net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = __dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_dev(
 172                                                 netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 380         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 381         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 382         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 384                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 385 };
 386
 387 /* policy for the key attributes */
 388 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 389         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 390         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 391         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 392         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 393         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 394         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 395         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 396         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 397 };
 398
 399 /* policy for the key default flags */
 400 static const struct nla_policy
 401 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 402         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 403         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 404 };
 405
 406 /* policy for WoWLAN attributes */
 407 static const struct nla_policy
 408 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 409         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 410         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 411         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 412         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 413         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 414         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 415         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 417         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 418 };
 419
 420 static const struct nla_policy
 421 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 422         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 423         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 424         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 425         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 426         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 427         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 428         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 429                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 430         },
 431         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 432                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 433         },
 434         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 435         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 436         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 437 };
 438
 439 /* policy for coalesce rule attributes */
 440 static const struct nla_policy
 441 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 442         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 443         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 444         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 445 };
 446
 447 /* policy for GTK rekey offload attributes */
 448 static const struct nla_policy
 449 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 450         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 451         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 452         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 453 };
 454
 455 static const struct nla_policy
 456 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 457         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 458                                                  .len = IEEE80211_MAX_SSID_LEN },
 459         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 460 };
 461
 462 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 463                                      struct netlink_callback *cb,
 464                                      struct cfg80211_registered_device **rdev,
 465                                      struct wireless_dev **wdev)
 466 {
 467         int err;
 468
 469         rtnl_lock();
 470
 471         if (!cb->args[0]) {
 472                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 473                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 474                                   nl80211_policy);
 475                 if (err)
 476                         goto out_unlock;
 477
 478                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 479                                                    nl80211_fam.attrbuf);
 480                 if (IS_ERR(*wdev)) {
 481                         err = PTR_ERR(*wdev);
 482                         goto out_unlock;
 483                 }
 484                 *rdev = wiphy_to_dev((*wdev)->wiphy);
 485                 /* 0 is the first index - add 1 to parse only once */
 486                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 487                 cb->args[1] = (*wdev)->identifier;
 488         } else {
 489                 /* subtract the 1 again here */
 490                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 491                 struct wireless_dev *tmp;
 492
 493                 if (!wiphy) {
 494                         err = -ENODEV;
 495                         goto out_unlock;
 496                 }
 497                 *rdev = wiphy_to_dev(wiphy);
 498                 *wdev = NULL;
 499
 500                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 501                         if (tmp->identifier == cb->args[1]) {
 502                                 *wdev = tmp;
 503                                 break;
 504                         }
 505                 }
 506
 507                 if (!*wdev) {
 508                         err = -ENODEV;
 509                         goto out_unlock;
 510                 }
 511         }
 512
 513         return 0;
 514  out_unlock:
 515         rtnl_unlock();
 516         return err;
 517 }
 518
 519 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 520 {
 521         rtnl_unlock();
 522 }
 523
 524 /* IE validation */
 525 static bool is_valid_ie_attr(const struct nlattr *attr)
 526 {
 527         const u8 *pos;
 528         int len;
 529
 530         if (!attr)
 531                 return true;
 532
 533         pos = nla_data(attr);
 534         len = nla_len(attr);
 535
 536         while (len) {
 537                 u8 elemlen;
 538
 539                 if (len < 2)
 540                         return false;
 541                 len -= 2;
 542
 543                 elemlen = pos[1];
 544                 if (elemlen > len)
 545                         return false;
 546
 547                 len -= elemlen;
 548                 pos += 2 + elemlen;
 549         }
 550
 551         return true;
 552 }
 553
 554 /* message building helper */
 555 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 556                                    int flags, u8 cmd)
 557 {
 558         /* since there is no private header just add the generic one */
 559         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 560 }
 561
 562 static int nl80211_msg_put_channel(struct sk_buff *msg,
 563                                    struct ieee80211_channel *chan,
 564                                    bool large)
 565 {
 566         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 567                         chan->center_freq))
 568                 goto nla_put_failure;
 569
 570         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 571             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 572                 goto nla_put_failure;
 573         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 574                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 575                         goto nla_put_failure;
 576                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 577                         goto nla_put_failure;
 578         }
 579         if (chan->flags & IEEE80211_CHAN_RADAR) {
 580                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 581                         goto nla_put_failure;
 582                 if (large) {
 583                         u32 time;
 584
 585                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 586
 587                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 588                                         chan->dfs_state))
 589                                 goto nla_put_failure;
 590                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 591                                         time))
 592                                 goto nla_put_failure;
 593                 }
 594         }
 595
 596         if (large) {
 597                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 598                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 599                         goto nla_put_failure;
 600                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 601                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 602                         goto nla_put_failure;
 603                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 604                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 605                         goto nla_put_failure;
 606                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 607                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 608                         goto nla_put_failure;
 609         }
 610
 611         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 612                         DBM_TO_MBM(chan->max_power)))
 613                 goto nla_put_failure;
 614
 615         return 0;
 616
 617  nla_put_failure:
 618         return -ENOBUFS;
 619 }
 620
 621 /* netlink command implementations */
 622
 623 struct key_parse {
 624         struct key_params p;
 625         int idx;
 626         int type;
 627         bool def, defmgmt;
 628         bool def_uni, def_multi;
 629 };
 630
 631 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 632 {
 633         struct nlattr *tb[NL80211_KEY_MAX + 1];
 634         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 635                                    nl80211_key_policy);
 636         if (err)
 637                 return err;
 638
 639         k->def = !!tb[NL80211_KEY_DEFAULT];
 640         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 641
 642         if (k->def) {
 643                 k->def_uni = true;
 644                 k->def_multi = true;
 645         }
 646         if (k->defmgmt)
 647                 k->def_multi = true;
 648
 649         if (tb[NL80211_KEY_IDX])
 650                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 651
 652         if (tb[NL80211_KEY_DATA]) {
 653                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 654                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 655         }
 656
 657         if (tb[NL80211_KEY_SEQ]) {
 658                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 659                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 660         }
 661
 662         if (tb[NL80211_KEY_CIPHER])
 663                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 664
 665         if (tb[NL80211_KEY_TYPE]) {
 666                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 667                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 668                         return -EINVAL;
 669         }
 670
 671         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 672                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 673                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 674                                        tb[NL80211_KEY_DEFAULT_TYPES],
 675                                        nl80211_key_default_policy);
 676                 if (err)
 677                         return err;
 678
 679                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 680                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 681         }
 682
 683         return 0;
 684 }
 685
 686 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 687 {
 688         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 689                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 690                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 691         }
 692
 693         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 694                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 695                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 696         }
 697
 698         if (info->attrs[NL80211_ATTR_KEY_IDX])
 699                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 700
 701         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 702                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 703
 704         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 705         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 706
 707         if (k->def) {
 708                 k->def_uni = true;
 709                 k->def_multi = true;
 710         }
 711         if (k->defmgmt)
 712                 k->def_multi = true;
 713
 714         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 715                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 716                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 717                         return -EINVAL;
 718         }
 719
 720         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 721                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 722                 int err = nla_parse_nested(
 723                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 724                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 725                                 nl80211_key_default_policy);
 726                 if (err)
 727                         return err;
 728
 729                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 730                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 731         }
 732
 733         return 0;
 734 }
 735
 736 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 737 {
 738         int err;
 739
 740         memset(k, 0, sizeof(*k));
 741         k->idx = -1;
 742         k->type = -1;
 743
 744         if (info->attrs[NL80211_ATTR_KEY])
 745                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 746         else
 747                 err = nl80211_parse_key_old(info, k);
 748
 749         if (err)
 750                 return err;
 751
 752         if (k->def && k->defmgmt)
 753                 return -EINVAL;
 754
 755         if (k->defmgmt) {
 756                 if (k->def_uni || !k->def_multi)
 757                         return -EINVAL;
 758         }
 759
 760         if (k->idx != -1) {
 761                 if (k->defmgmt) {
 762                         if (k->idx < 4 || k->idx > 5)
 763                                 return -EINVAL;
 764                 } else if (k->def) {
 765                         if (k->idx < 0 || k->idx > 3)
 766                                 return -EINVAL;
 767                 } else {
 768                         if (k->idx < 0 || k->idx > 5)
 769                                 return -EINVAL;
 770                 }
 771         }
 772
 773         return 0;
 774 }
 775
 776 static struct cfg80211_cached_keys *
 777 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 778                        struct nlattr *keys, bool *no_ht)
 779 {
 780         struct key_parse parse;
 781         struct nlattr *key;
 782         struct cfg80211_cached_keys *result;
 783         int rem, err, def = 0;
 784
 785         result = kzalloc(sizeof(*result), GFP_KERNEL);
 786         if (!result)
 787                 return ERR_PTR(-ENOMEM);
 788
 789         result->def = -1;
 790         result->defmgmt = -1;
 791
 792         nla_for_each_nested(key, keys, rem) {
 793                 memset(&parse, 0, sizeof(parse));
 794                 parse.idx = -1;
 795
 796                 err = nl80211_parse_key_new(key, &parse);
 797                 if (err)
 798                         goto error;
 799                 err = -EINVAL;
 800                 if (!parse.p.key)
 801                         goto error;
 802                 if (parse.idx < 0 || parse.idx > 4)
 803                         goto error;
 804                 if (parse.def) {
 805                         if (def)
 806                                 goto error;
 807                         def = 1;
 808                         result->def = parse.idx;
 809                         if (!parse.def_uni || !parse.def_multi)
 810                                 goto error;
 811                 } else if (parse.defmgmt)
 812                         goto error;
 813                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 814                                                      parse.idx, false, NULL);
 815                 if (err)
 816                         goto error;
 817                 result->params[parse.idx].cipher = parse.p.cipher;
 818                 result->params[parse.idx].key_len = parse.p.key_len;
 819                 result->params[parse.idx].key = result->data[parse.idx];
 820                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 821
 822                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 823                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 824                         if (no_ht)
 825                                 *no_ht = true;
 826                 }
 827         }
 828
 829         return result;
 830  error:
 831         kfree(result);
 832         return ERR_PTR(err);
 833 }
 834
 835 static int nl80211_key_allowed(struct wireless_dev *wdev)
 836 {
 837         ASSERT_WDEV_LOCK(wdev);
 838
 839         switch (wdev->iftype) {
 840         case NL80211_IFTYPE_AP:
 841         case NL80211_IFTYPE_AP_VLAN:
 842         case NL80211_IFTYPE_P2P_GO:
 843         case NL80211_IFTYPE_MESH_POINT:
 844                 break;
 845         case NL80211_IFTYPE_ADHOC:
 846         case NL80211_IFTYPE_STATION:
 847         case NL80211_IFTYPE_P2P_CLIENT:
 848                 if (!wdev->current_bss)
 849                         return -ENOLINK;
 850                 break;
 851         default:
 852                 return -EINVAL;
 853         }
 854
 855         return 0;
 856 }
 857
 858 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 859 {
 860         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 861         int i;
 862
 863         if (!nl_modes)
 864                 goto nla_put_failure;
 865
 866         i = 0;
 867         while (ifmodes) {
 868                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 869                         goto nla_put_failure;
 870                 ifmodes >>= 1;
 871                 i++;
 872         }
 873
 874         nla_nest_end(msg, nl_modes);
 875         return 0;
 876
 877 nla_put_failure:
 878         return -ENOBUFS;
 879 }
 880
 881 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 882                                           struct sk_buff *msg,
 883                                           bool large)
 884 {
 885         struct nlattr *nl_combis;
 886         int i, j;
 887
 888         nl_combis = nla_nest_start(msg,
 889                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 890         if (!nl_combis)
 891                 goto nla_put_failure;
 892
 893         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 894                 const struct ieee80211_iface_combination *c;
 895                 struct nlattr *nl_combi, *nl_limits;
 896
 897                 c = &wiphy->iface_combinations[i];
 898
 899                 nl_combi = nla_nest_start(msg, i + 1);
 900                 if (!nl_combi)
 901                         goto nla_put_failure;
 902
 903                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 904                 if (!nl_limits)
 905                         goto nla_put_failure;
 906
 907                 for (j = 0; j < c->n_limits; j++) {
 908                         struct nlattr *nl_limit;
 909
 910                         nl_limit = nla_nest_start(msg, j + 1);
 911                         if (!nl_limit)
 912                                 goto nla_put_failure;
 913                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 914                                         c->limits[j].max))
 915                                 goto nla_put_failure;
 916                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 917                                                 c->limits[j].types))
 918                                 goto nla_put_failure;
 919                         nla_nest_end(msg, nl_limit);
 920                 }
 921
 922                 nla_nest_end(msg, nl_limits);
 923
 924                 if (c->beacon_int_infra_match &&
 925                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 926                         goto nla_put_failure;
 927                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 928                                 c->num_different_channels) ||
 929                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 930                                 c->max_interfaces))
 931                         goto nla_put_failure;
 932                 if (large &&
 933                     nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 934                                 c->radar_detect_widths))
 935                         goto nla_put_failure;
 936
 937                 nla_nest_end(msg, nl_combi);
 938         }
 939
 940         nla_nest_end(msg, nl_combis);
 941
 942         return 0;
 943 nla_put_failure:
 944         return -ENOBUFS;
 945 }
 946
 947 #ifdef CONFIG_PM
 948 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 949                                         struct sk_buff *msg)
 950 {
 951         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 952         struct nlattr *nl_tcp;
 953
 954         if (!tcp)
 955                 return 0;
 956
 957         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
 958         if (!nl_tcp)
 959                 return -ENOBUFS;
 960
 961         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 962                         tcp->data_payload_max))
 963                 return -ENOBUFS;
 964
 965         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
 966                         tcp->data_payload_max))
 967                 return -ENOBUFS;
 968
 969         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
 970                 return -ENOBUFS;
 971
 972         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
 973                                 sizeof(*tcp->tok), tcp->tok))
 974                 return -ENOBUFS;
 975
 976         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
 977                         tcp->data_interval_max))
 978                 return -ENOBUFS;
 979
 980         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
 981                         tcp->wake_payload_max))
 982                 return -ENOBUFS;
 983
 984         nla_nest_end(msg, nl_tcp);
 985         return 0;
 986 }
 987
 988 static int nl80211_send_wowlan(struct sk_buff *msg,
 989                                struct cfg80211_registered_device *dev,
 990                                bool large)
 991 {
 992         struct nlattr *nl_wowlan;
 993
 994         if (!dev->wiphy.wowlan)
 995                 return 0;
 996
 997         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
 998         if (!nl_wowlan)
 999                 return -ENOBUFS;
1000
1001         if (((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1002              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1003             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1004              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1005             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1006              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1007             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1008              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1009             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1010              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1011             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1012              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1013             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1014              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1015             ((dev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1016              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1017                 return -ENOBUFS;
1018
