;
 102                        }
 103                        if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 104                                result = wdev;
 105                                break;
 106                        }
 107                }
 108
 109                if (result)
 110                        break;
 111        }
 112
 113        if (result)
 114                return result;
 115        return ERR_PTR(-ENODEV);
 116}
 117
 118static struct cfg80211_registered_device *
 119__cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 120{
 121        struct cfg80211_registered_device *rdev = NULL, *tmp;
 122        struct net_device *netdev;
 123
 124        ASSERT_RTNL();
 125
 126        if (!attrs[NL80211_ATTR_WIPHY] &&
 127            !attrs[NL80211_ATTR_IFINDEX] &&
 128            !attrs[NL80211_ATTR_WDEV])
 129                return ERR_PTR(-EINVAL);
 130
 131        if (attrs[NL80211_ATTR_WIPHY])
 132                rdev = cfg80211_rdev_by_wiphy_idx(
 133                                nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 134
 135        if (attrs[NL80211_ATTR_WDEV]) {
 136                u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 137                struct wireless_dev *wdev;
 138                bool found = false;
 139
 140                tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 141                if (tmp) {
 142                        /* make sure wdev exists */
 143                        list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 144                                if (wdev->identifier != (u32)wdev_id)
 145                                        continue;
 146                                found = true;
 147                                break;
 148                        }
 149
 150                        if (!found)
 151                                tmp = NULL;
 152
 153                        if (rdev && tmp != rdev)
 154                                return ERR_PTR(-EINVAL);
 155                        rdev = tmp;
 156                }
 157        }
 158
 159        if (attrs[NL80211_ATTR_IFINDEX]) {
 160                int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 161
 162                netdev = __dev_get_by_index(netns, ifindex);
 163                if (netdev) {
 164                        if (netdev->ieee80211_ptr)
 165                                tmp = wiphy_to_rdev(
 166                                        netdev->ieee80211_ptr->wiphy);
 167                        else
 168                                tmp = NULL;
 169
 170                        /* not wireless device -- return error */
 171                        if (!tmp)
 172                                return ERR_PTR(-EINVAL);
 173
 174                        /* mismatch -- return error */
 175                        if (rdev && tmp != rdev)
 176                                return ERR_PTR(-EINVAL);
 177
 178                        rdev = tmp;
 179                }
 180        }
 181
 182        if (!rdev)
 183                return ERR_PTR(-ENODEV);
 184
 185        if (netns != wiphy_net(&rdev->wiphy))
 186                return ERR_PTR(-ENODEV);
 187
 188        return rdev;
 189}
 190
 191/*
 192 * This function returns a pointer to the driver
 193 * that the genl_info item that is passed refers to.
 194 *
 195 * The result of this can be a PTR_ERR and hence must
 196 * be checked with IS_ERR() for errors.
 197 */
 198static struct cfg80211_registered_device *
 199cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 200{
 201        return __cfg80211_rdev_from_attrs(netns, info->attrs);
 202}
 203
 204static int validate_beacon_head(const struct nlattr *attr,
 205                                struct netlink_ext_ack *extack)
 206{
 207        const u8 *data = nla_data(attr);
 208        unsigned int len = nla_len(attr);
 209        const struct element *elem;
 210        const struct ieee80211_mgmt *mgmt = (void *)data;
 211        unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
 212                                         u.beacon.variable);
 213
 214        if (len < fixedlen)
 215                goto err;
 216
 217        if (ieee80211_hdrlen(mgmt->frame_control) !=
 218            offsetof(struct ieee80211_mgmt, u.beacon))
 219                goto err;
 220
 221        data += fixedlen;
 222        len -= fixedlen;
 223
 224        for_each_element(elem, data, len) {
 225                /* nothing */
 226        }
 227
 228        if (for_each_element_completed(elem, data, len))
 229                return 0;
 230
 231err:
 232        NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 233        return -EINVAL;
 234}
 235
 236static int validate_ie_attr(const struct nlattr *attr,
 237                            struct netlink_ext_ack *extack)
 238{
 239        const u8 *data = nla_data(attr);
 240        unsigned int len = nla_len(attr);
 241        const struct element *elem;
 242
 243        for_each_element(elem, data, len) {
 244                /* nothing */
 245        }
 246
 247        if (for_each_element_completed(elem, data, len))
 248                return 0;
 249
 250        NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 251        return -EINVAL;
 252}
 253
 254/* policy for the attributes */
 255static const struct nla_policy
 256nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 257        [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 258        [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 259                                        .len = U8_MAX },
 260        [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 261                                             .len = U8_MAX },
 262};
 263
 264static const struct nla_policy
 265nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 266        [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 267        [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 268        [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 269                NLA_POLICY_MAX(NLA_U8, 15),
 270        [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 271        [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 272                NLA_POLICY_MAX(NLA_U8, 15),
 273        [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 274                NLA_POLICY_MAX(NLA_U8, 31),
 275        [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 276        [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 277        [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 278};
 279
 280static const struct nla_policy
 281nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 282        [NL80211_PMSR_TYPE_FTM] =
 283                NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 284};
 285
 286static const struct nla_policy
 287nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 288        [NL80211_PMSR_REQ_ATTR_DATA] =
 289                NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 290        [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 291};
 292
 293static const struct nla_policy
 294nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 295        [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 296        /*
 297         * we could specify this again to be the top-level policy,
 298         * but that would open us up to recursion problems ...
 299         */
 300        [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 301        [NL80211_PMSR_PEER_ATTR_REQ] =
 302                NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 303        [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 304};
 305
 306static const struct nla_policy
 307nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 308        [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 309        [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 310        [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 311        [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 312        [NL80211_PMSR_ATTR_PEERS] =
 313                NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 314};
 315
 316static const struct nla_policy
 317he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 318        [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 319                NLA_POLICY_RANGE(NLA_U8, 1, 20),
 320        [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 321                NLA_POLICY_RANGE(NLA_U8, 1, 20),
 322};
 323
 324const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 325        [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 326        [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 327        [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 328                                      .len = 20-1 },
 329        [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 330
 331        [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 332        [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 333        [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 334                                                NL80211_EDMG_CHANNELS_MIN,
 335                                                NL80211_EDMG_CHANNELS_MAX),
 336        [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 337                                                NL80211_EDMG_BW_CONFIG_MIN,
 338                                                NL80211_EDMG_BW_CONFIG_MAX),
 339
 340        [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 341        [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 342        [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 343
 344        [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 345        [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 346        [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 347        [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 348        [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 349        [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 350
 351        [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 352        [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 353        [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 354
 355        [NL80211_ATTR_MAC] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 356        [NL80211_ATTR_PREV_BSSID] = {
 357                .type = NLA_EXACT_LEN_WARN,
 358                .len = ETH_ALEN
 359        },
 360
 361        [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 362        [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 363                                    .len = WLAN_MAX_KEY_LEN },
 364        [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 365        [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 366        [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 367        [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 368        [NL80211_ATTR_KEY_TYPE] =
 369                NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 370
 371        [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 372        [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 373        [NL80211_ATTR_BEACON_HEAD] =
 374                NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 375                                       IEEE80211_MAX_DATA_LEN),
 376        [NL80211_ATTR_BEACON_TAIL] =
 377                NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 378                                       IEEE80211_MAX_DATA_LEN),
 379        [NL80211_ATTR_STA_AID] =
 380                NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 381        [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 382        [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 383        [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 384                                               .len = NL80211_MAX_SUPP_RATES },
 385        [NL80211_ATTR_STA_PLINK_ACTION] =
 386                NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 387        [NL80211_ATTR_STA_TX_POWER_SETTING] =
 388                NLA_POLICY_RANGE(NLA_U8,
 389                                 NL80211_TX_POWER_AUTOMATIC,
 390                                 NL80211_TX_POWER_FIXED),
 391        [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 392        [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 393        [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 394        [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 395                                   .len = IEEE80211_MAX_MESH_ID_LEN },
 396        [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 397
 398        [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 399        [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 400
 401        [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 402        [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 403        [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 404        [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 405                                           .len = NL80211_MAX_SUPP_RATES },
 406        [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 407
 408        [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 409        [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 410
 411        [NL80211_ATTR_HT_CAPABILITY] = {
 412                .type = NLA_EXACT_LEN_WARN,
 413                .len = NL80211_HT_CAPABILITY_LEN
 414        },
 415
 416        [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 417        [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 418                                                   validate_ie_attr,
 419                                                   IEEE80211_MAX_DATA_LEN),
 420        [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 421        [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 422
 423        [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 424                                .len = IEEE80211_MAX_SSID_LEN },
 425        [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 426        [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 427        [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 428        [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 429        [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 430                                                  NL80211_MFP_NO,
 431                                                  NL80211_MFP_OPTIONAL),
 432        [NL80211_ATTR_STA_FLAGS2] = {
 433                .len = sizeof(struct nl80211_sta_flag_update),
 434        },
 435        [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 436        [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 437        [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 438        [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 439        [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 440        [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 441        [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 442        [NL80211_ATTR_PID] = { .type = NLA_U32 },
 443        [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 444        [NL80211_ATTR_PMKID] = {
 445                .type = NLA_EXACT_LEN_WARN,
 446                .len = WLAN_PMKID_LEN
 447        },
 448        [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 449        [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 450        [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 451        [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 452                                 .len = IEEE80211_MAX_DATA_LEN },
 453        [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 454        [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 455                                                   NL80211_PS_DISABLED,
 456                                                   NL80211_PS_ENABLED),
 457        [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 458        [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 459        [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 460        [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 461        [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 462        [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 463        [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 464        [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 465        [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 466        [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 467        [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 468        [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 469        [NL80211_ATTR_STA_PLINK_STATE] =
 470                NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 471        [NL80211_ATTR_MESH_PEER_AID] =
 472                NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 473        [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 474        [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 475        [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 476        [NL80211_ATTR_HIDDEN_SSID] =
 477                NLA_POLICY_RANGE(NLA_U32,
 478                                 NL80211_HIDDEN_SSID_NOT_IN_USE,
 479                                 NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 480        [NL80211_ATTR_IE_PROBE_RESP] =
 481                NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 482                                       IEEE80211_MAX_DATA_LEN),
 483        [NL80211_ATTR_IE_ASSOC_RESP] =
 484                NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 485                                       IEEE80211_MAX_DATA_LEN),
 486        [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 487        [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 488        [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 489        [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 490        [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 491        [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 492        [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 493        [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 494        [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 495        [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 496        [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 497                                      .len = IEEE80211_MAX_DATA_LEN },
 498        [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 499        [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 500        [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 501                .len = NL80211_HT_CAPABILITY_LEN
 502        },
 503        [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 504        [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 505        [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 506        [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 507        [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 508        [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 509        [NL80211_ATTR_VHT_CAPABILITY] = {
 510                .type = NLA_EXACT_LEN_WARN,
 511                .len = NL80211_VHT_CAPABILITY_LEN
 512        },
 513        [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 514        [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 515        [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 516        [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 517                NLA_POLICY_RANGE(NLA_U32,
 518                                 NL80211_MESH_POWER_UNKNOWN + 1,
 519                                 NL80211_MESH_POWER_MAX),
 520        [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 521        [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 522        [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 523        [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 524        [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 525        [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 526        [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 527                .len = NL80211_VHT_CAPABILITY_LEN,
 528        },
 529        [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 530        [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 531                                  .len = IEEE80211_MAX_DATA_LEN },
 532        [NL80211_ATTR_PEER_AID] =
 533                NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 534        [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 535        [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 536        [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 537        [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 538        [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 539        [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 540        [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 541        [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 542        [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 543        [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 544        [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 545        [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 546        [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 547                                   .len = IEEE80211_QOS_MAP_LEN_MAX },
 548        [NL80211_ATTR_MAC_HINT] = {
 549                .type = NLA_EXACT_LEN_WARN,
 550                .len = ETH_ALEN
 551        },
 552        [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 553        [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 554        [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 555        [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 556        [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 557        [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 558        [NL80211_ATTR_USER_PRIO] =
 559                NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 560        [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 561        [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 562        [NL80211_ATTR_MAC_MASK] = {
 563                .type = NLA_EXACT_LEN_WARN,
 564                .len = ETH_ALEN
 565        },
 566        [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 567        [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 568        [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 569        [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 570        [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 571        [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 572        [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 573                NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 574        [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 575                .len = VHT_MUMIMO_GROUPS_DATA_LEN
 576        },
 577        [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = {
 578                .type = NLA_EXACT_LEN_WARN,
 579                .len = ETH_ALEN
 580        },
 581        [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 582        [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 583        [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 584        [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 585                                    .len = FILS_MAX_KEK_LEN },
 586        [NL80211_ATTR_FILS_NONCES] = {
 587                .type = NLA_EXACT_LEN_WARN,
 588                .len = 2 * FILS_NONCE_LEN
 589        },
 590        [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 591        [NL80211_ATTR_BSSID] = { .type = NLA_EXACT_LEN_WARN, .len = ETH_ALEN },
 592        [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 593        [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 594                .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 595        },
 596        [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 597        [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 598                                             .len = FILS_ERP_MAX_USERNAME_LEN },
 599        [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 600                                          .len = FILS_ERP_MAX_REALM_LEN },
 601        [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 602        [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 603                                        .len = FILS_ERP_MAX_RRK_LEN },
 604        [NL80211_ATTR_FILS_CACHE_ID] = { .type = NLA_EXACT_LEN_WARN, .len = 2 },
 605        [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 606        [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 607        [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 608
 609        [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 610        [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 611        [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 612        [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 613                                         .len = NL80211_HE_MAX_CAPABILITY_LEN },
 614
 615        [NL80211_ATTR_FTM_RESPONDER] = {
 616                .type = NLA_NESTED,
 617                .validation_data = nl80211_ftm_responder_policy,
 618        },
 619        [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 620        [NL80211_ATTR_PEER_MEASUREMENTS] =
 621                NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 622        [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 623        [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 624                                        .len = SAE_PASSWORD_MAX_LEN },
 625        [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 626        [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 627};
 628
 629/* policy for the key attributes */
 630static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 631        [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 632        [NL80211_KEY_IDX] = { .type = NLA_U8 },
 633        [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 634        [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 635        [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 636        [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 637        [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 638        [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 639        [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 640};
 641
 642/* policy for the key default flags */
 643static const struct nla_policy
 644nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 645        [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 646        [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 647};
 648
 649#ifdef CONFIG_PM
 650/* policy for WoWLAN attributes */
 651static const struct nla_policy
 652nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 653        [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 654        [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 655        [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 656        [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 657        [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 658        [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 659        [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 660        [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 661        [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 662        [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 663};
 664
 665static const struct nla_policy
 666nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 667        [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 668        [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 669        [NL80211_WOWLAN_TCP_DST_MAC] = {
 670                .type = NLA_EXACT_LEN_WARN,
 671                .len = ETH_ALEN
 672        },
 673        [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 674        [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 675        [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 676        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 677                .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 678        },
 679        [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 680                .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 681        },
 682        [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 683        [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .type = NLA_MIN_LEN, .len = 1 },
 684        [NL80211_WOWLAN_TCP_WAKE_MASK] = { .type = NLA_MIN_LEN, .len = 1 },
 685};
 686#endif /* CONFIG_PM */
 687
 688/* policy for coalesce rule attributes */
 689static const struct nla_policy
 690nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 691        [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 692        [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 693                NLA_POLICY_RANGE(NLA_U32,
 694                                 NL80211_COALESCE_CONDITION_MATCH,
 695                                 NL80211_COALESCE_CONDITION_NO_MATCH),
 696        [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 697};
 698
 699/* policy for GTK rekey offload attributes */
 700static const struct nla_policy
 701nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 702        [NL80211_REKEY_DATA_KEK] = {
 703                .type = NLA_EXACT_LEN_WARN,
 704                .len = NL80211_KEK_LEN,
 705        },
 706        [NL80211_REKEY_DATA_KCK] = {
 707                .type = NLA_EXACT_LEN_WARN,
 708                .len = NL80211_KCK_LEN,
 709        },
 710        [NL80211_REKEY_DATA_REPLAY_CTR] = {
 711                .type = NLA_EXACT_LEN_WARN,
 712                .len = NL80211_REPLAY_CTR_LEN
 713        },
 714};
 715
 716static const struct nla_policy
 717nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 718        [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 719        [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 720        [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 721        [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 722};
 723
 724static const struct nla_policy
 725nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 726        [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 727                                                 .len = IEEE80211_MAX_SSID_LEN },
 728        [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = {
 729                .type = NLA_EXACT_LEN_WARN,
 730                .len = ETH_ALEN
 731        },
 732        [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 733        [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 734                NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 735};
 736
 737static const struct nla_policy
