net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 /* policy for the attributes */
 204 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 205         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 206         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 207                                       .len = 20-1 },
 208         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 209
 210         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 211         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 213         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 214         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 215
 216         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 217         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 218         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 221         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 222
 223         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 224         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 225         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 226
 227         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 228         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 229
 230         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 231         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 232                                     .len = WLAN_MAX_KEY_LEN },
 233         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 234         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 235         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 236         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 237         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 238
 239         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 240         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 241         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 244                                        .len = IEEE80211_MAX_DATA_LEN },
 245         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 247         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 248         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 249                                                .len = NL80211_MAX_SUPP_RATES },
 250         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 251         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 252         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 253         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 254                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 255         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 256
 257         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 258         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 259
 260         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 262         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 263         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 264                                            .len = NL80211_MAX_SUPP_RATES },
 265         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 266
 267         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 268         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 269
 270         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 271
 272         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 274                               .len = IEEE80211_MAX_DATA_LEN },
 275         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 277
 278         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 279                                 .len = IEEE80211_MAX_SSID_LEN },
 280         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 281         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 282         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 283         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 284         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 285         [NL80211_ATTR_STA_FLAGS2] = {
 286                 .len = sizeof(struct nl80211_sta_flag_update),
 287         },
 288         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 295         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 296         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 297         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 298         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 299         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 300         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 301         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 302                                  .len = IEEE80211_MAX_DATA_LEN },
 303         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 304         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 305         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 306         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 307         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 308         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 309         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 310         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 311         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 312         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 313         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 316         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 317         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 318         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 321         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 322         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 323                                          .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 325                                          .len = IEEE80211_MAX_DATA_LEN },
 326         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 329         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 330         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 331         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 332         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 334         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 337                                       .len = IEEE80211_MAX_DATA_LEN },
 338         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 341                 .len = NL80211_HT_CAPABILITY_LEN
 342         },
 343         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 344         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 345         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 346         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 347         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 348         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 349         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 350         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 351         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 352         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 353         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 354         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 355         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 356         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 357         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 359         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 360         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 361                 .len = NL80211_VHT_CAPABILITY_LEN,
 362         },
 363         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 365                                   .len = IEEE80211_MAX_DATA_LEN },
 366         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 367         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 368         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 369         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 370         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 372         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 373         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 374         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 376         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 377         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 378         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 380                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 381         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 382         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 383         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 384         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 385         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 387         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 388         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 389         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 390         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 391         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 392         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 394         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 395         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 397         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 398         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 400                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 401         },
 402         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 403         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 404         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 405         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 407                                     .len = FILS_MAX_KEK_LEN },
 408         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 409         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 410         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 411         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 412         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 413                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 414         },
 415         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 416         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 417                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 418         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 419                                           .len = FILS_ERP_MAX_REALM_LEN },
 420         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 421         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 422                                         .len = FILS_ERP_MAX_RRK_LEN },
 423         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 424         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 425         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 426         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 427 };
 428
 429 /* policy for the key attributes */
 430 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 431         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 432         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 433         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 434         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 435         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 436         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 437         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 438         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 439 };
 440
 441 /* policy for the key default flags */
 442 static const struct nla_policy
 443 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 444         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 445         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 446 };
 447
 448 #ifdef CONFIG_PM
 449 /* policy for WoWLAN attributes */
 450 static const struct nla_policy
 451 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 452         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 453         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 454         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 455         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 456         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 457         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 458         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 459         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 460         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 461         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 462 };
 463
 464 static const struct nla_policy
 465 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 466         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 467         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 468         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 469         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 470         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 471         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 472         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 473                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 474         },
 475         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 476                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 477         },
 478         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 479         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 480         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 481 };
 482 #endif /* CONFIG_PM */
 483
 484 /* policy for coalesce rule attributes */
 485 static const struct nla_policy
 486 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 487         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 488         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 489         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 490 };
 491
 492 /* policy for GTK rekey offload attributes */
 493 static const struct nla_policy
 494 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 495         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 496         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 497         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 498 };
 499
 500 static const struct nla_policy
 501 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 502         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 503                                                  .len = IEEE80211_MAX_SSID_LEN },
 504         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 505         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 506 };
 507
 508 static const struct nla_policy
 509 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 510         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 511         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 512 };
 513
 514 static const struct nla_policy
 515 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 516         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 517         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 518         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 519                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 520         },
 521 };
 522
 523 /* policy for NAN function attributes */
 524 static const struct nla_policy
 525 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 526         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 527         [NL80211_NAN_FUNC_SERVICE_ID] = {
 528                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 529         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 530         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 531         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 532         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 533         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 534         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 535         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 536         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 537         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 538                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 539         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 540         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 541         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 542         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 543         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 544 };
 545
 546 /* policy for Service Response Filter attributes */
 547 static const struct nla_policy
 548 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 549         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 550         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 551                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 552         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 553         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 554 };
 555
 556 /* policy for packet pattern attributes */
 557 static const struct nla_policy
 558 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 559         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 560         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 561         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 562 };
 563
 564 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 565                                      struct netlink_callback *cb,
 566                                      struct cfg80211_registered_device **rdev,
 567                                      struct wireless_dev **wdev)
 568 {
 569         int err;
 570
 571         if (!cb->args[0]) {
 572                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 573                                   genl_family_attrbuf(&nl80211_fam),
 574                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 575                 if (err)
 576                         return err;
 577
 578                 *wdev = __cfg80211_wdev_from_attrs(
 579                                         sock_net(skb->sk),
 580                                         genl_family_attrbuf(&nl80211_fam));
 581                 if (IS_ERR(*wdev))
 582                         return PTR_ERR(*wdev);
 583                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 584                 /* 0 is the first index - add 1 to parse only once */
 585                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 586                 cb->args[1] = (*wdev)->identifier;
 587         } else {
 588                 /* subtract the 1 again here */
 589                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 590                 struct wireless_dev *tmp;
 591
 592                 if (!wiphy)
 593                         return -ENODEV;
 594                 *rdev = wiphy_to_rdev(wiphy);
 595                 *wdev = NULL;
 596
 597                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 598                         if (tmp->identifier == cb->args[1]) {
 599                                 *wdev = tmp;
 600                                 break;
 601                         }
 602                 }
 603
 604                 if (!*wdev)
 605                         return -ENODEV;
 606         }
 607
 608         return 0;
 609 }
 610
 611 /* IE validation */
 612 static bool is_valid_ie_attr(const struct nlattr *attr)
 613 {
 614         const u8 *pos;
 615         int len;
 616
 617         if (!attr)
 618                 return true;
 619
 620         pos = nla_data(attr);
 621         len = nla_len(attr);
 622
 623         while (len) {
 624                 u8 elemlen;
 625
 626                 if (len < 2)
 627                         return false;
 628                 len -= 2;
 629
 630                 elemlen = pos[1];
 631                 if (elemlen > len)
 632                         return false;
 633
 634                 len -= elemlen;
 635                 pos += 2 + elemlen;
 636         }
 637
 638         return true;
 639 }
 640
 641 /* message building helper */
 642 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 643                                    int flags, u8 cmd)