1019         if (dev->wiphy.wowlan->n_patterns) {
1020                 struct nl80211_pattern_support pat = {
1021                         .max_patterns = dev->wiphy.wowlan->n_patterns,
1022                         .min_pattern_len = dev->wiphy.wowlan->pattern_min_len,
1023                         .max_pattern_len = dev->wiphy.wowlan->pattern_max_len,
1024                         .max_pkt_offset = dev->wiphy.wowlan->max_pkt_offset,
1025                 };
1026
1027                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1028                             sizeof(pat), &pat))
1029                         return -ENOBUFS;
1030         }
1031
1032         if (large && nl80211_send_wowlan_tcp_caps(dev, msg))
1033                 return -ENOBUFS;
1034
1035         nla_nest_end(msg, nl_wowlan);
1036
1037         return 0;
1038 }
1039 #endif
1040
1041 static int nl80211_send_coalesce(struct sk_buff *msg,
1042                                  struct cfg80211_registered_device *dev)
1043 {
1044         struct nl80211_coalesce_rule_support rule;
1045
1046         if (!dev->wiphy.coalesce)
1047                 return 0;
1048
1049         rule.max_rules = dev->wiphy.coalesce->n_rules;
1050         rule.max_delay = dev->wiphy.coalesce->max_delay;
1051         rule.pat.max_patterns = dev->wiphy.coalesce->n_patterns;
1052         rule.pat.min_pattern_len = dev->wiphy.coalesce->pattern_min_len;
1053         rule.pat.max_pattern_len = dev->wiphy.coalesce->pattern_max_len;
1054         rule.pat.max_pkt_offset = dev->wiphy.coalesce->max_pkt_offset;
1055
1056         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1057                 return -ENOBUFS;
1058
1059         return 0;
1060 }
1061
1062 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1063                                       struct ieee80211_supported_band *sband)
1064 {
1065         struct nlattr *nl_rates, *nl_rate;
1066         struct ieee80211_rate *rate;
1067         int i;
1068
1069         /* add HT info */
1070         if (sband->ht_cap.ht_supported &&
1071             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1072                      sizeof(sband->ht_cap.mcs),
1073                      &sband->ht_cap.mcs) ||
1074              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1075                          sband->ht_cap.cap) ||
1076              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1077                         sband->ht_cap.ampdu_factor) ||
1078              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1079                         sband->ht_cap.ampdu_density)))
1080                 return -ENOBUFS;
1081
1082         /* add VHT info */
1083         if (sband->vht_cap.vht_supported &&
1084             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1085                      sizeof(sband->vht_cap.vht_mcs),
1086                      &sband->vht_cap.vht_mcs) ||
1087              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1088                          sband->vht_cap.cap)))
1089                 return -ENOBUFS;
1090
1091         /* add bitrates */
1092         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1093         if (!nl_rates)
1094                 return -ENOBUFS;
1095
1096         for (i = 0; i < sband->n_bitrates; i++) {
1097                 nl_rate = nla_nest_start(msg, i);
1098                 if (!nl_rate)
1099                         return -ENOBUFS;
1100
1101                 rate = &sband->bitrates[i];
1102                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1103                                 rate->bitrate))
1104                         return -ENOBUFS;
1105                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1106                     nla_put_flag(msg,
1107                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1108                         return -ENOBUFS;
1109
1110                 nla_nest_end(msg, nl_rate);
1111         }
1112
1113         nla_nest_end(msg, nl_rates);
1114
1115         return 0;
1116 }
1117
1118 static int
1119 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1120                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1121 {
1122         u16 stypes;
1123         struct nlattr *nl_ftypes, *nl_ifs;
1124         enum nl80211_iftype ift;
1125         int i;
1126
1127         if (!mgmt_stypes)
1128                 return 0;
1129
1130         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1131         if (!nl_ifs)
1132                 return -ENOBUFS;
1133
1134         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1135                 nl_ftypes = nla_nest_start(msg, ift);
1136                 if (!nl_ftypes)
1137                         return -ENOBUFS;
1138                 i = 0;
1139                 stypes = mgmt_stypes[ift].tx;
1140                 while (stypes) {
1141                         if ((stypes & 1) &&
1142                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1143                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1144                                 return -ENOBUFS;
1145                         stypes >>= 1;
1146                         i++;
1147                 }
1148                 nla_nest_end(msg, nl_ftypes);
1149         }
1150
1151         nla_nest_end(msg, nl_ifs);
1152
1153         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1154         if (!nl_ifs)
1155                 return -ENOBUFS;
1156
1157         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1158                 nl_ftypes = nla_nest_start(msg, ift);
1159                 if (!nl_ftypes)
1160                         return -ENOBUFS;
1161                 i = 0;
1162                 stypes = mgmt_stypes[ift].rx;
1163                 while (stypes) {
1164                         if ((stypes & 1) &&
1165                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1166                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1167                                 return -ENOBUFS;
1168                         stypes >>= 1;
1169                         i++;
1170                 }
1171                 nla_nest_end(msg, nl_ftypes);
1172         }
1173         nla_nest_end(msg, nl_ifs);
1174
1175         return 0;
1176 }
1177
1178 struct nl80211_dump_wiphy_state {
1179         s64 filter_wiphy;
1180         long start;
1181         long split_start, band_start, chan_start;
1182         bool split;
1183 };
1184
1185 static int nl80211_send_wiphy(struct cfg80211_registered_device *dev,
1186                               struct sk_buff *msg, u32 portid, u32 seq,
1187                               int flags, struct nl80211_dump_wiphy_state *state)
1188 {
1189         void *hdr;
1190         struct nlattr *nl_bands, *nl_band;
1191         struct nlattr *nl_freqs, *nl_freq;
1192         struct nlattr *nl_cmds;
1193         enum ieee80211_band band;
1194         struct ieee80211_channel *chan;
1195         int i;
1196         const struct ieee80211_txrx_stypes *mgmt_stypes =
1197                                 dev->wiphy.mgmt_stypes;
1198         u32 features;
1199
1200         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1201         if (!hdr)
1202                 return -ENOBUFS;
1203
1204         if (WARN_ON(!state))
1205                 return -EINVAL;
1206
1207         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, dev->wiphy_idx) ||
1208             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1209                            wiphy_name(&dev->wiphy)) ||
1210             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1211                         cfg80211_rdev_list_generation))
1212                 goto nla_put_failure;
1213
1214         switch (state->split_start) {
1215         case 0:
1216                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1217                                dev->wiphy.retry_short) ||
1218                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1219                                dev->wiphy.retry_long) ||
1220                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1221                                 dev->wiphy.frag_threshold) ||
1222                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1223                                 dev->wiphy.rts_threshold) ||
1224                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1225                                dev->wiphy.coverage_class) ||
1226                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1227                                dev->wiphy.max_scan_ssids) ||
1228                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1229                                dev->wiphy.max_sched_scan_ssids) ||
1230                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1231                                 dev->wiphy.max_scan_ie_len) ||
1232                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1233                                 dev->wiphy.max_sched_scan_ie_len) ||
1234                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1235                                dev->wiphy.max_match_sets))
1236                         goto nla_put_failure;
1237
1238                 if ((dev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1239                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1240                         goto nla_put_failure;
1241                 if ((dev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1242                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1243                         goto nla_put_failure;
1244                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1245                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1246                         goto nla_put_failure;
1247                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1248                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1249                         goto nla_put_failure;
1250                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1251                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1252                         goto nla_put_failure;
1253                 if ((dev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1254                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1255                         goto nla_put_failure;
1256                 state->split_start++;
1257                 if (state->split)
1258                         break;
1259         case 1:
1260                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1261                             sizeof(u32) * dev->wiphy.n_cipher_suites,
1262                             dev->wiphy.cipher_suites))
1263                         goto nla_put_failure;
1264
1265                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1266                                dev->wiphy.max_num_pmkids))
1267                         goto nla_put_failure;
1268
1269                 if ((dev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1270                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1271                         goto nla_put_failure;
1272
1273                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1274                                 dev->wiphy.available_antennas_tx) ||
1275                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1276                                 dev->wiphy.available_antennas_rx))
1277                         goto nla_put_failure;
1278
1279                 if ((dev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1280                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1281                                 dev->wiphy.probe_resp_offload))
1282                         goto nla_put_failure;
1283
1284                 if ((dev->wiphy.available_antennas_tx ||
1285                      dev->wiphy.available_antennas_rx) &&
1286                     dev->ops->get_antenna) {
1287                         u32 tx_ant = 0, rx_ant = 0;
1288                         int res;
1289                         res = rdev_get_antenna(dev, &tx_ant, &rx_ant);
1290                         if (!res) {
1291                                 if (nla_put_u32(msg,
1292                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1293                                                 tx_ant) ||
1294                                     nla_put_u32(msg,
1295                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1296                                                 rx_ant))
1297                                         goto nla_put_failure;
1298                         }
1299                 }
1300
1301                 state->split_start++;
1302                 if (state->split)
1303                         break;
1304         case 2:
1305                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1306                                         dev->wiphy.interface_modes))
1307                                 goto nla_put_failure;
1308                 state->split_start++;
1309                 if (state->split)
1310                         break;
1311         case 3:
1312                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1313                 if (!nl_bands)
1314                         goto nla_put_failure;
1315
1316                 for (band = state->band_start;
1317                      band < IEEE80211_NUM_BANDS; band++) {
1318                         struct ieee80211_supported_band *sband;
1319
1320                         sband = dev->wiphy.bands[band];
1321
1322                         if (!sband)
1323                                 continue;
1324
1325                         nl_band = nla_nest_start(msg, band);
1326                         if (!nl_band)
1327                                 goto nla_put_failure;
1328
1329                         switch (state->chan_start) {
1330                         case 0:
1331                                 if (nl80211_send_band_rateinfo(msg, sband))
1332                                         goto nla_put_failure;
1333                                 state->chan_start++;
1334                                 if (state->split)
1335                                         break;
1336                         default:
1337                                 /* add frequencies */
1338                                 nl_freqs = nla_nest_start(
1339                                         msg, NL80211_BAND_ATTR_FREQS);
1340                                 if (!nl_freqs)
1341                                         goto nla_put_failure;
1342
1343                                 for (i = state->chan_start - 1;
1344                                      i < sband->n_channels;
1345                                      i++) {
1346                                         nl_freq = nla_nest_start(msg, i);
1347                                         if (!nl_freq)
1348                                                 goto nla_put_failure;
1349
1350                                         chan = &sband->channels[i];
1351
1352                                         if (nl80211_msg_put_channel(
1353                                                         msg, chan,
1354                                                         state->split))
1355                                                 goto nla_put_failure;
1356
1357                                         nla_nest_end(msg, nl_freq);
1358                                         if (state->split)
1359                                                 break;
1360                                 }
1361                                 if (i < sband->n_channels)
1362                                         state->chan_start = i + 2;
1363                                 else
1364                                         state->chan_start = 0;
1365                                 nla_nest_end(msg, nl_freqs);
1366                         }
1367
1368                         nla_nest_end(msg, nl_band);
1369
1370                         if (state->split) {
1371                                 /* start again here */
1372                                 if (state->chan_start)
1373                                         band--;
1374                                 break;
1375                         }
1376                 }
1377                 nla_nest_end(msg, nl_bands);
1378
1379                 if (band < IEEE80211_NUM_BANDS)
1380                         state->band_start = band + 1;
1381                 else
1382                         state->band_start = 0;
1383
1384                 /* if bands & channels are done, continue outside */
1385                 if (state->band_start == 0 && state->chan_start == 0)
1386                         state->split_start++;
1387                 if (state->split)
1388                         break;
1389         case 4:
1390                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1391                 if (!nl_cmds)
1392                         goto nla_put_failure;
1393
1394                 i = 0;
1395 #define CMD(op, n)                                                      \
1396                  do {                                                   \
1397                         if (dev->ops->op) {                             \
1398                                 i++;                                    \
1399                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1400                                         goto nla_put_failure;           \
1401                         }                                               \
1402                 } while (0)
1403
1404                 CMD(add_virtual_intf, NEW_INTERFACE);
1405                 CMD(change_virtual_intf, SET_INTERFACE);
1406                 CMD(add_key, NEW_KEY);
1407                 CMD(start_ap, START_AP);
1408                 CMD(add_station, NEW_STATION);
1409                 CMD(add_mpath, NEW_MPATH);
1410                 CMD(update_mesh_config, SET_MESH_CONFIG);
1411                 CMD(change_bss, SET_BSS);
1412                 CMD(auth, AUTHENTICATE);
1413                 CMD(assoc, ASSOCIATE);
1414                 CMD(deauth, DEAUTHENTICATE);
1415                 CMD(disassoc, DISASSOCIATE);
1416                 CMD(join_ibss, JOIN_IBSS);
1417                 CMD(join_mesh, JOIN_MESH);
1418                 CMD(set_pmksa, SET_PMKSA);
1419                 CMD(del_pmksa, DEL_PMKSA);
1420                 CMD(flush_pmksa, FLUSH_PMKSA);
1421                 if (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1422                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1423                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1424                 CMD(mgmt_tx, FRAME);
1425                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1426                 if (dev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1427                         i++;
1428                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1429                                 goto nla_put_failure;
1430                 }
1431                 if (dev->ops->set_monitor_channel || dev->ops->start_ap ||
1432                     dev->ops->join_mesh) {
1433                         i++;
1434                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1435                                 goto nla_put_failure;
1436                 }
1437                 CMD(set_wds_peer, SET_WDS_PEER);
1438                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1439                         CMD(tdls_mgmt, TDLS_MGMT);
1440                         CMD(tdls_oper, TDLS_OPER);
1441                 }
1442                 if (dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1443                         CMD(sched_scan_start, START_SCHED_SCAN);
1444                 CMD(probe_client, PROBE_CLIENT);
1445                 CMD(set_noack_map, SET_NOACK_MAP);
1446                 if (dev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1447                         i++;
1448                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1449                                 goto nla_put_failure;
1450                 }
1451                 CMD(start_p2p_device, START_P2P_DEVICE);
1452                 CMD(set_mcast_rate, SET_MCAST_RATE);
1453                 if (state->split) {
1454                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1455                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1456                         if (dev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1457                                 CMD(channel_switch, CHANNEL_SWITCH);
1458                 }
1459                 CMD(set_qos_map, SET_QOS_MAP);
1460
1461 #ifdef CONFIG_NL80211_TESTMODE
1462                 CMD(testmode_cmd, TESTMODE);
1463 #endif
1464
1465 #undef CMD
1466
1467                 if (dev->ops->connect || dev->ops->auth) {
1468                         i++;
1469                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1470                                 goto nla_put_failure;
1471                 }
1472
1473                 if (dev->ops->disconnect || dev->ops->deauth) {
1474                         i++;
1475                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1476                                 goto nla_put_failure;
1477                 }
1478
1479                 nla_nest_end(msg, nl_cmds);
1480                 state->split_start++;
1481                 if (state->split)
1482                         break;
1483         case 5:
1484                 if (dev->ops->remain_on_channel &&
1485                     (dev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1486                     nla_put_u32(msg,
1487                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1488                                 dev->wiphy.max_remain_on_channel_duration))
1489                         goto nla_put_failure;
1490
1491                 if ((dev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1492                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1493                         goto nla_put_failure;
1494
1495                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1496                         goto nla_put_failure;
1497                 state->split_start++;
1498                 if (state->split)
1499                         break;
1500         case 6:
1501 #ifdef CONFIG_PM
1502                 if (nl80211_send_wowlan(msg, dev, state->split))
1503                         goto nla_put_failure;
1504                 state->split_start++;
1505                 if (state->split)
1506                         break;
1507 #else
1508                 state->split_start++;
1509 #endif
1510         case 7:
1511                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1512                                         dev->wiphy.software_iftypes))
1513                         goto nla_put_failure;
1514
1515                 if (nl80211_put_iface_combinations(&dev->wiphy, msg,
1516                                                    state->split))
1517                         goto nla_put_failure;
1518
1519                 state->split_start++;
1520                 if (state->split)
1521                         break;
1522         case 8:
1523                 if ((dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1524                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1525                                 dev->wiphy.ap_sme_capa))
1526                         goto nla_put_failure;
1527
1528                 features = dev->wiphy.features;
1529                 /*
1530                  * We can only add the per-channel limit information if the
1531                  * dump is split, otherwise it makes it too big. Therefore
1532                  * only advertise it in that case.
1533                  */
1534                 if (state->split)
1535                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1536                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1537                         goto nla_put_failure;
1538
1539                 if (dev->wiphy.ht_capa_mod_mask &&
1540                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1541                             sizeof(*dev->wiphy.ht_capa_mod_mask),
1542                             dev->wiphy.ht_capa_mod_mask))
1543                         goto nla_put_failure;
1544
1545                 if (dev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1546                     dev->wiphy.max_acl_mac_addrs &&
1547                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1548                                 dev->wiphy.max_acl_mac_addrs))
1549                         goto nla_put_failure;
1550
1551                 /*
1552                  * Any information below this point is only available to
1553                  * applications that can deal with it being split. This
1554                  * helps ensure that newly added capabilities don't break
1555                  * older tools by overrunning their buffers.
1556                  *
1557                  * We still increment split_start so that in the split
1558                  * case we'll continue with more data in the next round,
1559                  * but break unconditionally so unsplit data stops here.