 738nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 739        [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 740        [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 741};
 742
 743static const struct nla_policy
 744nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 745        [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 746        [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 747        [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 748                .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 749        },
 750};
 751
 752/* policy for NAN function attributes */
 753static const struct nla_policy
 754nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 755        [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 756        [NL80211_NAN_FUNC_SERVICE_ID] = {
 757                                    .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 758        [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 759        [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 760        [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 761        [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 762        [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 763        [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = {
 764                .type = NLA_EXACT_LEN_WARN,
 765                .len = ETH_ALEN
 766        },
 767        [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 768        [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 769        [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 770                        .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 771        [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 772        [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 773        [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 774        [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 775        [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 776};
 777
 778/* policy for Service Response Filter attributes */
 779static const struct nla_policy
 780nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 781        [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 782        [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 783                                 .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 784        [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 785        [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 786};
 787
 788/* policy for packet pattern attributes */
 789static const struct nla_policy
 790nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 791        [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 792        [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 793        [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 794};
 795
 796int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 797                              struct cfg80211_registered_device **rdev,
 798                              struct wireless_dev **wdev)
 799{
 800        int err;
 801
 802        if (!cb->args[0]) {
 803                struct nlattr **attrbuf;
 804
 805                attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 806                                  GFP_KERNEL);
 807                if (!attrbuf)
 808                        return -ENOMEM;
 809
 810                err = nlmsg_parse_deprecated(cb->nlh,
 811                                             GENL_HDRLEN + nl80211_fam.hdrsize,
 812                                             attrbuf, nl80211_fam.maxattr,
 813                                             nl80211_policy, NULL);
 814                if (err) {
 815                        kfree(attrbuf);
 816                        return err;
 817                }
 818
 819                *wdev = __cfg80211_wdev_from_attrs(sock_net(cb->skb->sk),
 820                                                   attrbuf);
 821                kfree(attrbuf);
 822                if (IS_ERR(*wdev))
 823                        return PTR_ERR(*wdev);
 824                *rdev = wiphy_to_rdev((*wdev)->wiphy);
 825                /* 0 is the first index - add 1 to parse only once */
 826                cb->args[0] = (*rdev)->wiphy_idx + 1;
 827                cb->args[1] = (*wdev)->identifier;
 828        } else {
 829                /* subtract the 1 again here */
 830                struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 831                struct wireless_dev *tmp;
 832
 833                if (!wiphy)
 834                        return -ENODEV;
 835                *rdev = wiphy_to_rdev(wiphy);
 836                *wdev = NULL;
 837
 838                list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 839                        if (tmp->identifier == cb->args[1]) {
 840                                *wdev = tmp;
 841                                break;
 842                        }
 843                }
 844
 845                if (!*wdev)
 846                        return -ENODEV;
 847        }
 848
 849        return 0;
 850}
 851
 852/* message building helper */
 853void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 854                     int flags, u8 cmd)
 855{
 856        /* since there is no private header just add the generic one */
 857        return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 858}
 859
 860static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 861                                     const struct ieee80211_reg_rule *rule)
 862{
 863        int j;
 864        struct nlattr *nl_wmm_rules =
 865                nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
 866
 867        if (!nl_wmm_rules)
 868                goto nla_put_failure;
 869
 870        for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 871                struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
 872
 873                if (!nl_wmm_rule)
 874                        goto nla_put_failure;
 875
 876                if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 877                                rule->wmm_rule.client[j].cw_min) ||
 878                    nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 879                                rule->wmm_rule.client[j].cw_max) ||
 880                    nla_put_u8(msg, NL80211_WMMR_AIFSN,
 881                               rule->wmm_rule.client[j].aifsn) ||
 882                    nla_put_u16(msg, NL80211_WMMR_TXOP,
 883                                rule->wmm_rule.client[j].cot))
 884                        goto nla_put_failure;
 885
 886                nla_nest_end(msg, nl_wmm_rule);
 887        }
 888        nla_nest_end(msg, nl_wmm_rules);
 889
 890        return 0;
 891
 892nla_put_failure:
 893        return -ENOBUFS;
 894}
 895
 896static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 897                                   struct ieee80211_channel *chan,
 898                                   bool large)
 899{
 900        /* Some channels must be completely excluded from the
 901         * list to protect old user-space tools from breaking
 902         */
 903        if (!large && chan->flags &
 904            (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 905                return 0;
 906
 907        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 908                        chan->center_freq))
 909                goto nla_put_failure;
 910
 911        if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 912            nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 913                goto nla_put_failure;
 914        if (chan->flags & IEEE80211_CHAN_NO_IR) {
 915                if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 916                        goto nla_put_failure;
 917                if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 918                        goto nla_put_failure;
 919        }
 920        if (chan->flags & IEEE80211_CHAN_RADAR) {
 921                if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 922                        goto nla_put_failure;
 923                if (large) {
 924                        u32 time;
 925
 926                        time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 927
 928                        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 929                                        chan->dfs_state))
 930                                goto nla_put_failure;
 931                        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 932                                        time))
 933                                goto nla_put_failure;
 934                        if (nla_put_u32(msg,
 935                                        NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 936                                        chan->dfs_cac_ms))
 937                                goto nla_put_failure;
 938                }
 939        }
 940
 941        if (large) {
 942                if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 943                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 944                        goto nla_put_failure;
 945                if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 946                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 947                        goto nla_put_failure;
 948                if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 949                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 950                        goto nla_put_failure;
 951                if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 952                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 953                        goto nla_put_failure;
 954                if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 955                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 956                        goto nla_put_failure;
 957                if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 958                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 959                        goto nla_put_failure;
 960                if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 961                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 962                        goto nla_put_failure;
 963                if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 964                    nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 965                        goto nla_put_failure;
 966        }
 967
 968        if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 969                        DBM_TO_MBM(chan->max_power)))
 970                goto nla_put_failure;
 971
 972        if (large) {
 973                const struct ieee80211_reg_rule *rule =
 974                        freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 975
 976                if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 977                        if (nl80211_msg_put_wmm_rules(msg, rule))
 978                                goto nla_put_failure;
 979                }
 980        }
 981
 982        return 0;
 983
 984 nla_put_failure:
 985        return -ENOBUFS;
 986}
 987
 988static bool nl80211_put_txq_stats(struct sk_buff *msg,
 989                                  struct cfg80211_txq_stats *txqstats,
 990                                  int attrtype)
 991{
 992        struct nlattr *txqattr;
 993
 994#define PUT_TXQVAL_U32(attr, memb) do {                                   \
 995        if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 996            nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 997                return false;                                             \
 998        } while (0)
 999
1000        txqattr = nla_nest_start_noflag(msg, attrtype);
1001        if (!txqattr)
1002                return false;
1003
1004        PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1005        PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1006        PUT_TXQVAL_U32(FLOWS, flows);
1007        PUT_TXQVAL_U32(DROPS, drops);
1008        PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1009        PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1010        PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1011        PUT_TXQVAL_U32(COLLISIONS, collisions);
1012        PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1013        PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1014        PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1015        nla_nest_end(msg, txqattr);
1016
1017#undef PUT_TXQVAL_U32
1018        return true;
1019}
1020
1021/* netlink command implementations */
1022
1023struct key_parse {
1024        struct key_params p;
1025        int idx;
1026        int type;
1027        bool def, defmgmt;
1028        bool def_uni, def_multi;
1029};
1030
1031static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1032                                 struct key_parse *k)
1033{
1034        struct nlattr *tb[NL80211_KEY_MAX + 1];
1035        int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1036                                              nl80211_key_policy,
1037                                              info->extack);
1038        if (err)
1039                return err;
1040
1041        k->def = !!tb[NL80211_KEY_DEFAULT];
1042        k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1043
1044        if (k->def) {
1045                k->def_uni = true;
1046                k->def_multi = true;
1047        }
1048        if (k->defmgmt)
1049                k->def_multi = true;
1050
1051        if (tb[NL80211_KEY_IDX])
1052                k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1053
1054        if (tb[NL80211_KEY_DATA]) {
1055                k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1056                k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1057        }
1058
1059        if (tb[NL80211_KEY_SEQ]) {
1060                k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1061                k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1062        }
1063
1064        if (tb[NL80211_KEY_CIPHER])
1065                k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1066
1067        if (tb[NL80211_KEY_TYPE])
1068                k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1069
1070        if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1071                struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1072
1073                err = nla_parse_nested_deprecated(kdt,
1074                                                  NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1075                                                  tb[NL80211_KEY_DEFAULT_TYPES],
1076                                                  nl80211_key_default_policy,
1077                                                  info->extack);
1078                if (err)
1079                        return err;
1080
1081                k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1082                k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1083        }
1084
1085        if (tb[NL80211_KEY_MODE])
1086                k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1087
1088        return 0;
1089}
1090
1091static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1092{
1093        if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1094                k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1095                k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1096        }
1097
1098        if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1099                k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1100                k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1101        }
1102
1103        if (info->attrs[NL80211_ATTR_KEY_IDX])
1104                k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1105
1106        if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1107                k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1108
1109        k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1110        k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1111
1112        if (k->def) {
1113                k->def_uni = true;
1114                k->def_multi = true;
1115        }
1116        if (k->defmgmt)
1117                k->def_multi = true;
1118
1119        if (info->attrs[NL80211_ATTR_KEY_TYPE])
1120                k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1121
1122        if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1123                struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1124                int err = nla_parse_nested_deprecated(kdt,
1125                                                      NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1126                                                      info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1127                                                      nl80211_key_default_policy,
1128                                                      info->extack);
1129                if (err)
1130                        return err;
1131
1132                k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1133                k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1134        }
1135
1136        return 0;
1137}
1138
1139static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1140{
1141        int err;
1142
1143        memset(k, 0, sizeof(*k));
1144        k->idx = -1;
1145        k->type = -1;
1146
1147        if (info->attrs[NL80211_ATTR_KEY])
1148                err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1149        else
1150                err = nl80211_parse_key_old(info, k);
1151
1152        if (err)
1153                return err;
1154
1155        if (k->def && k->defmgmt) {
1156                GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1157                return -EINVAL;
1158        }
1159
1160        if (k->defmgmt) {
1161                if (k->def_uni || !k->def_multi) {
1162                        GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1163                        return -EINVAL;
1164                }
1165        }
1166
1167        if (k->idx != -1) {
1168                if (k->defmgmt) {
1169                        if (k->idx < 4 || k->idx > 5) {
1170                                GENL_SET_ERR_MSG(info,
1171                                                 "defmgmt key idx not 4 or 5");
1172                                return -EINVAL;
1173                        }
1174                } else if (k->def) {
1175                        if (k->idx < 0 || k->idx > 3) {
1176                                GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1177                                return -EINVAL;
1178                        }
1179                } else {
1180                        if (k->idx < 0 || k->idx > 5) {
1181                                GENL_SET_ERR_MSG(info, "key idx not 0-5");
1182                                return -EINVAL;
1183                        }
1184                }
1185        }
1186
1187        return 0;
1188}
1189
1190static struct cfg80211_cached_keys *
1191nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1192                       struct genl_info *info, bool *no_ht)
1193{
1194        struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1195        struct key_parse parse;
1196        struct nlattr *key;
1197        struct cfg80211_cached_keys *result;
1198        int rem, err, def = 0;
1199        bool have_key = false;
1200
1201        nla_for_each_nested(key, keys, rem) {
1202                have_key = true;
1203                break;
1204        }
1205
1206        if (!have_key)
1207                return NULL;
1208
1209        result = kzalloc(sizeof(*result), GFP_KERNEL);
1210        if (!result)
1211                return ERR_PTR(-ENOMEM);
1212
1213        result->def = -1;
1214
1215        nla_for_each_nested(key, keys, rem) {
1216                memset(&parse, 0, sizeof(parse));
1217                parse.idx = -1;
1218
1219                err = nl80211_parse_key_new(info, key, &parse);
1220                if (err)
1221                        goto error;
1222                err = -EINVAL;
1223                if (!parse.p.key)
1224                        goto error;
1225                if (parse.idx < 0 || parse.idx > 3) {
1226                        GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1227                        goto error;
1228                }
1229                if (parse.def) {
1230                        if (def) {
1231                                GENL_SET_ERR_MSG(info,
1232                                                 "only one key can be default");
1233                                goto error;
1234                        }
1235                        def = 1;
1236                        result->def = parse.idx;
1237                        if (!parse.def_uni || !parse.def_multi)
1238                                goto error;
1239                } else if (parse.defmgmt)
1240                        goto error;
1241                err = cfg80211_validate_key_settings(rdev, &parse.p,
1242                                                     parse.idx, false, NULL);
1243                if (err)
1244                        goto error;
1245                if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1246                    parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1247                        GENL_SET_ERR_MSG(info, "connect key must be WEP");
1248                        err = -EINVAL;
1249                        goto error;
1250                }
1251                result->params[parse.idx].cipher = parse.p.cipher;
1252                result->params[parse.idx].key_len = parse.p.key_len;
1253                result->params[parse.idx].key = result->data[parse.idx];
1254                memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1255
1256                /* must be WEP key if we got here */
1257                if (no_ht)
1258                        *no_ht = true;
1259        }
1260
1261        if (result->def < 0) {
1262                err = -EINVAL;
1263                GENL_SET_ERR_MSG(info, "need a default/TX key");
1264                goto error;
1265        }
1266
1267        return result;
1268 error:
1269        kfree(result);
1270        return ERR_PTR(err);
1271}
1272
1273static int nl80211_key_allowed(struct wireless_dev *wdev)
1274{
1275        ASSERT_WDEV_LOCK(wdev);
1276
1277        switch (wdev->iftype) {
1278        case NL80211_IFTYPE_AP:
1279        case NL80211_IFTYPE_AP_VLAN:
1280        case NL80211_IFTYPE_P2P_GO:
1281        case NL80211_IFTYPE_MESH_POINT:
1282                break;
1283        case NL80211_IFTYPE_ADHOC:
1284        case NL80211_IFTYPE_STATION:
1285        case NL80211_IFTYPE_P2P_CLIENT:
1286                if (!wdev->current_bss)
1287                        return -ENOLINK;
1288                break;
1289        case NL80211_IFTYPE_UNSPECIFIED:
1290        case NL80211_IFTYPE_OCB:
1291        case NL80211_IFTYPE_MONITOR:
1292        case NL80211_IFTYPE_NAN:
1293        case NL80211_IFTYPE_P2P_DEVICE:
1294        case NL80211_IFTYPE_WDS:
1295        case NUM_NL80211_IFTYPES:
1296                return -EINVAL;
1297        }
1298
1299        return 0;
1300}
1301
1302static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1303                                                        struct nlattr *tb)
1304{
1305        struct ieee80211_channel *chan;
1306
1307        if (tb == NULL)
1308                return NULL;
1309        chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1310        if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1311                return NULL;
1312        return chan;
1313}
1314
1315static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1316{
1317        struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1318        int i;
1319
1320        if (!nl_modes)
1321                goto nla_put_failure;
1322
1323        i = 0;
1324        while (ifmodes) {
1325                if ((ifmodes & 1) && nla_put_flag(msg, i))
1326                        goto nla_put_failure;
1327                ifmodes >>= 1;
1328                i++;
1329        }
1330
1331        nla_nest_end(msg, nl_modes);
1332        return 0;
1333
1334nla_put_failure:
1335        return -ENOBUFS;
1336}
1337
1338static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1339                                          struct sk_buff *msg,
1340                                          bool large)
1341{
1342        struct nlattr *nl_combis;
1343        int i, j;
1344
1345        nl_combis = nla_nest_start_noflag(msg,
1346                                          NL80211_ATTR_INTERFACE_COMBINATIONS);
1347        if (!nl_combis)
1348                goto nla_put_failure;
1349
1350        for (i = 0; i < wiphy->n_iface_combinations; i++) {
1351                const struct ieee80211_iface_combination *c;
1352                struct nlattr *nl_combi, *nl_limits;
1353
1354                c = &wiphy->iface_combinations[i];
1355
1356                nl_combi = nla_nest_start_noflag(msg, i + 1);
1357                if (!nl_combi)
1358                        goto nla_put_failure;
1359
1360                nl_limits = nla_nest_start_noflag(msg,
1361                                                  NL80211_IFACE_COMB_LIMITS);
1362                if (!nl_limits)
1363                        goto nla_put_failure;
1364
1365                for (j = 0; j < c->n_limits; j++) {
1366                        struct nlattr *nl_limit;
1367
1368                        nl_limit = nla_nest_start_noflag(msg, j + 1);
1369                        if (!nl_limit)
1370                                goto nla_put_failure;
1371                        if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1372                                        c->limits[j].max))
1373                                goto nla_put_failure;
1374                        if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1375                                                c->limits[j].types))
1376                                goto nla_put_failure;
1377                        nla_nest_end(msg, nl_limit);
1378                }
1379
1380                nla_nest_end(msg, nl_limits);
1381
1382                if (c->beacon_int_infra_match &&
1383                    nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1384                        goto nla_put_failure;
1385                if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1386                                c->num_different_channels) ||
1387                    nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1388                                c->max_interfaces))
1389                        goto nla_put_failure;
1390                if (large &&
1391                    (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1392                                c->radar_detect_widths) ||
1393                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1394                                c->radar_detect_regions)))
1395                        goto nla_put_failure;
1396                if (c->beacon_int_min_gcd &&
1397                    nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1398                                c->beacon_int_min_gcd))
1399                        goto nla_put_failure;
1400
1401                nla_nest_end(msg, nl_combi);
1402        }
1403
1404        nla_nest_end(msg, nl_combis);
1405
1406        return 0;
1407nla_put_failure:
1408        return -ENOBUFS;
1409}
1410
1411#ifdef CONFIG_PM
1412static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1413                                        struct sk_buff *msg)
1414{
1415        const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1416        struct nlattr *nl_tcp;
1417
1418        if (!tcp)
1419                return 0;
1420
1421        nl_tcp = nla_nest_start_noflag(msg,
1422                                       NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1423        if (!nl_tcp)
1424                return -ENOBUFS;
1425
1426        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1427                        tcp->data_payload_max))
1428                return -ENOBUFS;
1429
1430        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1431                        tcp->data_payload_max))
1432                return -ENOBUFS;
1433
1434        if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1435                return -ENOBUFS;
1436
1437        if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1438                                sizeof(*tcp->tok), tcp->tok))
1439                return -ENOBUFS;
1440
1441        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1442                        tcp->data_interval_max))
1443                return -ENOBUFS;
1444
1445        if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1446                        tcp->wake_payload_max))
1447                return -ENOBUFS;
1448
1449        nla_nest_end(msg, nl_tcp);
1450        return 0;
1451}
1452
1453static int nl80211_send_wowlan(struct sk_buff *msg,
1454                               struct cfg80211_registered_device *rdev,
1455                               bool large)
1456{
1457        struct nlattr *nl_wowlan;
1458
1459        if (!rdev->wiphy.wowlan)
1460                return 0;
1461
1462        nl_wowlan = nla_nest_start_noflag(msg,
1463                                          NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1464        if (!nl_wowlan)
1465                return -ENOBUFS;
1466
1467        if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1468             nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1469            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1470             nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1471            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1472             nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1473            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1474             nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1475            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1476             nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1477            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1478             nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1479            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1480             nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1481            ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1482             nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1483                return -ENOBUFS;
1484
1485        if (rdev->wiphy.wowlan->n_patterns) {
1486                struct nl80211_pattern_support pat = {
1487                        .max_patterns = rdev->wiphy.wowlan->n_patterns,