 644 {
 645         /* since there is no private header just add the generic one */
 646         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 647 }
 648
 649 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 650                                      const struct ieee80211_reg_rule *rule)
 651 {
 652         int j;
 653         struct nlattr *nl_wmm_rules =
 654                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 655
 656         if (!nl_wmm_rules)
 657                 goto nla_put_failure;
 658
 659         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 660                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 661
 662                 if (!nl_wmm_rule)
 663                         goto nla_put_failure;
 664
 665                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 666                                 rule->wmm_rule->client[j].cw_min) ||
 667                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 668                                 rule->wmm_rule->client[j].cw_max) ||
 669                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 670                                rule->wmm_rule->client[j].aifsn) ||
 671                     nla_put_u8(msg, NL80211_WMMR_TXOP,
 672                                rule->wmm_rule->client[j].cot))
 673                         goto nla_put_failure;
 674
 675                 nla_nest_end(msg, nl_wmm_rule);
 676         }
 677         nla_nest_end(msg, nl_wmm_rules);
 678
 679         return 0;
 680
 681 nla_put_failure:
 682         return -ENOBUFS;
 683 }
 684
 685 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 686                                    struct ieee80211_channel *chan,
 687                                    bool large)
 688 {
 689         /* Some channels must be completely excluded from the
 690          * list to protect old user-space tools from breaking
 691          */
 692         if (!large && chan->flags &
 693             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 694                 return 0;
 695
 696         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 697                         chan->center_freq))
 698                 goto nla_put_failure;
 699
 700         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 701             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 702                 goto nla_put_failure;
 703         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 704                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 705                         goto nla_put_failure;
 706                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 707                         goto nla_put_failure;
 708         }
 709         if (chan->flags & IEEE80211_CHAN_RADAR) {
 710                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 711                         goto nla_put_failure;
 712                 if (large) {
 713                         u32 time;
 714
 715                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 716
 717                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 718                                         chan->dfs_state))
 719                                 goto nla_put_failure;
 720                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 721                                         time))
 722                                 goto nla_put_failure;
 723                         if (nla_put_u32(msg,
 724                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 725                                         chan->dfs_cac_ms))
 726                                 goto nla_put_failure;
 727                 }
 728         }
 729
 730         if (large) {
 731                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 732                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 733                         goto nla_put_failure;
 734                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 735                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 736                         goto nla_put_failure;
 737                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 738                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 739                         goto nla_put_failure;
 740                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 741                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 742                         goto nla_put_failure;
 743                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 744                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 745                         goto nla_put_failure;
 746                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 747                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 748                         goto nla_put_failure;
 749                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 750                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 751                         goto nla_put_failure;
 752                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 753                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 754                         goto nla_put_failure;
 755         }
 756
 757         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 758                         DBM_TO_MBM(chan->max_power)))
 759                 goto nla_put_failure;
 760
 761         if (large) {
 762                 const struct ieee80211_reg_rule *rule =
 763                         freq_reg_info(wiphy, chan->center_freq);
 764
 765                 if (!IS_ERR(rule) && rule->wmm_rule) {
 766                         if (nl80211_msg_put_wmm_rules(msg, rule))
 767                                 goto nla_put_failure;
 768                 }
 769         }
 770
 771         return 0;
 772
 773  nla_put_failure:
 774         return -ENOBUFS;
 775 }
 776
 777 /* netlink command implementations */
 778
 779 struct key_parse {
 780         struct key_params p;
 781         int idx;
 782         int type;
 783         bool def, defmgmt;
 784         bool def_uni, def_multi;
 785 };
 786
 787 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 788                                  struct key_parse *k)
 789 {
 790         struct nlattr *tb[NL80211_KEY_MAX + 1];
 791         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 792                                    nl80211_key_policy, info->extack);
 793         if (err)
 794                 return err;
 795
 796         k->def = !!tb[NL80211_KEY_DEFAULT];
 797         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 798
 799         if (k->def) {
 800                 k->def_uni = true;
 801                 k->def_multi = true;
 802         }
 803         if (k->defmgmt)
 804                 k->def_multi = true;
 805
 806         if (tb[NL80211_KEY_IDX])
 807                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 808
 809         if (tb[NL80211_KEY_DATA]) {
 810                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 811                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 812         }
 813
 814         if (tb[NL80211_KEY_SEQ]) {
 815                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 816                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 817         }
 818
 819         if (tb[NL80211_KEY_CIPHER])
 820                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 821
 822         if (tb[NL80211_KEY_TYPE]) {
 823                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 824                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 825                         return genl_err_attr(info, -EINVAL,
 826                                              tb[NL80211_KEY_TYPE]);
 827         }
 828
 829         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 830                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 831
 832                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 833                                        tb[NL80211_KEY_DEFAULT_TYPES],
 834                                        nl80211_key_default_policy,
 835                                        info->extack);
 836                 if (err)
 837                         return err;
 838
 839                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 840                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 841         }
 842
 843         return 0;
 844 }
 845
 846 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 847 {
 848         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 849                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 850                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 851         }
 852
 853         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 854                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 855                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 856         }
 857
 858         if (info->attrs[NL80211_ATTR_KEY_IDX])
 859                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 860
 861         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 862                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 863
 864         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 865         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 866
 867         if (k->def) {
 868                 k->def_uni = true;
 869                 k->def_multi = true;
 870         }
 871         if (k->defmgmt)
 872                 k->def_multi = true;
 873
 874         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 875                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 876                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
 877                         GENL_SET_ERR_MSG(info, "key type out of range");
 878                         return -EINVAL;
 879                 }
 880         }
 881
 882         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 883                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 884                 int err = nla_parse_nested(kdt,
 885                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 886                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 887                                            nl80211_key_default_policy,
 888                                            info->extack);
 889                 if (err)
 890                         return err;
 891
 892                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 893                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 894         }
 895
 896         return 0;
 897 }
 898
 899 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 900 {
 901         int err;
 902
 903         memset(k, 0, sizeof(*k));
 904         k->idx = -1;
 905         k->type = -1;
 906
 907         if (info->attrs[NL80211_ATTR_KEY])
 908                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 909         else
 910                 err = nl80211_parse_key_old(info, k);
 911
 912         if (err)
 913                 return err;
 914
 915         if (k->def && k->defmgmt) {
 916                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 917                 return -EINVAL;
 918         }
 919
 920         if (k->defmgmt) {
 921                 if (k->def_uni || !k->def_multi) {
 922                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 923                         return -EINVAL;
 924                 }
 925         }
 926
 927         if (k->idx != -1) {
 928                 if (k->defmgmt) {
 929                         if (k->idx < 4 || k->idx > 5) {
 930                                 GENL_SET_ERR_MSG(info,
 931                                                  "defmgmt key idx not 4 or 5");
 932                                 return -EINVAL;
 933                         }
 934                 } else if (k->def) {
 935                         if (k->idx < 0 || k->idx > 3) {
 936                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
 937                                 return -EINVAL;
 938                         }
 939                 } else {
 940                         if (k->idx < 0 || k->idx > 5) {
 941                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
 942                                 return -EINVAL;
 943                         }
 944                 }
 945         }
 946
 947         return 0;
 948 }
 949
 950 static struct cfg80211_cached_keys *
 951 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 952                        struct genl_info *info, bool *no_ht)
 953 {
 954         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
 955         struct key_parse parse;
 956         struct nlattr *key;
 957         struct cfg80211_cached_keys *result;
 958         int rem, err, def = 0;
 959         bool have_key = false;
 960
 961         nla_for_each_nested(key, keys, rem) {
 962                 have_key = true;
 963                 break;
 964         }
 965
 966         if (!have_key)
 967                 return NULL;
 968
 969         result = kzalloc(sizeof(*result), GFP_KERNEL);
 970         if (!result)
 971                 return ERR_PTR(-ENOMEM);
 972
 973         result->def = -1;
 974
 975         nla_for_each_nested(key, keys, rem) {
 976                 memset(&parse, 0, sizeof(parse));
 977                 parse.idx = -1;
 978
 979                 err = nl80211_parse_key_new(info, key, &parse);
 980                 if (err)
 981                         goto error;
 982                 err = -EINVAL;
 983                 if (!parse.p.key)
 984                         goto error;
 985                 if (parse.idx < 0 || parse.idx > 3) {
 986                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
 987                         goto error;
 988                 }
 989                 if (parse.def) {
 990                         if (def) {
 991                                 GENL_SET_ERR_MSG(info,
 992                                                  "only one key can be default");
 993                                 goto error;
 994                         }
 995                         def = 1;
 996                         result->def = parse.idx;
 997                         if (!parse.def_uni || !parse.def_multi)
 998                                 goto error;
 999                 } else if (parse.defmgmt)
1000                         goto error;
1001                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1002                                                      parse.idx, false, NULL);
1003                 if (err)
1004                         goto error;
1005                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1006                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1007                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1008                         err = -EINVAL;
1009                         goto error;
1010                 }
1011                 result->params[parse.idx].cipher = parse.p.cipher;
1012                 result->params[parse.idx].key_len = parse.p.key_len;
1013                 result->params[parse.idx].key = result->data[parse.idx];
1014                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1015
1016                 /* must be WEP key if we got here */
1017                 if (no_ht)
1018                         *no_ht = true;
1019         }
1020
1021         if (result->def < 0) {
1022                 err = -EINVAL;
1023                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1024                 goto error;
1025         }
1026
1027         return result;
1028  error:
1029         kfree(result);
1030         return ERR_PTR(err);
1031 }
1032
1033 static int nl80211_key_allowed(struct wireless_dev *wdev)
1034 {
1035         ASSERT_WDEV_LOCK(wdev);
1036
1037         switch (wdev->iftype) {
1038         case NL80211_IFTYPE_AP:
1039         case NL80211_IFTYPE_AP_VLAN:
1040         case NL80211_IFTYPE_P2P_GO:
1041         case NL80211_IFTYPE_MESH_POINT:
1042                 break;
1043         case NL80211_IFTYPE_ADHOC:
1044         case NL80211_IFTYPE_STATION:
1045         case NL80211_IFTYPE_P2P_CLIENT:
1046                 if (!wdev->current_bss)
1047                         return -ENOLINK;
1048                 break;
1049         case NL80211_IFTYPE_UNSPECIFIED:
1050         case NL80211_IFTYPE_OCB:
1051         case NL80211_IFTYPE_MONITOR:
1052         case NL80211_IFTYPE_NAN:
1053         case NL80211_IFTYPE_P2P_DEVICE:
1054         case NL80211_IFTYPE_WDS:
1055         case NUM_NL80211_IFTYPES:
1056                 return -EINVAL;
1057         }
1058
1059         return 0;
1060 }
1061
1062 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1063                                                         struct nlattr *tb)
1064 {
1065         struct ieee80211_channel *chan;
1066
1067         if (tb == NULL)
1068                 return NULL;
1069         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1070         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1071                 return NULL;
1072         return chan;
1073 }
1074
1075 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1076 {
1077         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1078         int i;
1079
1080         if (!nl_modes)
1081                 goto nla_put_failure;
1082
1083         i = 0;
1084         while (ifmodes) {
1085                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1086                         goto nla_put_failure;
1087                 ifmodes >>= 1;
1088                 i++;
1089         }
1090
1091         nla_nest_end(msg, nl_modes);
1092         return 0;
1093
1094 nla_put_failure:
1095         return -ENOBUFS;
1096 }
1097
1098 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1099                                           struct sk_buff *msg,
1100                                           bool large)
1101 {
1102         struct nlattr *nl_combis;
1103         int i, j;
1104
1105         nl_combis = nla_nest_start(msg,
1106                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1107         if (!nl_combis)
1108                 goto nla_put_failure;
1109
1110         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1111                 const struct ieee80211_iface_combination *c;
1112                 struct nlattr *nl_combi, *nl_limits;
1113
1114                 c = &wiphy->iface_combinations[i];
1115
1116                 nl_combi = nla_nest_start(msg, i + 1);
1117                 if (!nl_combi)
1118                         goto nla_put_failure;
1119
1120                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1121                 if (!nl_limits)
1122                         goto nla_put_failure;
1123
1124                 for (j = 0; j < c->n_limits; j++) {
1125                         struct nlattr *nl_limit;
1126
1127                         nl_limit = nla_nest_start(msg, j + 1);
1128                         if (!nl_limit)
1129                                 goto nla_put_failure;
1130                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1131                                         c->limits[j].max))
1132                                 goto nla_put_failure;
1133                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1134                                                 c->limits[j].types))
1135                                 goto nla_put_failure;
1136                         nla_nest_end(msg, nl_limit);
1137                 }
1138
1139                 nla_nest_end(msg, nl_limits);
1140
1141                 if (c->beacon_int_infra_match &&
1142                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1143                         goto nla_put_failure;
1144                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1145                                 c->num_different_channels) ||
1146                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1147                                 c->max_interfaces))
1148                         goto nla_put_failure;
1149                 if (large &&
1150                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1151                                 c->radar_detect_widths) ||
1152                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1153                                 c->radar_detect_regions)))
1154                         goto nla_put_failure;
1155                 if (c->beacon_int_min_gcd &&
1156                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1157                                 c->beacon_int_min_gcd))