1560                  */
1561                 state->split_start++;
1562                 break;
1563         case 9:
1564                 if (dev->wiphy.extended_capabilities &&
1565                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1566                              dev->wiphy.extended_capabilities_len,
1567                              dev->wiphy.extended_capabilities) ||
1568                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1569                              dev->wiphy.extended_capabilities_len,
1570                              dev->wiphy.extended_capabilities_mask)))
1571                         goto nla_put_failure;
1572
1573                 if (dev->wiphy.vht_capa_mod_mask &&
1574                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1575                             sizeof(*dev->wiphy.vht_capa_mod_mask),
1576                             dev->wiphy.vht_capa_mod_mask))
1577                         goto nla_put_failure;
1578
1579                 state->split_start++;
1580                 break;
1581         case 10:
1582                 if (nl80211_send_coalesce(msg, dev))
1583                         goto nla_put_failure;
1584
1585                 if ((dev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1586                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1587                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1588                         goto nla_put_failure;
1589                 state->split_start++;
1590                 break;
1591         case 11:
1592                 if (dev->wiphy.n_vendor_commands) {
1593                         const struct nl80211_vendor_cmd_info *info;
1594                         struct nlattr *nested;
1595
1596                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1597                         if (!nested)
1598                                 goto nla_put_failure;
1599
1600                         for (i = 0; i < dev->wiphy.n_vendor_commands; i++) {
1601                                 info = &dev->wiphy.vendor_commands[i].info;
1602                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1603                                         goto nla_put_failure;
1604                         }
1605                         nla_nest_end(msg, nested);
1606                 }
1607
1608                 if (dev->wiphy.n_vendor_events) {
1609                         const struct nl80211_vendor_cmd_info *info;
1610                         struct nlattr *nested;
1611
1612                         nested = nla_nest_start(msg,
1613                                                 NL80211_ATTR_VENDOR_EVENTS);
1614                         if (!nested)
1615                                 goto nla_put_failure;
1616
1617                         for (i = 0; i < dev->wiphy.n_vendor_events; i++) {
1618                                 info = &dev->wiphy.vendor_events[i];
1619                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1620                                         goto nla_put_failure;
1621                         }
1622                         nla_nest_end(msg, nested);
1623                 }
1624
1625                 /* done */
1626                 state->split_start = 0;
1627                 break;
1628         }
1629         return genlmsg_end(msg, hdr);
1630
1631  nla_put_failure:
1632         genlmsg_cancel(msg, hdr);
1633         return -EMSGSIZE;
1634 }
1635
1636 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1637                                     struct netlink_callback *cb,
1638                                     struct nl80211_dump_wiphy_state *state)
1639 {
1640         struct nlattr **tb = nl80211_fam.attrbuf;
1641         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1642                               tb, nl80211_fam.maxattr, nl80211_policy);
1643         /* ignore parse errors for backward compatibility */
1644         if (ret)
1645                 return 0;
1646
1647         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1648         if (tb[NL80211_ATTR_WIPHY])
1649                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1650         if (tb[NL80211_ATTR_WDEV])
1651                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1652         if (tb[NL80211_ATTR_IFINDEX]) {
1653                 struct net_device *netdev;
1654                 struct cfg80211_registered_device *rdev;
1655                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1656
1657                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1658                 if (!netdev)
1659                         return -ENODEV;
1660                 if (netdev->ieee80211_ptr) {
1661                         rdev = wiphy_to_dev(
1662                                 netdev->ieee80211_ptr->wiphy);
1663                         state->filter_wiphy = rdev->wiphy_idx;
1664                 }
1665         }
1666
1667         return 0;
1668 }
1669
1670 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1671 {
1672         int idx = 0, ret;
1673         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1674         struct cfg80211_registered_device *dev;
1675
1676         rtnl_lock();
1677         if (!state) {
1678                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1679                 if (!state) {
1680                         rtnl_unlock();
1681                         return -ENOMEM;
1682                 }
1683                 state->filter_wiphy = -1;
1684                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1685                 if (ret) {
1686                         kfree(state);
1687                         rtnl_unlock();
1688                         return ret;
1689                 }
1690                 cb->args[0] = (long)state;
1691         }
1692
1693         list_for_each_entry(dev, &cfg80211_rdev_list, list) {
1694                 if (!net_eq(wiphy_net(&dev->wiphy), sock_net(skb->sk)))
1695                         continue;
1696                 if (++idx <= state->start)
1697                         continue;
1698                 if (state->filter_wiphy != -1 &&
1699                     state->filter_wiphy != dev->wiphy_idx)
1700                         continue;
1701                 /* attempt to fit multiple wiphy data chunks into the skb */
1702                 do {
1703                         ret = nl80211_send_wiphy(dev, skb,
1704                                                  NETLINK_CB(cb->skb).portid,
1705                                                  cb->nlh->nlmsg_seq,
1706                                                  NLM_F_MULTI, state);
1707                         if (ret < 0) {
1708                                 /*
1709                                  * If sending the wiphy data didn't fit (ENOBUFS
1710                                  * or EMSGSIZE returned), this SKB is still
1711                                  * empty (so it's not too big because another
1712                                  * wiphy dataset is already in the skb) and
1713                                  * we've not tried to adjust the dump allocation
1714                                  * yet ... then adjust the alloc size to be
1715                                  * bigger, and return 1 but with the empty skb.
1716                                  * This results in an empty message being RX'ed
1717                                  * in userspace, but that is ignored.
1718                                  *
1719                                  * We can then retry with the larger buffer.
1720                                  */
1721                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1722                                     !skb->len && !state->split &&
1723                                     cb->min_dump_alloc < 4096) {
1724                                         cb->min_dump_alloc = 4096;
1725                                         state->split_start = 0;
1726                                         rtnl_unlock();
1727                                         return 1;
1728                                 }
1729                                 idx--;
1730                                 break;
1731                         }
1732                 } while (state->split_start > 0);
1733                 break;
1734         }
1735         rtnl_unlock();
1736
1737         state->start = idx;
1738
1739         return skb->len;
1740 }
1741
1742 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1743 {
1744         kfree((void *)cb->args[0]);
1745         return 0;
1746 }
1747
1748 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1749 {
1750         struct sk_buff *msg;
1751         struct cfg80211_registered_device *dev = info->user_ptr[0];
1752         struct nl80211_dump_wiphy_state state = {};
1753
1754         msg = nlmsg_new(4096, GFP_KERNEL);
1755         if (!msg)
1756                 return -ENOMEM;
1757
1758         if (nl80211_send_wiphy(dev, msg, info->snd_portid, info->snd_seq, 0,
1759                                &state) < 0) {
1760                 nlmsg_free(msg);
1761                 return -ENOBUFS;
1762         }
1763
1764         return genlmsg_reply(msg, info);
1765 }
1766
1767 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1768         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1769         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1770         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1771         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1772         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1773 };
1774
1775 static int parse_txq_params(struct nlattr *tb[],
1776                             struct ieee80211_txq_params *txq_params)
1777 {
1778         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1779             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1780             !tb[NL80211_TXQ_ATTR_AIFS])
1781                 return -EINVAL;
1782
1783         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1784         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1785         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1786         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1787         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1788
1789         if (txq_params->ac >= NL80211_NUM_ACS)
1790                 return -EINVAL;
1791
1792         return 0;
1793 }
1794
1795 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1796 {
1797         /*
1798          * You can only set the channel explicitly for WDS interfaces,
1799          * all others have their channel managed via their respective
1800          * "establish a connection" command (connect, join, ...)
1801          *
1802          * For AP/GO and mesh mode, the channel can be set with the
1803          * channel userspace API, but is only stored and passed to the
1804          * low-level driver when the AP starts or the mesh is joined.
1805          * This is for backward compatibility, userspace can also give
1806          * the channel in the start-ap or join-mesh commands instead.
1807          *
1808          * Monitors are special as they are normally slaved to
1809          * whatever else is going on, so they have their own special
1810          * operation to set the monitor channel if possible.
1811          */
1812         return !wdev ||
1813                 wdev->iftype == NL80211_IFTYPE_AP ||
1814                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1815                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1816                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1817 }
1818
1819 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1820                                  struct genl_info *info,
1821                                  struct cfg80211_chan_def *chandef)
1822 {
1823         u32 control_freq;
1824
1825         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1826                 return -EINVAL;
1827
1828         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1829
1830         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1831         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1832         chandef->center_freq1 = control_freq;
1833         chandef->center_freq2 = 0;
1834
1835         /* Primary channel not allowed */
1836         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1837                 return -EINVAL;
1838
1839         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1840                 enum nl80211_channel_type chantype;
1841
1842                 chantype = nla_get_u32(
1843                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1844
1845                 switch (chantype) {
1846                 case NL80211_CHAN_NO_HT:
1847                 case NL80211_CHAN_HT20:
1848                 case NL80211_CHAN_HT40PLUS:
1849                 case NL80211_CHAN_HT40MINUS:
1850                         cfg80211_chandef_create(chandef, chandef->chan,
1851                                                 chantype);
1852                         break;
1853                 default:
1854                         return -EINVAL;
1855                 }
1856         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1857                 chandef->width =
1858                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1859                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1860                         chandef->center_freq1 =
1861                                 nla_get_u32(
1862                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1863                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1864                         chandef->center_freq2 =
1865                                 nla_get_u32(
1866                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1867         }
1868
1869         if (!cfg80211_chandef_valid(chandef))
1870                 return -EINVAL;
1871
1872         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1873                                      IEEE80211_CHAN_DISABLED))
1874                 return -EINVAL;
1875
1876         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1877              chandef->width == NL80211_CHAN_WIDTH_10) &&
1878             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1879                 return -EINVAL;
1880
1881         return 0;
1882 }
1883
1884 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1885                                  struct wireless_dev *wdev,
1886                                  struct genl_info *info)
1887 {
1888         struct cfg80211_chan_def chandef;
1889         int result;
1890         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1891
1892         if (wdev)
1893                 iftype = wdev->iftype;
1894
1895         if (!nl80211_can_set_dev_channel(wdev))
1896                 return -EOPNOTSUPP;
1897
1898         result = nl80211_parse_chandef(rdev, info, &chandef);
1899         if (result)
1900                 return result;
1901
1902         switch (iftype) {
1903         case NL80211_IFTYPE_AP:
1904         case NL80211_IFTYPE_P2P_GO:
1905                 if (wdev->beacon_interval) {
1906                         result = -EBUSY;
1907                         break;
1908                 }
1909                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef)) {
1910                         result = -EINVAL;
1911                         break;
1912                 }
1913                 wdev->preset_chandef = chandef;
1914                 result = 0;
1915                 break;
1916         case NL80211_IFTYPE_MESH_POINT:
1917                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1918                 break;
1919         case NL80211_IFTYPE_MONITOR:
1920                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1921                 break;
1922         default:
1923                 result = -EINVAL;
1924         }
1925
1926         return result;
1927 }
1928
1929 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1930 {
1931         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1932         struct net_device *netdev = info->user_ptr[1];
1933
1934         return __nl80211_set_channel(rdev, netdev->ieee80211_ptr, info);
1935 }
1936
1937 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
1938 {
1939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1940         struct net_device *dev = info->user_ptr[1];
1941         struct wireless_dev *wdev = dev->ieee80211_ptr;
1942         const u8 *bssid;
1943
1944         if (!info->attrs[NL80211_ATTR_MAC])
1945                 return -EINVAL;
1946
1947         if (netif_running(dev))
1948                 return -EBUSY;
1949
1950         if (!rdev->ops->set_wds_peer)
1951                 return -EOPNOTSUPP;
1952
1953         if (wdev->iftype != NL80211_IFTYPE_WDS)
1954                 return -EOPNOTSUPP;
1955
1956         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
1957         return rdev_set_wds_peer(rdev, dev, bssid);
1958 }
1959
1960
1961 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1962 {
1963         struct cfg80211_registered_device *rdev;
1964         struct net_device *netdev = NULL;
1965         struct wireless_dev *wdev;
1966         int result = 0, rem_txq_params = 0;
1967         struct nlattr *nl_txq_params;
1968         u32 changed;
1969         u8 retry_short = 0, retry_long = 0;
1970         u32 frag_threshold = 0, rts_threshold = 0;
1971         u8 coverage_class = 0;
1972
1973         ASSERT_RTNL();
1974
1975         /*
1976          * Try to find the wiphy and netdev. Normally this
1977          * function shouldn't need the netdev, but this is
1978          * done for backward compatibility -- previously
1979          * setting the channel was done per wiphy, but now
1980          * it is per netdev. Previous userland like hostapd
1981          * also passed a netdev to set_wiphy, so that it is
1982          * possible to let that go to the right netdev!
1983          */
1984
1985         if (info->attrs[NL80211_ATTR_IFINDEX]) {
1986                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
1987
1988                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
1989                 if (netdev && netdev->ieee80211_ptr)
1990                         rdev = wiphy_to_dev(netdev->ieee80211_ptr->wiphy);
1991                 else
1992                         netdev = NULL;
1993         }
1994
1995         if (!netdev) {
1996                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
1997                                                   info->attrs);
1998                 if (IS_ERR(rdev))
1999                         return PTR_ERR(rdev);
2000                 wdev = NULL;
2001                 netdev = NULL;
2002                 result = 0;
2003         } else
2004                 wdev = netdev->ieee80211_ptr;
2005
2006         /*
2007          * end workaround code, by now the rdev is available
2008          * and locked, and wdev may or may not be NULL.
2009          */
2010
2011         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2012                 result = cfg80211_dev_rename(
2013                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2014
2015         if (result)
2016                 return result;
2017
2018         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2019                 struct ieee80211_txq_params txq_params;
2020                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2021
2022                 if (!rdev->ops->set_txq_params)
2023                         return -EOPNOTSUPP;
2024
2025                 if (!netdev)
2026                         return -EINVAL;
2027
2028                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2029                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2030                         return -EINVAL;
2031
2032                 if (!netif_running(netdev))
2033                         return -ENETDOWN;
2034
2035                 nla_for_each_nested(nl_txq_params,
2036                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2037                                     rem_txq_params) {
2038                         nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2039                                   nla_data(nl_txq_params),
2040                                   nla_len(nl_txq_params),
2041                                   txq_params_policy);
2042                         result = parse_txq_params(tb, &txq_params);
2043                         if (result)
2044                                 return result;
2045
2046                         result = rdev_set_txq_params(rdev, netdev,
2047                                                      &txq_params);
2048                         if (result)
2049                                 return result;
2050                 }
2051         }
2052
2053         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2054                 result = __nl80211_set_channel(rdev,
2055                                 nl80211_can_set_dev_channel(wdev) ? wdev : NULL,
2056                                 info);
2057                 if (result)
2058                         return result;
2059         }
2060
2061         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2062                 struct wireless_dev *txp_wdev = wdev;
2063                 enum nl80211_tx_power_setting type;
2064                 int idx, mbm = 0;
2065
2066                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2067                         txp_wdev = NULL;
2068
2069                 if (!rdev->ops->set_tx_power)
2070                         return -EOPNOTSUPP;
2071
2072                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2073                 type = nla_get_u32(info->attrs[idx]);
2074
2075                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2076                     (type != NL80211_TX_POWER_AUTOMATIC))
2077                         return -EINVAL;
2078
2079                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2080                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2081                         mbm = nla_get_u32(info->attrs[idx]);
2082                 }
2083
2084                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2085                 if (result)
2086                         return result;
2087         }
2088
2089         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2090             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2091                 u32 tx_ant, rx_ant;
2092                 if ((!rdev->wiphy.available_antennas_tx &&
2093                      !rdev->wiphy.available_antennas_rx) ||
2094                     !rdev->ops->set_antenna)
2095                         return -EOPNOTSUPP;
2096
2097                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2098                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2099
2100                 /* reject antenna configurations which don't match the
2101                  * available antenna masks, except for the "all" mask */
2102                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2103                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2104                         return -EINVAL;
2105
2106                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2107                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2108
2109                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2110                 if (result)
2111                         return result;
2112         }
2113
2114         changed = 0;
2115
2116         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2117                 retry_short = nla_get_u8(
2118                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2119                 if (retry_short == 0)
2120                         return -EINVAL;
2121
2122                 changed |= WIPHY_PARAM_RETRY_SHORT;
2123         }
2124
2125         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2126                 retry_long = nla_get_u8(
2127                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2128                 if (retry_long == 0)
2129                         return -EINVAL;
2130
2131                 changed |= WIPHY_PARAM_RETRY_LONG;
2132         }
2133
2134         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2135                 frag_threshold = nla_get_u32(
2136                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2137                 if (frag_threshold < 256)
2138                         return -EINVAL;
2139
2140                 if (frag_threshold != (u32) -1) {
2141                         /*
2142                          * Fragments (apart from the last one) are required to
2143                          * have even length. Make the fragmentation code
2144                          * simpler by stripping LSB should someone try to use
2145                          * odd threshold value.