1488                        .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1489                        .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1490                        .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1491                };
1492
1493                if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1494                            sizeof(pat), &pat))
1495                        return -ENOBUFS;
1496        }
1497
1498        if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1499            nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1500                        rdev->wiphy.wowlan->max_nd_match_sets))
1501                return -ENOBUFS;
1502
1503        if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1504                return -ENOBUFS;
1505
1506        nla_nest_end(msg, nl_wowlan);
1507
1508        return 0;
1509}
1510#endif
1511
1512static int nl80211_send_coalesce(struct sk_buff *msg,
1513                                 struct cfg80211_registered_device *rdev)
1514{
1515        struct nl80211_coalesce_rule_support rule;
1516
1517        if (!rdev->wiphy.coalesce)
1518                return 0;
1519
1520        rule.max_rules = rdev->wiphy.coalesce->n_rules;
1521        rule.max_delay = rdev->wiphy.coalesce->max_delay;
1522        rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1523        rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1524        rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1525        rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1526
1527        if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1528                return -ENOBUFS;
1529
1530        return 0;
1531}
1532
1533static int
1534nl80211_send_iftype_data(struct sk_buff *msg,
1535                         const struct ieee80211_sband_iftype_data *iftdata)
1536{
1537        const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1538
1539        if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1540                                iftdata->types_mask))
1541                return -ENOBUFS;
1542
1543        if (he_cap->has_he) {
1544                if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1545                            sizeof(he_cap->he_cap_elem.mac_cap_info),
1546                            he_cap->he_cap_elem.mac_cap_info) ||
1547                    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1548                            sizeof(he_cap->he_cap_elem.phy_cap_info),
1549                            he_cap->he_cap_elem.phy_cap_info) ||
1550                    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1551                            sizeof(he_cap->he_mcs_nss_supp),
1552                            &he_cap->he_mcs_nss_supp) ||
1553                    nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1554                            sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1555                        return -ENOBUFS;
1556        }
1557
1558        return 0;
1559}
1560
1561static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1562                                      struct ieee80211_supported_band *sband)
1563{
1564        struct nlattr *nl_rates, *nl_rate;
1565        struct ieee80211_rate *rate;
1566        int i;
1567
1568        /* add HT info */
1569        if (sband->ht_cap.ht_supported &&
1570            (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1571                     sizeof(sband->ht_cap.mcs),
1572                     &sband->ht_cap.mcs) ||
1573             nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1574                         sband->ht_cap.cap) ||
1575             nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1576                        sband->ht_cap.ampdu_factor) ||
1577             nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1578                        sband->ht_cap.ampdu_density)))
1579                return -ENOBUFS;
1580
1581        /* add VHT info */
1582        if (sband->vht_cap.vht_supported &&
1583            (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1584                     sizeof(sband->vht_cap.vht_mcs),
1585                     &sband->vht_cap.vht_mcs) ||
1586             nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1587                         sband->vht_cap.cap)))
1588                return -ENOBUFS;
1589
1590        if (sband->n_iftype_data) {
1591                struct nlattr *nl_iftype_data =
1592                        nla_nest_start_noflag(msg,
1593                                              NL80211_BAND_ATTR_IFTYPE_DATA);
1594                int err;
1595
1596                if (!nl_iftype_data)
1597                        return -ENOBUFS;
1598
1599                for (i = 0; i < sband->n_iftype_data; i++) {
1600                        struct nlattr *iftdata;
1601
1602                        iftdata = nla_nest_start_noflag(msg, i + 1);
1603                        if (!iftdata)
1604                                return -ENOBUFS;
1605
1606                        err = nl80211_send_iftype_data(msg,
1607                                                       &sband->iftype_data[i]);
1608                        if (err)
1609                                return err;
1610
1611                        nla_nest_end(msg, iftdata);
1612                }
1613
1614                nla_nest_end(msg, nl_iftype_data);
1615        }
1616
1617        /* add EDMG info */
1618        if (sband->edmg_cap.channels &&
1619            (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1620                       sband->edmg_cap.channels) ||
1621            nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1622                       sband->edmg_cap.bw_config)))
1623
1624                return -ENOBUFS;
1625
1626        /* add bitrates */
1627        nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1628        if (!nl_rates)
1629                return -ENOBUFS;
1630
1631        for (i = 0; i < sband->n_bitrates; i++) {
1632                nl_rate = nla_nest_start_noflag(msg, i);
1633                if (!nl_rate)
1634                        return -ENOBUFS;
1635
1636                rate = &sband->bitrates[i];
1637                if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1638                                rate->bitrate))
1639                        return -ENOBUFS;
1640                if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1641                    nla_put_flag(msg,
1642                                 NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1643                        return -ENOBUFS;
1644
1645                nla_nest_end(msg, nl_rate);
1646        }
1647
1648        nla_nest_end(msg, nl_rates);
1649
1650        return 0;
1651}
1652
1653static int
1654nl80211_send_mgmt_stypes(struct sk_buff *msg,
1655                         const struct ieee80211_txrx_stypes *mgmt_stypes)
1656{
1657        u16 stypes;
1658        struct nlattr *nl_ftypes, *nl_ifs;
1659        enum nl80211_iftype ift;
1660        int i;
1661
1662        if (!mgmt_stypes)
1663                return 0;
1664
1665        nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1666        if (!nl_ifs)
1667                return -ENOBUFS;
1668
1669        for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1670                nl_ftypes = nla_nest_start_noflag(msg, ift);
1671                if (!nl_ftypes)
1672                        return -ENOBUFS;
1673                i = 0;
1674                stypes = mgmt_stypes[ift].tx;
1675                while (stypes) {
1676                        if ((stypes & 1) &&
1677                            nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1678                                        (i << 4) | IEEE80211_FTYPE_MGMT))
1679                                return -ENOBUFS;
1680                        stypes >>= 1;
1681                        i++;
1682                }
1683                nla_nest_end(msg, nl_ftypes);
1684        }
1685
1686        nla_nest_end(msg, nl_ifs);
1687
1688        nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1689        if (!nl_ifs)
1690                return -ENOBUFS;
1691
1692        for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1693                nl_ftypes = nla_nest_start_noflag(msg, ift);
1694                if (!nl_ftypes)
1695                        return -ENOBUFS;
1696                i = 0;
1697                stypes = mgmt_stypes[ift].rx;
1698                while (stypes) {
1699                        if ((stypes & 1) &&
1700                            nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1701                                        (i << 4) | IEEE80211_FTYPE_MGMT))
1702                                return -ENOBUFS;
1703                        stypes >>= 1;
1704                        i++;
1705                }
1706                nla_nest_end(msg, nl_ftypes);
1707        }
1708        nla_nest_end(msg, nl_ifs);
1709
1710        return 0;
1711}
1712
1713#define CMD(op, n)                                                      \
1714         do {                                                           \
1715                if (rdev->ops->op) {                                    \
1716                        i++;                                            \
1717                        if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1718                                goto nla_put_failure;                   \
1719                }                                                       \
1720        } while (0)
1721
1722static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1723                                        struct sk_buff *msg)
1724{
1725        int i = 0;
1726
1727        /*
1728         * do *NOT* add anything into this function, new things need to be
1729         * advertised only to new versions of userspace that can deal with
1730         * the split (and they can't possibly care about new features...
1731         */
1732        CMD(add_virtual_intf, NEW_INTERFACE);
1733        CMD(change_virtual_intf, SET_INTERFACE);
1734        CMD(add_key, NEW_KEY);
1735        CMD(start_ap, START_AP);
1736        CMD(add_station, NEW_STATION);
1737        CMD(add_mpath, NEW_MPATH);
1738        CMD(update_mesh_config, SET_MESH_CONFIG);
1739        CMD(change_bss, SET_BSS);
1740        CMD(auth, AUTHENTICATE);
1741        CMD(assoc, ASSOCIATE);
1742        CMD(deauth, DEAUTHENTICATE);
1743        CMD(disassoc, DISASSOCIATE);
1744        CMD(join_ibss, JOIN_IBSS);
1745        CMD(join_mesh, JOIN_MESH);
1746        CMD(set_pmksa, SET_PMKSA);
1747        CMD(del_pmksa, DEL_PMKSA);
1748        CMD(flush_pmksa, FLUSH_PMKSA);
1749        if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1750                CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1751        CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1752        CMD(mgmt_tx, FRAME);
1753        CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1754        if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1755                i++;
1756                if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1757                        goto nla_put_failure;
1758        }
1759        if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1760            rdev->ops->join_mesh) {
1761                i++;
1762                if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1763                        goto nla_put_failure;
1764        }
1765        CMD(set_wds_peer, SET_WDS_PEER);
1766        if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1767                CMD(tdls_mgmt, TDLS_MGMT);
1768                CMD(tdls_oper, TDLS_OPER);
1769        }
1770        if (rdev->wiphy.max_sched_scan_reqs)
1771                CMD(sched_scan_start, START_SCHED_SCAN);
1772        CMD(probe_client, PROBE_CLIENT);
1773        CMD(set_noack_map, SET_NOACK_MAP);
1774        if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1775                i++;
1776                if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1777                        goto nla_put_failure;
1778        }
1779        CMD(start_p2p_device, START_P2P_DEVICE);
1780        CMD(set_mcast_rate, SET_MCAST_RATE);
1781#ifdef CONFIG_NL80211_TESTMODE
1782        CMD(testmode_cmd, TESTMODE);
1783#endif
1784
1785        if (rdev->ops->connect || rdev->ops->auth) {
1786                i++;
1787                if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1788                        goto nla_put_failure;
1789        }
1790
1791        if (rdev->ops->disconnect || rdev->ops->deauth) {
1792                i++;
1793                if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1794                        goto nla_put_failure;
1795        }
1796
1797        return i;
1798 nla_put_failure:
1799        return -ENOBUFS;
1800}
1801
1802static int
1803nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1804                           struct sk_buff *msg)
1805{
1806        struct nlattr *ftm;
1807
1808        if (!cap->ftm.supported)
1809                return 0;
1810
1811        ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1812        if (!ftm)
1813                return -ENOBUFS;
1814
1815        if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1816                return -ENOBUFS;
1817        if (cap->ftm.non_asap &&
1818            nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1819                return -ENOBUFS;
1820        if (cap->ftm.request_lci &&
1821            nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1822                return -ENOBUFS;
1823        if (cap->ftm.request_civicloc &&
1824            nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1825                return -ENOBUFS;
1826        if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1827                        cap->ftm.preambles))
1828                return -ENOBUFS;
1829        if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1830                        cap->ftm.bandwidths))
1831                return -ENOBUFS;
1832        if (cap->ftm.max_bursts_exponent >= 0 &&
1833            nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1834                        cap->ftm.max_bursts_exponent))
1835                return -ENOBUFS;
1836        if (cap->ftm.max_ftms_per_burst &&
1837            nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1838                        cap->ftm.max_ftms_per_burst))
1839                return -ENOBUFS;
1840
1841        nla_nest_end(msg, ftm);
1842        return 0;
1843}
1844
1845static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1846                                  struct sk_buff *msg)
1847{
1848        const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1849        struct nlattr *pmsr, *caps;
1850
1851        if (!cap)
1852                return 0;
1853
1854        /*
1855         * we don't need to clean up anything here since the caller
1856         * will genlmsg_cancel() if we fail
1857         */
1858
1859        pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1860        if (!pmsr)
1861                return -ENOBUFS;
1862
1863        if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1864                return -ENOBUFS;
1865
1866        if (cap->report_ap_tsf &&
1867            nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1868                return -ENOBUFS;
1869
1870        if (cap->randomize_mac_addr &&
1871            nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1872                return -ENOBUFS;
1873
1874        caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1875        if (!caps)
1876                return -ENOBUFS;
1877
1878        if (nl80211_send_pmsr_ftm_capa(cap, msg))
1879                return -ENOBUFS;
1880
1881        nla_nest_end(msg, caps);
1882        nla_nest_end(msg, pmsr);
1883
1884        return 0;
1885}
1886
1887struct nl80211_dump_wiphy_state {
1888        s64 filter_wiphy;
1889        long start;
1890        long split_start, band_start, chan_start, capa_start;
1891        bool split;
1892};
1893
1894static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1895                              enum nl80211_commands cmd,
1896                              struct sk_buff *msg, u32 portid, u32 seq,
1897                              int flags, struct nl80211_dump_wiphy_state *state)
1898{
1899        void *hdr;
1900        struct nlattr *nl_bands, *nl_band;
1901        struct nlattr *nl_freqs, *nl_freq;
1902        struct nlattr *nl_cmds;
1903        enum nl80211_band band;
1904        struct ieee80211_channel *chan;
1905        int i;
1906        const struct ieee80211_txrx_stypes *mgmt_stypes =
1907                                rdev->wiphy.mgmt_stypes;
1908        u32 features;
1909
1910        hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1911        if (!hdr)
1912                return -ENOBUFS;
1913
1914        if (WARN_ON(!state))
1915                return -EINVAL;
1916
1917        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1918            nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1919                           wiphy_name(&rdev->wiphy)) ||
1920            nla_put_u32(msg, NL80211_ATTR_GENERATION,
1921                        cfg80211_rdev_list_generation))
1922                goto nla_put_failure;
1923
1924        if (cmd != NL80211_CMD_NEW_WIPHY)
1925                goto finish;
1926
1927        switch (state->split_start) {
1928        case 0:
1929                if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1930                               rdev->wiphy.retry_short) ||
1931                    nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1932                               rdev->wiphy.retry_long) ||
1933                    nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1934                                rdev->wiphy.frag_threshold) ||
1935                    nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1936                                rdev->wiphy.rts_threshold) ||
1937                    nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1938                               rdev->wiphy.coverage_class) ||
1939                    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1940                               rdev->wiphy.max_scan_ssids) ||
1941                    nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1942                               rdev->wiphy.max_sched_scan_ssids) ||
1943                    nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1944                                rdev->wiphy.max_scan_ie_len) ||
1945                    nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1946                                rdev->wiphy.max_sched_scan_ie_len) ||
1947                    nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1948                               rdev->wiphy.max_match_sets) ||
1949                    nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1950                                rdev->wiphy.max_sched_scan_plans) ||
1951                    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1952                                rdev->wiphy.max_sched_scan_plan_interval) ||
1953                    nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1954                                rdev->wiphy.max_sched_scan_plan_iterations))
1955                        goto nla_put_failure;
1956
1957                if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1958                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1959                        goto nla_put_failure;
1960                if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1961                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1962                        goto nla_put_failure;
1963                if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1964                    nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1965                        goto nla_put_failure;
1966                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1967                    nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1968                        goto nla_put_failure;
1969                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1970                    nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1971                        goto nla_put_failure;
1972                if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1973                    nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1974                        goto nla_put_failure;
1975                state->split_start++;
1976                if (state->split)
1977                        break;
1978                /* fall through */
1979        case 1:
1980                if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1981                            sizeof(u32) * rdev->wiphy.n_cipher_suites,
1982                            rdev->wiphy.cipher_suites))
1983                        goto nla_put_failure;
1984
1985                if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1986                               rdev->wiphy.max_num_pmkids))
1987                        goto nla_put_failure;
1988
1989                if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1990                    nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1991                        goto nla_put_failure;
1992
1993                if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1994                                rdev->wiphy.available_antennas_tx) ||
1995                    nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1996                                rdev->wiphy.available_antennas_rx))
1997                        goto nla_put_failure;
1998
1999                if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2000                    nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2001                                rdev->wiphy.probe_resp_offload))
2002                        goto nla_put_failure;
2003
2004                if ((rdev->wiphy.available_antennas_tx ||
2005                     rdev->wiphy.available_antennas_rx) &&
2006                    rdev->ops->get_antenna) {
2007                        u32 tx_ant = 0, rx_ant = 0;
2008                        int res;
2009
2010                        res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2011                        if (!res) {
2012                                if (nla_put_u32(msg,
2013                                                NL80211_ATTR_WIPHY_ANTENNA_TX,
2014                                                tx_ant) ||
2015                                    nla_put_u32(msg,
2016                                                NL80211_ATTR_WIPHY_ANTENNA_RX,
2017                                                rx_ant))
2018                                        goto nla_put_failure;
2019                        }
2020                }
2021
2022                state->split_start++;
2023                if (state->split)
2024                        break;
2025                /* fall through */
2026        case 2:
2027                if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2028                                        rdev->wiphy.interface_modes))
2029                                goto nla_put_failure;
2030                state->split_start++;
2031                if (state->split)
2032                        break;
2033                /* fall through */
2034        case 3:
2035                nl_bands = nla_nest_start_noflag(msg,
2036                                                 NL80211_ATTR_WIPHY_BANDS);
2037                if (!nl_bands)
2038                        goto nla_put_failure;
2039
2040                for (band = state->band_start;
2041                     band < NUM_NL80211_BANDS; band++) {
2042                        struct ieee80211_supported_band *sband;
2043
2044                        sband = rdev->wiphy.bands[band];
2045
2046                        if (!sband)
2047                                continue;
2048
2049                        nl_band = nla_nest_start_noflag(msg, band);
2050                        if (!nl_band)
2051                                goto nla_put_failure;
2052
2053                        switch (state->chan_start) {
2054                        case 0:
2055                                if (nl80211_send_band_rateinfo(msg, sband))
2056                                        goto nla_put_failure;
2057                                state->chan_start++;
2058                                if (state->split)
2059                                        break;
2060                                /* fall through */
2061                        default:
2062                                /* add frequencies */
2063                                nl_freqs = nla_nest_start_noflag(msg,
2064                                                                 NL80211_BAND_ATTR_FREQS);
2065                                if (!nl_freqs)
2066                                        goto nla_put_failure;
2067
2068                                for (i = state->chan_start - 1;
2069                                     i < sband->n_channels;
2070                                     i++) {
2071                                        nl_freq = nla_nest_start_noflag(msg,
2072                                                                        i);
2073                                        if (!nl_freq)
2074                                                goto nla_put_failure;
2075
2076                                        chan = &sband->channels[i];
2077
2078                                        if (nl80211_msg_put_channel(
2079                                                        msg, &rdev->wiphy, chan,
2080                                                        state->split))
2081                                                goto nla_put_failure;
2082
2083                                        nla_nest_end(msg, nl_freq);
2084                                        if (state->split)
2085                                                break;
2086                                }
2087                                if (i < sband->n_channels)
2088                                        state->chan_start = i + 2;
2089                                else
2090                                        state->chan_start = 0;
2091                                nla_nest_end(msg, nl_freqs);
2092                        }
2093
2094                        nla_nest_end(msg, nl_band);
2095
2096                        if (state->split) {
2097                                /* start again here */
2098                                if (state->chan_start)
2099                                        band--;
2100                                break;
2101                        }
2102                }
2103                nla_nest_end(msg, nl_bands);
2104
2105                if (band < NUM_NL80211_BANDS)
2106                        state->band_start = band + 1;
2107                else
2108                        state->band_start = 0;
2109
2110                /* if bands & channels are done, continue outside */
2111                if (state->band_start == 0 && state->chan_start == 0)
2112                        state->split_start++;
2113                if (state->split)
2114                        break;
2115                /* fall through */
2116        case 4:
2117                nl_cmds = nla_nest_start_noflag(msg,
2118                                                NL80211_ATTR_SUPPORTED_COMMANDS);
2119                if (!nl_cmds)
2120                        goto nla_put_failure;
2121
2122                i = nl80211_add_commands_unsplit(rdev, msg);
2123                if (i < 0)
2124                        goto nla_put_failure;
2125                if (state->split) {
2126                        CMD(crit_proto_start, CRIT_PROTOCOL_START);
2127                        CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2128                        if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2129                                CMD(channel_switch, CHANNEL_SWITCH);
2130                        CMD(set_qos_map, SET_QOS_MAP);
2131                        if (rdev->wiphy.features &
2132                                        NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2133                                CMD(add_tx_ts, ADD_TX_TS);
2134                        CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2135                        CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2136                        CMD(update_ft_ies, UPDATE_FT_IES);
2137                }
2138#undef CMD
2139
2140                nla_nest_end(msg, nl_cmds);
2141                state->split_start++;
2142                if (state->split)
2143                        break;
2144                /* fall through */
2145        case 5:
2146                if (rdev->ops->remain_on_channel &&
2147                    (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2148                    nla_put_u32(msg,
2149                                NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2150                                rdev->wiphy.max_remain_on_channel_duration))
2151                        goto nla_put_failure;
2152
2153                if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2154                    nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2155                        goto nla_put_failure;
2156
2157                if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2158                        goto nla_put_failure;
2159                state->split_start++;
2160                if (state->split)
2161                        break;
2162                /* fall through */
2163        case 6:
2164#ifdef CONFIG_PM
2165                if (nl80211_send_wowlan(msg, rdev, state->split))
2166                        goto nla_put_failure;
2167                state->split_start++;
2168                if (state->split)
2169                        break;
2170#else
2171                state->split_start++;
2172#endif
2173                /* fall through */
2174        case 7:
2175                if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2176                                        rdev->wiphy.software_iftypes))
2177                        goto nla_put_failure;
2178
2179                if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2180                                                   state->split))
2181                        goto nla_put_failure;
2182
2183                state->split_start++;
2184                if (state->split)
2185                        break;
2186                /* fall through */
2187        case 8:
2188                if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2189                    nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2190                                rdev->wiphy.ap_sme_capa))
2191                        goto nla_put_failure;
2192
2193                features = rdev->wiphy.features;
2194                /*
2195                 * We can only add the per-channel limit information if the
2196                 * dump is split, otherwise it makes it too big. Therefore
2197                 * only advertise it in that case.