1158                         goto nla_put_failure;
1159
1160                 nla_nest_end(msg, nl_combi);
1161         }
1162
1163         nla_nest_end(msg, nl_combis);
1164
1165         return 0;
1166 nla_put_failure:
1167         return -ENOBUFS;
1168 }
1169
1170 #ifdef CONFIG_PM
1171 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1172                                         struct sk_buff *msg)
1173 {
1174         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1175         struct nlattr *nl_tcp;
1176
1177         if (!tcp)
1178                 return 0;
1179
1180         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1181         if (!nl_tcp)
1182                 return -ENOBUFS;
1183
1184         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1185                         tcp->data_payload_max))
1186                 return -ENOBUFS;
1187
1188         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1189                         tcp->data_payload_max))
1190                 return -ENOBUFS;
1191
1192         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1193                 return -ENOBUFS;
1194
1195         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1196                                 sizeof(*tcp->tok), tcp->tok))
1197                 return -ENOBUFS;
1198
1199         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1200                         tcp->data_interval_max))
1201                 return -ENOBUFS;
1202
1203         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1204                         tcp->wake_payload_max))
1205                 return -ENOBUFS;
1206
1207         nla_nest_end(msg, nl_tcp);
1208         return 0;
1209 }
1210
1211 static int nl80211_send_wowlan(struct sk_buff *msg,
1212                                struct cfg80211_registered_device *rdev,
1213                                bool large)
1214 {
1215         struct nlattr *nl_wowlan;
1216
1217         if (!rdev->wiphy.wowlan)
1218                 return 0;
1219
1220         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1221         if (!nl_wowlan)
1222                 return -ENOBUFS;
1223
1224         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1225              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1226             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1227              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1228             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1229              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1230             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1231              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1232             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1233              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1234             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1235              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1236             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1237              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1238             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1239              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1240                 return -ENOBUFS;
1241
1242         if (rdev->wiphy.wowlan->n_patterns) {
1243                 struct nl80211_pattern_support pat = {
1244                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1245                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1246                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1247                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1248                 };
1249
1250                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1251                             sizeof(pat), &pat))
1252                         return -ENOBUFS;
1253         }
1254
1255         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1256             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1257                         rdev->wiphy.wowlan->max_nd_match_sets))
1258                 return -ENOBUFS;
1259
1260         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1261                 return -ENOBUFS;
1262
1263         nla_nest_end(msg, nl_wowlan);
1264
1265         return 0;
1266 }
1267 #endif
1268
1269 static int nl80211_send_coalesce(struct sk_buff *msg,
1270                                  struct cfg80211_registered_device *rdev)
1271 {
1272         struct nl80211_coalesce_rule_support rule;
1273
1274         if (!rdev->wiphy.coalesce)
1275                 return 0;
1276
1277         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1278         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1279         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1280         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1281         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1282         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1283
1284         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1285                 return -ENOBUFS;
1286
1287         return 0;
1288 }
1289
1290 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1291                                       struct ieee80211_supported_band *sband)
1292 {
1293         struct nlattr *nl_rates, *nl_rate;
1294         struct ieee80211_rate *rate;
1295         int i;
1296
1297         /* add HT info */
1298         if (sband->ht_cap.ht_supported &&
1299             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1300                      sizeof(sband->ht_cap.mcs),
1301                      &sband->ht_cap.mcs) ||
1302              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1303                          sband->ht_cap.cap) ||
1304              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1305                         sband->ht_cap.ampdu_factor) ||
1306              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1307                         sband->ht_cap.ampdu_density)))
1308                 return -ENOBUFS;
1309
1310         /* add VHT info */
1311         if (sband->vht_cap.vht_supported &&
1312             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1313                      sizeof(sband->vht_cap.vht_mcs),
1314                      &sband->vht_cap.vht_mcs) ||
1315              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1316                          sband->vht_cap.cap)))
1317                 return -ENOBUFS;
1318
1319         /* add bitrates */
1320         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1321         if (!nl_rates)
1322                 return -ENOBUFS;
1323
1324         for (i = 0; i < sband->n_bitrates; i++) {
1325                 nl_rate = nla_nest_start(msg, i);
1326                 if (!nl_rate)
1327                         return -ENOBUFS;
1328
1329                 rate = &sband->bitrates[i];
1330                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1331                                 rate->bitrate))
1332                         return -ENOBUFS;
1333                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1334                     nla_put_flag(msg,
1335                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1336                         return -ENOBUFS;
1337
1338                 nla_nest_end(msg, nl_rate);
1339         }
1340
1341         nla_nest_end(msg, nl_rates);
1342
1343         return 0;
1344 }
1345
1346 static int
1347 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1348                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1349 {
1350         u16 stypes;
1351         struct nlattr *nl_ftypes, *nl_ifs;
1352         enum nl80211_iftype ift;
1353         int i;
1354
1355         if (!mgmt_stypes)
1356                 return 0;
1357
1358         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1359         if (!nl_ifs)
1360                 return -ENOBUFS;
1361
1362         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1363                 nl_ftypes = nla_nest_start(msg, ift);
1364                 if (!nl_ftypes)
1365                         return -ENOBUFS;
1366                 i = 0;
1367                 stypes = mgmt_stypes[ift].tx;
1368                 while (stypes) {
1369                         if ((stypes & 1) &&
1370                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1371                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1372                                 return -ENOBUFS;
1373                         stypes >>= 1;
1374                         i++;
1375                 }
1376                 nla_nest_end(msg, nl_ftypes);
1377         }
1378
1379         nla_nest_end(msg, nl_ifs);
1380
1381         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1382         if (!nl_ifs)
1383                 return -ENOBUFS;
1384
1385         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1386                 nl_ftypes = nla_nest_start(msg, ift);
1387                 if (!nl_ftypes)
1388                         return -ENOBUFS;
1389                 i = 0;
1390                 stypes = mgmt_stypes[ift].rx;
1391                 while (stypes) {
1392                         if ((stypes & 1) &&
1393                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1394                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1395                                 return -ENOBUFS;
1396                         stypes >>= 1;
1397                         i++;
1398                 }
1399                 nla_nest_end(msg, nl_ftypes);
1400         }
1401         nla_nest_end(msg, nl_ifs);
1402
1403         return 0;
1404 }
1405
1406 #define CMD(op, n)                                                      \
1407          do {                                                           \
1408                 if (rdev->ops->op) {                                    \
1409                         i++;                                            \
1410                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1411                                 goto nla_put_failure;                   \
1412                 }                                                       \
1413         } while (0)
1414
1415 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1416                                         struct sk_buff *msg)
1417 {
1418         int i = 0;
1419
1420         /*
1421          * do *NOT* add anything into this function, new things need to be
1422          * advertised only to new versions of userspace that can deal with
1423          * the split (and they can't possibly care about new features...
1424          */
1425         CMD(add_virtual_intf, NEW_INTERFACE);
1426         CMD(change_virtual_intf, SET_INTERFACE);
1427         CMD(add_key, NEW_KEY);
1428         CMD(start_ap, START_AP);
1429         CMD(add_station, NEW_STATION);
1430         CMD(add_mpath, NEW_MPATH);
1431         CMD(update_mesh_config, SET_MESH_CONFIG);
1432         CMD(change_bss, SET_BSS);
1433         CMD(auth, AUTHENTICATE);
1434         CMD(assoc, ASSOCIATE);
1435         CMD(deauth, DEAUTHENTICATE);
1436         CMD(disassoc, DISASSOCIATE);
1437         CMD(join_ibss, JOIN_IBSS);
1438         CMD(join_mesh, JOIN_MESH);
1439         CMD(set_pmksa, SET_PMKSA);
1440         CMD(del_pmksa, DEL_PMKSA);
1441         CMD(flush_pmksa, FLUSH_PMKSA);
1442         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1443                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1444         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1445         CMD(mgmt_tx, FRAME);
1446         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1447         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1448                 i++;
1449                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1450                         goto nla_put_failure;
1451         }
1452         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1453             rdev->ops->join_mesh) {
1454                 i++;
1455                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1456                         goto nla_put_failure;
1457         }
1458         CMD(set_wds_peer, SET_WDS_PEER);
1459         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1460                 CMD(tdls_mgmt, TDLS_MGMT);
1461                 CMD(tdls_oper, TDLS_OPER);
1462         }
1463         if (rdev->wiphy.max_sched_scan_reqs)
1464                 CMD(sched_scan_start, START_SCHED_SCAN);
1465         CMD(probe_client, PROBE_CLIENT);
1466         CMD(set_noack_map, SET_NOACK_MAP);
1467         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1468                 i++;
1469                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1470                         goto nla_put_failure;
1471         }
1472         CMD(start_p2p_device, START_P2P_DEVICE);
1473         CMD(set_mcast_rate, SET_MCAST_RATE);
1474 #ifdef CONFIG_NL80211_TESTMODE
1475         CMD(testmode_cmd, TESTMODE);
1476 #endif
1477
1478         if (rdev->ops->connect || rdev->ops->auth) {
1479                 i++;
1480                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1481                         goto nla_put_failure;
1482         }
1483
1484         if (rdev->ops->disconnect || rdev->ops->deauth) {
1485                 i++;
1486                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1487                         goto nla_put_failure;
1488         }
1489
1490         return i;
1491  nla_put_failure:
1492         return -ENOBUFS;
1493 }
1494
1495 struct nl80211_dump_wiphy_state {
1496         s64 filter_wiphy;
1497         long start;
1498         long split_start, band_start, chan_start, capa_start;
1499         bool split;
1500 };
1501
1502 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1503                               enum nl80211_commands cmd,
1504                               struct sk_buff *msg, u32 portid, u32 seq,
1505                               int flags, struct nl80211_dump_wiphy_state *state)
1506 {
1507         void *hdr;
1508         struct nlattr *nl_bands, *nl_band;
1509         struct nlattr *nl_freqs, *nl_freq;
1510         struct nlattr *nl_cmds;
1511         enum nl80211_band band;
1512         struct ieee80211_channel *chan;
1513         int i;
1514         const struct ieee80211_txrx_stypes *mgmt_stypes =
1515                                 rdev->wiphy.mgmt_stypes;
1516         u32 features;
1517
1518         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1519         if (!hdr)
1520                 return -ENOBUFS;
1521
1522         if (WARN_ON(!state))
1523                 return -EINVAL;
1524
1525         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1526             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1527                            wiphy_name(&rdev->wiphy)) ||
1528             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1529                         cfg80211_rdev_list_generation))
1530                 goto nla_put_failure;
1531
1532         if (cmd != NL80211_CMD_NEW_WIPHY)
1533                 goto finish;
1534
1535         switch (state->split_start) {
1536         case 0:
1537                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1538                                rdev->wiphy.retry_short) ||
1539                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1540                                rdev->wiphy.retry_long) ||
1541                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1542                                 rdev->wiphy.frag_threshold) ||
1543                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1544                                 rdev->wiphy.rts_threshold) ||
1545                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1546                                rdev->wiphy.coverage_class) ||
1547                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1548                                rdev->wiphy.max_scan_ssids) ||
1549                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1550                                rdev->wiphy.max_sched_scan_ssids) ||
1551                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1552                                 rdev->wiphy.max_scan_ie_len) ||
1553                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1554                                 rdev->wiphy.max_sched_scan_ie_len) ||
1555                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1556                                rdev->wiphy.max_match_sets) ||
1557                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1558                                 rdev->wiphy.max_sched_scan_plans) ||
1559                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1560                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1561                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1562                                 rdev->wiphy.max_sched_scan_plan_iterations))
1563                         goto nla_put_failure;
1564
1565                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1566                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1567                         goto nla_put_failure;
1568                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1569                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1570                         goto nla_put_failure;
1571                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1572                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1573                         goto nla_put_failure;
1574                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1575                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1576                         goto nla_put_failure;
1577                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1578                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1579                         goto nla_put_failure;
1580                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1581                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1582                         goto nla_put_failure;
1583                 state->split_start++;
1584                 if (state->split)
1585                         break;
1586         case 1:
1587                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1588                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1589                             rdev->wiphy.cipher_suites))
1590                         goto nla_put_failure;
1591
1592                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1593                                rdev->wiphy.max_num_pmkids))
1594                         goto nla_put_failure;
1595
1596                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1597                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1598                         goto nla_put_failure;
1599
1600                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1601                                 rdev->wiphy.available_antennas_tx) ||
1602                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1603                                 rdev->wiphy.available_antennas_rx))
1604                         goto nla_put_failure;
1605
1606                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1607                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1608                                 rdev->wiphy.probe_resp_offload))
1609                         goto nla_put_failure;
1610
1611                 if ((rdev->wiphy.available_antennas_tx ||
1612                      rdev->wiphy.available_antennas_rx) &&
1613                     rdev->ops->get_antenna) {
1614                         u32 tx_ant = 0, rx_ant = 0;
1615                         int res;
1616
1617                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1618                         if (!res) {
1619                                 if (nla_put_u32(msg,
1620                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1621                                                 tx_ant) ||
1622                                     nla_put_u32(msg,
1623                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1624                                                 rx_ant))
1625                                         goto nla_put_failure;
1626                         }
1627                 }
1628
1629                 state->split_start++;
1630                 if (state->split)
1631                         break;
1632         case 2:
1633                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1634                                         rdev->wiphy.interface_modes))