2146                          */
2147                         frag_threshold &= ~0x1;
2148                 }
2149                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2150         }
2151
2152         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2153                 rts_threshold = nla_get_u32(
2154                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2155                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2156         }
2157
2158         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2159                 coverage_class = nla_get_u8(
2160                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2161                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2162         }
2163
2164         if (changed) {
2165                 u8 old_retry_short, old_retry_long;
2166                 u32 old_frag_threshold, old_rts_threshold;
2167                 u8 old_coverage_class;
2168
2169                 if (!rdev->ops->set_wiphy_params)
2170                         return -EOPNOTSUPP;
2171
2172                 old_retry_short = rdev->wiphy.retry_short;
2173                 old_retry_long = rdev->wiphy.retry_long;
2174                 old_frag_threshold = rdev->wiphy.frag_threshold;
2175                 old_rts_threshold = rdev->wiphy.rts_threshold;
2176                 old_coverage_class = rdev->wiphy.coverage_class;
2177
2178                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2179                         rdev->wiphy.retry_short = retry_short;
2180                 if (changed & WIPHY_PARAM_RETRY_LONG)
2181                         rdev->wiphy.retry_long = retry_long;
2182                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2183                         rdev->wiphy.frag_threshold = frag_threshold;
2184                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2185                         rdev->wiphy.rts_threshold = rts_threshold;
2186                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2187                         rdev->wiphy.coverage_class = coverage_class;
2188
2189                 result = rdev_set_wiphy_params(rdev, changed);
2190                 if (result) {
2191                         rdev->wiphy.retry_short = old_retry_short;
2192                         rdev->wiphy.retry_long = old_retry_long;
2193                         rdev->wiphy.frag_threshold = old_frag_threshold;
2194                         rdev->wiphy.rts_threshold = old_rts_threshold;
2195                         rdev->wiphy.coverage_class = old_coverage_class;
2196                 }
2197         }
2198         return 0;
2199 }
2200
2201 static inline u64 wdev_id(struct wireless_dev *wdev)
2202 {
2203         return (u64)wdev->identifier |
2204                ((u64)wiphy_to_dev(wdev->wiphy)->wiphy_idx << 32);
2205 }
2206
2207 static int nl80211_send_chandef(struct sk_buff *msg,
2208                                 const struct cfg80211_chan_def *chandef)
2209 {
2210         WARN_ON(!cfg80211_chandef_valid(chandef));
2211
2212         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2213                         chandef->chan->center_freq))
2214                 return -ENOBUFS;
2215         switch (chandef->width) {
2216         case NL80211_CHAN_WIDTH_20_NOHT:
2217         case NL80211_CHAN_WIDTH_20:
2218         case NL80211_CHAN_WIDTH_40:
2219                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2220                                 cfg80211_get_chandef_type(chandef)))
2221                         return -ENOBUFS;
2222                 break;
2223         default:
2224                 break;
2225         }
2226         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2227                 return -ENOBUFS;
2228         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2229                 return -ENOBUFS;
2230         if (chandef->center_freq2 &&
2231             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2232                 return -ENOBUFS;
2233         return 0;
2234 }
2235
2236 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2237                               struct cfg80211_registered_device *rdev,
2238                               struct wireless_dev *wdev)
2239 {
2240         struct net_device *dev = wdev->netdev;
2241         void *hdr;
2242
2243         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2244         if (!hdr)
2245                 return -1;
2246
2247         if (dev &&
2248             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2249              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2250                 goto nla_put_failure;
2251
2252         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2253             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2254             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2255             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2256             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2257                         rdev->devlist_generation ^
2258                         (cfg80211_rdev_list_generation << 2)))
2259                 goto nla_put_failure;
2260
2261         if (rdev->ops->get_channel) {
2262                 int ret;
2263                 struct cfg80211_chan_def chandef;
2264
2265                 ret = rdev_get_channel(rdev, wdev, &chandef);
2266                 if (ret == 0) {
2267                         if (nl80211_send_chandef(msg, &chandef))
2268                                 goto nla_put_failure;
2269                 }
2270         }
2271
2272         if (wdev->ssid_len) {
2273                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2274                         goto nla_put_failure;
2275         }
2276
2277         return genlmsg_end(msg, hdr);
2278
2279  nla_put_failure:
2280         genlmsg_cancel(msg, hdr);
2281         return -EMSGSIZE;
2282 }
2283
2284 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2285 {
2286         int wp_idx = 0;
2287         int if_idx = 0;
2288         int wp_start = cb->args[0];
2289         int if_start = cb->args[1];
2290         struct cfg80211_registered_device *rdev;
2291         struct wireless_dev *wdev;
2292
2293         rtnl_lock();
2294         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2295                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2296                         continue;
2297                 if (wp_idx < wp_start) {
2298                         wp_idx++;
2299                         continue;
2300                 }
2301                 if_idx = 0;
2302
2303                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2304                         if (if_idx < if_start) {
2305                                 if_idx++;
2306                                 continue;
2307                         }
2308                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2309                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2310                                                rdev, wdev) < 0) {
2311                                 goto out;
2312                         }
2313                         if_idx++;
2314                 }
2315
2316                 wp_idx++;
2317         }
2318  out:
2319         rtnl_unlock();
2320
2321         cb->args[0] = wp_idx;
2322         cb->args[1] = if_idx;
2323
2324         return skb->len;
2325 }
2326
2327 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2328 {
2329         struct sk_buff *msg;
2330         struct cfg80211_registered_device *dev = info->user_ptr[0];
2331         struct wireless_dev *wdev = info->user_ptr[1];
2332
2333         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2334         if (!msg)
2335                 return -ENOMEM;
2336
2337         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2338                                dev, wdev) < 0) {
2339                 nlmsg_free(msg);
2340                 return -ENOBUFS;
2341         }
2342
2343         return genlmsg_reply(msg, info);
2344 }
2345
2346 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2347         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2348         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2349         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2350         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2351         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2352         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2353 };
2354
2355 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2356 {
2357         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2358         int flag;
2359
2360         *mntrflags = 0;
2361
2362         if (!nla)
2363                 return -EINVAL;
2364
2365         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2366                              nla, mntr_flags_policy))
2367                 return -EINVAL;
2368
2369         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2370                 if (flags[flag])
2371                         *mntrflags |= (1<<flag);
2372
2373         return 0;
2374 }
2375
2376 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2377                                struct net_device *netdev, u8 use_4addr,
2378                                enum nl80211_iftype iftype)
2379 {
2380         if (!use_4addr) {
2381                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2382                         return -EBUSY;
2383                 return 0;
2384         }
2385
2386         switch (iftype) {
2387         case NL80211_IFTYPE_AP_VLAN:
2388                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2389                         return 0;
2390                 break;
2391         case NL80211_IFTYPE_STATION:
2392                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2393                         return 0;
2394                 break;
2395         default:
2396                 break;
2397         }
2398
2399         return -EOPNOTSUPP;
2400 }
2401
2402 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2403 {
2404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2405         struct vif_params params;
2406         int err;
2407         enum nl80211_iftype otype, ntype;
2408         struct net_device *dev = info->user_ptr[1];
2409         u32 _flags, *flags = NULL;
2410         bool change = false;
2411
2412         memset(&params, 0, sizeof(params));
2413
2414         otype = ntype = dev->ieee80211_ptr->iftype;
2415
2416         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2417                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2418                 if (otype != ntype)
2419                         change = true;
2420                 if (ntype > NL80211_IFTYPE_MAX)
2421                         return -EINVAL;
2422         }
2423
2424         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2425                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2426
2427                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2428                         return -EINVAL;
2429                 if (netif_running(dev))
2430                         return -EBUSY;
2431
2432                 wdev_lock(wdev);
2433                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2434                              IEEE80211_MAX_MESH_ID_LEN);
2435                 wdev->mesh_id_up_len =
2436                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2437                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2438                        wdev->mesh_id_up_len);
2439                 wdev_unlock(wdev);
2440         }
2441
2442         if (info->attrs[NL80211_ATTR_4ADDR]) {
2443                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2444                 change = true;
2445                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2446                 if (err)
2447                         return err;
2448         } else {
2449                 params.use_4addr = -1;
2450         }
2451
2452         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2453                 if (ntype != NL80211_IFTYPE_MONITOR)
2454                         return -EINVAL;
2455                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2456                                           &_flags);
2457                 if (err)
2458                         return err;
2459
2460                 flags = &_flags;
2461                 change = true;
2462         }
2463
2464         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2465             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2466                 return -EOPNOTSUPP;
2467
2468         if (change)
2469                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2470         else
2471                 err = 0;
2472
2473         if (!err && params.use_4addr != -1)
2474                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2475
2476         return err;
2477 }
2478
2479 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2480 {
2481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2482         struct vif_params params;
2483         struct wireless_dev *wdev;
2484         struct sk_buff *msg;
2485         int err;
2486         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2487         u32 flags;
2488
2489         memset(&params, 0, sizeof(params));
2490
2491         if (!info->attrs[NL80211_ATTR_IFNAME])
2492                 return -EINVAL;
2493
2494         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2495                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2496                 if (type > NL80211_IFTYPE_MAX)
2497                         return -EINVAL;
2498         }
2499
2500         if (!rdev->ops->add_virtual_intf ||
2501             !(rdev->wiphy.interface_modes & (1 << type)))
2502                 return -EOPNOTSUPP;
2503
2504         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2505                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2506                            ETH_ALEN);
2507                 if (!is_valid_ether_addr(params.macaddr))
2508                         return -EADDRNOTAVAIL;
2509         }
2510
2511         if (info->attrs[NL80211_ATTR_4ADDR]) {
2512                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2513                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2514                 if (err)
2515                         return err;
2516         }
2517
2518         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2519         if (!msg)
2520                 return -ENOMEM;
2521
2522         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2523                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2524                                   &flags);
2525
2526         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2527             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2528                 return -EOPNOTSUPP;
2529
2530         wdev = rdev_add_virtual_intf(rdev,
2531                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2532                                 type, err ? NULL : &flags, &params);
2533         if (IS_ERR(wdev)) {
2534                 nlmsg_free(msg);
2535                 return PTR_ERR(wdev);
2536         }
2537
2538         switch (type) {
2539         case NL80211_IFTYPE_MESH_POINT:
2540                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2541                         break;
2542                 wdev_lock(wdev);
2543                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2544                              IEEE80211_MAX_MESH_ID_LEN);
2545                 wdev->mesh_id_up_len =
2546                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2547                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2548                        wdev->mesh_id_up_len);
2549                 wdev_unlock(wdev);
2550                 break;
2551         case NL80211_IFTYPE_P2P_DEVICE:
2552                 /*
2553                  * P2P Device doesn't have a netdev, so doesn't go
2554                  * through the netdev notifier and must be added here
2555                  */
2556                 mutex_init(&wdev->mtx);
2557                 INIT_LIST_HEAD(&wdev->event_list);
2558                 spin_lock_init(&wdev->event_lock);
2559                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2560                 spin_lock_init(&wdev->mgmt_registrations_lock);
2561
2562                 wdev->identifier = ++rdev->wdev_id;
2563                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2564                 rdev->devlist_generation++;
2565                 break;
2566         default:
2567                 break;
2568         }
2569
2570         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2571                                rdev, wdev) < 0) {
2572                 nlmsg_free(msg);
2573                 return -ENOBUFS;
2574         }
2575
2576         return genlmsg_reply(msg, info);
2577 }
2578
2579 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2580 {
2581         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2582         struct wireless_dev *wdev = info->user_ptr[1];
2583
2584         if (!rdev->ops->del_virtual_intf)
2585                 return -EOPNOTSUPP;
2586
2587         /*
2588          * If we remove a wireless device without a netdev then clear
2589          * user_ptr[1] so that nl80211_post_doit won't dereference it
2590          * to check if it needs to do dev_put(). Otherwise it crashes
2591          * since the wdev has been freed, unlike with a netdev where
2592          * we need the dev_put() for the netdev to really be freed.
2593          */
2594         if (!wdev->netdev)
2595                 info->user_ptr[1] = NULL;
2596
2597         return rdev_del_virtual_intf(rdev, wdev);
2598 }
2599
2600 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2601 {
2602         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2603         struct net_device *dev = info->user_ptr[1];
2604         u16 noack_map;
2605
2606         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2607                 return -EINVAL;
2608
2609         if (!rdev->ops->set_noack_map)
2610                 return -EOPNOTSUPP;
2611
2612         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2613
2614         return rdev_set_noack_map(rdev, dev, noack_map);
2615 }
2616
2617 struct get_key_cookie {
2618         struct sk_buff *msg;
2619         int error;
2620         int idx;
2621 };
2622
2623 static void get_key_callback(void *c, struct key_params *params)
2624 {
2625         struct nlattr *key;
2626         struct get_key_cookie *cookie = c;
2627
2628         if ((params->key &&
2629              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2630                      params->key_len, params->key)) ||
2631             (params->seq &&
2632              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2633                      params->seq_len, params->seq)) ||
2634             (params->cipher &&
2635              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2636                          params->cipher)))
2637                 goto nla_put_failure;
2638
2639         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2640         if (!key)
2641                 goto nla_put_failure;
2642
2643         if ((params->key &&
2644              nla_put(cookie->msg, NL80211_KEY_DATA,
2645                      params->key_len, params->key)) ||
2646             (params->seq &&
2647              nla_put(cookie->msg, NL80211_KEY_SEQ,
2648                      params->seq_len, params->seq)) ||
2649             (params->cipher &&
2650              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2651                          params->cipher)))
2652                 goto nla_put_failure;
2653
2654         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2655                 goto nla_put_failure;
2656
2657         nla_nest_end(cookie->msg, key);
2658
2659         return;
2660  nla_put_failure:
2661         cookie->error = 1;
2662 }
2663
2664 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2665 {
2666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2667         int err;
2668         struct net_device *dev = info->user_ptr[1];
2669         u8 key_idx = 0;
2670         const u8 *mac_addr = NULL;
2671         bool pairwise;
2672         struct get_key_cookie cookie = {
2673                 .error = 0,
2674         };
2675         void *hdr;
2676         struct sk_buff *msg;
2677
2678         if (info->attrs[NL80211_ATTR_KEY_IDX])
2679                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2680
2681         if (key_idx > 5)
2682                 return -EINVAL;
2683
2684         if (info->attrs[NL80211_ATTR_MAC])
2685                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2686
2687         pairwise = !!mac_addr;
2688         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2689                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2690                 if (kt >= NUM_NL80211_KEYTYPES)
2691                         return -EINVAL;
2692                 if (kt != NL80211_KEYTYPE_GROUP &&
2693                     kt != NL80211_KEYTYPE_PAIRWISE)
2694                         return -EINVAL;
2695                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2696         }
2697
2698         if (!rdev->ops->get_key)
2699                 return -EOPNOTSUPP;
2700
2701         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2702         if (!msg)
2703                 return -ENOMEM;
2704
2705         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2706                              NL80211_CMD_NEW_KEY);
2707         if (!hdr)
2708                 goto nla_put_failure;
2709
2710         cookie.msg = msg;
2711         cookie.idx = key_idx;
2712
2713         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2714             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2715                 goto nla_put_failure;
2716         if (mac_addr &&
2717             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2718                 goto nla_put_failure;
2719
2720         if (pairwise && mac_addr &&
2721             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2722                 return -ENOENT;
2723
2724         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2725                            get_key_callback);
2726
2727         if (err)
2728                 goto free_msg;
2729
2730         if (cookie.error)
2731                 goto nla_put_failure;
2732
2733         genlmsg_end(msg, hdr);
2734         return genlmsg_reply(msg, info);
2735
2736  nla_put_failure:
2737         err = -ENOBUFS;
2738  free_msg:
2739         nlmsg_free(msg);
2740         return err;
2741 }
2742
2743 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2744 {
2745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2746         struct key_parse key;
2747         int err;
2748         struct net_device *dev = info->user_ptr[1];
2749
2750         err = nl80211_parse_key(info, &key);
2751         if (err)
2752                 return err;
2753
2754         if (key.idx < 0)
2755                 return -EINVAL;
2756
2757         /* only support setting default key */
2758         if (!key.def && !key.defmgmt)
2759                 return -EINVAL;
2760
2761         wdev_lock(dev->ieee80211_ptr);
2762
2763         if (key.def) {
2764                 if (!rdev->ops->set_default_key) {
2765                         err = -EOPNOTSUPP;
2766                         goto out;
2767                 }
2768
2769                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2770                 if (err)
2771                         goto out;
2772
2773                 err = rdev_set_default_key(rdev, dev, key.idx,
2774                                                  key.def_uni, key.def_multi);
2775
2776                 if (err)
2777                         goto out;
2778
2779 #ifdef CONFIG_CFG80211_WEXT
2780                 dev->ieee80211_ptr->wext.default_key = key.idx;
2781 #endif
2782         } else {
2783                 if (key.def_uni || !key.def_multi) {
2784                         err = -EINVAL;
2785                         goto out;
2786                 }
2787
2788                 if (!rdev->ops->set_default_mgmt_key) {
2789                         err = -EOPNOTSUPP;
2790                         goto out;
2791                 }
2792
2793                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2794                 if (err)
2795                         goto out;
2796
2797                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2798                 if (err)
2799                         goto out;
2800
2801 #ifdef CONFIG_CFG80211_WEXT
2802                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2803 #endif
2804         }
2805
2806  out:
2807         wdev_unlock(dev->ieee80211_ptr);
2808
2809         return err;
2810 }
2811
2812 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2813 {
2814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2815         int err;
2816         struct net_device *dev = info->user_ptr[1];
2817         struct key_parse key;
2818         const u8 *mac_addr = NULL;
2819
2820         err = nl80211_parse_key(info, &key);
2821         if (err)
2822                 return err;
2823
2824         if (!key.p.key)
2825                 return -EINVAL;
2826
2827         if (info->attrs[NL80211_ATTR_MAC])
2828                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2829
2830         if (key.type == -1) {
2831                 if (mac_addr)
2832                         key.type = NL80211_KEYTYPE_PAIRWISE;
2833                 else
2834                         key.type = NL80211_KEYTYPE_GROUP;
2835         }
2836
2837         /* for now */
2838         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2839             key.type != NL80211_KEYTYPE_GROUP)
2840                 return -EINVAL;
2841
2842         if (!rdev->ops->add_key)
2843                 return -EOPNOTSUPP;
2844
2845         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2846                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2847                                            mac_addr))
2848                 return -EINVAL;
2849
2850         wdev_lock(dev->ieee80211_ptr);
2851         err = nl80211_key_allowed(dev->ieee80211_ptr);
2852         if (!err)
2853                 err = rdev_add_key(rdev, dev, key.idx,
2854                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2855                                     mac_addr, &key.p);
2856         wdev_unlock(dev->ieee80211_ptr);
2857
2858         return err;
2859 }
2860
2861 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2862 {
2863         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2864         int err;
2865         struct net_device *dev = info->user_ptr[1];
2866         u8 *mac_addr = NULL;
2867         struct key_parse key;
2868
2869         err = nl80211_parse_key(info, &key);
2870         if (err)
2871                 return err;
2872
2873         if (info->attrs[NL80211_ATTR_MAC])
2874                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2875
2876         if (key.type == -1) {
2877                 if (mac_addr)
2878                         key.type = NL80211_KEYTYPE_PAIRWISE;
2879                 else
2880                         key.type = NL80211_KEYTYPE_GROUP;
2881         }
2882
2883         /* for now */
2884         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2885             key.type != NL80211_KEYTYPE_GROUP)
2886                 return -EINVAL;
2887
2888         if (!rdev->ops->del_key)
2889                 return -EOPNOTSUPP;
2890
2891         wdev_lock(dev->ieee80211_ptr);
2892         err = nl80211_key_allowed(dev->ieee80211_ptr);
2893
2894         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2895             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2896                 err = -ENOENT;
2897
2898         if (!err)
2899                 err = rdev_del_key(rdev, dev, key.idx,
2900                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2901                                    mac_addr);
2902
2903 #ifdef CONFIG_CFG80211_WEXT
2904         if (!err) {
2905                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2906                         dev->ieee80211_ptr->wext.default_key = -1;
2907                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2908                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2909         }
2910 #endif
2911         wdev_unlock(dev->ieee80211_ptr);
2912
2913         return err;
2914 }
2915
2916 /* This function returns an error or the number of nested attributes */
2917 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2918 {
2919         struct nlattr *attr;
2920         int n_entries = 0, tmp;
2921
2922         nla_for_each_nested(attr, nl_attr, tmp) {
2923                 if (nla_len(attr) != ETH_ALEN)
2924                         return -EINVAL;
2925
2926                 n_entries++;
2927         }
2928
2929         return n_entries;
2930 }
2931
2932 /*
2933  * This function parses ACL information and allocates memory for ACL data.