2198                 */
2199                if (state->split)
2200                        features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2201                if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2202                        goto nla_put_failure;
2203
2204                if (rdev->wiphy.ht_capa_mod_mask &&
2205                    nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2206                            sizeof(*rdev->wiphy.ht_capa_mod_mask),
2207                            rdev->wiphy.ht_capa_mod_mask))
2208                        goto nla_put_failure;
2209
2210                if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2211                    rdev->wiphy.max_acl_mac_addrs &&
2212                    nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2213                                rdev->wiphy.max_acl_mac_addrs))
2214                        goto nla_put_failure;
2215
2216                /*
2217                 * Any information below this point is only available to
2218                 * applications that can deal with it being split. This
2219                 * helps ensure that newly added capabilities don't break
2220                 * older tools by overrunning their buffers.
2221                 *
2222                 * We still increment split_start so that in the split
2223                 * case we'll continue with more data in the next round,
2224                 * but break unconditionally so unsplit data stops here.
2225                 */
2226                state->split_start++;
2227                break;
2228        case 9:
2229                if (rdev->wiphy.extended_capabilities &&
2230                    (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2231                             rdev->wiphy.extended_capabilities_len,
2232                             rdev->wiphy.extended_capabilities) ||
2233                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2234                             rdev->wiphy.extended_capabilities_len,
2235                             rdev->wiphy.extended_capabilities_mask)))
2236                        goto nla_put_failure;
2237
2238                if (rdev->wiphy.vht_capa_mod_mask &&
2239                    nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2240                            sizeof(*rdev->wiphy.vht_capa_mod_mask),
2241                            rdev->wiphy.vht_capa_mod_mask))
2242                        goto nla_put_failure;
2243
2244                if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2245                            rdev->wiphy.perm_addr))
2246                        goto nla_put_failure;
2247
2248                if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2249                    nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2250                            rdev->wiphy.addr_mask))
2251                        goto nla_put_failure;
2252
2253                if (rdev->wiphy.n_addresses > 1) {
2254                        void *attr;
2255
2256                        attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2257                        if (!attr)
2258                                goto nla_put_failure;
2259
2260                        for (i = 0; i < rdev->wiphy.n_addresses; i++)
2261                                if (nla_put(msg, i + 1, ETH_ALEN,
2262                                            rdev->wiphy.addresses[i].addr))
2263                                        goto nla_put_failure;
2264
2265                        nla_nest_end(msg, attr);
2266                }
2267
2268                state->split_start++;
2269                break;
2270        case 10:
2271                if (nl80211_send_coalesce(msg, rdev))
2272                        goto nla_put_failure;
2273
2274                if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2275                    (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2276                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2277                        goto nla_put_failure;
2278
2279                if (rdev->wiphy.max_ap_assoc_sta &&
2280                    nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2281                                rdev->wiphy.max_ap_assoc_sta))
2282                        goto nla_put_failure;
2283
2284                state->split_start++;
2285                break;
2286        case 11:
2287                if (rdev->wiphy.n_vendor_commands) {
2288                        const struct nl80211_vendor_cmd_info *info;
2289                        struct nlattr *nested;
2290
2291                        nested = nla_nest_start_noflag(msg,
2292                                                       NL80211_ATTR_VENDOR_DATA);
2293                        if (!nested)
2294                                goto nla_put_failure;
2295
2296                        for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2297                                info = &rdev->wiphy.vendor_commands[i].info;
2298                                if (nla_put(msg, i + 1, sizeof(*info), info))
2299                                        goto nla_put_failure;
2300                        }
2301                        nla_nest_end(msg, nested);
2302                }
2303
2304                if (rdev->wiphy.n_vendor_events) {
2305                        const struct nl80211_vendor_cmd_info *info;
2306                        struct nlattr *nested;
2307
2308                        nested = nla_nest_start_noflag(msg,
2309                                                       NL80211_ATTR_VENDOR_EVENTS);
2310                        if (!nested)
2311                                goto nla_put_failure;
2312
2313                        for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2314                                info = &rdev->wiphy.vendor_events[i];
2315                                if (nla_put(msg, i + 1, sizeof(*info), info))
2316                                        goto nla_put_failure;
2317                        }
2318                        nla_nest_end(msg, nested);
2319                }
2320                state->split_start++;
2321                break;
2322        case 12:
2323                if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2324                    nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2325                               rdev->wiphy.max_num_csa_counters))
2326                        goto nla_put_failure;
2327
2328                if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2329                    nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2330                        goto nla_put_failure;
2331
2332                if (rdev->wiphy.max_sched_scan_reqs &&
2333                    nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2334                                rdev->wiphy.max_sched_scan_reqs))
2335                        goto nla_put_failure;
2336
2337                if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2338                            sizeof(rdev->wiphy.ext_features),
2339                            rdev->wiphy.ext_features))
2340                        goto nla_put_failure;
2341
2342                if (rdev->wiphy.bss_select_support) {
2343                        struct nlattr *nested;
2344                        u32 bss_select_support = rdev->wiphy.bss_select_support;
2345
2346                        nested = nla_nest_start_noflag(msg,
2347                                                       NL80211_ATTR_BSS_SELECT);
2348                        if (!nested)
2349                                goto nla_put_failure;
2350
2351                        i = 0;
2352                        while (bss_select_support) {
2353                                if ((bss_select_support & 1) &&
2354                                    nla_put_flag(msg, i))
2355                                        goto nla_put_failure;
2356                                i++;
2357                                bss_select_support >>= 1;
2358                        }
2359                        nla_nest_end(msg, nested);
2360                }
2361
2362                state->split_start++;
2363                break;
2364        case 13:
2365                if (rdev->wiphy.num_iftype_ext_capab &&
2366                    rdev->wiphy.iftype_ext_capab) {
2367                        struct nlattr *nested_ext_capab, *nested;
2368
2369                        nested = nla_nest_start_noflag(msg,
2370                                                       NL80211_ATTR_IFTYPE_EXT_CAPA);
2371                        if (!nested)
2372                                goto nla_put_failure;
2373
2374                        for (i = state->capa_start;
2375                             i < rdev->wiphy.num_iftype_ext_capab; i++) {
2376                                const struct wiphy_iftype_ext_capab *capab;
2377
2378                                capab = &rdev->wiphy.iftype_ext_capab[i];
2379
2380                                nested_ext_capab = nla_nest_start_noflag(msg,
2381                                                                         i);
2382                                if (!nested_ext_capab ||
2383                                    nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2384                                                capab->iftype) ||
2385                                    nla_put(msg, NL80211_ATTR_EXT_CAPA,
2386                                            capab->extended_capabilities_len,
2387                                            capab->extended_capabilities) ||
2388                                    nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2389                                            capab->extended_capabilities_len,
2390                                            capab->extended_capabilities_mask))
2391                                        goto nla_put_failure;
2392
2393                                nla_nest_end(msg, nested_ext_capab);
2394                                if (state->split)
2395                                        break;
2396                        }
2397                        nla_nest_end(msg, nested);
2398                        if (i < rdev->wiphy.num_iftype_ext_capab) {
2399                                state->capa_start = i + 1;
2400                                break;
2401                        }
2402                }
2403
2404                if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2405                                rdev->wiphy.nan_supported_bands))
2406                        goto nla_put_failure;
2407
2408                if (wiphy_ext_feature_isset(&rdev->wiphy,
2409                                            NL80211_EXT_FEATURE_TXQS)) {
2410                        struct cfg80211_txq_stats txqstats = {};
2411                        int res;
2412
2413                        res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2414                        if (!res &&
2415                            !nl80211_put_txq_stats(msg, &txqstats,
2416                                                   NL80211_ATTR_TXQ_STATS))
2417                                goto nla_put_failure;
2418
2419                        if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2420                                        rdev->wiphy.txq_limit))
2421                                goto nla_put_failure;
2422                        if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2423                                        rdev->wiphy.txq_memory_limit))
2424                                goto nla_put_failure;
2425                        if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2426                                        rdev->wiphy.txq_quantum))
2427                                goto nla_put_failure;
2428                }
2429
2430                state->split_start++;
2431                break;
2432        case 14:
2433                if (nl80211_send_pmsr_capa(rdev, msg))
2434                        goto nla_put_failure;
2435
2436                state->split_start++;
2437                break;
2438        case 15:
2439                if (rdev->wiphy.akm_suites &&
2440                    nla_put(msg, NL80211_ATTR_AKM_SUITES,
2441                            sizeof(u32) * rdev->wiphy.n_akm_suites,
2442                            rdev->wiphy.akm_suites))
2443                        goto nla_put_failure;
2444
2445                /* done */
2446                state->split_start = 0;
2447                break;
2448        }
2449 finish:
2450        genlmsg_end(msg, hdr);
2451        return 0;
2452
2453 nla_put_failure:
2454        genlmsg_cancel(msg, hdr);
2455        return -EMSGSIZE;
2456}
2457
2458static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2459                                    struct netlink_callback *cb,
2460                                    struct nl80211_dump_wiphy_state *state)
2461{
2462        struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2463        int ret;
2464
2465        if (!tb)
2466                return -ENOMEM;
2467
2468        ret = nlmsg_parse_deprecated(cb->nlh,
2469                                     GENL_HDRLEN + nl80211_fam.hdrsize,
2470                                     tb, nl80211_fam.maxattr,
2471                                     nl80211_policy, NULL);
2472        /* ignore parse errors for backward compatibility */
2473        if (ret) {
2474                ret = 0;
2475                goto out;
2476        }
2477
2478        state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2479        if (tb[NL80211_ATTR_WIPHY])
2480                state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2481        if (tb[NL80211_ATTR_WDEV])
2482                state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2483        if (tb[NL80211_ATTR_IFINDEX]) {
2484                struct net_device *netdev;
2485                struct cfg80211_registered_device *rdev;
2486                int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2487
2488                netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2489                if (!netdev) {
2490                        ret = -ENODEV;
2491                        goto out;
2492                }
2493                if (netdev->ieee80211_ptr) {
2494                        rdev = wiphy_to_rdev(
2495                                netdev->ieee80211_ptr->wiphy);
2496                        state->filter_wiphy = rdev->wiphy_idx;
2497                }
2498        }
2499
2500        ret = 0;
2501out:
2502        kfree(tb);
2503        return ret;
2504}
2505
2506static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2507{
2508        int idx = 0, ret;
2509        struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2510        struct cfg80211_registered_device *rdev;
2511
2512        rtnl_lock();
2513        if (!state) {
2514                state = kzalloc(sizeof(*state), GFP_KERNEL);
2515                if (!state) {
2516                        rtnl_unlock();
2517                        return -ENOMEM;
2518                }
2519                state->filter_wiphy = -1;
2520                ret = nl80211_dump_wiphy_parse(skb, cb, state);
2521                if (ret) {
2522                        kfree(state);
2523                        rtnl_unlock();
2524                        return ret;
2525                }
2526                cb->args[0] = (long)state;
2527        }
2528
2529        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2530                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2531                        continue;
2532                if (++idx <= state->start)
2533                        continue;
2534                if (state->filter_wiphy != -1 &&
2535                    state->filter_wiphy != rdev->wiphy_idx)
2536                        continue;
2537                /* attempt to fit multiple wiphy data chunks into the skb */
2538                do {
2539                        ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2540                                                 skb,
2541                                                 NETLINK_CB(cb->skb).portid,
2542                                                 cb->nlh->nlmsg_seq,
2543                                                 NLM_F_MULTI, state);
2544                        if (ret < 0) {
2545                                /*
2546                                 * If sending the wiphy data didn't fit (ENOBUFS
2547                                 * or EMSGSIZE returned), this SKB is still
2548                                 * empty (so it's not too big because another
2549                                 * wiphy dataset is already in the skb) and
2550                                 * we've not tried to adjust the dump allocation
2551                                 * yet ... then adjust the alloc size to be
2552                                 * bigger, and return 1 but with the empty skb.
2553                                 * This results in an empty message being RX'ed
2554                                 * in userspace, but that is ignored.
2555                                 *
2556                                 * We can then retry with the larger buffer.
2557                                 */
2558                                if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2559                                    !skb->len && !state->split &&
2560                                    cb->min_dump_alloc < 4096) {
2561                                        cb->min_dump_alloc = 4096;
2562                                        state->split_start = 0;
2563                                        rtnl_unlock();
2564                                        return 1;
2565                                }
2566                                idx--;
2567                                break;
2568                        }
2569                } while (state->split_start > 0);
2570                break;
2571        }
2572        rtnl_unlock();
2573
2574        state->start = idx;
2575
2576        return skb->len;
2577}
2578
2579static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2580{
2581        kfree((void *)cb->args[0]);
2582        return 0;
2583}
2584
2585static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2586{
2587        struct sk_buff *msg;
2588        struct cfg80211_registered_device *rdev = info->user_ptr[0];
2589        struct nl80211_dump_wiphy_state state = {};
2590
2591        msg = nlmsg_new(4096, GFP_KERNEL);
2592        if (!msg)
2593                return -ENOMEM;
2594
2595        if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2596                               info->snd_portid, info->snd_seq, 0,
2597                               &state) < 0) {
2598                nlmsg_free(msg);
2599                return -ENOBUFS;
2600        }
2601
2602        return genlmsg_reply(msg, info);
2603}
2604
2605static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2606        [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2607        [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2608        [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2609        [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2610        [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2611};
2612
2613static int parse_txq_params(struct nlattr *tb[],
2614                            struct ieee80211_txq_params *txq_params)
2615{
2616        u8 ac;
2617
2618        if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2619            !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2620            !tb[NL80211_TXQ_ATTR_AIFS])
2621                return -EINVAL;
2622
2623        ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2624        txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2625        txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2626        txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2627        txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2628
2629        if (ac >= NL80211_NUM_ACS)
2630                return -EINVAL;
2631        txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2632        return 0;
2633}
2634
2635static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2636{
2637        /*
2638         * You can only set the channel explicitly for WDS interfaces,
2639         * all others have their channel managed via their respective
2640         * "establish a connection" command (connect, join, ...)