1635                                 goto nla_put_failure;
1636                 state->split_start++;
1637                 if (state->split)
1638                         break;
1639         case 3:
1640                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1641                 if (!nl_bands)
1642                         goto nla_put_failure;
1643
1644                 for (band = state->band_start;
1645                      band < NUM_NL80211_BANDS; band++) {
1646                         struct ieee80211_supported_band *sband;
1647
1648                         sband = rdev->wiphy.bands[band];
1649
1650                         if (!sband)
1651                                 continue;
1652
1653                         nl_band = nla_nest_start(msg, band);
1654                         if (!nl_band)
1655                                 goto nla_put_failure;
1656
1657                         switch (state->chan_start) {
1658                         case 0:
1659                                 if (nl80211_send_band_rateinfo(msg, sband))
1660                                         goto nla_put_failure;
1661                                 state->chan_start++;
1662                                 if (state->split)
1663                                         break;
1664                         default:
1665                                 /* add frequencies */
1666                                 nl_freqs = nla_nest_start(
1667                                         msg, NL80211_BAND_ATTR_FREQS);
1668                                 if (!nl_freqs)
1669                                         goto nla_put_failure;
1670
1671                                 for (i = state->chan_start - 1;
1672                                      i < sband->n_channels;
1673                                      i++) {
1674                                         nl_freq = nla_nest_start(msg, i);
1675                                         if (!nl_freq)
1676                                                 goto nla_put_failure;
1677
1678                                         chan = &sband->channels[i];
1679
1680                                         if (nl80211_msg_put_channel(
1681                                                         msg, &rdev->wiphy, chan,
1682                                                         state->split))
1683                                                 goto nla_put_failure;
1684
1685                                         nla_nest_end(msg, nl_freq);
1686                                         if (state->split)
1687                                                 break;
1688                                 }
1689                                 if (i < sband->n_channels)
1690                                         state->chan_start = i + 2;
1691                                 else
1692                                         state->chan_start = 0;
1693                                 nla_nest_end(msg, nl_freqs);
1694                         }
1695
1696                         nla_nest_end(msg, nl_band);
1697
1698                         if (state->split) {
1699                                 /* start again here */
1700                                 if (state->chan_start)
1701                                         band--;
1702                                 break;
1703                         }
1704                 }
1705                 nla_nest_end(msg, nl_bands);
1706
1707                 if (band < NUM_NL80211_BANDS)
1708                         state->band_start = band + 1;
1709                 else
1710                         state->band_start = 0;
1711
1712                 /* if bands & channels are done, continue outside */
1713                 if (state->band_start == 0 && state->chan_start == 0)
1714                         state->split_start++;
1715                 if (state->split)
1716                         break;
1717         case 4:
1718                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1719                 if (!nl_cmds)
1720                         goto nla_put_failure;
1721
1722                 i = nl80211_add_commands_unsplit(rdev, msg);
1723                 if (i < 0)
1724                         goto nla_put_failure;
1725                 if (state->split) {
1726                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1727                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1728                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1729                                 CMD(channel_switch, CHANNEL_SWITCH);
1730                         CMD(set_qos_map, SET_QOS_MAP);
1731                         if (rdev->wiphy.features &
1732                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1733                                 CMD(add_tx_ts, ADD_TX_TS);
1734                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1735                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1736                 }
1737 #undef CMD
1738
1739                 nla_nest_end(msg, nl_cmds);
1740                 state->split_start++;
1741                 if (state->split)
1742                         break;
1743         case 5:
1744                 if (rdev->ops->remain_on_channel &&
1745                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1746                     nla_put_u32(msg,
1747                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1748                                 rdev->wiphy.max_remain_on_channel_duration))
1749                         goto nla_put_failure;
1750
1751                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1752                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1753                         goto nla_put_failure;
1754
1755                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1756                         goto nla_put_failure;
1757                 state->split_start++;
1758                 if (state->split)
1759                         break;
1760         case 6:
1761 #ifdef CONFIG_PM
1762                 if (nl80211_send_wowlan(msg, rdev, state->split))
1763                         goto nla_put_failure;
1764                 state->split_start++;
1765                 if (state->split)
1766                         break;
1767 #else
1768                 state->split_start++;
1769 #endif
1770         case 7:
1771                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1772                                         rdev->wiphy.software_iftypes))
1773                         goto nla_put_failure;
1774
1775                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1776                                                    state->split))
1777                         goto nla_put_failure;
1778
1779                 state->split_start++;
1780                 if (state->split)
1781                         break;
1782         case 8:
1783                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1784                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1785                                 rdev->wiphy.ap_sme_capa))
1786                         goto nla_put_failure;
1787
1788                 features = rdev->wiphy.features;
1789                 /*
1790                  * We can only add the per-channel limit information if the
1791                  * dump is split, otherwise it makes it too big. Therefore
1792                  * only advertise it in that case.
1793                  */
1794                 if (state->split)
1795                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1796                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1797                         goto nla_put_failure;
1798
1799                 if (rdev->wiphy.ht_capa_mod_mask &&
1800                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1801                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1802                             rdev->wiphy.ht_capa_mod_mask))
1803                         goto nla_put_failure;
1804
1805                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1806                     rdev->wiphy.max_acl_mac_addrs &&
1807                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1808                                 rdev->wiphy.max_acl_mac_addrs))
1809                         goto nla_put_failure;
1810
1811                 /*
1812                  * Any information below this point is only available to
1813                  * applications that can deal with it being split. This
1814                  * helps ensure that newly added capabilities don't break
1815                  * older tools by overrunning their buffers.
1816                  *
1817                  * We still increment split_start so that in the split
1818                  * case we'll continue with more data in the next round,
1819                  * but break unconditionally so unsplit data stops here.
1820                  */
1821                 state->split_start++;
1822                 break;
1823         case 9:
1824                 if (rdev->wiphy.extended_capabilities &&
1825                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1826                              rdev->wiphy.extended_capabilities_len,
1827                              rdev->wiphy.extended_capabilities) ||
1828                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1829                              rdev->wiphy.extended_capabilities_len,
1830                              rdev->wiphy.extended_capabilities_mask)))
1831                         goto nla_put_failure;
1832
1833                 if (rdev->wiphy.vht_capa_mod_mask &&
1834                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1835                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1836                             rdev->wiphy.vht_capa_mod_mask))
1837                         goto nla_put_failure;
1838
1839                 state->split_start++;
1840                 break;
1841         case 10:
1842                 if (nl80211_send_coalesce(msg, rdev))
1843                         goto nla_put_failure;
1844
1845                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1846                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1847                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1848                         goto nla_put_failure;
1849
1850                 if (rdev->wiphy.max_ap_assoc_sta &&
1851                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1852                                 rdev->wiphy.max_ap_assoc_sta))
1853                         goto nla_put_failure;
1854
1855                 state->split_start++;
1856                 break;
1857         case 11:
1858                 if (rdev->wiphy.n_vendor_commands) {
1859                         const struct nl80211_vendor_cmd_info *info;
1860                         struct nlattr *nested;
1861
1862                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1863                         if (!nested)
1864                                 goto nla_put_failure;
1865
1866                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1867                                 info = &rdev->wiphy.vendor_commands[i].info;
1868                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1869                                         goto nla_put_failure;
1870                         }
1871                         nla_nest_end(msg, nested);
1872                 }
1873
1874                 if (rdev->wiphy.n_vendor_events) {
1875                         const struct nl80211_vendor_cmd_info *info;
1876                         struct nlattr *nested;
1877
1878                         nested = nla_nest_start(msg,
1879                                                 NL80211_ATTR_VENDOR_EVENTS);
1880                         if (!nested)
1881                                 goto nla_put_failure;
1882
1883                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1884                                 info = &rdev->wiphy.vendor_events[i];
1885                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1886                                         goto nla_put_failure;
1887                         }
1888                         nla_nest_end(msg, nested);
1889                 }
1890                 state->split_start++;
1891                 break;
1892         case 12:
1893                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1894                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1895                                rdev->wiphy.max_num_csa_counters))
1896                         goto nla_put_failure;
1897
1898                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1899                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1900                         goto nla_put_failure;
1901
1902                 if (rdev->wiphy.max_sched_scan_reqs &&
1903                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1904                                 rdev->wiphy.max_sched_scan_reqs))
1905                         goto nla_put_failure;
1906
1907                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1908                             sizeof(rdev->wiphy.ext_features),
1909                             rdev->wiphy.ext_features))
1910                         goto nla_put_failure;
1911
1912                 if (rdev->wiphy.bss_select_support) {
1913                         struct nlattr *nested;
1914                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1915
1916                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1917                         if (!nested)
1918                                 goto nla_put_failure;
1919
1920                         i = 0;
1921                         while (bss_select_support) {
1922                                 if ((bss_select_support & 1) &&
1923                                     nla_put_flag(msg, i))
1924                                         goto nla_put_failure;
1925                                 i++;
1926                                 bss_select_support >>= 1;
1927                         }
1928                         nla_nest_end(msg, nested);
1929                 }
1930
1931                 state->split_start++;
1932                 break;
1933         case 13:
1934                 if (rdev->wiphy.num_iftype_ext_capab &&
1935                     rdev->wiphy.iftype_ext_capab) {
1936                         struct nlattr *nested_ext_capab, *nested;
1937
1938                         nested = nla_nest_start(msg,
1939                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1940                         if (!nested)
1941                                 goto nla_put_failure;
1942
1943                         for (i = state->capa_start;
1944                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1945                                 const struct wiphy_iftype_ext_capab *capab;
1946
1947                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1948
1949                                 nested_ext_capab = nla_nest_start(msg, i);
1950                                 if (!nested_ext_capab ||
1951                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1952                                                 capab->iftype) ||
1953                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1954                                             capab->extended_capabilities_len,
1955                                             capab->extended_capabilities) ||
1956                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1957                                             capab->extended_capabilities_len,
1958                                             capab->extended_capabilities_mask))
1959                                         goto nla_put_failure;
1960
1961                                 nla_nest_end(msg, nested_ext_capab);
1962                                 if (state->split)
1963                                         break;
1964                         }
1965                         nla_nest_end(msg, nested);
1966                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1967                                 state->capa_start = i + 1;
1968                                 break;
1969                         }
1970                 }
1971
1972                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1973                                 rdev->wiphy.nan_supported_bands))
1974                         goto nla_put_failure;
1975
1976                 /* done */
1977                 state->split_start = 0;
1978                 break;
1979         }
1980  finish:
1981         genlmsg_end(msg, hdr);
1982         return 0;
1983
1984  nla_put_failure:
1985         genlmsg_cancel(msg, hdr);
1986         return -EMSGSIZE;
1987 }
1988
1989 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1990                                     struct netlink_callback *cb,
1991                                     struct nl80211_dump_wiphy_state *state)
1992 {
1993         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1994         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1995                               nl80211_fam.maxattr, nl80211_policy, NULL);
1996         /* ignore parse errors for backward compatibility */
1997         if (ret)
1998                 return 0;
1999
2000         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2001         if (tb[NL80211_ATTR_WIPHY])
2002                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2003         if (tb[NL80211_ATTR_WDEV])
2004                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2005         if (tb[NL80211_ATTR_IFINDEX]) {
2006                 struct net_device *netdev;
2007                 struct cfg80211_registered_device *rdev;
2008                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2009
2010                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2011                 if (!netdev)
2012                         return -ENODEV;
2013                 if (netdev->ieee80211_ptr) {
2014                         rdev = wiphy_to_rdev(
2015                                 netdev->ieee80211_ptr->wiphy);
2016                         state->filter_wiphy = rdev->wiphy_idx;
2017                 }
2018         }
2019
2020         return 0;
2021 }
2022
2023 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2024 {
2025         int idx = 0, ret;
2026         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2027         struct cfg80211_registered_device *rdev;
2028
2029         rtnl_lock();
2030         if (!state) {
2031                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2032                 if (!state) {
2033                         rtnl_unlock();
2034                         return -ENOMEM;
2035                 }
2036                 state->filter_wiphy = -1;
2037                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2038                 if (ret) {
2039                         kfree(state);
2040                         rtnl_unlock();
2041                         return ret;
2042                 }
2043                 cb->args[0] = (long)state;
2044         }
2045
2046         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2047                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2048                         continue;
2049                 if (++idx <= state->start)
2050                         continue;
2051                 if (state->filter_wiphy != -1 &&
2052                     state->filter_wiphy != rdev->wiphy_idx)
2053                         continue;
2054                 /* attempt to fit multiple wiphy data chunks into the skb */
2055                 do {
2056                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2057                                                  skb,
2058                                                  NETLINK_CB(cb->skb).portid,
2059                                                  cb->nlh->nlmsg_seq,
2060                                                  NLM_F_MULTI, state);
2061                         if (ret < 0) {
2062                                 /*
2063                                  * If sending the wiphy data didn't fit (ENOBUFS
2064                                  * or EMSGSIZE returned), this SKB is still
2065                                  * empty (so it's not too big because another
2066                                  * wiphy dataset is already in the skb) and
2067                                  * we've not tried to adjust the dump allocation
2068                                  * yet ... then adjust the alloc size to be
2069                                  * bigger, and return 1 but with the empty skb.