2934  * On successful return, the calling function is responsible to free the
2935  * ACL buffer returned by this function.
2936  */
2937 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
2938                                                 struct genl_info *info)
2939 {
2940         enum nl80211_acl_policy acl_policy;
2941         struct nlattr *attr;
2942         struct cfg80211_acl_data *acl;
2943         int i = 0, n_entries, tmp;
2944
2945         if (!wiphy->max_acl_mac_addrs)
2946                 return ERR_PTR(-EOPNOTSUPP);
2947
2948         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
2949                 return ERR_PTR(-EINVAL);
2950
2951         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
2952         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
2953             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
2954                 return ERR_PTR(-EINVAL);
2955
2956         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
2957                 return ERR_PTR(-EINVAL);
2958
2959         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
2960         if (n_entries < 0)
2961                 return ERR_PTR(n_entries);
2962
2963         if (n_entries > wiphy->max_acl_mac_addrs)
2964                 return ERR_PTR(-ENOTSUPP);
2965
2966         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
2967                       GFP_KERNEL);
2968         if (!acl)
2969                 return ERR_PTR(-ENOMEM);
2970
2971         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
2972                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
2973                 i++;
2974         }
2975
2976         acl->n_acl_entries = n_entries;
2977         acl->acl_policy = acl_policy;
2978
2979         return acl;
2980 }
2981
2982 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
2983 {
2984         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2985         struct net_device *dev = info->user_ptr[1];
2986         struct cfg80211_acl_data *acl;
2987         int err;
2988
2989         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2990             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2991                 return -EOPNOTSUPP;
2992
2993         if (!dev->ieee80211_ptr->beacon_interval)
2994                 return -EINVAL;
2995
2996         acl = parse_acl_data(&rdev->wiphy, info);
2997         if (IS_ERR(acl))
2998                 return PTR_ERR(acl);
2999
3000         err = rdev_set_mac_acl(rdev, dev, acl);
3001
3002         kfree(acl);
3003
3004         return err;
3005 }
3006
3007 static int nl80211_parse_beacon(struct nlattr *attrs[],
3008                                 struct cfg80211_beacon_data *bcn)
3009 {
3010         bool haveinfo = false;
3011
3012         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3013             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3014             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3015             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3016                 return -EINVAL;
3017
3018         memset(bcn, 0, sizeof(*bcn));
3019
3020         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3021                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3022                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3023                 if (!bcn->head_len)
3024                         return -EINVAL;
3025                 haveinfo = true;
3026         }
3027
3028         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3029                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3030                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3031                 haveinfo = true;
3032         }
3033
3034         if (!haveinfo)
3035                 return -EINVAL;
3036
3037         if (attrs[NL80211_ATTR_IE]) {
3038                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3039                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3040         }
3041
3042         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3043                 bcn->proberesp_ies =
3044                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3045                 bcn->proberesp_ies_len =
3046                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3047         }
3048
3049         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3050                 bcn->assocresp_ies =
3051                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3052                 bcn->assocresp_ies_len =
3053                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3054         }
3055
3056         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3057                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3058                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3059         }
3060
3061         return 0;
3062 }
3063
3064 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3065                                    struct cfg80211_ap_settings *params)
3066 {
3067         struct wireless_dev *wdev;
3068         bool ret = false;
3069
3070         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3071                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3072                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3073                         continue;
3074
3075                 if (!wdev->preset_chandef.chan)
3076                         continue;
3077
3078                 params->chandef = wdev->preset_chandef;
3079                 ret = true;
3080                 break;
3081         }
3082
3083         return ret;
3084 }
3085
3086 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3087                                     enum nl80211_auth_type auth_type,
3088                                     enum nl80211_commands cmd)
3089 {
3090         if (auth_type > NL80211_AUTHTYPE_MAX)
3091                 return false;
3092
3093         switch (cmd) {
3094         case NL80211_CMD_AUTHENTICATE:
3095                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3096                     auth_type == NL80211_AUTHTYPE_SAE)
3097                         return false;
3098                 return true;
3099         case NL80211_CMD_CONNECT:
3100         case NL80211_CMD_START_AP:
3101                 /* SAE not supported yet */
3102                 if (auth_type == NL80211_AUTHTYPE_SAE)
3103                         return false;
3104                 return true;
3105         default:
3106                 return false;
3107         }
3108 }
3109
3110 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3111 {
3112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3113         struct net_device *dev = info->user_ptr[1];
3114         struct wireless_dev *wdev = dev->ieee80211_ptr;
3115         struct cfg80211_ap_settings params;
3116         int err;
3117         u8 radar_detect_width = 0;
3118
3119         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3120             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3121                 return -EOPNOTSUPP;
3122
3123         if (!rdev->ops->start_ap)
3124                 return -EOPNOTSUPP;
3125
3126         if (wdev->beacon_interval)
3127                 return -EALREADY;
3128
3129         memset(&params, 0, sizeof(params));
3130
3131         /* these are required for START_AP */
3132         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3133             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3134             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3135                 return -EINVAL;
3136
3137         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3138         if (err)
3139                 return err;
3140
3141         params.beacon_interval =
3142                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3143         params.dtim_period =
3144                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3145
3146         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3147         if (err)
3148                 return err;
3149
3150         /*
3151          * In theory, some of these attributes should be required here
3152          * but since they were not used when the command was originally
3153          * added, keep them optional for old user space programs to let
3154          * them continue to work with drivers that do not need the
3155          * additional information -- drivers must check!
3156          */
3157         if (info->attrs[NL80211_ATTR_SSID]) {
3158                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3159                 params.ssid_len =
3160                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3161                 if (params.ssid_len == 0 ||
3162                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3163                         return -EINVAL;
3164         }
3165
3166         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3167                 params.hidden_ssid = nla_get_u32(
3168                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3169                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3170                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3171                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3172                         return -EINVAL;
3173         }
3174
3175         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3176
3177         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3178                 params.auth_type = nla_get_u32(
3179                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3180                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3181                                              NL80211_CMD_START_AP))
3182                         return -EINVAL;
3183         } else
3184                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3185
3186         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3187                                       NL80211_MAX_NR_CIPHER_SUITES);
3188         if (err)
3189                 return err;
3190
3191         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3192                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3193                         return -EOPNOTSUPP;
3194                 params.inactivity_timeout = nla_get_u16(
3195                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3196         }
3197
3198         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3199                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3200                         return -EINVAL;
3201                 params.p2p_ctwindow =
3202                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3203                 if (params.p2p_ctwindow > 127)
3204                         return -EINVAL;
3205                 if (params.p2p_ctwindow != 0 &&
3206                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3207                         return -EINVAL;
3208         }
3209
3210         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3211                 u8 tmp;
3212
3213                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3214                         return -EINVAL;
3215                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3216                 if (tmp > 1)
3217                         return -EINVAL;
3218                 params.p2p_opp_ps = tmp;
3219                 if (params.p2p_opp_ps != 0 &&
3220                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3221                         return -EINVAL;
3222         }
3223
3224         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3225                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3226                 if (err)
3227                         return err;
3228         } else if (wdev->preset_chandef.chan) {
3229                 params.chandef = wdev->preset_chandef;
3230         } else if (!nl80211_get_ap_channel(rdev, &params))
3231                 return -EINVAL;
3232
3233         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
3234                 return -EINVAL;
3235
3236         err = cfg80211_chandef_dfs_required(wdev->wiphy, &params.chandef);
3237         if (err < 0)
3238                 return err;
3239         if (err) {
3240                 radar_detect_width = BIT(params.chandef.width);
3241                 params.radar_required = true;
3242         }
3243
3244         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
3245                                            params.chandef.chan,
3246                                            CHAN_MODE_SHARED,
3247                                            radar_detect_width);
3248         if (err)
3249                 return err;
3250
3251         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3252                 params.acl = parse_acl_data(&rdev->wiphy, info);
3253                 if (IS_ERR(params.acl))
3254                         return PTR_ERR(params.acl);
3255         }
3256
3257         wdev_lock(wdev);
3258         err = rdev_start_ap(rdev, dev, &params);
3259         if (!err) {
3260                 wdev->preset_chandef = params.chandef;
3261                 wdev->beacon_interval = params.beacon_interval;
3262                 wdev->channel = params.chandef.chan;
3263                 wdev->ssid_len = params.ssid_len;
3264                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3265         }
3266         wdev_unlock(wdev);
3267
3268         kfree(params.acl);
3269
3270         return err;
3271 }
3272
3273 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3274 {
3275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3276         struct net_device *dev = info->user_ptr[1];
3277         struct wireless_dev *wdev = dev->ieee80211_ptr;
3278         struct cfg80211_beacon_data params;
3279         int err;
3280
3281         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3282             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3283                 return -EOPNOTSUPP;
3284
3285         if (!rdev->ops->change_beacon)
3286                 return -EOPNOTSUPP;
3287
3288         if (!wdev->beacon_interval)
3289                 return -EINVAL;
3290
3291         err = nl80211_parse_beacon(info->attrs, &params);
3292         if (err)
3293                 return err;
3294
3295         wdev_lock(wdev);
3296         err = rdev_change_beacon(rdev, dev, &params);
3297         wdev_unlock(wdev);
3298
3299         return err;
3300 }
3301
3302 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3303 {
3304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3305         struct net_device *dev = info->user_ptr[1];
3306
3307         return cfg80211_stop_ap(rdev, dev);
3308 }
3309
3310 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3311         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3312         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3313         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3314         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3315         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3316         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3317 };
3318
3319 static int parse_station_flags(struct genl_info *info,
3320                                enum nl80211_iftype iftype,
3321                                struct station_parameters *params)
3322 {
3323         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3324         struct nlattr *nla;
3325         int flag;
3326
3327         /*
3328          * Try parsing the new attribute first so userspace
3329          * can specify both for older kernels.
3330          */
3331         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3332         if (nla) {
3333                 struct nl80211_sta_flag_update *sta_flags;
3334
3335                 sta_flags = nla_data(nla);
3336                 params->sta_flags_mask = sta_flags->mask;
3337                 params->sta_flags_set = sta_flags->set;
3338                 params->sta_flags_set &= params->sta_flags_mask;
3339                 if ((params->sta_flags_mask |
3340                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3341                         return -EINVAL;
3342                 return 0;
3343         }
3344
3345         /* if present, parse the old attribute */
3346
3347         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3348         if (!nla)
3349                 return 0;
3350
3351         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3352                              nla, sta_flags_policy))
3353                 return -EINVAL;
3354
3355         /*
3356          * Only allow certain flags for interface types so that
3357          * other attributes are silently ignored. Remember that
3358          * this is backward compatibility code with old userspace
3359          * and shouldn't be hit in other cases anyway.