2641         *
2642         * For AP/GO and mesh mode, the channel can be set with the
2643         * channel userspace API, but is only stored and passed to the
2644         * low-level driver when the AP starts or the mesh is joined.
2645         * This is for backward compatibility, userspace can also give
2646         * the channel in the start-ap or join-mesh commands instead.
2647         *
2648         * Monitors are special as they are normally slaved to
2649         * whatever else is going on, so they have their own special
2650         * operation to set the monitor channel if possible.
2651         */
2652        return !wdev ||
2653                wdev->iftype == NL80211_IFTYPE_AP ||
2654                wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2655                wdev->iftype == NL80211_IFTYPE_MONITOR ||
2656                wdev->iftype == NL80211_IFTYPE_P2P_GO;
2657}
2658
2659int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2660                          struct genl_info *info,
2661                          struct cfg80211_chan_def *chandef)
2662{
2663        struct netlink_ext_ack *extack = info->extack;
2664        struct nlattr **attrs = info->attrs;
2665        u32 control_freq;
2666
2667        if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2668                return -EINVAL;
2669
2670        control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2671
2672        memset(chandef, 0, sizeof(*chandef));
2673
2674        chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2675        chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2676        chandef->center_freq1 = control_freq;
2677        chandef->center_freq2 = 0;
2678
2679        /* Primary channel not allowed */
2680        if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2681                NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2682                                    "Channel is disabled");
2683                return -EINVAL;
2684        }
2685
2686        if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2687                enum nl80211_channel_type chantype;
2688
2689                chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2690
2691                switch (chantype) {
2692                case NL80211_CHAN_NO_HT:
2693                case NL80211_CHAN_HT20:
2694                case NL80211_CHAN_HT40PLUS:
2695                case NL80211_CHAN_HT40MINUS:
2696                        cfg80211_chandef_create(chandef, chandef->chan,
2697                                                chantype);
2698                        /* user input for center_freq is incorrect */
2699                        if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2700                            chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2701                                NL_SET_ERR_MSG_ATTR(extack,
2702                                                    attrs[NL80211_ATTR_CENTER_FREQ1],
2703                                                    "bad center frequency 1");
2704                                return -EINVAL;
2705                        }
2706                        /* center_freq2 must be zero */
2707                        if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2708                            nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2709                                NL_SET_ERR_MSG_ATTR(extack,
2710                                                    attrs[NL80211_ATTR_CENTER_FREQ2],
2711                                                    "center frequency 2 can't be used");
2712                                return -EINVAL;
2713                        }
2714                        break;
2715                default:
2716                        NL_SET_ERR_MSG_ATTR(extack,
2717                                            attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2718                                            "invalid channel type");
2719                        return -EINVAL;
2720                }
2721        } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2722                chandef->width =
2723                        nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2724                if (attrs[NL80211_ATTR_CENTER_FREQ1])
2725                        chandef->center_freq1 =
2726                                nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2727                if (attrs[NL80211_ATTR_CENTER_FREQ2])
2728                        chandef->center_freq2 =
2729                                nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2730        }
2731
2732        if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
2733                chandef->edmg.channels =
2734                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
2735
2736                if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
2737                        chandef->edmg.bw_config =
2738                     nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
2739        } else {
2740                chandef->edmg.bw_config = 0;
2741                chandef->edmg.channels = 0;
2742        }
2743
2744        if (!cfg80211_chandef_valid(chandef)) {
2745                NL_SET_ERR_MSG(extack, "invalid channel definition");
2746                return -EINVAL;
2747        }
2748
2749        if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2750                                     IEEE80211_CHAN_DISABLED)) {
2751                NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2752                return -EINVAL;
2753        }
2754
2755        if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2756             chandef->width == NL80211_CHAN_WIDTH_10) &&
2757            !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2758                NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2759                return -EINVAL;
2760        }
2761
2762        return 0;
2763}
2764
2765static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2766                                 struct net_device *dev,
2767                                 struct genl_info *info)
2768{
2769        struct cfg80211_chan_def chandef;
2770        int result;
2771        enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2772        struct wireless_dev *wdev = NULL;
2773
2774        if (dev)
2775                wdev = dev->ieee80211_ptr;
2776        if (!nl80211_can_set_dev_channel(wdev))
2777                return -EOPNOTSUPP;
2778        if (wdev)
2779                iftype = wdev->iftype;
2780
2781        result = nl80211_parse_chandef(rdev, info, &chandef);
2782        if (result)
2783                return result;
2784
2785        switch (iftype) {
2786        case NL80211_IFTYPE_AP:
2787        case NL80211_IFTYPE_P2P_GO:
2788                if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2789                                                   iftype)) {
2790                        result = -EINVAL;
2791                        break;
2792                }
2793                if (wdev->beacon_interval) {
2794                        if (!dev || !rdev->ops->set_ap_chanwidth ||
2795                            !(rdev->wiphy.features &
2796                              NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2797                                result = -EBUSY;
2798                                break;
2799                        }
2800
2801                        /* Only allow dynamic channel width changes */
2802                        if (chandef.chan != wdev->preset_chandef.chan) {
2803                                result = -EBUSY;
2804                                break;
2805                        }
2806                        result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2807                        if (result)
2808                                break;
2809                }
2810                wdev->preset_chandef = chandef;
2811                result = 0;
2812                break;
2813        case NL80211_IFTYPE_MESH_POINT:
2814                result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2815                break;
2816        case NL80211_IFTYPE_MONITOR:
2817                result = cfg80211_set_monitor_channel(rdev, &chandef);
2818                break;
2819        default:
2820                result = -EINVAL;
2821        }
2822
2823        return result;
2824}
2825
2826static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2827{
2828        struct cfg80211_registered_device *rdev = info->user_ptr[0];
2829        struct net_device *netdev = info->user_ptr[1];
2830
2831        return __nl80211_set_channel(rdev, netdev, info);
2832}
2833
2834static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2835{
2836        struct cfg80211_registered_device *rdev = info->user_ptr[0];
2837        struct net_device *dev = info->user_ptr[1];
2838        struct wireless_dev *wdev = dev->ieee80211_ptr;
2839        const u8 *bssid;
2840
2841        if (!info->attrs[NL80211_ATTR_MAC])
2842                return -EINVAL;
2843
2844        if (netif_running(dev))
2845                return -EBUSY;
2846
2847        if (!rdev->ops->set_wds_peer)
2848                return -EOPNOTSUPP;
2849
2850        if (wdev->iftype != NL80211_IFTYPE_WDS)
2851                return -EOPNOTSUPP;
2852
2853        bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2854        return rdev_set_wds_peer(rdev, dev, bssid);
2855}
2856
2857static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2858{
2859        struct cfg80211_registered_device *rdev;
2860        struct net_device *netdev = NULL;
2861        struct wireless_dev *wdev;
2862        int result = 0, rem_txq_params = 0;
2863        struct nlattr *nl_txq_params;
2864        u32 changed;
2865        u8 retry_short = 0, retry_long = 0;
2866        u32 frag_threshold = 0, rts_threshold = 0;
2867        u8 coverage_class = 0;
2868        u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2869
2870        ASSERT_RTNL();
2871
2872        /*
2873         * Try to find the wiphy and netdev. Normally this
2874         * function shouldn't need the netdev, but this is
2875         * done for backward compatibility -- previously
2876         * setting the channel was done per wiphy, but now
2877         * it is per netdev. Previous userland like hostapd
2878         * also passed a netdev to set_wiphy, so that it is
2879         * possible to let that go to the right netdev!
2880         */
2881
2882        if (info->attrs[NL80211_ATTR_IFINDEX]) {
2883                int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2884
2885                netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2886                if (netdev && netdev->ieee80211_ptr)
2887                        rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2888                else
2889                        netdev = NULL;
2890        }
2891
2892        if (!netdev) {
2893                rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2894                                                  info->attrs);
2895                if (IS_ERR(rdev))
2896                        return PTR_ERR(rdev);
2897                wdev = NULL;
2898                netdev = NULL;
2899                result = 0;
2900        } else
2901                wdev = netdev->ieee80211_ptr;
2902
2903        /*
2904         * end workaround code, by now the rdev is available
2905         * and locked, and wdev may or may not be NULL.
2906         */
2907
2908        if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2909                result = cfg80211_dev_rename(
2910                        rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2911
2912        if (result)
2913                return result;
2914
2915        if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2916                struct ieee80211_txq_params txq_params;
2917                struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2918
2919                if (!rdev->ops->set_txq_params)
2920                        return -EOPNOTSUPP;
2921
2922                if (!netdev)
2923                        return -EINVAL;
2924
2925                if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2926                    netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2927                        return -EINVAL;
2928
2929                if (!netif_running(netdev))
2930                        return -ENETDOWN;
2931
2932                nla_for_each_nested(nl_txq_params,
2933                                    info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2934                                    rem_txq_params) {
2935                        result = nla_parse_nested_deprecated(tb,
2936                                                             NL80211_TXQ_ATTR_MAX,
2937                                                             nl_txq_params,
2938                                                             txq_params_policy,
2939                                                             info->extack);
2940                        if (result)
2941                                return result;
2942                        result = parse_txq_params(tb, &txq_params);
2943                        if (result)
2944                                return result;
2945
2946                        result = rdev_set_txq_params(rdev, netdev,
2947                                                     &txq_params);
2948                        if (result)
2949                                return result;
2950                }
2951        }
2952
2953        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2954                result = __nl80211_set_channel(
2955                        rdev,
2956                        nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2957                        info);
2958                if (result)
2959                        return result;
2960        }
2961
2962        if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2963                struct wireless_dev *txp_wdev = wdev;
2964                enum nl80211_tx_power_setting type;
2965                int idx, mbm = 0;
2966
2967                if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2968                        txp_wdev = NULL;
2969
2970                if (!rdev->ops->set_tx_power)
2971                        return -EOPNOTSUPP;
2972
2973                idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2974                type = nla_get_u32(info->attrs[idx]);
2975
2976                if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2977                    (type != NL80211_TX_POWER_AUTOMATIC))
2978                        return -EINVAL;
2979
2980                if (type != NL80211_TX_POWER_AUTOMATIC) {
2981                        idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2982                        mbm = nla_get_u32(info->attrs[idx]);
2983                }
2984
2985                result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2986                if (result)
2987                        return result;
2988        }
2989
2990        if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2991            info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2992                u32 tx_ant, rx_ant;
2993
2994                if ((!rdev->wiphy.available_antennas_tx &&
2995                     !rdev->wiphy.available_antennas_rx) ||
2996                    !rdev->ops->set_antenna)
2997                        return -EOPNOTSUPP;
2998
2999                tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3000                rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3001
3002                /* reject antenna configurations which don't match the
3003                 * available antenna masks, except for the "all" mask */
3004                if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3005                    (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
3006                        return -EINVAL;
3007
3008                tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3009                rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3010
3011                result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3012                if (result)
3013                        return result;
3014        }
3015
3016        changed = 0;
3017
3018        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3019                retry_short = nla_get_u8(
3020                        info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3021
3022                changed |= WIPHY_PARAM_RETRY_SHORT;
3023        }
3024
3025        if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3026                retry_long = nla_get_u8(
3027                        info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3028
3029                changed |= WIPHY_PARAM_RETRY_LONG;
3030        }
3031
3032        if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3033                frag_threshold = nla_get_u32(
3034                        info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3035                if (frag_threshold < 256)
3036                        return -EINVAL;
3037
3038                if (frag_threshold != (u32) -1) {
3039                        /*
3040                         * Fragments (apart from the last one) are required to
3041                         * have even length. Make the fragmentation code
3042                         * simpler by stripping LSB should someone try to use
3043                         * odd threshold value.
3044                         */
3045                        frag_threshold &= ~0x1;
3046                }
3047                changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3048        }
3049
3050        if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3051                rts_threshold = nla_get_u32(
3052                        info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3053                changed |= WIPHY_PARAM_RTS_THRESHOLD;
3054        }
3055
3056        if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3057                if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
3058                        return -EINVAL;
3059
3060                coverage_class = nla_get_u8(
3061                        info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3062                changed |= WIPHY_PARAM_COVERAGE_CLASS;
3063        }
3064
3065        if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3066                if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
3067                        return -EOPNOTSUPP;
3068
3069                changed |= WIPHY_PARAM_DYN_ACK;
3070        }
3071
3072        if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3073                if (!wiphy_ext_feature_isset(&rdev->wiphy,
3074                                             NL80211_EXT_FEATURE_TXQS))
3075                        return -EOPNOTSUPP;
3076                txq_limit = nla_get_u32(
3077                        info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3078                changed |= WIPHY_PARAM_TXQ_LIMIT;
3079        }
3080
3081        if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3082                if (!wiphy_ext_feature_isset(&rdev->wiphy,
3083                                             NL80211_EXT_FEATURE_TXQS))
3084                        return -EOPNOTSUPP;
3085                txq_memory_limit = nla_get_u32(
3086                        info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3087                changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3088        }
3089
3090        if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3091                if (!wiphy_ext_feature_isset(&rdev->wiphy,
3092                                             NL80211_EXT_FEATURE_TXQS))
3093                        return -EOPNOTSUPP;
3094                txq_quantum = nla_get_u32(
3095                        info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3096                changed |= WIPHY_PARAM_TXQ_QUANTUM;
3097        }
3098
3099        if (changed) {
3100                u8 old_retry_short, old_retry_long;
3101                u32 old_frag_threshold, old_rts_threshold;
3102                u8 old_coverage_class;
3103                u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3104
3105                if (!rdev->ops->set_wiphy_params)
3106                        return -EOPNOTSUPP;
3107
3108                old_retry_short = rdev->wiphy.retry_short;
3109                old_retry_long = rdev->wiphy.retry_long;
3110                old_frag_threshold = rdev->wiphy.frag_threshold;
3111                old_rts_threshold = rdev->wiphy.rts_threshold;
3112                old_coverage_class = rdev->wiphy.coverage_class;
3113                old_txq_limit = rdev->wiphy.txq_limit;
3114                old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3115                old_txq_quantum = rdev->wiphy.txq_quantum;
3116
3117                if (changed & WIPHY_PARAM_RETRY_SHORT)
3118                        rdev->wiphy.retry_short = retry_short;
3119                if (changed & WIPHY_PARAM_RETRY_LONG)
3120                        rdev->wiphy.retry_long = retry_long;
3121                if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3122                        rdev->wiphy.frag_threshold = frag_threshold;
3123                if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3124                        rdev->wiphy.rts_threshold = rts_threshold;
3125                if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3126                        rdev->wiphy.coverage_class = coverage_class;
3127                if (changed & WIPHY_PARAM_TXQ_LIMIT)
3128                        rdev->wiphy.txq_limit = txq_limit;
3129                if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3130                        rdev->wiphy.txq_memory_limit = txq_memory_limit;
3131                if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3132                        rdev->wiphy.txq_quantum = txq_quantum;
3133
3134                result = rdev_set_wiphy_params(rdev, changed);
3135                if (result) {
3136                        rdev->wiphy.retry_short = old_retry_short;
3137                        rdev->wiphy.retry_long = old_retry_long;
3138                        rdev->wiphy.frag_threshold = old_frag_threshold;
3139                        rdev->wiphy.rts_threshold = old_rts_threshold;
3140                        rdev->wiphy.coverage_class = old_coverage_class;
3141                        rdev->wiphy.txq_limit = old_txq_limit;
3142                        rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3143                        rdev->wiphy.txq_quantum = old_txq_quantum;
3144                        return result;
3145                }
3146        }
3147        return 0;
3148}
3149
3150static int nl80211_send_chandef(struct sk_buff *msg,
3151                                const struct cfg80211_chan_def *chandef)
3152{
3153        if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3154                return -EINVAL;
3155
3156        if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3157                        chandef->chan->center_freq))
3158                return -ENOBUFS;
3159        switch (chandef->width) {
3160        case NL80211_CHAN_WIDTH_20_NOHT:
3161        case NL80211_CHAN_WIDTH_20:
3162        case NL80211_CHAN_WIDTH_40:
3163                if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3164                                cfg80211_get_chandef_type(chandef)))
3165                        return -ENOBUFS;
3166                break;
3167        default:
3168                break;
3169        }
3170        if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3171                return -ENOBUFS;
3172        if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3173                return -ENOBUFS;
3174        if (chandef->center_freq2 &&
3175            nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3176                return -ENOBUFS;
3177        return 0;
3178}
3179
3180static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3181                              struct cfg80211_registered_device *rdev,
3182                              struct wireless_dev *wdev,
3183                              enum nl80211_commands cmd)
3184{
3185        struct net_device *dev = wdev->netdev;
3186        void *hdr;
3187
3188        WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3189                cmd != NL80211_CMD_DEL_INTERFACE &&
3190                cmd != NL80211_CMD_SET_INTERFACE);
3191
3192        hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3193        if (!hdr)
3194                return -1;
3195
3196        if (dev &&
3197            (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3198             nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3199                goto nla_put_failure;
3200
3201        if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3202            nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3203            nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3204                              NL80211_ATTR_PAD) ||
3205            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3206            nla_put_u32(msg, NL80211_ATTR_GENERATION,
3207                        rdev->devlist_generation ^
3208                        (cfg80211_rdev_list_generation << 2)) ||
3209            nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3210                goto nla_put_failure;
3211
3212        if (rdev->ops->get_channel) {
3213                int ret;
3214                struct cfg80211_chan_def chandef = {};
3215
3216                ret = rdev_get_channel(rdev, wdev, &chandef);
3217                if (ret == 0) {
3218                        if (nl80211_send_chandef(msg, &chandef))
3219                                goto nla_put_failure;
3220                }
3221        }
3222
3223        if (rdev->ops->get_tx_power) {
3224                int dbm, ret;
3225
3226                ret = rdev_get_tx_power(rdev, wdev, &dbm);
3227                if (ret == 0 &&
3228                    nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3229                                DBM_TO_MBM(dbm)))
3230                        goto nla_put_failure;
3231        }
3232
3233        wdev_lock(wdev);
3234        switch (wdev->iftype) {
3235        case NL80211_IFTYPE_AP:
3236                if (wdev->ssid_len &&
3237                    nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3238                        goto nla_put_failure_locked;
3239                break;
3240        case NL80211_IFTYPE_STATION:
3241        case NL80211_IFTYPE_P2P_CLIENT:
3242        case NL80211_IFTYPE_ADHOC: {
3243                const u8 *ssid_ie;
3244                if (!wdev->current_bss)
3245                        break;
3246                rcu_read_lock();
3247                ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3248                                               WLAN_EID_SSID);
3249                if (ssid_ie &&
3250                    nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3251                        goto nla_put_failure_rcu_locked;
3252                rcu_read_unlock();
3253                break;
3254                }
3255        default:
3256                /* nothing */
3257                break;
3258        }
3259        wdev_unlock(wdev);
3260
3261        if (rdev->ops->get_txq_stats) {
3262                struct cfg80211_txq_stats txqstats = {};
3263                int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3264
3265                if (ret == 0 &&
3266                    !nl80211_put_txq_stats(msg, &txqstats,
3267                                           NL80211_ATTR_TXQ_STATS))
3268                        goto nla_put_failure;
3269        }
3270
3271        genlmsg_end(msg, hdr);
3272        return 0;
3273
3274 nla_put_failure_rcu_locked:
3275        rcu_read_unlock();
3276 nla_put_failure_locked:
3277        wdev_unlock(wdev);
3278 nla_put_failure:
3279        genlmsg_cancel(msg, hdr);
3280        return -EMSGSIZE;
3281}
3282
3283static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3284{
3285        int wp_idx = 0;
3286        int if_idx = 0;
3287        int wp_start = cb->args[0];
3288        int if_start = cb->args[1];
3289        int filter_wiphy = -1;
3290        struct cfg80211_registered_device *rdev;
3291        struct wireless_dev *wdev;
3292        int ret;
3293
3294        rtnl_lock();
3295        if (!cb->args[2]) {
3296                struct nl80211_dump_wiphy_state state = {
3297                        .filter_wiphy = -1,
3298                };
3299
3300                ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3301                if (ret)
3302                        goto out_unlock;
3303
3304                filter_wiphy = state.filter_wiphy;
3305
3306                /*
3307                 * if filtering, set cb->args[2] to +1 since 0 is the default
3308                 * value needed to determine that parsing is necessary.