2070                                  * This results in an empty message being RX'ed
2071                                  * in userspace, but that is ignored.
2072                                  *
2073                                  * We can then retry with the larger buffer.
2074                                  */
2075                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2076                                     !skb->len && !state->split &&
2077                                     cb->min_dump_alloc < 4096) {
2078                                         cb->min_dump_alloc = 4096;
2079                                         state->split_start = 0;
2080                                         rtnl_unlock();
2081                                         return 1;
2082                                 }
2083                                 idx--;
2084                                 break;
2085                         }
2086                 } while (state->split_start > 0);
2087                 break;
2088         }
2089         rtnl_unlock();
2090
2091         state->start = idx;
2092
2093         return skb->len;
2094 }
2095
2096 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2097 {
2098         kfree((void *)cb->args[0]);
2099         return 0;
2100 }
2101
2102 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2103 {
2104         struct sk_buff *msg;
2105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2106         struct nl80211_dump_wiphy_state state = {};
2107
2108         msg = nlmsg_new(4096, GFP_KERNEL);
2109         if (!msg)
2110                 return -ENOMEM;
2111
2112         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2113                                info->snd_portid, info->snd_seq, 0,
2114                                &state) < 0) {
2115                 nlmsg_free(msg);
2116                 return -ENOBUFS;
2117         }
2118
2119         return genlmsg_reply(msg, info);
2120 }
2121
2122 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2123         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2124         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2125         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2126         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2127         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2128 };
2129
2130 static int parse_txq_params(struct nlattr *tb[],
2131                             struct ieee80211_txq_params *txq_params)
2132 {
2133         u8 ac;
2134
2135         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2136             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2137             !tb[NL80211_TXQ_ATTR_AIFS])
2138                 return -EINVAL;
2139
2140         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2141         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2142         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2143         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2144         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2145
2146         if (ac >= NL80211_NUM_ACS)
2147                 return -EINVAL;
2148         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2149         return 0;
2150 }
2151
2152 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2153 {
2154         /*
2155          * You can only set the channel explicitly for WDS interfaces,
2156          * all others have their channel managed via their respective
2157          * "establish a connection" command (connect, join, ...)
2158          *
2159          * For AP/GO and mesh mode, the channel can be set with the
2160          * channel userspace API, but is only stored and passed to the
2161          * low-level driver when the AP starts or the mesh is joined.
2162          * This is for backward compatibility, userspace can also give
2163          * the channel in the start-ap or join-mesh commands instead.
2164          *
2165          * Monitors are special as they are normally slaved to
2166          * whatever else is going on, so they have their own special
2167          * operation to set the monitor channel if possible.
2168          */
2169         return !wdev ||
2170                 wdev->iftype == NL80211_IFTYPE_AP ||
2171                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2172                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2173                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2174 }
2175
2176 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2177                                  struct genl_info *info,
2178                                  struct cfg80211_chan_def *chandef)
2179 {
2180         u32 control_freq;
2181
2182         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2183                 return -EINVAL;
2184
2185         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2186
2187         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2188         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2189         chandef->center_freq1 = control_freq;
2190         chandef->center_freq2 = 0;
2191
2192         /* Primary channel not allowed */
2193         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2194                 return -EINVAL;
2195
2196         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2197                 enum nl80211_channel_type chantype;
2198
2199                 chantype = nla_get_u32(
2200                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2201
2202                 switch (chantype) {
2203                 case NL80211_CHAN_NO_HT:
2204                 case NL80211_CHAN_HT20:
2205                 case NL80211_CHAN_HT40PLUS:
2206                 case NL80211_CHAN_HT40MINUS:
2207                         cfg80211_chandef_create(chandef, chandef->chan,
2208                                                 chantype);
2209                         /* user input for center_freq is incorrect */
2210                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2211                             chandef->center_freq1 != nla_get_u32(
2212                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2213                                 return -EINVAL;
2214                         /* center_freq2 must be zero */
2215                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2216                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2217                                 return -EINVAL;
2218                         break;
2219                 default:
2220                         return -EINVAL;
2221                 }
2222         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2223                 chandef->width =
2224                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2225                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2226                         chandef->center_freq1 =
2227                                 nla_get_u32(
2228                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2229                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2230                         chandef->center_freq2 =
2231                                 nla_get_u32(
2232                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2233         }
2234
2235         if (!cfg80211_chandef_valid(chandef))
2236                 return -EINVAL;
2237
2238         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2239                                      IEEE80211_CHAN_DISABLED))
2240                 return -EINVAL;
2241
2242         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2243              chandef->width == NL80211_CHAN_WIDTH_10) &&
2244             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2245                 return -EINVAL;
2246
2247         return 0;
2248 }
2249
2250 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2251                                  struct net_device *dev,
2252                                  struct genl_info *info)
2253 {
2254         struct cfg80211_chan_def chandef;
2255         int result;
2256         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2257         struct wireless_dev *wdev = NULL;
2258
2259         if (dev)
2260                 wdev = dev->ieee80211_ptr;
2261         if (!nl80211_can_set_dev_channel(wdev))
2262                 return -EOPNOTSUPP;
2263         if (wdev)
2264                 iftype = wdev->iftype;
2265
2266         result = nl80211_parse_chandef(rdev, info, &chandef);
2267         if (result)
2268                 return result;
2269
2270         switch (iftype) {
2271         case NL80211_IFTYPE_AP:
2272         case NL80211_IFTYPE_P2P_GO:
2273                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2274                                                    iftype)) {
2275                         result = -EINVAL;
2276                         break;
2277                 }
2278                 if (wdev->beacon_interval) {
2279                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2280                             !(rdev->wiphy.features &
2281                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2282                                 result = -EBUSY;
2283                                 break;
2284                         }
2285
2286                         /* Only allow dynamic channel width changes */
2287                         if (chandef.chan != wdev->preset_chandef.chan) {
2288                                 result = -EBUSY;
2289                                 break;
2290                         }
2291                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2292                         if (result)
2293                                 break;
2294                 }
2295                 wdev->preset_chandef = chandef;
2296                 result = 0;
2297                 break;
2298         case NL80211_IFTYPE_MESH_POINT:
2299                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2300                 break;
2301         case NL80211_IFTYPE_MONITOR:
2302                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2303                 break;
2304         default:
2305                 result = -EINVAL;
2306         }
2307
2308         return result;
2309 }
2310
2311 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2312 {
2313         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2314         struct net_device *netdev = info->user_ptr[1];
2315
2316         return __nl80211_set_channel(rdev, netdev, info);
2317 }
2318
2319 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2320 {
2321         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2322         struct net_device *dev = info->user_ptr[1];
2323         struct wireless_dev *wdev = dev->ieee80211_ptr;
2324         const u8 *bssid;
2325
2326         if (!info->attrs[NL80211_ATTR_MAC])
2327                 return -EINVAL;
2328
2329         if (netif_running(dev))
2330                 return -EBUSY;
2331
2332         if (!rdev->ops->set_wds_peer)
2333                 return -EOPNOTSUPP;
2334
2335         if (wdev->iftype != NL80211_IFTYPE_WDS)
2336                 return -EOPNOTSUPP;
2337
2338         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2339         return rdev_set_wds_peer(rdev, dev, bssid);
2340 }
2341
2342 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2343 {
2344         struct cfg80211_registered_device *rdev;
2345         struct net_device *netdev = NULL;
2346         struct wireless_dev *wdev;
2347         int result = 0, rem_txq_params = 0;
2348         struct nlattr *nl_txq_params;
2349         u32 changed;
2350         u8 retry_short = 0, retry_long = 0;
2351         u32 frag_threshold = 0, rts_threshold = 0;
2352         u8 coverage_class = 0;
2353
2354         ASSERT_RTNL();
2355
2356         /*
2357          * Try to find the wiphy and netdev. Normally this
2358          * function shouldn't need the netdev, but this is
2359          * done for backward compatibility -- previously
2360          * setting the channel was done per wiphy, but now
2361          * it is per netdev. Previous userland like hostapd
2362          * also passed a netdev to set_wiphy, so that it is
2363          * possible to let that go to the right netdev!
2364          */
2365
2366         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2367                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2368
2369                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2370                 if (netdev && netdev->ieee80211_ptr)
2371                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2372                 else
2373                         netdev = NULL;
2374         }
2375
2376         if (!netdev) {
2377                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2378                                                   info->attrs);
2379                 if (IS_ERR(rdev))
2380                         return PTR_ERR(rdev);
2381                 wdev = NULL;
2382                 netdev = NULL;
2383                 result = 0;
2384         } else
2385                 wdev = netdev->ieee80211_ptr;
2386
2387         /*
2388          * end workaround code, by now the rdev is available
2389          * and locked, and wdev may or may not be NULL.