3360          */
3361         switch (iftype) {
3362         case NL80211_IFTYPE_AP:
3363         case NL80211_IFTYPE_AP_VLAN:
3364         case NL80211_IFTYPE_P2P_GO:
3365                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3366                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3367                                          BIT(NL80211_STA_FLAG_WME) |
3368                                          BIT(NL80211_STA_FLAG_MFP);
3369                 break;
3370         case NL80211_IFTYPE_P2P_CLIENT:
3371         case NL80211_IFTYPE_STATION:
3372                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3373                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3374                 break;
3375         case NL80211_IFTYPE_MESH_POINT:
3376                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3377                                          BIT(NL80211_STA_FLAG_MFP) |
3378                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3379         default:
3380                 return -EINVAL;
3381         }
3382
3383         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3384                 if (flags[flag]) {
3385                         params->sta_flags_set |= (1<<flag);
3386
3387                         /* no longer support new API additions in old API */
3388                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3389                                 return -EINVAL;
3390                 }
3391         }
3392
3393         return 0;
3394 }
3395
3396 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3397                                  int attr)
3398 {
3399         struct nlattr *rate;
3400         u32 bitrate;
3401         u16 bitrate_compat;
3402
3403         rate = nla_nest_start(msg, attr);
3404         if (!rate)
3405                 return false;
3406
3407         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3408         bitrate = cfg80211_calculate_bitrate(info);
3409         /* report 16-bit bitrate only if we can */
3410         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3411         if (bitrate > 0 &&
3412             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3413                 return false;
3414         if (bitrate_compat > 0 &&
3415             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3416                 return false;
3417
3418         if (info->flags & RATE_INFO_FLAGS_MCS) {
3419                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3420                         return false;
3421                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3422                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3423                         return false;
3424                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3425                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3426                         return false;
3427         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3428                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3429                         return false;
3430                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3431                         return false;
3432                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3433                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3434                         return false;
3435                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3436                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3437                         return false;
3438                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3439                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3440                         return false;
3441                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3442                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3443                         return false;
3444                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3445                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3446                         return false;
3447         }
3448
3449         nla_nest_end(msg, rate);
3450         return true;
3451 }
3452
3453 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3454                                int id)
3455 {
3456         void *attr;
3457         int i = 0;
3458
3459         if (!mask)
3460                 return true;
3461
3462         attr = nla_nest_start(msg, id);
3463         if (!attr)
3464                 return false;
3465
3466         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3467                 if (!(mask & BIT(i)))
3468                         continue;
3469
3470                 if (nla_put_u8(msg, i, signal[i]))
3471                         return false;
3472         }
3473
3474         nla_nest_end(msg, attr);
3475
3476         return true;
3477 }
3478
3479 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3480                                 int flags,
3481                                 struct cfg80211_registered_device *rdev,
3482                                 struct net_device *dev,
3483                                 const u8 *mac_addr, struct station_info *sinfo)
3484 {
3485         void *hdr;
3486         struct nlattr *sinfoattr, *bss_param;
3487
3488         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3489         if (!hdr)
3490                 return -1;
3491
3492         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3494             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3495                 goto nla_put_failure;
3496
3497         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3498         if (!sinfoattr)
3499                 goto nla_put_failure;
3500         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3501             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3502                         sinfo->connected_time))
3503                 goto nla_put_failure;
3504         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3505             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3506                         sinfo->inactive_time))
3507                 goto nla_put_failure;
3508         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3509                               STATION_INFO_RX_BYTES64)) &&
3510             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3511                         (u32)sinfo->rx_bytes))
3512                 goto nla_put_failure;
3513         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3514                               STATION_INFO_TX_BYTES64)) &&
3515             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3516                         (u32)sinfo->tx_bytes))
3517                 goto nla_put_failure;
3518         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3519             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3520                         sinfo->rx_bytes))
3521                 goto nla_put_failure;
3522         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3523             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3524                         sinfo->tx_bytes))
3525                 goto nla_put_failure;
3526         if ((sinfo->filled & STATION_INFO_LLID) &&
3527             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3528                 goto nla_put_failure;
3529         if ((sinfo->filled & STATION_INFO_PLID) &&
3530             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3531                 goto nla_put_failure;
3532         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3533             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3534                        sinfo->plink_state))
3535                 goto nla_put_failure;
3536         switch (rdev->wiphy.signal_type) {
3537         case CFG80211_SIGNAL_TYPE_MBM:
3538                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3539                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3540                                sinfo->signal))
3541                         goto nla_put_failure;
3542                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3543                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3544                                sinfo->signal_avg))
3545                         goto nla_put_failure;
3546                 break;
3547         default:
3548                 break;
3549         }
3550         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3551                 if (!nl80211_put_signal(msg, sinfo->chains,
3552                                         sinfo->chain_signal,
3553                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3554                         goto nla_put_failure;
3555         }
3556         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3557                 if (!nl80211_put_signal(msg, sinfo->chains,
3558                                         sinfo->chain_signal_avg,
3559                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3560                         goto nla_put_failure;
3561         }
3562         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3563                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3564                                           NL80211_STA_INFO_TX_BITRATE))
3565                         goto nla_put_failure;
3566         }
3567         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3568                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3569                                           NL80211_STA_INFO_RX_BITRATE))
3570                         goto nla_put_failure;
3571         }
3572         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3573             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3574                         sinfo->rx_packets))
3575                 goto nla_put_failure;
3576         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3577             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3578                         sinfo->tx_packets))
3579                 goto nla_put_failure;
3580         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3581             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3582                         sinfo->tx_retries))
3583                 goto nla_put_failure;
3584         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3585             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3586                         sinfo->tx_failed))
3587                 goto nla_put_failure;
3588         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3589             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3590                         sinfo->beacon_loss_count))
3591                 goto nla_put_failure;
3592         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3593             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3594                         sinfo->local_pm))
3595                 goto nla_put_failure;
3596         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3597             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3598                         sinfo->peer_pm))
3599                 goto nla_put_failure;
3600         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3601             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3602                         sinfo->nonpeer_pm))
3603                 goto nla_put_failure;
3604         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3605                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3606                 if (!bss_param)
3607                         goto nla_put_failure;
3608
3609                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3610                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3611                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3612                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3613                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3614                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3615                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3616                                sinfo->bss_param.dtim_period) ||
3617                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3618                                 sinfo->bss_param.beacon_interval))
3619                         goto nla_put_failure;
3620
3621                 nla_nest_end(msg, bss_param);
3622         }
3623         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3624             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3625                     sizeof(struct nl80211_sta_flag_update),
3626                     &sinfo->sta_flags))
3627                 goto nla_put_failure;
3628         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3629                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3630                             sinfo->t_offset))
3631                 goto nla_put_failure;
3632         nla_nest_end(msg, sinfoattr);
3633
3634         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3635             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3636                     sinfo->assoc_req_ies))
3637                 goto nla_put_failure;
3638
3639         return genlmsg_end(msg, hdr);
3640
3641  nla_put_failure:
3642         genlmsg_cancel(msg, hdr);
3643         return -EMSGSIZE;
3644 }
3645
3646 static int nl80211_dump_station(struct sk_buff *skb,
3647                                 struct netlink_callback *cb)
3648 {
3649         struct station_info sinfo;
3650         struct cfg80211_registered_device *dev;
3651         struct wireless_dev *wdev;
3652         u8 mac_addr[ETH_ALEN];
3653         int sta_idx = cb->args[2];
3654         int err;
3655
3656         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
3657         if (err)
3658                 return err;
3659
3660         if (!wdev->netdev) {
3661                 err = -EINVAL;
3662                 goto out_err;
3663         }
3664
3665         if (!dev->ops->dump_station) {
3666                 err = -EOPNOTSUPP;
3667                 goto out_err;
3668         }
3669
3670         while (1) {
3671                 memset(&sinfo, 0, sizeof(sinfo));
3672                 err = rdev_dump_station(dev, wdev->netdev, sta_idx,
3673                                         mac_addr, &sinfo);
3674                 if (err == -ENOENT)
3675                         break;
3676                 if (err)
3677                         goto out_err;
3678
3679                 if (nl80211_send_station(skb,
3680                                 NETLINK_CB(cb->skb).portid,
3681                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3682                                 dev, wdev->netdev, mac_addr,
3683                                 &sinfo) < 0)
3684                         goto out;
3685
3686                 sta_idx++;
3687         }
3688
3689
3690  out:
3691         cb->args[2] = sta_idx;
3692         err = skb->len;
3693  out_err:
3694         nl80211_finish_wdev_dump(dev);
3695
3696         return err;
3697 }
3698
3699 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3700 {
3701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3702         struct net_device *dev = info->user_ptr[1];
3703         struct station_info sinfo;
3704         struct sk_buff *msg;
3705         u8 *mac_addr = NULL;
3706         int err;
3707
3708         memset(&sinfo, 0, sizeof(sinfo));
3709
3710         if (!info->attrs[NL80211_ATTR_MAC])
3711                 return -EINVAL;
3712
3713         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3714
3715         if (!rdev->ops->get_station)
3716                 return -EOPNOTSUPP;
3717
3718         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3719         if (err)
3720                 return err;
3721
3722         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3723         if (!msg)
3724                 return -ENOMEM;
3725
3726         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3727                                  rdev, dev, mac_addr, &sinfo) < 0) {
3728                 nlmsg_free(msg);
3729                 return -ENOBUFS;
3730         }
3731
3732         return genlmsg_reply(msg, info);
3733 }
3734
3735 int cfg80211_check_station_change(struct wiphy *wiphy,
3736                                   struct station_parameters *params,
3737                                   enum cfg80211_station_type statype)
3738 {
3739         if (params->listen_interval != -1)
3740                 return -EINVAL;
3741         if (params->aid)
3742                 return -EINVAL;
3743
3744         /* When you run into this, adjust the code below for the new flag */
3745         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3746
3747         switch (statype) {
3748         case CFG80211_STA_MESH_PEER_KERNEL:
3749         case CFG80211_STA_MESH_PEER_USER:
3750                 /*
3751                  * No ignoring the TDLS flag here -- the userspace mesh
3752                  * code doesn't have the bug of including TDLS in the
3753                  * mask everywhere.
3754                  */
3755                 if (params->sta_flags_mask &
3756                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3757                                   BIT(NL80211_STA_FLAG_MFP) |
3758                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3759                         return -EINVAL;
3760                 break;
3761         case CFG80211_STA_TDLS_PEER_SETUP:
3762         case CFG80211_STA_TDLS_PEER_ACTIVE:
3763                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3764                         return -EINVAL;
3765                 /* ignore since it can't change */
3766                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3767                 break;
3768         default:
3769                 /* disallow mesh-specific things */
3770                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3771                         return -EINVAL;
3772                 if (params->local_pm)
3773                         return -EINVAL;
3774                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3775                         return -EINVAL;
3776         }
3777
3778         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3779             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3780                 /* TDLS can't be set, ... */
3781                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3782                         return -EINVAL;
3783                 /*
3784                  * ... but don't bother the driver with it. This works around
3785                  * a hostapd/wpa_supplicant issue -- it always includes the
3786                  * TLDS_PEER flag in the mask even for AP mode.
3787                  */
3788                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3789         }
3790
3791         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3792                 /* reject other things that can't change */
3793                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3794                         return -EINVAL;
3795                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3796                         return -EINVAL;
3797                 if (params->supported_rates)
3798                         return -EINVAL;
3799                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3800                         return -EINVAL;
3801         }
3802
3803         if (statype != CFG80211_STA_AP_CLIENT) {
3804                 if (params->vlan)
3805                         return -EINVAL;
3806         }
3807
3808         switch (statype) {
3809         case CFG80211_STA_AP_MLME_CLIENT:
3810                 /* Use this only for authorizing/unauthorizing a station */
3811                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3812                         return -EOPNOTSUPP;
3813                 break;
3814         case CFG80211_STA_AP_CLIENT:
3815                 /* accept only the listed bits */
3816                 if (params->sta_flags_mask &
3817                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3818                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3819                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3820                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3821                                   BIT(NL80211_STA_FLAG_WME) |
3822                                   BIT(NL80211_STA_FLAG_MFP)))
3823                         return -EINVAL;
3824
3825                 /* but authenticated/associated only if driver handles it */
3826                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3827                     params->sta_flags_mask &
3828                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3829                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3830                         return -EINVAL;
3831                 break;
3832         case CFG80211_STA_IBSS:
3833         case CFG80211_STA_AP_STA:
3834                 /* reject any changes other than AUTHORIZED */
3835                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3836                         return -EINVAL;
3837                 break;
3838         case CFG80211_STA_TDLS_PEER_SETUP:
3839                 /* reject any changes other than AUTHORIZED or WME */
3840                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3841                                                BIT(NL80211_STA_FLAG_WME)))
3842                         return -EINVAL;
3843                 /* force (at least) rates when authorizing */
3844                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3845                     !params->supported_rates)
3846                         return -EINVAL;
3847                 break;
3848         case CFG80211_STA_TDLS_PEER_ACTIVE:
3849                 /* reject any changes */
3850                 return -EINVAL;
3851         case CFG80211_STA_MESH_PEER_KERNEL:
3852                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3853                         return -EINVAL;
3854                 break;
3855         case CFG80211_STA_MESH_PEER_USER:
3856                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3857                         return -EINVAL;
3858                 break;
3859         }
3860
3861         return 0;
3862 }
3863 EXPORT_SYMBOL(cfg80211_check_station_change);
3864
3865 /*
3866  * Get vlan interface making sure it is running and on the right wiphy.
3867  */
3868 static struct net_device *get_vlan(struct genl_info *info,
3869                                    struct cfg80211_registered_device *rdev)
3870 {
3871         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3872         struct net_device *v;
3873         int ret;
3874
3875         if (!vlanattr)
3876                 return NULL;
3877
3878         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3879         if (!v)
3880                 return ERR_PTR(-ENODEV);
3881
3882         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3883                 ret = -EINVAL;
3884                 goto error;
3885         }
3886
3887         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3888             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3889             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3890                 ret = -EINVAL;
3891                 goto error;
3892         }
3893
3894         if (!netif_running(v)) {
3895                 ret = -ENETDOWN;
3896                 goto error;
3897         }
3898
3899         return v;
3900  error:
3901         dev_put(v);
3902         return ERR_PTR(ret);
3903 }
3904
3905 static struct nla_policy
3906 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] __read_mostly = {
3907         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3908         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3909 };
3910
3911 static int nl80211_parse_sta_wme(struct genl_info *info,
3912                                  struct station_parameters *params)
3913 {
3914         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3915         struct nlattr *nla;
3916         int err;
3917
3918         /* parse WME attributes if present */
3919         if (!info->attrs[NL80211_ATTR_STA_WME])
3920                 return 0;
3921
3922         nla = info->attrs[NL80211_ATTR_STA_WME];
3923         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3924                                nl80211_sta_wme_policy);
3925         if (err)
3926                 return err;
3927
3928         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3929                 params->uapsd_queues = nla_get_u8(
3930                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3931         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3932                 return -EINVAL;
3933
3934         if (tb[NL80211_STA_WME_MAX_SP])
3935                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3936
3937         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3938                 return -EINVAL;
3939
3940         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3941
3942         return 0;
3943 }
3944
3945 static int nl80211_parse_sta_channel_info(struct genl_info *info,
3946                                       struct station_parameters *params)
3947 {
3948         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
3949                 params->supported_channels =
3950                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3951                 params->supported_channels_len =
3952                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
3953                 /*
3954                  * Need to include at least one (first channel, number of
3955                  * channels) tuple for each subband, and must have proper
3956                  * tuples for the rest of the data as well.
3957                  */
3958                 if (params->supported_channels_len < 2)
3959                         return -EINVAL;
3960                 if (params->supported_channels_len % 2)
3961                         return -EINVAL;
3962         }
3963
3964         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
3965                 params->supported_oper_classes =
3966                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3967                 params->supported_oper_classes_len =
3968                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
3969                 /*
3970                  * The value of the Length field of the Supported Operating
3971                  * Classes element is between 2 and 253.