3309                 */
3310                if (filter_wiphy >= 0)
3311                        cb->args[2] = filter_wiphy + 1;
3312                else
3313                        cb->args[2] = -1;
3314        } else if (cb->args[2] > 0) {
3315                filter_wiphy = cb->args[2] - 1;
3316        }
3317
3318        list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3319                if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3320                        continue;
3321                if (wp_idx < wp_start) {
3322                        wp_idx++;
3323                        continue;
3324                }
3325
3326                if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3327                        continue;
3328
3329                if_idx = 0;
3330
3331                list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3332                        if (if_idx < if_start) {
3333                                if_idx++;
3334                                continue;
3335                        }
3336                        if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3337                                               cb->nlh->nlmsg_seq, NLM_F_MULTI,
3338                                               rdev, wdev,
3339                                               NL80211_CMD_NEW_INTERFACE) < 0) {
3340                                goto out;
3341                        }
3342                        if_idx++;
3343                }
3344
3345                wp_idx++;
3346        }
3347 out:
3348        cb->args[0] = wp_idx;
3349        cb->args[1] = if_idx;
3350
3351        ret = skb->len;
3352 out_unlock:
3353        rtnl_unlock();
3354
3355        return ret;
3356}
3357
3358static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3359{
3360        struct sk_buff *msg;
3361        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3362        struct wireless_dev *wdev = info->user_ptr[1];
3363
3364        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3365        if (!msg)
3366                return -ENOMEM;
3367
3368        if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3369                               rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3370                nlmsg_free(msg);
3371                return -ENOBUFS;
3372        }
3373
3374        return genlmsg_reply(msg, info);
3375}
3376
3377static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3378        [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3379        [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3380        [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3381        [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3382        [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3383        [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3384};
3385
3386static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3387{
3388        struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3389        int flag;
3390
3391        *mntrflags = 0;
3392
3393        if (!nla)
3394                return -EINVAL;
3395
3396        if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3397                return -EINVAL;
3398
3399        for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3400                if (flags[flag])
3401                        *mntrflags |= (1<<flag);
3402
3403        *mntrflags |= MONITOR_FLAG_CHANGED;
3404
3405        return 0;
3406}
3407
3408static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3409                                     enum nl80211_iftype type,
3410                                     struct genl_info *info,
3411                                     struct vif_params *params)
3412{
3413        bool change = false;
3414        int err;
3415
3416        if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3417                if (type != NL80211_IFTYPE_MONITOR)
3418                        return -EINVAL;
3419
3420                err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3421                                          &params->flags);
3422                if (err)
3423                        return err;
3424
3425                change = true;
3426        }
3427
3428        if (params->flags & MONITOR_FLAG_ACTIVE &&
3429            !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3430                return -EOPNOTSUPP;
3431
3432        if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3433                const u8 *mumimo_groups;
3434                u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3435
3436                if (type != NL80211_IFTYPE_MONITOR)
3437                        return -EINVAL;
3438
3439                if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3440                        return -EOPNOTSUPP;
3441
3442                mumimo_groups =
3443                        nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3444
3445                /* bits 0 and 63 are reserved and must be zero */
3446                if ((mumimo_groups[0] & BIT(0)) ||
3447                    (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3448                        return -EINVAL;
3449
3450                params->vht_mumimo_groups = mumimo_groups;
3451                change = true;
3452        }
3453
3454        if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3455                u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3456
3457                if (type != NL80211_IFTYPE_MONITOR)
3458                        return -EINVAL;
3459
3460                if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3461                        return -EOPNOTSUPP;
3462
3463                params->vht_mumimo_follow_addr =
3464                        nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3465                change = true;
3466        }
3467
3468        return change ? 1 : 0;
3469}
3470
3471static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3472                               struct net_device *netdev, u8 use_4addr,
3473                               enum nl80211_iftype iftype)
3474{
3475        if (!use_4addr) {
3476                if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3477                        return -EBUSY;
3478                return 0;
3479        }
3480
3481        switch (iftype) {
3482        case NL80211_IFTYPE_AP_VLAN:
3483                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3484                        return 0;
3485                break;
3486        case NL80211_IFTYPE_STATION:
3487                if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3488                        return 0;
3489                break;
3490        default:
3491                break;
3492        }
3493
3494        return -EOPNOTSUPP;
3495}
3496
3497static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3498{
3499        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3500        struct vif_params params;
3501        int err;
3502        enum nl80211_iftype otype, ntype;
3503        struct net_device *dev = info->user_ptr[1];
3504        bool change = false;
3505
3506        memset(&params, 0, sizeof(params));
3507
3508        otype = ntype = dev->ieee80211_ptr->iftype;
3509
3510        if (info->attrs[NL80211_ATTR_IFTYPE]) {
3511                ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3512                if (otype != ntype)
3513                        change = true;
3514        }
3515
3516        if (info->attrs[NL80211_ATTR_MESH_ID]) {
3517                struct wireless_dev *wdev = dev->ieee80211_ptr;
3518
3519                if (ntype != NL80211_IFTYPE_MESH_POINT)
3520                        return -EINVAL;
3521                if (netif_running(dev))
3522                        return -EBUSY;
3523
3524                wdev_lock(wdev);
3525                BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3526                             IEEE80211_MAX_MESH_ID_LEN);
3527                wdev->mesh_id_up_len =
3528                        nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3529                memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3530                       wdev->mesh_id_up_len);
3531                wdev_unlock(wdev);
3532        }
3533
3534        if (info->attrs[NL80211_ATTR_4ADDR]) {
3535                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3536                change = true;
3537                err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3538                if (err)
3539                        return err;
3540        } else {
3541                params.use_4addr = -1;
3542        }
3543
3544        err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3545        if (err < 0)
3546                return err;
3547        if (err > 0)
3548                change = true;
3549
3550        if (change)
3551                err = cfg80211_change_iface(rdev, dev, ntype, &params);
3552        else
3553                err = 0;
3554
3555        if (!err && params.use_4addr != -1)
3556                dev->ieee80211_ptr->use_4addr = params.use_4addr;
3557
3558        if (change && !err) {
3559                struct wireless_dev *wdev = dev->ieee80211_ptr;
3560
3561                nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3562        }
3563
3564        return err;
3565}
3566
3567static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3568{
3569        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3570        struct vif_params params;
3571        struct wireless_dev *wdev;
3572        struct sk_buff *msg;
3573        int err;
3574        enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3575
3576        /* to avoid failing a new interface creation due to pending removal */
3577        cfg80211_destroy_ifaces(rdev);
3578
3579        memset(&params, 0, sizeof(params));
3580
3581        if (!info->attrs[NL80211_ATTR_IFNAME])
3582                return -EINVAL;
3583
3584        if (info->attrs[NL80211_ATTR_IFTYPE])
3585                type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3586
3587        if (!rdev->ops->add_virtual_intf)
3588                return -EOPNOTSUPP;
3589
3590        if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3591             rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3592            info->attrs[NL80211_ATTR_MAC]) {
3593                nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3594                           ETH_ALEN);
3595                if (!is_valid_ether_addr(params.macaddr))
3596                        return -EADDRNOTAVAIL;
3597        }
3598
3599        if (info->attrs[NL80211_ATTR_4ADDR]) {
3600                params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3601                err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3602                if (err)
3603                        return err;
3604        }
3605
3606        if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3607                return -EOPNOTSUPP;
3608
3609        err = nl80211_parse_mon_options(rdev, type, info, &params);
3610        if (err < 0)
3611                return err;
3612
3613        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3614        if (!msg)
3615                return -ENOMEM;
3616
3617        wdev = rdev_add_virtual_intf(rdev,
3618                                nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3619                                NET_NAME_USER, type, &params);
3620        if (WARN_ON(!wdev)) {
3621                nlmsg_free(msg);
3622                return -EPROTO;
3623        } else if (IS_ERR(wdev)) {
3624                nlmsg_free(msg);
3625                return PTR_ERR(wdev);
3626        }
3627
3628        if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3629                wdev->owner_nlportid = info->snd_portid;
3630
3631        switch (type) {
3632        case NL80211_IFTYPE_MESH_POINT:
3633                if (!info->attrs[NL80211_ATTR_MESH_ID])
3634                        break;
3635                wdev_lock(wdev);
3636                BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3637                             IEEE80211_MAX_MESH_ID_LEN);
3638                wdev->mesh_id_up_len =
3639                        nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3640                memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3641                       wdev->mesh_id_up_len);
3642                wdev_unlock(wdev);
3643                break;
3644        case NL80211_IFTYPE_NAN:
3645        case NL80211_IFTYPE_P2P_DEVICE:
3646                /*
3647                 * P2P Device and NAN do not have a netdev, so don't go
3648                 * through the netdev notifier and must be added here
3649                 */
3650                cfg80211_init_wdev(rdev, wdev);
3651                break;
3652        default:
3653                break;
3654        }
3655
3656        if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3657                               rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3658                nlmsg_free(msg);
3659                return -ENOBUFS;
3660        }
3661
3662        return genlmsg_reply(msg, info);
3663}
3664
3665static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3666{
3667        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3668        struct wireless_dev *wdev = info->user_ptr[1];
3669
3670        if (!rdev->ops->del_virtual_intf)
3671                return -EOPNOTSUPP;
3672
3673        /*
3674         * If we remove a wireless device without a netdev then clear
3675         * user_ptr[1] so that nl80211_post_doit won't dereference it
3676         * to check if it needs to do dev_put(). Otherwise it crashes
3677         * since the wdev has been freed, unlike with a netdev where
3678         * we need the dev_put() for the netdev to really be freed.
3679         */
3680        if (!wdev->netdev)
3681                info->user_ptr[1] = NULL;
3682
3683        return rdev_del_virtual_intf(rdev, wdev);
3684}
3685
3686static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3687{
3688        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3689        struct net_device *dev = info->user_ptr[1];
3690        u16 noack_map;
3691
3692        if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3693                return -EINVAL;
3694
3695        if (!rdev->ops->set_noack_map)
3696                return -EOPNOTSUPP;
3697
3698        noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3699
3700        return rdev_set_noack_map(rdev, dev, noack_map);
3701}
3702
3703struct get_key_cookie {
3704        struct sk_buff *msg;
3705        int error;
3706        int idx;
3707};
3708
3709static void get_key_callback(void *c, struct key_params *params)
3710{
3711        struct nlattr *key;
3712        struct get_key_cookie *cookie = c;
3713
3714        if ((params->key &&
3715             nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3716                     params->key_len, params->key)) ||
3717            (params->seq &&
3718             nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3719                     params->seq_len, params->seq)) ||
3720            (params->cipher &&
3721             nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3722                         params->cipher)))
3723                goto nla_put_failure;
3724
3725        key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
3726        if (!key)
3727                goto nla_put_failure;
3728
3729        if ((params->key &&
3730             nla_put(cookie->msg, NL80211_KEY_DATA,
3731                     params->key_len, params->key)) ||
3732            (params->seq &&
3733             nla_put(cookie->msg, NL80211_KEY_SEQ,
3734                     params->seq_len, params->seq)) ||
3735            (params->cipher &&
3736             nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3737                         params->cipher)))
3738                goto nla_put_failure;
3739
3740        if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3741                goto nla_put_failure;
3742
3743        nla_nest_end(cookie->msg, key);
3744
3745        return;
3746 nla_put_failure:
3747        cookie->error = 1;
3748}
3749
3750static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3751{
3752        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3753        int err;
3754        struct net_device *dev = info->user_ptr[1];
3755        u8 key_idx = 0;
3756        const u8 *mac_addr = NULL;
3757        bool pairwise;
3758        struct get_key_cookie cookie = {
3759                .error = 0,
3760        };
3761        void *hdr;
3762        struct sk_buff *msg;
3763
3764        if (info->attrs[NL80211_ATTR_KEY_IDX])
3765                key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3766
3767        if (info->attrs[NL80211_ATTR_MAC])
3768                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3769
3770        pairwise = !!mac_addr;
3771        if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3772                u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3773
3774                if (kt != NL80211_KEYTYPE_GROUP &&
3775                    kt != NL80211_KEYTYPE_PAIRWISE)
3776                        return -EINVAL;
3777                pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3778        }
3779
3780        if (!rdev->ops->get_key)
3781                return -EOPNOTSUPP;
3782
3783        if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3784                return -ENOENT;
3785
3786        msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3787        if (!msg)
3788                return -ENOMEM;
3789
3790        hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3791                             NL80211_CMD_NEW_KEY);
3792        if (!hdr)
3793                goto nla_put_failure;
3794
3795        cookie.msg = msg;
3796        cookie.idx = key_idx;
3797
3798        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3799            nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3800                goto nla_put_failure;
3801        if (mac_addr &&
3802            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3803                goto nla_put_failure;
3804
3805        err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3806                           get_key_callback);
3807
3808        if (err)
3809                goto free_msg;
3810
3811        if (cookie.error)
3812                goto nla_put_failure;
3813
3814        genlmsg_end(msg, hdr);
3815        return genlmsg_reply(msg, info);
3816
3817 nla_put_failure:
3818        err = -ENOBUFS;
3819 free_msg:
3820        nlmsg_free(msg);
3821        return err;
3822}
3823
3824static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3825{
3826        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3827        struct key_parse key;
3828        int err;
3829        struct net_device *dev = info->user_ptr[1];
3830
3831        err = nl80211_parse_key(info, &key);
3832        if (err)
3833                return err;
3834
3835        if (key.idx < 0)
3836                return -EINVAL;
3837
3838        /* Only support setting default key and
3839         * Extended Key ID action NL80211_KEY_SET_TX.