2390          */
2391
2392         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2393                 result = cfg80211_dev_rename(
2394                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2395
2396         if (result)
2397                 return result;
2398
2399         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2400                 struct ieee80211_txq_params txq_params;
2401                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2402
2403                 if (!rdev->ops->set_txq_params)
2404                         return -EOPNOTSUPP;
2405
2406                 if (!netdev)
2407                         return -EINVAL;
2408
2409                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2410                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2411                         return -EINVAL;
2412
2413                 if (!netif_running(netdev))
2414                         return -ENETDOWN;
2415
2416                 nla_for_each_nested(nl_txq_params,
2417                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2418                                     rem_txq_params) {
2419                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2420                                                   nl_txq_params,
2421                                                   txq_params_policy,
2422                                                   info->extack);
2423                         if (result)
2424                                 return result;
2425                         result = parse_txq_params(tb, &txq_params);
2426                         if (result)
2427                                 return result;
2428
2429                         result = rdev_set_txq_params(rdev, netdev,
2430                                                      &txq_params);
2431                         if (result)
2432                                 return result;
2433                 }
2434         }
2435
2436         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2437                 result = __nl80211_set_channel(
2438                         rdev,
2439                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2440                         info);
2441                 if (result)
2442                         return result;
2443         }
2444
2445         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2446                 struct wireless_dev *txp_wdev = wdev;
2447                 enum nl80211_tx_power_setting type;
2448                 int idx, mbm = 0;
2449
2450                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2451                         txp_wdev = NULL;
2452
2453                 if (!rdev->ops->set_tx_power)
2454                         return -EOPNOTSUPP;
2455
2456                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2457                 type = nla_get_u32(info->attrs[idx]);
2458
2459                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2460                     (type != NL80211_TX_POWER_AUTOMATIC))
2461                         return -EINVAL;
2462
2463                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2464                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2465                         mbm = nla_get_u32(info->attrs[idx]);
2466                 }
2467
2468                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2469                 if (result)
2470                         return result;
2471         }
2472
2473         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2474             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2475                 u32 tx_ant, rx_ant;
2476
2477                 if ((!rdev->wiphy.available_antennas_tx &&
2478                      !rdev->wiphy.available_antennas_rx) ||
2479                     !rdev->ops->set_antenna)
2480                         return -EOPNOTSUPP;
2481
2482                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2483                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2484
2485                 /* reject antenna configurations which don't match the
2486                  * available antenna masks, except for the "all" mask */
2487                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2488                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2489                         return -EINVAL;
2490
2491                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2492                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2493
2494                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2495                 if (result)
2496                         return result;
2497         }
2498
2499         changed = 0;
2500
2501         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2502                 retry_short = nla_get_u8(
2503                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2504                 if (retry_short == 0)
2505                         return -EINVAL;
2506
2507                 changed |= WIPHY_PARAM_RETRY_SHORT;
2508         }
2509
2510         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2511                 retry_long = nla_get_u8(
2512                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2513                 if (retry_long == 0)
2514                         return -EINVAL;
2515
2516                 changed |= WIPHY_PARAM_RETRY_LONG;
2517         }
2518
2519         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2520                 frag_threshold = nla_get_u32(
2521                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2522                 if (frag_threshold < 256)
2523                         return -EINVAL;
2524
2525                 if (frag_threshold != (u32) -1) {
2526                         /*
2527                          * Fragments (apart from the last one) are required to
2528                          * have even length. Make the fragmentation code
2529                          * simpler by stripping LSB should someone try to use
2530                          * odd threshold value.
2531                          */
2532                         frag_threshold &= ~0x1;
2533                 }
2534                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2535         }
2536
2537         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2538                 rts_threshold = nla_get_u32(
2539                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2540                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2541         }
2542
2543         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2544                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2545                         return -EINVAL;
2546
2547                 coverage_class = nla_get_u8(
2548                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2549                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2550         }
2551
2552         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2553                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2554                         return -EOPNOTSUPP;
2555
2556                 changed |= WIPHY_PARAM_DYN_ACK;
2557         }
2558
2559         if (changed) {
2560                 u8 old_retry_short, old_retry_long;
2561                 u32 old_frag_threshold, old_rts_threshold;
2562                 u8 old_coverage_class;
2563
2564                 if (!rdev->ops->set_wiphy_params)
2565                         return -EOPNOTSUPP;
2566
2567                 old_retry_short = rdev->wiphy.retry_short;
2568                 old_retry_long = rdev->wiphy.retry_long;
2569                 old_frag_threshold = rdev->wiphy.frag_threshold;
2570                 old_rts_threshold = rdev->wiphy.rts_threshold;
2571                 old_coverage_class = rdev->wiphy.coverage_class;
2572
2573                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2574                         rdev->wiphy.retry_short = retry_short;
2575                 if (changed & WIPHY_PARAM_RETRY_LONG)
2576                         rdev->wiphy.retry_long = retry_long;
2577                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2578                         rdev->wiphy.frag_threshold = frag_threshold;
2579                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2580                         rdev->wiphy.rts_threshold = rts_threshold;
2581                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2582                         rdev->wiphy.coverage_class = coverage_class;
2583
2584                 result = rdev_set_wiphy_params(rdev, changed);
2585                 if (result) {
2586                         rdev->wiphy.retry_short = old_retry_short;
2587                         rdev->wiphy.retry_long = old_retry_long;
2588                         rdev->wiphy.frag_threshold = old_frag_threshold;
2589                         rdev->wiphy.rts_threshold = old_rts_threshold;
2590                         rdev->wiphy.coverage_class = old_coverage_class;
2591                         return result;
2592                 }
2593         }
2594         return 0;
2595 }
2596
2597 static inline u64 wdev_id(struct wireless_dev *wdev)
2598 {
2599         return (u64)wdev->identifier |
2600                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2601 }
2602
2603 static int nl80211_send_chandef(struct sk_buff *msg,
2604                                 const struct cfg80211_chan_def *chandef)
2605 {
2606         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2607                 return -EINVAL;
2608
2609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2610                         chandef->chan->center_freq))
2611                 return -ENOBUFS;
2612         switch (chandef->width) {
2613         case NL80211_CHAN_WIDTH_20_NOHT:
2614         case NL80211_CHAN_WIDTH_20:
2615         case NL80211_CHAN_WIDTH_40:
2616                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2617                                 cfg80211_get_chandef_type(chandef)))
2618                         return -ENOBUFS;
2619                 break;
2620         default:
2621                 break;
2622         }
2623         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2624                 return -ENOBUFS;
2625         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2626                 return -ENOBUFS;
2627         if (chandef->center_freq2 &&
2628             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2629                 return -ENOBUFS;
2630         return 0;
2631 }
2632
2633 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2634                               struct cfg80211_registered_device *rdev,
2635                               struct wireless_dev *wdev, bool removal)
2636 {
2637         struct net_device *dev = wdev->netdev;
2638         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2639         void *hdr;
2640
2641         if (removal)
2642                 cmd = NL80211_CMD_DEL_INTERFACE;
2643
2644         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2645         if (!hdr)
2646                 return -1;
2647
2648         if (dev &&
2649             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2650              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2651                 goto nla_put_failure;
2652
2653         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2654             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2655             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2656                               NL80211_ATTR_PAD) ||
2657             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2658             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2659                         rdev->devlist_generation ^
2660                         (cfg80211_rdev_list_generation << 2)))
2661                 goto nla_put_failure;
2662
2663         if (rdev->ops->get_channel) {
2664                 int ret;
2665                 struct cfg80211_chan_def chandef;
2666
2667                 ret = rdev_get_channel(rdev, wdev, &chandef);
2668                 if (ret == 0) {
2669                         if (nl80211_send_chandef(msg, &chandef))
2670                                 goto nla_put_failure;
2671                 }
2672         }
2673
2674         if (rdev->ops->get_tx_power) {
2675                 int dbm, ret;
2676
2677                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2678                 if (ret == 0 &&
2679                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2680                                 DBM_TO_MBM(dbm)))
2681                         goto nla_put_failure;
2682         }
2683
2684         wdev_lock(wdev);
2685         switch (wdev->iftype) {
2686         case NL80211_IFTYPE_AP:
2687                 if (wdev->ssid_len &&
2688                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2689                         goto nla_put_failure_locked;
2690                 break;
2691         case NL80211_IFTYPE_STATION:
2692         case NL80211_IFTYPE_P2P_CLIENT:
2693         case NL80211_IFTYPE_ADHOC: {
2694                 const u8 *ssid_ie;
2695                 if (!wdev->current_bss)
2696                         break;
2697                 rcu_read_lock();
2698                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2699                                                WLAN_EID_SSID);
2700                 if (ssid_ie &&
2701                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2702                         goto nla_put_failure_rcu_locked;
2703                 rcu_read_unlock();
2704                 break;
2705                 }
2706         default:
2707                 /* nothing */
2708                 break;
2709         }
2710         wdev_unlock(wdev);
2711
2712         genlmsg_end(msg, hdr);
2713         return 0;
2714
2715  nla_put_failure_rcu_locked:
2716         rcu_read_unlock();
2717  nla_put_failure_locked:
2718         wdev_unlock(wdev);
2719  nla_put_failure:
2720         genlmsg_cancel(msg, hdr);
2721         return -EMSGSIZE;
2722 }
2723
2724 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2725 {
2726         int wp_idx = 0;
2727         int if_idx = 0;
2728         int wp_start = cb->args[0];
2729         int if_start = cb->args[1];
2730         int filter_wiphy = -1;
2731         struct cfg80211_registered_device *rdev;
2732         struct wireless_dev *wdev;
2733         int ret;
2734
2735         rtnl_lock();
2736         if (!cb->args[2]) {
2737                 struct nl80211_dump_wiphy_state state = {
2738                         .filter_wiphy = -1,
2739                 };
2740
2741                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2742                 if (ret)
2743                         goto out_unlock;
2744
2745                 filter_wiphy = state.filter_wiphy;
2746
2747                 /*
2748                  * if filtering, set cb->args[2] to +1 since 0 is the default
2749                  * value needed to determine that parsing is necessary.