3972                  */
3973                 if (params->supported_oper_classes_len < 2 ||
3974                     params->supported_oper_classes_len > 253)
3975                         return -EINVAL;
3976         }
3977         return 0;
3978 }
3979
3980 static int nl80211_set_station_tdls(struct genl_info *info,
3981                                     struct station_parameters *params)
3982 {
3983         int err;
3984         /* Dummy STA entry gets updated once the peer capabilities are known */
3985         if (info->attrs[NL80211_ATTR_PEER_AID])
3986                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
3987         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
3988                 params->ht_capa =
3989                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
3990         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
3991                 params->vht_capa =
3992                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
3993
3994         err = nl80211_parse_sta_channel_info(info, params);
3995         if (err)
3996                 return err;
3997
3998         return nl80211_parse_sta_wme(info, params);
3999 }
4000
4001 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4002 {
4003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4004         struct net_device *dev = info->user_ptr[1];
4005         struct station_parameters params;
4006         u8 *mac_addr;
4007         int err;
4008
4009         memset(&params, 0, sizeof(params));
4010
4011         params.listen_interval = -1;
4012
4013         if (!rdev->ops->change_station)
4014                 return -EOPNOTSUPP;
4015
4016         if (info->attrs[NL80211_ATTR_STA_AID])
4017                 return -EINVAL;
4018
4019         if (!info->attrs[NL80211_ATTR_MAC])
4020                 return -EINVAL;
4021
4022         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4023
4024         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4025                 params.supported_rates =
4026                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4027                 params.supported_rates_len =
4028                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4029         }
4030
4031         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4032                 params.capability =
4033                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4034                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4035         }
4036
4037         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4038                 params.ext_capab =
4039                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4040                 params.ext_capab_len =
4041                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4042         }
4043
4044         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4045                 return -EINVAL;
4046
4047         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4048                 return -EINVAL;
4049
4050         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4051                 params.plink_action =
4052                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4053                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4054                         return -EINVAL;
4055         }
4056
4057         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4058                 params.plink_state =
4059                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4060                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4061                         return -EINVAL;
4062                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4063         }
4064
4065         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4066                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4067                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4068
4069                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4070                     pm > NL80211_MESH_POWER_MAX)
4071                         return -EINVAL;
4072
4073                 params.local_pm = pm;
4074         }
4075
4076         /* Include parameters for TDLS peer (will check later) */
4077         err = nl80211_set_station_tdls(info, &params);
4078         if (err)
4079                 return err;
4080
4081         params.vlan = get_vlan(info, rdev);
4082         if (IS_ERR(params.vlan))
4083                 return PTR_ERR(params.vlan);
4084
4085         switch (dev->ieee80211_ptr->iftype) {
4086         case NL80211_IFTYPE_AP:
4087         case NL80211_IFTYPE_AP_VLAN:
4088         case NL80211_IFTYPE_P2P_GO:
4089         case NL80211_IFTYPE_P2P_CLIENT:
4090         case NL80211_IFTYPE_STATION:
4091         case NL80211_IFTYPE_ADHOC:
4092         case NL80211_IFTYPE_MESH_POINT:
4093                 break;
4094         default:
4095                 err = -EOPNOTSUPP;
4096                 goto out_put_vlan;
4097         }
4098
4099         /* driver will call cfg80211_check_station_change() */
4100         err = rdev_change_station(rdev, dev, mac_addr, &params);
4101
4102  out_put_vlan:
4103         if (params.vlan)
4104                 dev_put(params.vlan);
4105
4106         return err;
4107 }
4108
4109 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4110 {
4111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4112         int err;
4113         struct net_device *dev = info->user_ptr[1];
4114         struct station_parameters params;
4115         u8 *mac_addr = NULL;
4116
4117         memset(&params, 0, sizeof(params));
4118
4119         if (!rdev->ops->add_station)
4120                 return -EOPNOTSUPP;
4121
4122         if (!info->attrs[NL80211_ATTR_MAC])
4123                 return -EINVAL;
4124
4125         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4126                 return -EINVAL;
4127
4128         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4129                 return -EINVAL;
4130
4131         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4132             !info->attrs[NL80211_ATTR_PEER_AID])
4133                 return -EINVAL;
4134
4135         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4136         params.supported_rates =
4137                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4138         params.supported_rates_len =
4139                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4140         params.listen_interval =
4141                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4142
4143         if (info->attrs[NL80211_ATTR_PEER_AID])
4144                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4145         else
4146                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4147         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4148                 return -EINVAL;
4149
4150         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4151                 params.capability =
4152                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4153                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4154         }
4155
4156         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4157                 params.ext_capab =
4158                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4159                 params.ext_capab_len =
4160                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4161         }
4162
4163         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4164                 params.ht_capa =
4165                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4166
4167         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4168                 params.vht_capa =
4169                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4170
4171         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4172                 params.opmode_notif_used = true;
4173                 params.opmode_notif =
4174                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4175         }
4176
4177         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4178                 params.plink_action =
4179                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4180                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4181                         return -EINVAL;
4182         }
4183
4184         err = nl80211_parse_sta_channel_info(info, &params);
4185         if (err)
4186                 return err;
4187
4188         err = nl80211_parse_sta_wme(info, &params);
4189         if (err)
4190                 return err;
4191
4192         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4193                 return -EINVAL;
4194
4195         /* When you run into this, adjust the code below for the new flag */
4196         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4197
4198         switch (dev->ieee80211_ptr->iftype) {
4199         case NL80211_IFTYPE_AP:
4200         case NL80211_IFTYPE_AP_VLAN:
4201         case NL80211_IFTYPE_P2P_GO:
4202                 /* ignore WME attributes if iface/sta is not capable */
4203                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4204                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4205                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4206
4207                 /* TDLS peers cannot be added */
4208                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4209                     info->attrs[NL80211_ATTR_PEER_AID])
4210                         return -EINVAL;
4211                 /* but don't bother the driver with it */
4212                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4213
4214                 /* allow authenticated/associated only if driver handles it */
4215                 if (!(rdev->wiphy.features &
4216                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4217                     params.sta_flags_mask &
4218                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4219                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4220                         return -EINVAL;
4221
4222                 /* must be last in here for error handling */
4223                 params.vlan = get_vlan(info, rdev);
4224                 if (IS_ERR(params.vlan))
4225                         return PTR_ERR(params.vlan);
4226                 break;
4227         case NL80211_IFTYPE_MESH_POINT:
4228                 /* ignore uAPSD data */
4229                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4230
4231                 /* associated is disallowed */
4232                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4233                         return -EINVAL;
4234                 /* TDLS peers cannot be added */
4235                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4236                     info->attrs[NL80211_ATTR_PEER_AID])
4237                         return -EINVAL;
4238                 break;
4239         case NL80211_IFTYPE_STATION:
4240         case NL80211_IFTYPE_P2P_CLIENT:
4241                 /* ignore uAPSD data */
4242                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4243
4244                 /* these are disallowed */
4245                 if (params.sta_flags_mask &
4246                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4247                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4248                         return -EINVAL;
4249                 /* Only TDLS peers can be added */
4250                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4251                         return -EINVAL;
4252                 /* Can only add if TDLS ... */
4253                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4254                         return -EOPNOTSUPP;
4255                 /* ... with external setup is supported */
4256                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4257                         return -EOPNOTSUPP;
4258                 /*
4259                  * Older wpa_supplicant versions always mark the TDLS peer
4260                  * as authorized, but it shouldn't yet be.
4261                  */
4262                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4263                 break;
4264         default:
4265                 return -EOPNOTSUPP;
4266         }
4267
4268         /* be aware of params.vlan when changing code here */
4269
4270         err = rdev_add_station(rdev, dev, mac_addr, &params);
4271
4272         if (params.vlan)
4273                 dev_put(params.vlan);
4274         return err;
4275 }
4276
4277 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4278 {
4279         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4280         struct net_device *dev = info->user_ptr[1];
4281         u8 *mac_addr = NULL;
4282
4283         if (info->attrs[NL80211_ATTR_MAC])
4284                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4285
4286         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4287             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4288             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4289             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4290                 return -EINVAL;
4291
4292         if (!rdev->ops->del_station)
4293                 return -EOPNOTSUPP;
4294
4295         return rdev_del_station(rdev, dev, mac_addr);
4296 }
4297
4298 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4299                                 int flags, struct net_device *dev,
4300                                 u8 *dst, u8 *next_hop,
4301                                 struct mpath_info *pinfo)
4302 {
4303         void *hdr;
4304         struct nlattr *pinfoattr;
4305
4306         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4307         if (!hdr)
4308                 return -1;
4309
4310         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4311             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4312             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4313             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4314                 goto nla_put_failure;
4315
4316         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4317         if (!pinfoattr)
4318                 goto nla_put_failure;
4319         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4320             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4321                         pinfo->frame_qlen))
4322                 goto nla_put_failure;
4323         if (((pinfo->filled & MPATH_INFO_SN) &&
4324              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4325             ((pinfo->filled & MPATH_INFO_METRIC) &&
4326              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4327                          pinfo->metric)) ||
4328             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4329              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4330                          pinfo->exptime)) ||
4331             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4332              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4333                         pinfo->flags)) ||
4334             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4335              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4336                          pinfo->discovery_timeout)) ||
4337             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4338              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4339                         pinfo->discovery_retries)))
4340                 goto nla_put_failure;
4341
4342         nla_nest_end(msg, pinfoattr);
4343
4344         return genlmsg_end(msg, hdr);
4345
4346  nla_put_failure:
4347         genlmsg_cancel(msg, hdr);
4348         return -EMSGSIZE;
4349 }
4350
4351 static int nl80211_dump_mpath(struct sk_buff *skb,
4352                               struct netlink_callback *cb)
4353 {
4354         struct mpath_info pinfo;
4355         struct cfg80211_registered_device *dev;
4356         struct wireless_dev *wdev;
4357         u8 dst[ETH_ALEN];
4358         u8 next_hop[ETH_ALEN];
4359         int path_idx = cb->args[2];
4360         int err;
4361
4362         err = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
4363         if (err)
4364                 return err;
4365
4366         if (!dev->ops->dump_mpath) {
4367                 err = -EOPNOTSUPP;
4368                 goto out_err;
4369         }
4370
4371         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4372                 err = -EOPNOTSUPP;
4373                 goto out_err;
4374         }
4375
4376         while (1) {
4377                 err = rdev_dump_mpath(dev, wdev->netdev, path_idx, dst,
4378                                       next_hop, &pinfo);
4379                 if (err == -ENOENT)
4380                         break;
4381                 if (err)
4382                         goto out_err;
4383
4384                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4385                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4386                                        wdev->netdev, dst, next_hop,
4387                                        &pinfo) < 0)
4388                         goto out;
4389
4390                 path_idx++;
4391         }
4392
4393
4394  out:
4395         cb->args[2] = path_idx;
4396         err = skb->len;
4397  out_err:
4398         nl80211_finish_wdev_dump(dev);
4399         return err;
4400 }
4401
4402 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4403 {
4404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4405         int err;
4406         struct net_device *dev = info->user_ptr[1];
4407         struct mpath_info pinfo;
4408         struct sk_buff *msg;
4409         u8 *dst = NULL;
4410         u8 next_hop[ETH_ALEN];
4411
4412         memset(&pinfo, 0, sizeof(pinfo));
4413
4414         if (!info->attrs[NL80211_ATTR_MAC])
4415                 return -EINVAL;
4416
4417         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4418
4419         if (!rdev->ops->get_mpath)
4420                 return -EOPNOTSUPP;
4421
4422         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4423                 return -EOPNOTSUPP;
4424
4425         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4426         if (err)
4427                 return err;
4428
4429         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4430         if (!msg)
4431                 return -ENOMEM;
4432
4433         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4434                                  dev, dst, next_hop, &pinfo) < 0) {
4435                 nlmsg_free(msg);
4436                 return -ENOBUFS;
4437         }
4438
4439         return genlmsg_reply(msg, info);
4440 }
4441
4442 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4443 {
4444         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4445         struct net_device *dev = info->user_ptr[1];
4446         u8 *dst = NULL;
4447         u8 *next_hop = NULL;
4448
4449         if (!info->attrs[NL80211_ATTR_MAC])
4450                 return -EINVAL;
4451
4452         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4453                 return -EINVAL;
4454
4455         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4456         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4457
4458         if (!rdev->ops->change_mpath)
4459                 return -EOPNOTSUPP;
4460
4461         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4462                 return -EOPNOTSUPP;
4463
4464         return rdev_change_mpath(rdev, dev, dst, next_hop);
4465 }
4466
4467 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4468 {
4469         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4470         struct net_device *dev = info->user_ptr[1];
4471         u8 *dst = NULL;
4472         u8 *next_hop = NULL;
4473
4474         if (!info->attrs[NL80211_ATTR_MAC])
4475                 return -EINVAL;
4476
4477         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4478                 return -EINVAL;
4479
4480         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4481         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4482
4483         if (!rdev->ops->add_mpath)
4484                 return -EOPNOTSUPP;
4485
4486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4487                 return -EOPNOTSUPP;
4488
4489         return rdev_add_mpath(rdev, dev, dst, next_hop);
4490 }
4491
4492 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4493 {
4494         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4495         struct net_device *dev = info->user_ptr[1];
4496         u8 *dst = NULL;
4497
4498         if (info->attrs[NL80211_ATTR_MAC])
4499                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4500
4501         if (!rdev->ops->del_mpath)
4502                 return -EOPNOTSUPP;
4503
4504         return rdev_del_mpath(rdev, dev, dst);
4505 }
4506
4507 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4508 {
4509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4510         struct net_device *dev = info->user_ptr[1];
4511         struct wireless_dev *wdev = dev->ieee80211_ptr;
4512         struct bss_parameters params;
4513         int err;
4514
4515         memset(&params, 0, sizeof(params));
4516         /* default to not changing parameters */
4517         params.use_cts_prot = -1;
4518         params.use_short_preamble = -1;
4519         params.use_short_slot_time = -1;
4520         params.ap_isolate = -1;
4521         params.ht_opmode = -1;
4522         params.p2p_ctwindow = -1;
4523         params.p2p_opp_ps = -1;
4524
4525         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4526                 params.use_cts_prot =
4527                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4528         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4529                 params.use_short_preamble =
4530                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4531         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4532                 params.use_short_slot_time =
4533                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4534         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4535                 params.basic_rates =
4536                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4537                 params.basic_rates_len =
4538                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4539         }
4540         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4541                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4542         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4543                 params.ht_opmode =
4544                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4545
4546         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4547                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4548                         return -EINVAL;
4549                 params.p2p_ctwindow =
4550                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4551                 if (params.p2p_ctwindow < 0)
4552                         return -EINVAL;
4553                 if (params.p2p_ctwindow != 0 &&
4554                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4555                         return -EINVAL;
4556         }
4557
4558         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4559                 u8 tmp;
4560
4561                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4562                         return -EINVAL;
4563                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4564                 if (tmp > 1)
4565                         return -EINVAL;
4566                 params.p2p_opp_ps = tmp;
4567                 if (params.p2p_opp_ps &&
4568                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4569                         return -EINVAL;
4570         }
4571
4572         if (!rdev->ops->change_bss)
4573                 return -EOPNOTSUPP;
4574
4575         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4576             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4577                 return -EOPNOTSUPP;
4578
4579         wdev_lock(wdev);
4580         err = rdev_change_bss(rdev, dev, &params);
4581         wdev_unlock(wdev);
4582
4583         return err;
4584 }
4585
4586 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4587         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4588         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4589         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4590         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4591         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4592         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4593 };
4594
4595 static int parse_reg_rule(struct nlattr *tb[],
4596         struct ieee80211_reg_rule *reg_rule)
4597 {
4598         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4599         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4600
4601         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4602                 return -EINVAL;
4603         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4604                 return -EINVAL;
4605         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4606                 return -EINVAL;
4607         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4608                 return -EINVAL;
4609         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4610                 return -EINVAL;
4611
4612         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4613
4614         freq_range->start_freq_khz =
4615                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4616         freq_range->end_freq_khz =
4617                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4618         freq_range->max_bandwidth_khz =
4619                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4620
4621         power_rule->max_eirp =
4622                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4623
4624         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4625                 power_rule->max_antenna_gain =
4626                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4627
4628         return 0;
4629 }
4630
4631 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4632 {
4633         int r;
4634         char *data = NULL;
4635         enum nl80211_user_reg_hint_type user_reg_hint_type;
4636
4637         /*
4638          * You should only get this when cfg80211 hasn't yet initialized
4639          * completely when built-in to the kernel right between the time
4640          * window between nl80211_init() and regulatory_init(), if that is
4641          * even possible.