3840         */
3841        if (!key.def && !key.defmgmt &&
3842            !(key.p.mode == NL80211_KEY_SET_TX))
3843                return -EINVAL;
3844
3845        wdev_lock(dev->ieee80211_ptr);
3846
3847        if (key.def) {
3848                if (!rdev->ops->set_default_key) {
3849                        err = -EOPNOTSUPP;
3850                        goto out;
3851                }
3852
3853                err = nl80211_key_allowed(dev->ieee80211_ptr);
3854                if (err)
3855                        goto out;
3856
3857                err = rdev_set_default_key(rdev, dev, key.idx,
3858                                                 key.def_uni, key.def_multi);
3859
3860                if (err)
3861                        goto out;
3862
3863#ifdef CONFIG_CFG80211_WEXT
3864                dev->ieee80211_ptr->wext.default_key = key.idx;
3865#endif
3866        } else if (key.defmgmt) {
3867                if (key.def_uni || !key.def_multi) {
3868                        err = -EINVAL;
3869                        goto out;
3870                }
3871
3872                if (!rdev->ops->set_default_mgmt_key) {
3873                        err = -EOPNOTSUPP;
3874                        goto out;
3875                }
3876
3877                err = nl80211_key_allowed(dev->ieee80211_ptr);
3878                if (err)
3879                        goto out;
3880
3881                err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3882                if (err)
3883                        goto out;
3884
3885#ifdef CONFIG_CFG80211_WEXT
3886                dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3887#endif
3888        } else if (key.p.mode == NL80211_KEY_SET_TX &&
3889                   wiphy_ext_feature_isset(&rdev->wiphy,
3890                                           NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3891                u8 *mac_addr = NULL;
3892
3893                if (info->attrs[NL80211_ATTR_MAC])
3894                        mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3895
3896                if (!mac_addr || key.idx < 0 || key.idx > 1) {
3897                        err = -EINVAL;
3898                        goto out;
3899                }
3900
3901                err = rdev_add_key(rdev, dev, key.idx,
3902                                   NL80211_KEYTYPE_PAIRWISE,
3903                                   mac_addr, &key.p);
3904        } else {
3905                err = -EINVAL;
3906        }
3907 out:
3908        wdev_unlock(dev->ieee80211_ptr);
3909
3910        return err;
3911}
3912
3913static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3914{
3915        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3916        int err;
3917        struct net_device *dev = info->user_ptr[1];
3918        struct key_parse key;
3919        const u8 *mac_addr = NULL;
3920
3921        err = nl80211_parse_key(info, &key);
3922        if (err)
3923                return err;
3924
3925        if (!key.p.key)
3926                return -EINVAL;
3927
3928        if (info->attrs[NL80211_ATTR_MAC])
3929                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3930
3931        if (key.type == -1) {
3932                if (mac_addr)
3933                        key.type = NL80211_KEYTYPE_PAIRWISE;
3934                else
3935                        key.type = NL80211_KEYTYPE_GROUP;
3936        }
3937
3938        /* for now */
3939        if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3940            key.type != NL80211_KEYTYPE_GROUP)
3941                return -EINVAL;
3942
3943        if (!rdev->ops->add_key)
3944                return -EOPNOTSUPP;
3945
3946        if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3947                                           key.type == NL80211_KEYTYPE_PAIRWISE,
3948                                           mac_addr))
3949                return -EINVAL;
3950
3951        wdev_lock(dev->ieee80211_ptr);
3952        err = nl80211_key_allowed(dev->ieee80211_ptr);
3953        if (!err)
3954                err = rdev_add_key(rdev, dev, key.idx,
3955                                   key.type == NL80211_KEYTYPE_PAIRWISE,
3956                                    mac_addr, &key.p);
3957        wdev_unlock(dev->ieee80211_ptr);
3958
3959        return err;
3960}
3961
3962static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3963{
3964        struct cfg80211_registered_device *rdev = info->user_ptr[0];
3965        int err;
3966        struct net_device *dev = info->user_ptr[1];
3967        u8 *mac_addr = NULL;
3968        struct key_parse key;
3969
3970        err = nl80211_parse_key(info, &key);
3971        if (err)
3972                return err;
3973
3974        if (info->attrs[NL80211_ATTR_MAC])
3975                mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3976
3977        if (key.type == -1) {
3978                if (mac_addr)
3979                        key.type = NL80211_KEYTYPE_PAIRWISE;
3980                else
3981                        key.type = NL80211_KEYTYPE_GROUP;
3982        }
3983
3984        /* for now */
3985        if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3986            key.type != NL80211_KEYTYPE_GROUP)
3987                return -EINVAL;
3988
3989        if (!rdev->ops->del_key)
3990                return -EOPNOTSUPP;
3991
3992        wdev_lock(dev->ieee80211_ptr);
3993        err = nl80211_key_allowed(dev->ieee80211_ptr);
3994
3995        if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3996            !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3997                err = -ENOENT;
3998
3999        if (!err)
4000                err = rdev_del_key(rdev, dev, key.idx,
4001                                   key.type == NL80211_KEYTYPE_PAIRWISE,
4002                                   mac_addr);
4003
4004#ifdef CONFIG_CFG80211_WEXT
4005        if (!err) {
4006                if (key.idx == dev->ieee80211_ptr->wext.default_key)
4007                        dev->ieee80211_ptr->wext.default_key = -1;
4008                else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4009                        dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4010        }
4011#endif
4012        wdev_unlock(dev->ieee80211_ptr);
4013
4014        return err;
4015}
4016
4017/* This function returns an error or the number of nested attributes */
4018static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4019{
4020        struct nlattr *attr;
4021        int n_entries = 0, tmp;
4022
4023        nla_for_each_nested(attr, nl_attr, tmp) {
4024                if (nla_len(attr) != ETH_ALEN)
4025                        return -EINVAL;
4026
4027                n_entries++;
4028        }
4029
4030        return n_entries;
4031}
4032
4033/*
4034 * This function parses ACL information and allocates memory for ACL data.
4035 * On successful return, the calling function is responsible to free the
4036 * ACL buffer returned by this function.
4037 */
4038static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4039                                                struct genl_info *info)
4040{
4041        enum nl80211_acl_policy acl_policy;
4042        struct nlattr *attr;
4043        struct cfg80211_acl_data *acl;
4044        int i = 0, n_entries, tmp;
4045
4046        if (!wiphy->max_acl_mac_addrs)
4047                return ERR_PTR(-EOPNOTSUPP);
4048
4049        if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4050                return ERR_PTR(-EINVAL);
4051
4052        acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4053        if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4054            acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4055                return ERR_PTR(-EINVAL);
4056
4057        if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4058                return ERR_PTR(-EINVAL);
4059
4060        n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4061        if (n_entries < 0)
4062                return ERR_PTR(n_entries);
4063
4064        if (n_entries > wiphy->max_acl_mac_addrs)
4065                return ERR_PTR(-ENOTSUPP);
4066
4067        acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4068        if (!acl)
4069                return ERR_PTR(-ENOMEM);
4070
4071        nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4072                memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4073                i++;
4074        }
4075
4076        acl->n_acl_entries = n_entries;
4077        acl->acl_policy = acl_policy;
4078
4079        return acl;
4080}
4081
4082static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4083{
4084        struct cfg80211_registered_device *rdev = info->user_ptr[0];
4085        struct net_device *dev = info->user_ptr[1];
4086        struct cfg80211_acl_data *acl;
4087        int err;
4088
4089        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4090            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4091                return -EOPNOTSUPP;
4092
4093        if (!dev->ieee80211_ptr->beacon_interval)
4094                return -EINVAL;
4095
4096        acl = parse_acl_data(&rdev->wiphy, info);
4097        if (IS_ERR(acl))
4098                return PTR_ERR(acl);
4099
4100        err = rdev_set_mac_acl(rdev, dev, acl);
4101
4102        kfree(acl);
4103
4104        return err;
4105}
4106
4107static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4108                           u8 *rates, u8 rates_len)
4109{
4110        u8 i;
4111        u32 mask = 0;
4112
4113        for (i = 0; i < rates_len; i++) {
4114                int rate = (rates[i] & 0x7f) * 5;
4115                int ridx;
4116
4117                for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4118                        struct ieee80211_rate *srate =
4119                                &sband->bitrates[ridx];
4120                        if (rate == srate->bitrate) {
4121                                mask |= 1 << ridx;
4122                                break;
4123                        }
4124                }
4125                if (ridx == sband->n_bitrates)
4126                        return 0; /* rate not found */
4127        }
4128
4129        return mask;
4130}
4131
4132static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4133                               u8 *rates, u8 rates_len,
4134                               u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4135{
4136        u8 i;
4137
4138        memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4139
4140        for (i = 0; i < rates_len; i++) {
4141                int ridx, rbit;
4142
4143                ridx = rates[i] / 8;
4144                rbit = BIT(rates[i] % 8);
4145
4146                /* check validity */
4147                if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4148                        return false;
4149
4150                /* check availability */
4151                ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4152                if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4153                        mcs[ridx] |= rbit;
4154                else
4155                        return false;
4156        }
4157
4158        return true;
4159}
4160
4161static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4162{
4163        u16 mcs_mask = 0;
4164
4165        switch (vht_mcs_map) {
4166        case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4167                break;
4168        case IEEE80211_VHT_MCS_SUPPORT_0_7:
4169                mcs_mask = 0x00FF;
4170                break;
4171        case IEEE80211_VHT_MCS_SUPPORT_0_8:
4172                mcs_mask = 0x01FF;
4173                break;
4174        case IEEE80211_VHT_MCS_SUPPORT_0_9:
4175                mcs_mask = 0x03FF;
4176                break;
4177        default:
4178                break;
4179        }
4180
4181        return mcs_mask;
4182}
4183
4184static void vht_build_mcs_mask(u16 vht_mcs_map,
4185                               u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4186{
4187        u8 nss;
4188
4189        for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4190                vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4191                vht_mcs_map >>= 2;
4192        }
4193}
4194
4195static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4196                             struct nl80211_txrate_vht *txrate,
4197                             u16 mcs[NL80211_VHT_NSS_MAX])
4198{
4199        u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4200        u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4201        u8 i;
4202
4203        if (!sband->vht_cap.vht_supported)
4204                return false;
4205
4206        memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4207
4208        /* Build vht_mcs_mask from VHT capabilities */
4209        vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4210
4211        for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4212                if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4213                        mcs[i] = txrate->mcs[i];
4214                else
4215                        return false;
4216        }
4217
4218        return true;
4219}
4220
4221static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4222        [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4223                                    .len = NL80211_MAX_SUPP_RATES },
4224        [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4225                                .len = NL80211_MAX_SUPP_HT_RATES },
4226        [NL80211_TXRATE_VHT] = {
4227                .type = NLA_EXACT_LEN_WARN,
4228                .len = sizeof(struct nl80211_txrate_vht),
4229        },
4230        [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4231};
4232
4233static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4234                                         struct cfg80211_bitrate_mask *mask)
4235{
4236        struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4237        struct cfg80211_registered_device *rdev = info->user_ptr[0];
4238        int rem, i;
4239        struct nlattr *tx_rates;
4240        struct ieee80211_supported_band *sband;
4241        u16 vht_tx_mcs_map;
4242
4243        memset(mask, 0, sizeof(*mask));
4244        /* Default to all rates enabled */
4245        for (i = 0; i < NUM_NL80211_BANDS; i++) {
4246                sband = rdev->wiphy.bands[i];
4247
4248                if (!sband)
4249                        continue;
4250
4251                mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4252                memcpy(mask->control[i].ht_mcs,
4253                       sband->ht_cap.mcs.rx_mask,
4254                       sizeof(mask->control[i].ht_mcs));
4255
4256                if (!sband->vht_cap.vht_supported)
4257                        continue;
4258
4259                vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4260                vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4261        }
4262
4263        /* if no rates are given set it back to the defaults */
4264        if (!info->attrs[NL80211_ATTR_TX_RATES])
4265                goto out;
4266
4267        /* The nested attribute uses enum nl80211_band as the index. This maps
4268         * directly to the enum nl80211_band values used in cfg80211.
4269         */
4270        BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4271        nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4272                enum nl80211_band band = nla_type(tx_rates);
4273                int err;
4274
4275                if (band < 0 || band >= NUM_NL80211_BANDS)
4276                        return -EINVAL;
4277                sband = rdev->wiphy.bands[band];
4278                if (sband == NULL)
4279                        return -EINVAL;
4280                err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4281                                                  tx_rates,
4282                                                  nl80211_txattr_policy,
4283                                                  info->extack);
4284                if (err)
4285                        return err;
4286                if (tb[NL80211_TXRATE_LEGACY]) {
4287                        mask->control[band].legacy = rateset_to_mask(
4288                                sband,
4289                                nla_data(tb[NL80211_TXRATE_LEGACY]),
4290                                nla_len(tb[NL80211_TXRATE_LEGACY]));
4291                        if ((mask->control[band].legacy == 0) &&
4292                            nla_len(tb[NL80211_TXRATE_LEGACY]))
4293                                return -EINVAL;
4294                }
4295                if (tb[NL80211_TXRATE_HT]) {
4296                        if (!ht_rateset_to_mask(
4297                                        sband,
4298                                        nla_data(tb[NL80211_TXRATE_HT]),
4299                                        nla_len(tb[NL80211_TXRATE_HT]),
4300                                        mask->control[band].ht_mcs))
4301                                return -EINVAL;
4302                }
4303                if (tb[NL80211_TXRATE_VHT]) {
4304                        if (!vht_set_mcs_mask(
4305                                        sband,
4306                                        nla_data(tb[NL80211_TXRATE_VHT]),
4307                                        mask->control[band].vht_mcs))
4308                                return -EINVAL;
4309                }
4310                if (tb[NL80211_TXRATE_GI]) {
4311                        mask->control[band].gi =
4312                                nla_get_u8(tb[NL80211_TXRATE_GI]);
4313                        if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4314                                return -EINVAL;
4315                }
4316
4317                if (mask->control[band].legacy == 0) {
4318                        /* don't allow empty legacy rates if HT or VHT
4319                         * are not even supported.
4320                         */
4321                        if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4322                              rdev->wiphy.bands[band]->vht_cap.vht_supported))
4323                                return -EINVAL;
4324
4325                        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4326                                if (mask->control[band].ht_mcs[i])
4327                                        goto out;
4328
4329                        for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4330                                if (mask->control[band].vht_mcs[i])
4331                                        goto out;
4332
4333                        /* legacy and mcs rates may not be both empty */
4334                        return -EINVAL;
4335                }
4336        }
4337
4338out:
4339        return 0;
4340}
4341
4342static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4343                                   enum nl80211_band band,
4344                                   struct cfg80211_bitrate_mask *beacon_rate)
4345{
4346        u32 count_ht, count_vht, i;
4347        u32 rate = beacon_rate->control[band].legacy;
4348
4349        /* Allow only one rate */
4350        if (hweight32(rate) > 1)
4351                return -EINVAL;
4352
4353        count_ht = 0;
4354        for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4355                if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4356                        return -EINVAL;
4357                } else if (beacon_rate->control[band].ht_mcs[i]) {
4358                        count_ht++;
4359                        if (count_ht > 1)
4360                                return -EINVAL;
4361                }
4362                if (count_ht && rate)
4363                        return -EINVAL;
4364        }
4365
4366        count_vht = 0;
4367        for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4368                if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4369                        return -EINVAL;
4370                } else if (beacon_rate->control[band].vht_mcs[i]) {
4371                        count_vht++;
4372                        if (count_vht > 1)
4373                                return -EINVAL;
4374                }
4375                if (count_vht && rate)
4376                        return -EINVAL;
4377        }
4378
4379        if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4380                return -EINVAL;
4381
4382        if (rate &&
4383            !wiphy_ext_feature_isset(&rdev->wiphy,
4384                                     NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4385                return -EINVAL;
4386        if (count_ht &&
4387            !wiphy_ext_feature_isset(&rdev->wiphy,
4388                                     NL80211_EXT_FEATURE_BEACON_RATE_HT))
4389                return -EINVAL;
4390        if (count_vht &&
4391            !wiphy_ext_feature_isset(&rdev->wiphy,
4392                                     NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4393                return -EINVAL;
4394
4395        return 0;
4396}
4397
4398static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4399                                struct nlattr *attrs[],
4400                                struct cfg80211_beacon_data *bcn)
4401{
4402        bool haveinfo = false;
4403        int err;
4404
4405        memset(bcn, 0, sizeof(*bcn));
4406
4407        if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4408                bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4409                bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4410                if (!bcn->head_len)
4411                        return -EINVAL;
4412                haveinfo = true;
4413        }
4414
4415        if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4416                bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4417                bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4418                haveinfo = true;
4419        }
4420
4421        if (!haveinfo)
4422                return -EINVAL;
4423
4424        if (attrs[NL80211_ATTR_IE]) {
4425                bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4426                bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4427        }
4428
4429        if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4430                bcn->proberesp_ies =
4431                        nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4432                bcn->proberesp_ies_len =
4433                        nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4434        }
4435
4436        if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4437                bcn->assocresp_ies =
4438                        nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4439                bcn->assocresp_ies_len =
4440                        nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4441        }
4442
4443        if (attrs[NL80211_ATTR_PROBE_RESP]) {
4444                bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4445                bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4446        }
4447
4448        if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4449                struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4450
4451                err = nla_parse_nested_deprecated(tb,
4452                                                  NL80211_FTM_RESP_ATTR_MAX,
4453                                                  attrs[NL80211_ATTR_FTM_RESPONDER],
4454                                                  NULL, NULL);
4455                if (err)
4456                        return err;
4457
4458                if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4459                    wiphy_ext_feature_isset(&rdev->wiphy,
4460                                            NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4461                        bcn->ftm_responder = 1;
4462                else
4463                        return -EOPNOTSUPP;
4464
4465                if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4466                        bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4467                        bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4468                }
4469
4470                if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4471                        bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4472                        bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4473                }
4474        } else {
4475                bcn->ftm_responder = -1;
4476        }
4477
4478        return 0;
4479}
4480
4481static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
4482                                    struct ieee80211_he_obss_pd *he_obss_pd)
4483{
4484        struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
4485        int err;
4486
4487        err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
4488                               he_obss_pd_policy, NULL);
4489        if (err)
4490                return err;
4491
4492        if (!tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] ||
4493            !tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
4494                return -EINVAL;
4495
4496        he_obss_pd->min_offset =
4497                nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
4498        he_obss_pd->max_offset =
4499                nla_get_u32(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
4500
4501        if (he_obss_pd->min_offset >= he_obss_pd->max_offset)
4502                return -EINVAL;
4503
4504        he_obss_pd->enable = true;
4505
4506        return 0;
4507}
4508
4509static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4510                                            const u8 *rates)
4511{
4512        int i;
4513
4514        if (!rates)
4515                return;
4516
4517        for (i = 0; i < rates[1]; i++) {
4518                if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4519                        params->ht_required = true;
4520                if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4521                        params->vht_required = true;
4522        }
4523}
4524
4525/*
4526 * Since the nl80211 API didn't include, from the beginning, attributes about
4527 * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4528 * benefit of drivers that rebuild IEs in the firmware.