2750                  */
2751                 if (filter_wiphy >= 0)
2752                         cb->args[2] = filter_wiphy + 1;
2753                 else
2754                         cb->args[2] = -1;
2755         } else if (cb->args[2] > 0) {
2756                 filter_wiphy = cb->args[2] - 1;
2757         }
2758
2759         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2760                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2761                         continue;
2762                 if (wp_idx < wp_start) {
2763                         wp_idx++;
2764                         continue;
2765                 }
2766
2767                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2768                         continue;
2769
2770                 if_idx = 0;
2771
2772                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2773                         if (if_idx < if_start) {
2774                                 if_idx++;
2775                                 continue;
2776                         }
2777                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2778                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2779                                                rdev, wdev, false) < 0) {
2780                                 goto out;
2781                         }
2782                         if_idx++;
2783                 }
2784
2785                 wp_idx++;
2786         }
2787  out:
2788         cb->args[0] = wp_idx;
2789         cb->args[1] = if_idx;
2790
2791         ret = skb->len;
2792  out_unlock:
2793         rtnl_unlock();
2794
2795         return ret;
2796 }
2797
2798 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2799 {
2800         struct sk_buff *msg;
2801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2802         struct wireless_dev *wdev = info->user_ptr[1];
2803
2804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2805         if (!msg)
2806                 return -ENOMEM;
2807
2808         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2809                                rdev, wdev, false) < 0) {
2810                 nlmsg_free(msg);
2811                 return -ENOBUFS;
2812         }
2813
2814         return genlmsg_reply(msg, info);
2815 }
2816
2817 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2818         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2819         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2820         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2821         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2822         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2823         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2824 };
2825
2826 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2827 {
2828         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2829         int flag;
2830
2831         *mntrflags = 0;
2832
2833         if (!nla)
2834                 return -EINVAL;
2835
2836         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2837                              mntr_flags_policy, NULL))
2838                 return -EINVAL;
2839
2840         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2841                 if (flags[flag])
2842                         *mntrflags |= (1<<flag);
2843
2844         *mntrflags |= MONITOR_FLAG_CHANGED;
2845
2846         return 0;
2847 }
2848
2849 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2850                                      enum nl80211_iftype type,
2851                                      struct genl_info *info,
2852                                      struct vif_params *params)
2853 {
2854         bool change = false;
2855         int err;
2856
2857         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2858                 if (type != NL80211_IFTYPE_MONITOR)
2859                         return -EINVAL;
2860
2861                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2862                                           &params->flags);
2863                 if (err)
2864                         return err;
2865
2866                 change = true;
2867         }
2868
2869         if (params->flags & MONITOR_FLAG_ACTIVE &&
2870             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2871                 return -EOPNOTSUPP;
2872
2873         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2874                 const u8 *mumimo_groups;
2875                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2876
2877                 if (type != NL80211_IFTYPE_MONITOR)
2878                         return -EINVAL;
2879
2880                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2881                         return -EOPNOTSUPP;
2882
2883                 mumimo_groups =
2884                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2885
2886                 /* bits 0 and 63 are reserved and must be zero */
2887                 if ((mumimo_groups[0] & BIT(0)) ||
2888                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2889                         return -EINVAL;
2890
2891                 params->vht_mumimo_groups = mumimo_groups;
2892                 change = true;
2893         }
2894
2895         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2896                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2897
2898                 if (type != NL80211_IFTYPE_MONITOR)
2899                         return -EINVAL;
2900
2901                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2902                         return -EOPNOTSUPP;
2903
2904                 params->vht_mumimo_follow_addr =
2905                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2906                 change = true;
2907         }
2908
2909         return change ? 1 : 0;
2910 }
2911
2912 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2913                                struct net_device *netdev, u8 use_4addr,
2914                                enum nl80211_iftype iftype)
2915 {
2916         if (!use_4addr) {
2917                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2918                         return -EBUSY;
2919                 return 0;
2920         }
2921
2922         switch (iftype) {
2923         case NL80211_IFTYPE_AP_VLAN:
2924                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2925                         return 0;
2926                 break;
2927         case NL80211_IFTYPE_STATION:
2928                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2929                         return 0;
2930                 break;
2931         default:
2932                 break;
2933         }
2934
2935         return -EOPNOTSUPP;
2936 }
2937
2938 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2939 {
2940         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2941         struct vif_params params;
2942         int err;
2943         enum nl80211_iftype otype, ntype;
2944         struct net_device *dev = info->user_ptr[1];
2945         bool change = false;
2946
2947         memset(&params, 0, sizeof(params));
2948
2949         otype = ntype = dev->ieee80211_ptr->iftype;
2950
2951         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2952                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2953                 if (otype != ntype)
2954                         change = true;
2955                 if (ntype > NL80211_IFTYPE_MAX)
2956                         return -EINVAL;
2957         }
2958
2959         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2960                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2961
2962                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2963                         return -EINVAL;
2964                 if (netif_running(dev))
2965                         return -EBUSY;
2966
2967                 wdev_lock(wdev);
2968                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2969                              IEEE80211_MAX_MESH_ID_LEN);
2970                 wdev->mesh_id_up_len =
2971                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2972                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2973                        wdev->mesh_id_up_len);
2974                 wdev_unlock(wdev);
2975         }
2976
2977         if (info->attrs[NL80211_ATTR_4ADDR]) {
2978                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2979                 change = true;
2980                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2981                 if (err)
2982                         return err;
2983         } else {
2984                 params.use_4addr = -1;
2985         }
2986
2987         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2988         if (err < 0)
2989                 return err;
2990         if (err > 0)
2991                 change = true;
2992
2993         if (change)
2994                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
2995         else
2996                 err = 0;
2997
2998         if (!err && params.use_4addr != -1)
2999                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3000
3001         return err;
3002 }
3003
3004 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3005 {
3006         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3007         struct vif_params params;
3008         struct wireless_dev *wdev;
3009         struct sk_buff *msg;
3010         int err;
3011         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3012
3013         /* to avoid failing a new interface creation due to pending removal */
3014         cfg80211_destroy_ifaces(rdev);
3015
3016         memset(&params, 0, sizeof(params));
3017
3018         if (!info->attrs[NL80211_ATTR_IFNAME])
3019                 return -EINVAL;
3020
3021         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3022                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3023                 if (type > NL80211_IFTYPE_MAX)
3024                         return -EINVAL;
3025         }
3026
3027         if (!rdev->ops->add_virtual_intf ||
3028             !(rdev->wiphy.interface_modes & (1 << type)))
3029                 return -EOPNOTSUPP;
3030
3031         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3032              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3033             info->attrs[NL80211_ATTR_MAC]) {
3034                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3035                            ETH_ALEN);
3036                 if (!is_valid_ether_addr(params.macaddr))
3037                         return -EADDRNOTAVAIL;
3038         }
3039
3040         if (info->attrs[NL80211_ATTR_4ADDR]) {
3041                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3042                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3043                 if (err)
3044                         return err;
3045         }
3046
3047         err = nl80211_parse_mon_options(rdev, type, info, &params);
3048         if (err < 0)
3049                 return err;
3050
3051         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3052         if (!msg)
3053                 return -ENOMEM;
3054
3055         wdev = rdev_add_virtual_intf(rdev,
3056                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3057                                 NET_NAME_USER, type, &params);
3058         if (WARN_ON(!wdev)) {
3059                 nlmsg_free(msg);
3060                 return -EPROTO;
3061         } else if (IS_ERR(wdev)) {
3062                 nlmsg_free(msg);
3063                 return PTR_ERR(wdev);
3064         }
3065
3066         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3067                 wdev->owner_nlportid = info->snd_portid;
3068
3069         switch (type) {
3070         case NL80211_IFTYPE_MESH_POINT:
3071                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3072                         break;
3073                 wdev_lock(wdev);
3074                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3075                              IEEE80211_MAX_MESH_ID_LEN);
3076                 wdev->mesh_id_up_len =
3077                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3078                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3079                        wdev->mesh_id_up_len);
3080                 wdev_unlock(wdev);
3081                 break;
3082         case NL80211_IFTYPE_NAN:
3083         case NL80211_IFTYPE_P2P_DEVICE:
3084                 /*
3085                  * P2P Device and NAN do not have a netdev, so don't go
3086                  * through the netdev notifier and must be added here
3087                  */
3088                 mutex_init(&wdev->mtx);
3089                 INIT_LIST_HEAD(&wdev->event_list);
3090                 spin_lock_init(&wdev->event_lock);
3091                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3092                 spin_lock_init(&wdev->mgmt_registrations_lock);
3093
3094                 wdev->identifier = ++rdev->wdev_id;
3095                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3096                 rdev->devlist_generation++;
3097                 break;
3098         default:
3099                 break;
3100         }
3101
3102         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3103                                rdev, wdev, false) < 0) {
3104                 nlmsg_free(msg);
3105                 return -ENOBUFS;
3106         }
3107
3108         /*
3109          * For wdevs which have no associated netdev object (e.g. of type
3110          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3111          * For all other types, the event will be generated from the
3112          * netdev notifier
3113          */
3114         if (!wdev->netdev)
3115                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3116
3117         return genlmsg_reply(msg, info);
3118 }
3119
3120 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3121 {
3122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3123         struct wireless_dev *wdev = info->user_ptr[1];
3124
3125         if (!rdev->ops->del_virtual_intf)
3126                 return -EOPNOTSUPP;
3127
3128         /*
3129          * If we remove a wireless device without a netdev then clear
3130          * user_ptr[1] so that nl80211_post_doit won't dereference it
3131          * to check if it needs to do dev_put(). Otherwise it crashes
3132          * since the wdev has been freed, unlike with a netdev where
3133          * we need the dev_put() for the netdev to really be freed.
3134          */
3135         if (!wdev->netdev)
3136                 info->user_ptr[1] = NULL;
3137
3138         return rdev_del_virtual_intf(rdev, wdev);
3139 }
3140
3141 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3142 {
3143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3144         struct net_device *dev = info->user_ptr[1];
3145         u16 noack_map;
3146
3147         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3148                 return -EINVAL;
3149
3150         if (!rdev->ops->set_noack_map)
3151                 return -EOPNOTSUPP;
3152
3153         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3154
3155         return rdev_set_noack_map(rdev, dev, noack_map);
3156 }
3157
3158 struct get_key_cookie {
3159         struct sk_buff *msg;
3160         int error;
3161         int idx;
3162 };
3163
3164 static void get_key_callback(void *c, struct key_params *params)
3165 {
3166         struct nlattr *key;
3167         struct get_key_cookie *cookie = c;
3168
3169         if ((params->key &&
3170              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3171                      params->key_len, params->key)) ||
3172             (params->seq &&
3173              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3174                      params->seq_len, params->seq)) ||
3175             (params->cipher &&
3176              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3177                          params->cipher)))
3178                 goto nla_put_failure;
3179
3180         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3181         if (!key)
3182                 goto nla_put_failure;
3183
3184         if ((params->key &&
3185              nla_put(cookie->msg, NL80211_KEY_DATA,
3186                      params->key_len, params->key)) ||
3187             (params->seq &&
3188              nla_put(cookie->msg, NL80211_KEY_SEQ,
3189                      params->seq_len, params->seq)) ||
3190             (params->cipher &&
3191              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3192                          params->cipher)))
3193                 goto nla_put_failure;
3194
3195         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3196                 goto nla_put_failure;
3197
3198         nla_nest_end(cookie->msg, key);
3199
3200         return;
3201  nla_put_failure:
3202         cookie->error = 1;
3203 }
3204
3205 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3206 {
3207         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3208         int err;
3209         struct net_device *dev = info->user_ptr[1];
3210         u8 key_idx = 0;
3211         const u8 *mac_addr = NULL;
3212         bool pairwise;
3213         struct get_key_cookie cookie = {
3214                 .error = 0,
3215         };
3216         void *hdr;
3217         struct sk_buff *msg;
3218
3219         if (info->attrs[NL80211_ATTR_KEY_IDX])
3220                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3221
3222         if (key_idx > 5)
3223                 return -EINVAL;
3224
3225         if (info->attrs[NL80211_ATTR_MAC])
3226                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3227
3228         pairwise = !!mac_addr;
3229         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3230                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3231
3232                 if (kt >= NUM_NL80211_KEYTYPES)
3233                         return -EINVAL;
3234                 if (kt != NL80211_KEYTYPE_GROUP &&
3235                     kt != NL80211_KEYTYPE_PAIRWISE)
3236                         return -EINVAL;
3237                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3238         }
3239
3240         if (!rdev->ops->get_key)
3241                 return -EOPNOTSUPP;
3242
3243         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3244                 return -ENOENT;
3245
3246         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3247         if (!msg)
3248                 return -ENOMEM;
3249
3250         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3251                              NL80211_CMD_NEW_KEY);
3252         if (!hdr)
3253                 goto nla_put_failure;
3254
3255         cookie.msg = msg;
3256         cookie.idx = key_idx;
3257
3258         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3259             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3260                 goto nla_put_failure;
3261         if (mac_addr &&
3262             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3263                 goto nla_put_failure;
3264
3265         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3266                            get_key_callback);
3267
3268         if (err)
3269                 goto free_msg;
3270
3271         if (cookie.error)
3272                 goto nla_put_failure;
3273
3274         genlmsg_end(msg, hdr);
3275         return genlmsg_reply(msg, info);
3276
3277  nla_put_failure:
3278         err = -ENOBUFS;
3279  free_msg:
3280         nlmsg_free(msg);
3281         return err;
3282 }
3283
3284 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3285 {
3286         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3287         struct key_parse key;
3288         int err;
3289         struct net_device *dev = info->user_ptr[1];
3290
3291         err = nl80211_parse_key(info, &key);
3292         if (err)
3293                 return err;
3294
3295         if (key.idx < 0)
3296                 return -EINVAL;
3297
3298         /* only support setting default key */
3299         if (!key.def && !key.defmgmt)
3300                 return -EINVAL;
3301
3302         wdev_lock(dev->ieee80211_ptr);
3303
3304         if (key.def) {
3305                 if (!rdev->ops->set_default_key) {
3306                         err = -EOPNOTSUPP;
3307                         goto out;
3308                 }
3309
3310                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3311                 if (err)
3312                         goto out;
3313
3314                 err = rdev_set_default_key(rdev, dev, key.idx,
3315                                                  key.def_uni, key.def_multi);
3316
3317                 if (err)
3318                         goto out;
3319
3320 #ifdef CONFIG_CFG80211_WEXT
3321                 dev->ieee80211_ptr->wext.default_key = key.idx;
3322 #endif
3323         } else {
3324                 if (key.def_uni || !key.def_multi) {
3325                         err = -EINVAL;
3326                         goto out;
3327                 }
3328
3329                 if (!rdev->ops->set_default_mgmt_key) {
3330                         err = -EOPNOTSUPP;
3331                         goto out;
3332                 }
3333
3334                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3335                 if (err)
3336                         goto out;
3337
3338                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3339                 if (err)
3340                         goto out;
3341
3342 #ifdef CONFIG_CFG80211_WEXT
3343                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3344 #endif
3345         }
3346
3347  out:
3348         wdev_unlock(dev->ieee80211_ptr);
3349
3350         return err;
3351 }
3352
3353 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3354 {
3355         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3356         int err;
3357         struct net_device *dev = info->user_ptr[1];
3358         struct key_parse key;
3359         const u8 *mac_addr = NULL;
3360
3361         err = nl80211_parse_key(info, &key);
3362         if (err)
3363                 return err;
3364
3365         if (!key.p.key)
3366                 return -EINVAL;
3367
3368         if (info->attrs[NL80211_ATTR_MAC])
3369                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3370
3371         if (key.type == -1) {
3372                 if (mac_addr)
3373                         key.type = NL80211_KEYTYPE_PAIRWISE;
3374                 else
3375                         key.type = NL80211_KEYTYPE_GROUP;
3376         }
3377
3378         /* for now */
3379         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3380             key.type != NL80211_KEYTYPE_GROUP)
3381                 return -EINVAL;
3382
3383         if (!rdev->ops->add_key)
3384                 return -EOPNOTSUPP;
3385
3386         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3387                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3388                                            mac_addr))
3389                 return -EINVAL;
3390
3391         wdev_lock(dev->ieee80211_ptr);
3392         err = nl80211_key_allowed(dev->ieee80211_ptr);
3393         if (!err)
3394                 err = rdev_add_key(rdev, dev, key.idx,
3395                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3396                                     mac_addr, &key.p);
3397         wdev_unlock(dev->ieee80211_ptr);
3398
3399         return err;
3400 }
3401
3402 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3403 {
3404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3405         int err;
3406         struct net_device *dev = info->user_ptr[1];
3407         u8 *mac_addr = NULL;
3408         struct key_parse key;
3409
3410         err = nl80211_parse_key(info, &key);
3411         if (err)
3412                 return err;
3413
3414         if (info->attrs[NL80211_ATTR_MAC])
3415                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3416
3417         if (key.type == -1) {
3418                 if (mac_addr)
3419                         key.type = NL80211_KEYTYPE_PAIRWISE;
3420                 else
3421                         key.type = NL80211_KEYTYPE_GROUP;
3422         }
3423
3424         /* for now */
3425         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3426             key.type != NL80211_KEYTYPE_GROUP)
3427                 return -EINVAL;
3428
3429         if (!rdev->ops->del_key)
3430                 return -EOPNOTSUPP;
3431
3432         wdev_lock(dev->ieee80211_ptr);
3433         err = nl80211_key_allowed(dev->ieee80211_ptr);
3434
3435         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3436             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3437                 err = -ENOENT;
3438
3439         if (!err)
3440                 err = rdev_del_key(rdev, dev, key.idx,
3441                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3442                                    mac_addr);
3443
3444 #ifdef CONFIG_CFG80211_WEXT
3445         if (!err) {
3446                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3447                         dev->ieee80211_ptr->wext.default_key = -1;
3448                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3449                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3450         }
3451 #endif
3452         wdev_unlock(dev->ieee80211_ptr);
3453
3454         return err;
3455 }
3456
3457 /* This function returns an error or the number of nested attributes */
3458 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3459 {
3460         struct nlattr *attr;
3461         int n_entries = 0, tmp;
3462
3463         nla_for_each_nested(attr, nl_attr, tmp) {
3464                 if (nla_len(attr) != ETH_ALEN)
3465                         return -EINVAL;
3466
3467                 n_entries++;
3468         }
3469
3470         return n_entries;
3471 }
3472
3473 /*
3474  * This function parses ACL information and allocates memory for ACL data.
3475  * On successful return, the calling function is responsible to free the
3476  * ACL buffer returned by this function.
3477  */
3478 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3479                                                 struct genl_info *info)
3480 {
3481         enum nl80211_acl_policy acl_policy;
3482         struct nlattr *attr;
3483         struct cfg80211_acl_data *acl;
3484         int i = 0, n_entries, tmp;
3485
3486         if (!wiphy->max_acl_mac_addrs)
3487                 return ERR_PTR(-EOPNOTSUPP);
3488
3489         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3490                 return ERR_PTR(-EINVAL);
3491
3492         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3493         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3494             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3495                 return ERR_PTR(-EINVAL);
3496
3497         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3498                 return ERR_PTR(-EINVAL);
3499
3500         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3501         if (n_entries < 0)
3502                 return ERR_PTR(n_entries);
3503
3504         if (n_entries > wiphy->max_acl_mac_addrs)
3505                 return ERR_PTR(-ENOTSUPP);
3506
3507         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3508                       GFP_KERNEL);
3509         if (!acl)
3510                 return ERR_PTR(-ENOMEM);
3511
3512         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3513                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3514                 i++;
3515         }
3516
3517         acl->n_acl_entries = n_entries;
3518         acl->acl_policy = acl_policy;
3519
3520         return acl;
3521 }
3522
3523 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3524 {
3525         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3526         struct net_device *dev = info->user_ptr[1];
3527         struct cfg80211_acl_data *acl;
3528         int err;
3529
3530         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3531             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3532                 return -EOPNOTSUPP;
3533
3534         if (!dev->ieee80211_ptr->beacon_interval)
3535                 return -EINVAL;
3536
3537         acl = parse_acl_data(&rdev->wiphy, info);
3538         if (IS_ERR(acl))
3539                 return PTR_ERR(acl);
3540
3541         err = rdev_set_mac_acl(rdev, dev, acl);
3542
3543         kfree(acl);
3544
3545         return err;
3546 }
3547
3548 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3549                            u8 *rates, u8 rates_len)
3550 {
3551         u8 i;
3552         u32 mask = 0;
3553
3554         for (i = 0; i < rates_len; i++) {
3555                 int rate = (rates[i] & 0x7f) * 5;
3556                 int ridx;
3557
3558                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3559                         struct ieee80211_rate *srate =
3560                                 &sband->bitrates[ridx];
3561                         if (rate == srate->bitrate) {
3562                                 mask |= 1 << ridx;
3563                                 break;
3564                         }
3565                 }
3566                 if (ridx == sband->n_bitrates)
3567                         return 0; /* rate not found */
3568         }
3569
3570         return mask;
3571 }
3572
3573 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3574                                u8 *rates, u8 rates_len,
3575                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3576 {
3577         u8 i;
3578
3579         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3580
3581         for (i = 0; i < rates_len; i++) {
3582                 int ridx, rbit;
3583
3584                 ridx = rates[i] / 8;
3585                 rbit = BIT(rates[i] % 8);
3586
3587                 /* check validity */
3588                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3589                         return false;
3590
3591                 /* check availability */
3592                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3593                         mcs[ridx] |= rbit;
3594                 else
3595                         return false;
3596         }
3597
3598         return true;
3599 }
3600
3601 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3602 {
3603         u16 mcs_mask = 0;
3604
3605         switch (vht_mcs_map) {
3606         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3607                 break;
3608         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3609                 mcs_mask = 0x00FF;
3610                 break;
3611         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3612                 mcs_mask = 0x01FF;
3613                 break;
3614         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3615                 mcs_mask = 0x03FF;
3616                 break;
3617         default:
3618                 break;
3619         }
3620
3621         return mcs_mask;
3622 }
3623
3624 static void vht_build_mcs_mask(u16 vht_mcs_map,
3625                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3626 {
3627         u8 nss;
3628
3629         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3630                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3631                 vht_mcs_map >>= 2;
3632         }
3633 }
3634
3635 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3636                              struct nl80211_txrate_vht *txrate,
3637                              u16 mcs[NL80211_VHT_NSS_MAX])
3638 {
3639         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3640         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3641         u8 i;
3642
3643         if (!sband->vht_cap.vht_supported)
3644                 return false;
3645
3646         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3647
3648         /* Build vht_mcs_mask from VHT capabilities */
3649         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3650
3651         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3652                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3653                         mcs[i] = txrate->mcs[i];
3654                 else
3655                         return false;
3656         }
3657
3658         return true;
3659 }
3660
3661 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3662         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3663                                     .len = NL80211_MAX_SUPP_RATES },
3664         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3665                                 .len = NL80211_MAX_SUPP_HT_RATES },
3666         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3667         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3668 };
3669
3670 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3671                                          struct cfg80211_bitrate_mask *mask)
3672 {
3673         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3675         int rem, i;
3676         struct nlattr *tx_rates;
3677         struct ieee80211_supported_band *sband;
3678         u16 vht_tx_mcs_map;
3679
3680         memset(mask, 0, sizeof(*mask));
3681         /* Default to all rates enabled */
3682         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3683                 sband = rdev->wiphy.bands[i];
3684
3685                 if (!sband)
3686                         continue;
3687
3688                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3689                 memcpy(mask->control[i].ht_mcs,
3690                        sband->ht_cap.mcs.rx_mask,
3691                        sizeof(mask->control[i].ht_mcs));
3692
3693                 if (!sband->vht_cap.vht_supported)
3694                         continue;
3695
3696                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3697                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3698         }
3699
3700         /* if no rates are given set it back to the defaults */
3701         if (!info->attrs[NL80211_ATTR_TX_RATES])
3702                 goto out;
3703
3704         /* The nested attribute uses enum nl80211_band as the index. This maps
3705          * directly to the enum nl80211_band values used in cfg80211.
3706          */
3707         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3708         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3709                 enum nl80211_band band = nla_type(tx_rates);
3710                 int err;
3711
3712                 if (band < 0 || band >= NUM_NL80211_BANDS)
3713                         return -EINVAL;
3714                 sband = rdev->wiphy.bands[band];
3715                 if (sband == NULL)
3716                         return -EINVAL;
3717                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3718                                        nl80211_txattr_policy, info->extack);
3719                 if (err)
3720                         return err;
3721                 if (tb[NL80211_TXRATE_LEGACY]) {
3722                         mask->control[band].legacy = rateset_to_mask(
3723                                 sband,
3724                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3725                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3726                         if ((mask->control[band].legacy == 0) &&
3727                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3728                                 return -EINVAL;
3729                 }
3730                 if (tb[NL80211_TXRATE_HT]) {
3731                         if (!ht_rateset_to_mask(
3732                                         sband,
3733                                         nla_data(tb[NL80211_TXRATE_HT]),
3734                                         nla_len(tb[NL80211_TXRATE_HT]),
3735                 &nbs