4529 */
4530static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4531{
4532        const struct cfg80211_beacon_data *bcn = &params->beacon;
4533        size_t ies_len = bcn->tail_len;
4534        const u8 *ies = bcn->tail;
4535        const u8 *rates;
4536        const u8 *cap;
4537
4538        rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4539        nl80211_check_ap_rate_selectors(params, rates);
4540
4541        rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4542        nl80211_check_ap_rate_selectors(params, rates);
4543
4544        cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4545        if (cap && cap[1] >= sizeof(*params->ht_cap))
4546                params->ht_cap = (void *)(cap + 2);
4547        cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4548        if (cap && cap[1] >= sizeof(*params->vht_cap))
4549                params->vht_cap = (void *)(cap + 2);
4550        cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4551        if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4552                params->he_cap = (void *)(cap + 3);
4553}
4554
4555static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4556                                   struct cfg80211_ap_settings *params)
4557{
4558        struct wireless_dev *wdev;
4559        bool ret = false;
4560
4561        list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4562                if (wdev->iftype != NL80211_IFTYPE_AP &&
4563                    wdev->iftype != NL80211_IFTYPE_P2P_GO)
4564                        continue;
4565
4566                if (!wdev->preset_chandef.chan)
4567                        continue;
4568
4569                params->chandef = wdev->preset_chandef;
4570                ret = true;
4571                break;
4572        }
4573
4574        return ret;
4575}
4576
4577static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4578                                    enum nl80211_auth_type auth_type,
4579                                    enum nl80211_commands cmd)
4580{
4581        if (auth_type > NL80211_AUTHTYPE_MAX)
4582                return false;
4583
4584        switch (cmd) {
4585        case NL80211_CMD_AUTHENTICATE:
4586                if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4587                    auth_type == NL80211_AUTHTYPE_SAE)
4588                        return false;
4589                if (!wiphy_ext_feature_isset(&rdev->wiphy,
4590                                             NL80211_EXT_FEATURE_FILS_STA) &&
4591                    (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4592                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4593                     auth_type == NL80211_AUTHTYPE_FILS_PK))
4594                        return false;
4595                return true;
4596        case NL80211_CMD_CONNECT:
4597                if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4598                    !wiphy_ext_feature_isset(&rdev->wiphy,
4599                                             NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
4600                    auth_type == NL80211_AUTHTYPE_SAE)
4601                        return false;
4602
4603                /* FILS with SK PFS or PK not supported yet */
4604                if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4605                    auth_type == NL80211_AUTHTYPE_FILS_PK)
4606                        return false;
4607                if (!wiphy_ext_feature_isset(
4608                            &rdev->wiphy,
4609                            NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4610                    auth_type == NL80211_AUTHTYPE_FILS_SK)
4611                        return false;
4612                return true;
4613        case NL80211_CMD_START_AP:
4614                /* SAE not supported yet */
4615                if (auth_type == NL80211_AUTHTYPE_SAE)
4616                        return false;
4617                /* FILS not supported yet */
4618                if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4619                    auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4620                    auth_type == NL80211_AUTHTYPE_FILS_PK)
4621                        return false;
4622                return true;
4623        default:
4624                return false;
4625        }
4626}
4627
4628static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4629{
4630        struct cfg80211_registered_device *rdev = info->user_ptr[0];
4631        struct net_device *dev = info->user_ptr[1];
4632        struct wireless_dev *wdev = dev->ieee80211_ptr;
4633        struct cfg80211_ap_settings params;
4634        int err;
4635
4636        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4637            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4638                return -EOPNOTSUPP;
4639
4640        if (!rdev->ops->start_ap)
4641                return -EOPNOTSUPP;
4642
4643        if (wdev->beacon_interval)
4644                return -EALREADY;
4645
4646        memset(&params, 0, sizeof(params));
4647
4648        /* these are required for START_AP */
4649        if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4650            !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4651            !info->attrs[NL80211_ATTR_BEACON_HEAD])
4652                return -EINVAL;
4653
4654        err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4655        if (err)
4656                return err;
4657
4658        params.beacon_interval =
4659                nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4660        params.dtim_period =
4661                nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4662
4663        err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4664                                           params.beacon_interval);
4665        if (err)
4666                return err;
4667
4668        /*
4669         * In theory, some of these attributes should be required here
4670         * but since they were not used when the command was originally
4671         * added, keep them optional for old user space programs to let
4672         * them continue to work with drivers that do not need the
4673         * additional information -- drivers must check!
4674         */
4675        if (info->attrs[NL80211_ATTR_SSID]) {
4676                params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4677                params.ssid_len =
4678                        nla_len(info->attrs[NL80211_ATTR_SSID]);
4679                if (params.ssid_len == 0 ||
4680                    params.ssid_len > IEEE80211_MAX_SSID_LEN)
4681                        return -EINVAL;
4682        }
4683
4684        if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4685                params.hidden_ssid = nla_get_u32(
4686                        info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4687
4688        params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4689
4690        if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4691                params.auth_type = nla_get_u32(
4692                        info->attrs[NL80211_ATTR_AUTH_TYPE]);
4693                if (!nl80211_valid_auth_type(rdev, params.auth_type,
4694                                             NL80211_CMD_START_AP))
4695                        return -EINVAL;
4696        } else
4697                params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4698
4699        err = nl80211_crypto_settings(rdev, info, &params.crypto,
4700                                      NL80211_MAX_NR_CIPHER_SUITES);
4701        if (err)
4702                return err;
4703
4704        if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4705                if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4706                        return -EOPNOTSUPP;
4707                params.inactivity_timeout = nla_get_u16(
4708                        info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4709        }
4710
4711        if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4712                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4713                        return -EINVAL;
4714                params.p2p_ctwindow =
4715                        nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4716                if (params.p2p_ctwindow != 0 &&
4717                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4718                        return -EINVAL;
4719        }
4720
4721        if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4722                u8 tmp;
4723
4724                if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4725                        return -EINVAL;
4726                tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4727                params.p2p_opp_ps = tmp;
4728                if (params.p2p_opp_ps != 0 &&
4729                    !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4730                        return -EINVAL;
4731        }
4732
4733        if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4734                err = nl80211_parse_chandef(rdev, info, &params.chandef);
4735                if (err)
4736                        return err;
4737        } else if (wdev->preset_chandef.chan) {
4738                params.chandef = wdev->preset_chandef;
4739        } else if (!nl80211_get_ap_channel(rdev, &params))
4740                return -EINVAL;
4741
4742        if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4743                                           wdev->iftype))
4744                return -EINVAL;
4745
4746        if (info->attrs[NL80211_ATTR_TX_RATES]) {
4747                err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4748                if (err)
4749                        return err;
4750
4751                err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4752                                              &params.beacon_rate);
4753                if (err)
4754                        return err;
4755        }
4756
4757        if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4758                params.smps_mode =
4759                        nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4760                switch (params.smps_mode) {
4761                case NL80211_SMPS_OFF:
4762                        break;
4763                case NL80211_SMPS_STATIC:
4764                        if (!(rdev->wiphy.features &
4765                              NL80211_FEATURE_STATIC_SMPS))
4766                                return -EINVAL;
4767                        break;
4768                case NL80211_SMPS_DYNAMIC:
4769                        if (!(rdev->wiphy.features &
4770                              NL80211_FEATURE_DYNAMIC_SMPS))
4771                                return -EINVAL;
4772                        break;
4773                default:
4774                        return -EINVAL;
4775                }
4776        } else {
4777                params.smps_mode = NL80211_SMPS_OFF;
4778        }
4779
4780        params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4781        if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4782                return -EOPNOTSUPP;
4783
4784        if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4785                params.acl = parse_acl_data(&rdev->wiphy, info);
4786                if (IS_ERR(params.acl))
4787                        return PTR_ERR(params.acl);
4788        }
4789
4790        params.twt_responder =
4791                    nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
4792
4793        if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
4794                err = nl80211_parse_he_obss_pd(
4795                                        info->attrs[NL80211_ATTR_HE_OBSS_PD],
4796                                        &params.he_obss_pd);
4797                if (err)
4798                        return err;
4799        }
4800
4801        nl80211_calculate_ap_params(&params);
4802
4803        if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4804                params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4805
4806        wdev_lock(wdev);
4807        err = rdev_start_ap(rdev, dev, &params);
4808        if (!err) {
4809                wdev->preset_chandef = params.chandef;
4810                wdev->beacon_interval = params.beacon_interval;
4811                wdev->chandef = params.chandef;
4812                wdev->ssid_len = params.ssid_len;
4813                memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4814
4815                if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4816                        wdev->conn_owner_nlportid = info->snd_portid;
4817        }
4818        wdev_unlock(wdev);
4819
4820        kfree(params.acl);
4821
4822        return err;
4823}
4824
4825static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4826{
4827        struct cfg80211_registered_device *rdev = info->user_ptr[0];
4828        struct net_device *dev = info->user_ptr[1];
4829        struct wireless_dev *wdev = dev->ieee80211_ptr;
4830        struct cfg80211_beacon_data params;
4831        int err;
4832
4833        if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4834            dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4835                return -EOPNOTSUPP;
4836
4837        if (!rdev->ops->change_beacon)
4838                return -EOPNOTSUPP;
4839
4840        if (!wdev->beacon_interval)
4841                return -EINVAL;
4842
4843        err = nl80211_parse_beacon(rdev, info->attrs, &params);
4844        if (err)
4845                return err;
4846
4847        wdev_lock(wdev);
4848        err = rdev_change_beacon(rdev, dev, &params);
4849        wdev_unlock(wdev);
4850
4851        return err;
4852}
4853
4854static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4855{
4856        struct cfg80211_registered_device *rdev = info->user_ptr[0];
4857        struct net_device *dev = info->user_ptr[1];
4858
4859        return cfg80211_stop_ap(rdev, dev, false);
4860}
4861
4862static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4863        [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4864        [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4865        [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4866        [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4867        [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4868        [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4869};
4870
4871static int parse_station_flags(struct genl_info *info,
4872                               enum nl80211_iftype iftype,
4873                               struct station_parameters *params)
4874{
4875        struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4876        struct nlattr *nla;
4877        int flag;
4878
4879        /*
4880         * Try parsing the new attribute first so userspace
4881         * can specify both for older kernels.
4882         */
4883        nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4884        if (nla) {
4885                struct nl80211_sta_flag_update *sta_flags;
4886
4887                sta_flags = nla_data(nla);
4888                params->sta_flags_mask = sta_flags->mask;
4889                params->sta_flags_set = sta_flags->set;
4890                params->sta_flags_set &= params->sta_flags_mask;
4891                if ((params->sta_flags_mask |
4892                     params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4893                        return -EINVAL;
4894                return 0;
4895        }
4896
4897        /* if present, parse the old attribute */
4898
4899        nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4900        if (!nla)
4901                return 0;
4902
4903        if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
4904                return -EINVAL;
4905
4906        /*
4907         * Only allow certain flags for interface types so that
4908         * other attributes are silently ignored. Remember that
4909         * this is backward compatibility code with old userspace
4910         * and shouldn't be hit in other cases anyway.
4911         */
4912        switch (iftype) {
4913        case NL80211_IFTYPE_AP:
4914        case NL80211_IFTYPE_AP_VLAN:
4915        case NL80211_IFTYPE_P2P_GO:
4916                params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4917                                         BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4918                                         BIT(NL80211_STA_FLAG_WME) |
4919                                         BIT(NL80211_STA_FLAG_MFP);
4920                break;
4921        case NL80211_IFTYPE_P2P_CLIENT:
4922        case NL80211_IFTYPE_STATION:
4923                params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4924                                         BIT(NL80211_STA_FLAG_TDLS_PEER);
4925                break;
4926        case NL80211_IFTYPE_MESH_POINT:
4927                params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4928                                         BIT(NL80211_STA_FLAG_MFP) |
4929                                         BIT(NL80211_STA_FLAG_AUTHORIZED);
4930                break;
4931        default:
4932                return -EINVAL;
4933        }
4934
4935        for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4936                if (flags[flag]) {
4937                        params->sta_flags_set |= (1<<flag);
4938
4939                        /* no longer support new API additions in old API */
4940                        if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4941                                return -EINVAL;
4942                }
4943        }
4944
4945        return 0;
4946}
4947
4948bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4949{
4950        struct nlattr *rate;
4951        u32 bitrate;
4952        u16 bitrate_compat;
4953        enum nl80211_rate_info rate_flg;
4954
4955        rate = nla_nest_start_noflag(msg, attr);
4956        if (!rate)
4957                return false;
4958
4959        /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4960        bitrate = cfg80211_calculate_bitrate(info);
4961        /* report 16-bit bitrate only if we can */
4962        bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4963        if (bitrate > 0 &&
4964            nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4965                return false;
4966        if (bitrate_compat > 0 &&
4967            nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4968                return false;
4969
4970        switch (info->bw) {
4971        case RATE_INFO_BW_5:
4972                rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4973                break;
4974        case RATE_INFO_BW_10:
4975                rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4976                break;
4977        default:
4978                WARN_ON(1);
4979                /* fall through */
4980        case RATE_INFO_BW_20:
4981                rate_flg = 0;
4982                break;
4983        case RATE_INFO_BW_40:
4984                rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4985                break;
4986        case RATE_INFO_BW_80:
4987                rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4988                break;
4989        case RATE_INFO_BW_160:
4990                rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4991                break;
4992        case RATE_INFO_BW_HE_RU:
4993                rate_flg = 0;
4994                WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4995        }
4996
4997        if (rate_flg && nla_put_flag(msg, rate_flg))
4998                return false;
4999
5000        if (info->flags & RATE_INFO_FLAGS_MCS) {
5001                if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5002                        return false;
5003                if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5004                    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5005                        return false;
5006        } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5007                if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5008                        return false;
5009                if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5010                        return false;
5011                if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5012                    nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5013                        return false;
5014        } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5015                if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5016                        return false;
5017                if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5018                        return false;
5019                if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5020                        return false;
5021                if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5022                        return false;
5023                if (info->bw == RATE_INFO_BW_HE_RU &&
5024                    nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5025                               info->he_ru_alloc))
5026                        return false;
5027        }
5028
5029        nla_nest_end(msg, rate);
5030        return true;
5031}
5032
5033static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5034                               int id)
5035{
5036        void *attr;
5037        int i = 0;
5038
5039        if (!mask)
5040                return true;
5041
5042        attr = nla_nest_start_noflag(msg, id);
5043        if (!attr)
5044                return false;
5045
5046        for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5047                if (!(mask & BIT(i)))
5048                        continue;
5049
5050                if (nla_put_u8(msg, i, signal[i]))
5051                        return false;
5052        }
5053
5054        nla_nest_end(msg, attr);
5055
5056        return true;
5057}
5058
5059static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5060                                u32 seq, int flags,
5061                                struct cfg80211_registered_device *rdev,
5062                                struct net_device *dev,
5063                                const u8 *mac_addr, struct station_info *sinfo)
5064{
5065        void *hdr;
5066        struct nlattr *sinfoattr, *bss_param;
5067
5068        hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5069        if (!hdr) {
5070                cfg80211_sinfo_release_content(sinfo);
5071                return -1;
5072        }
5073
5074        if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5075            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5076            nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5077                goto nla_put_failure;
5078
5079        sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5080        if (!sinfoattr)
5081                goto nla_put_failure;
5082
5083#define PUT_SINFO(attr, memb, type) do {                                \
5084        BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5085        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5086            nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5087                             sinfo->memb))                              \
5088                goto nla_put_failure;                                   \
5089        } while (0)
5090#define PUT_SINFO_U64(attr, memb) do {                                  \
5091        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5092            nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5093                              sinfo->memb, NL80211_STA_INFO_PAD))       \
5094                goto nla_put_failure;                                   \
5095        } while (0)
5096
5097        PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5098        PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5099        PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5100
5101        if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5102                             BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5103            nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5104                        (u32)sinfo->rx_bytes))
5105                goto nla_put_failure;
5106
5107        if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5108                             BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5109            nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5110                        (u32)sinfo->tx_bytes))
5111                goto nla_put_failure;
5112
5113        PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5114        PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5115        PUT_SINFO(LLID, llid, u16);
5116        PUT_SINFO(PLID, plid, u16);
5117        PUT_SINFO(PLINK_STATE, plink_state, u8);
5118        PUT_SINFO_U64(RX_DURATION, rx_duration);
5119        PUT_SINFO_U64(TX_DURATION, tx_duration);
5120
5121        if (wiphy_ext_feature_isset(&rdev->wiphy,
5122                                    NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5123                PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5124
5125        switch (rdev->wiphy.signal_type) {
5126        case CFG80211_SIGNAL_TYPE_MBM:
5127                PUT_SINFO(SIGNAL, signal, u8);
5128                PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5129                break;
5130        default:
5131                break;
5132        }
5133        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5134                if (!nl80211_put_signal(msg, sinfo->chains,
5135                                        sinfo->chain_signal,
5136                                        NL80211_STA_INFO_CHAIN_SIGNAL))
5137                        goto nla_put_failure;
5138        }
5139        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5140                if (!nl80211_put_signal(msg, sinfo->chains,
5141                                        sinfo->chain_signal_avg,
5142                                        NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5143                        goto nla_put_failure;
5144        }
5145        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5146                if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5147                                          NL80211_STA_INFO_TX_BITRATE))
5148                        goto nla_put_failure;
5149        }
5150        if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5151                if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5152                                          NL80211_STA_INFO_RX_BITRATE))
5153                        goto nla_put_failure;
5154        }
5155
5156        PUT_SINFO(RX_PACKETS, rx_packets, u32);
5157        PUT_SINFO(TX_PACKETS, tx_packets, u32);