4642          */
4643         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4644                 return -EINPROGRESS;
4645
4646         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4647                 return -EINVAL;
4648
4649         data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4650
4651         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4652                 user_reg_hint_type =
4653                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4654         else
4655                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4656
4657         switch (user_reg_hint_type) {
4658         case NL80211_USER_REG_HINT_USER:
4659         case NL80211_USER_REG_HINT_CELL_BASE:
4660                 break;
4661         default:
4662                 return -EINVAL;
4663         }
4664
4665         r = regulatory_hint_user(data, user_reg_hint_type);
4666
4667         return r;
4668 }
4669
4670 static int nl80211_get_mesh_config(struct sk_buff *skb,
4671                                    struct genl_info *info)
4672 {
4673         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4674         struct net_device *dev = info->user_ptr[1];
4675         struct wireless_dev *wdev = dev->ieee80211_ptr;
4676         struct mesh_config cur_params;
4677         int err = 0;
4678         void *hdr;
4679         struct nlattr *pinfoattr;
4680         struct sk_buff *msg;
4681
4682         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4683                 return -EOPNOTSUPP;
4684
4685         if (!rdev->ops->get_mesh_config)
4686                 return -EOPNOTSUPP;
4687
4688         wdev_lock(wdev);
4689         /* If not connected, get default parameters */
4690         if (!wdev->mesh_id_len)
4691                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4692         else
4693                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4694         wdev_unlock(wdev);
4695
4696         if (err)
4697                 return err;
4698
4699         /* Draw up a netlink message to send back */
4700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4701         if (!msg)
4702                 return -ENOMEM;
4703         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4704                              NL80211_CMD_GET_MESH_CONFIG);
4705         if (!hdr)
4706                 goto out;
4707         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4708         if (!pinfoattr)
4709                 goto nla_put_failure;
4710         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4711             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4712                         cur_params.dot11MeshRetryTimeout) ||
4713             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4714                         cur_params.dot11MeshConfirmTimeout) ||
4715             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4716                         cur_params.dot11MeshHoldingTimeout) ||
4717             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4718                         cur_params.dot11MeshMaxPeerLinks) ||
4719             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4720                        cur_params.dot11MeshMaxRetries) ||
4721             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4722                        cur_params.dot11MeshTTL) ||
4723             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4724                        cur_params.element_ttl) ||
4725             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4726                        cur_params.auto_open_plinks) ||
4727             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4728                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4729             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4730                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4731             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4732                         cur_params.path_refresh_time) ||
4733             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4734                         cur_params.min_discovery_timeout) ||
4735             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4736                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4737             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4738                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4739             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4740                         cur_params.dot11MeshHWMPperrMinInterval) ||
4741             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4742                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4743             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4744                        cur_params.dot11MeshHWMPRootMode) ||
4745             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4746                         cur_params.dot11MeshHWMPRannInterval) ||
4747             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4748                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4749             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4750                        cur_params.dot11MeshForwarding) ||
4751             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4752                         cur_params.rssi_threshold) ||
4753             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4754                         cur_params.ht_opmode) ||
4755             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4756                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4757             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4758                         cur_params.dot11MeshHWMProotInterval) ||
4759             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4760                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4761             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4762                         cur_params.power_mode) ||
4763             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4764                         cur_params.dot11MeshAwakeWindowDuration) ||
4765             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4766                         cur_params.plink_timeout))
4767                 goto nla_put_failure;
4768         nla_nest_end(msg, pinfoattr);
4769         genlmsg_end(msg, hdr);
4770         return genlmsg_reply(msg, info);
4771
4772  nla_put_failure:
4773         genlmsg_cancel(msg, hdr);
4774  out:
4775         nlmsg_free(msg);
4776         return -ENOBUFS;
4777 }
4778
4779 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4780         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4781         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4782         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4783         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4784         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4785         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4786         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4787         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4788         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4789         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4790         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4791         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4792         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4793         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4794         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4795         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4796         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4797         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4798         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4799         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4800         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4801         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4802         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4803         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4804         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4805         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4806         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4807         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4808 };
4809
4810 static const struct nla_policy
4811         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4812         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4813         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4814         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4815         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4816         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4817         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4818         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4819                                     .len = IEEE80211_MAX_DATA_LEN },
4820         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4821 };
4822
4823 static int nl80211_parse_mesh_config(struct genl_info *info,
4824                                      struct mesh_config *cfg,
4825                                      u32 *mask_out)
4826 {
4827         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4828         u32 mask = 0;
4829
4830 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4831 do {                                                                        \
4832         if (tb[attr]) {                                                     \
4833                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4834                         return -EINVAL;                                     \
4835                 cfg->param = fn(tb[attr]);                                  \
4836                 mask |= (1 << (attr - 1));                                  \
4837         }                                                                   \
4838 } while (0)
4839
4840
4841         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4842                 return -EINVAL;
4843         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4844                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4845                              nl80211_meshconf_params_policy))
4846                 return -EINVAL;
4847
4848         /* This makes sure that there aren't more than 32 mesh config
4849          * parameters (otherwise our bitfield scheme would not work.) */
4850         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4851
4852         /* Fill in the params struct */
4853         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4854                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4855                                   nla_get_u16);
4856         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4857                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4858                                   nla_get_u16);
4859         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4860                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4861                                   nla_get_u16);
4862         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4863                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4864                                   nla_get_u16);
4865         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4866                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4867                                   nla_get_u8);
4868         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4869                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4870         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4871                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4872                                   nla_get_u8);
4873         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4874                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4875                                   nla_get_u8);
4876         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4877                                   1, 255, mask,
4878                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4879                                   nla_get_u32);
4880         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4881                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4882                                   nla_get_u8);
4883         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4884                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4885                                   nla_get_u32);
4886         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4887                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4888                                   nla_get_u16);
4889         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4890                                   1, 65535, mask,
4891                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4892                                   nla_get_u32);
4893         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4894                                   1, 65535, mask,
4895                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4896                                   nla_get_u16);
4897         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4898                                   1, 65535, mask,
4899                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4900                                   nla_get_u16);
4901         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4902                                   dot11MeshHWMPnetDiameterTraversalTime,
4903                                   1, 65535, mask,
4904                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4905                                   nla_get_u16);
4906         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4907                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4908                                   nla_get_u8);
4909         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4910                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4911                                   nla_get_u16);
4912         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4913                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4914                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4915                                   nla_get_u8);
4916         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4917                                   mask, NL80211_MESHCONF_FORWARDING,
4918                                   nla_get_u8);
4919         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4920                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4921                                   nla_get_s32);
4922         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4923                                   mask, NL80211_MESHCONF_HT_OPMODE,
4924                                   nla_get_u16);
4925         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4926                                   1, 65535, mask,
4927                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4928                                   nla_get_u32);
4929         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4930                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4931                                   nla_get_u16);
4932         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4933                                   dot11MeshHWMPconfirmationInterval,
4934                                   1, 65535, mask,
4935                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4936                                   nla_get_u16);
4937         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4938                                   NL80211_MESH_POWER_ACTIVE,
4939                                   NL80211_MESH_POWER_MAX,
4940                                   mask, NL80211_MESHCONF_POWER_MODE,
4941                                   nla_get_u32);
4942         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
4943                                   0, 65535, mask,
4944                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
4945         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
4946                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
4947                                   nla_get_u32);
4948         if (mask_out)
4949                 *mask_out = mask;
4950
4951         return 0;
4952
4953 #undef FILL_IN_MESH_PARAM_IF_SET
4954 }
4955
4956 static int nl80211_parse_mesh_setup(struct genl_info *info,
4957                                      struct mesh_setup *setup)
4958 {
4959         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4960         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
4961
4962         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
4963                 return -EINVAL;
4964         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
4965                              info->attrs[NL80211_ATTR_MESH_SETUP],
4966                              nl80211_mesh_setup_params_policy))
4967                 return -EINVAL;
4968
4969         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
4970                 setup->sync_method =
4971                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
4972                  IEEE80211_SYNC_METHOD_VENDOR :
4973                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
4974
4975         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
4976                 setup->path_sel_proto =
4977                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
4978                  IEEE80211_PATH_PROTOCOL_VENDOR :
4979                  IEEE80211_PATH_PROTOCOL_HWMP;
4980
4981         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
4982                 setup->path_metric =
4983                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
4984                  IEEE80211_PATH_METRIC_VENDOR :
4985                  IEEE80211_PATH_METRIC_AIRTIME;
4986
4987
4988         if (tb[NL80211_MESH_SETUP_IE]) {
4989                 struct nlattr *ieattr =
4990                         tb[NL80211_MESH_SETUP_IE];
4991                 if (!is_valid_ie_attr(ieattr))
4992                         return -EINVAL;
4993                 setup->ie = nla_data(ieattr);
4994                 setup->ie_len = nla_len(ieattr);
4995         }
4996         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
4997             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
4998                 return -EINVAL;
4999         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5000         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5001         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5002         if (setup->is_secure)
5003                 setup->user_mpm = true;
5004
5005         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5006                 if (!setup->user_mpm)
5007                         return -EINVAL;
5008                 setup->auth_id =
5009                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5010         }
5011
5012         return 0;
5013 }
5014
5015 static int nl80211_update_mesh_config(struct sk_buff *skb,
5016                                       struct genl_info *info)
5017 {
5018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5019         struct net_device *dev = info->user_ptr[1];
5020         struct wireless_dev *wdev = dev->ieee80211_ptr;
5021         struct mesh_config cfg;
5022         u32 mask;
5023         int err;
5024
5025         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5026                 return -EOPNOTSUPP;
5027
5028         if (!rdev->ops->update_mesh_config)
5029                 return -EOPNOTSUPP;
5030
5031         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5032         if (err)
5033                 return err;
5034
5035         wdev_lock(wdev);
5036         if (!wdev->mesh_id_len)
5037                 err = -ENOLINK;
5038
5039         if (!err)
5040                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5041
5042         wdev_unlock(wdev);
5043
5044         return err;
5045 }
5046
5047 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5048 {
5049         const struct ieee80211_regdomain *regdom;
5050         struct sk_buff *msg;
5051         void *hdr = NULL;
5052         struct nlattr *nl_reg_rules;
5053         unsigned int i;
5054
5055         if (!cfg80211_regdomain)
5056                 return -EINVAL;
5057
5058         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5059         if (!msg)
5060                 return -ENOBUFS;
5061
5062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5063                              NL80211_CMD_GET_REG);
5064         if (!hdr)
5065                 goto put_failure;
5066
5067         if (reg_last_request_cell_base() &&
5068             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5069                         NL80211_USER_REG_HINT_CELL_BASE))
5070                 goto nla_put_failure;
5071
5072         rcu_read_lock();
5073         regdom = rcu_dereference(cfg80211_regdomain);
5074
5075         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5076             (regdom->dfs_region &&
5077              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5078                 goto nla_put_failure_rcu;
5079
5080         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5081         if (!nl_reg_rules)
5082                 goto nla_put_failure_rcu;
5083
5084         for (i = 0; i < regdom->n_reg_rules; i++) {
5085                 struct nlattr *nl_reg_rule;
5086                 const struct ieee80211_reg_rule *reg_rule;
5087                 const struct ieee80211_freq_range *freq_range;
5088                 const struct ieee80211_power_rule *power_rule;
5089
5090                 reg_rule = &regdom->reg_rules[i];
5091                 freq_range = &reg_rule->freq_range;
5092                 power_rule = &reg_rule->power_rule;
5093
5094                 nl_reg_rule = nla_nest_start(msg, i);
5095                 if (!nl_reg_rule)
5096                         goto nla_put_failure_rcu;
5097
5098                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5099                                 reg_rule->flags) ||
5100                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5101                                 freq_range->start_freq_khz) ||
5102                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5103                                 freq_range->end_freq_khz) ||
5104                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5105                                 freq_range->max_bandwidth_khz) ||
5106                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5107                                 power_rule->max_antenna_gain) ||
5108                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5109                                 power_rule->max_eirp))
5110                         goto nla_put_failure_rcu;
5111
5112                 nla_nest_end(msg, nl_reg_rule);
5113         }
5114         rcu_read_unlock();
5115
5116         nla_nest_end(msg, nl_reg_rules);
5117
5118         genlmsg_end(msg, hdr);
5119         return genlmsg_reply(msg, info);
5120
5121 nla_put_failure_rcu:
5122         rcu_read_unlock();
5123 nla_put_failure:
5124         genlmsg_cancel(msg, hdr);
5125 put_failure:
5126         nlmsg_free(msg);
5127         return -EMSGSIZE;
5128 }
5129
5130 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5131 {
5132         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5133         struct nlattr *nl_reg_rule;
5134         char *alpha2 = NULL;
5135         int rem_reg_rules = 0, r = 0;
5136         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5137         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5138         struct ieee80211_regdomain *rd = NULL;
5139
5140         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5141                 return -EINVAL;
5142
5143         if (!info->attrs[NL80211_ATTR_REG_RULES])
5144                 return -EINVAL;
5145
5146         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5147
5148         if (info->attrs[NL80211_ATTR_DFS_REGION])
5149                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5150
5151         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5152                             rem_reg_rules) {
5153                 num_rules++;
5154                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5155                         return -EINVAL;
5156         }
5157
5158         if (!reg_is_valid_request(alpha2))
5159                 return -EINVAL;
5160
5161         size_of_regd = sizeof(struct ieee80211_regdomain) +
5162                        num_rules * sizeof(struct ieee80211_reg_rule);
5163
5164         rd = kzalloc(size_of_regd, GFP_KERNEL);
5165         if (!rd)
5166                 return -ENOMEM;
5167
5168         rd->n_reg_rules = num_rules;
5169         rd->alpha2[0] = alpha2[0];
5170         rd->alpha2[1] = alpha2[1];
5171
5172         /*
5173          * Disable DFS master mode if the DFS region was
5174          * not supported or known on this kernel.
5175          */
5176         if (reg_supported_dfs_region(dfs_region))
5177                 rd->dfs_region = dfs_region;
5178
5179         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5180                             rem_reg_rules) {
5181                 nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5182                           nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5183                           reg_rule_policy);
5184                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5185                 if (r)
5186                         goto bad_reg;
5187
5188                 rule_idx++;
5189
5190                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5191                         r = -EINVAL;
5192                         goto bad_reg;
5193                 }
5194         }
5195
5196         r = set_regdom(rd);
5197         /* set_regdom took ownership */
5198         rd = NULL;
5199
5200  bad_reg:
5201         kfree(rd);
5202         return r;
5203 }
5204
5205 static int validate_scan_freqs(struct nlattr *freqs)
5206 {
5207         struct nlattr *attr1, *attr2;
5208         int n_channels = 0, tmp1, tmp2;
5209
5210         nla_for_each_nested(attr1, freqs, tmp1) {
5211                 n_channels++;
5212                 /*
5213                  * Some hardware has a limited channel list for
5214                  * scanning, and it is pretty much nonsensical
5215                  * to scan for a channel twice, so disallow that
5216                  * and don't require drivers to check that the
5217                  * channel list they get isn't longer than what
5218                  * they can scan, as long as they can scan all
5219                  * the channels they registered at once.
5220                  */
5221                 nla_for_each_nested(attr2, freqs, tmp2)
5222                         if (attr1 != attr2 &&
5223                             nla_get_u32(attr1) == nla_get_u32(attr2))
5224                                 return 0;
5225         }
5226
5227         return n_channels;
5228 }
5229
5230 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5231 {
5232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5233         struct wireless_dev *wdev = info->user_ptr[1];
5234         struct cfg80211_scan_request *request;
5235         struct nlattr *attr;
5236         struct wiphy *wiphy;
5237         int err, tmp, n_ssids = 0, n_channels, i;
5238         size_t ie_len;
5239
5240         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5241                 return -EINVAL;
5242
5243         wiphy = &rdev->wiphy;
5244
5245         if (!rdev->ops->scan)
5246                 return -EOPNOTSUPP;
5247
5248         if (rdev->scan_req || rdev->scan_msg) {
5249                 err = -EBUSY;
5250                 goto unlock;
5251         }
5252
5253         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5254                 n_channels = validate_scan_freqs(
5255                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5256                 if (!n_channels) {
5257                         err = -EINVAL;
5258                         goto unlock;
5259                 }
5260         } else {
5261                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5262         }
5263
5264         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5265                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5266                         n_ssids++;
5267
5268         if (n_ssids > wiphy->max_scan_ssids) {
5269                 err = -EINVAL;
5270                 goto unlock;
5271         }
5272
5273         if (info->attrs[NL80211_ATTR_IE])
5274                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5275         else
5276                 ie_len = 0;
5277
5278         if (ie_len > wiphy->max_scan_ie_len) {
5279                 err = -EINVAL;
5280                 goto unlock;
5281         }
5282
5283         request = kzalloc(sizeof(*request)
5284                         + sizeof(*request->ssids) * n_ssids
5285                         + sizeof(*request->channels) * n_channels
5286                         + ie_len, GFP_KERNEL);
5287         if (!request) {
5288                 err = -ENOMEM;
5289                 goto unlock;
5290         }
5291
5292         if (n_ssids)
5293                 request->ssids = (void *)&request->channels[n_channels];
5294         request->n_ssids = n_ssids;
5295         if (ie_len) {
5296                 if (request->ssids)
5297                         request->ie = (void *)(request->ssids + n_ssids);
5298                 else
5299                         request->ie = (void *)(request->channels + n_channels);
5300         }
5301
5302         i = 0;
5303         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5304                 /* user specified, bail out if channel not found */
5305                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5306                         struct ieee80211_channel *chan;
5307
5308                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5309
5310                         if (!chan) {
5311                                 err = -EINVAL;
5312                                 goto out_free;
5313                         }
5314
5315                         /* ignore disabled channels */
5316                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5317                                 continue;
5318
5319                         request->channels[i] = chan;
5320                         i++;
5321                 }
5322         } else {
5323                 enum ieee80211_band band;
5324
5325                 /* all channels */
5326                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5327                         int j;
5328                         if (!wiphy->bands[band])
5329                                 continue;
5330                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5331                                 struct ieee80211_channel *chan;
5332
5333                                 chan = &wiphy->bands[band]->channels[j];
5334
5335                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5336                                         continue;
5337
5338                                 request->channels[i] = chan;
5339                                 i++;
5340                         }
5341                 }
5342         }
5343
5344         if (!i) {
5345                 err = -EINVAL;
5346                 goto out_free;
5347         }
5348
5349         request->n_channels = i;
5350
5351         i = 0;
5352         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5353                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5354                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5355                                 err = -EINVAL;
5356                                 goto out_free;
5357                         }
5358                         request->ssids[i].ssid_len = nla_len(attr);
5359                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5360                         i++;
5361                 }
5362         }
5363
5364         if (info->attrs[NL80211_ATTR_IE]) {
5365                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5366                 memcpy((void *)request->ie,
5367                        nla_data(info->attrs[NL80211_ATTR_IE]),
5368                        request->ie_len);
5369         }
5370
5371         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5372                 if (wiphy->bands[i])
5373                         request->rates[i] =
5374                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5375
5376         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5377                 nla_for_each_nested(attr,
5378                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5379                                     tmp) {
5380                         enum ieee80211_band band = nla_type(attr);
5381
5382                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5383                                 err = -EINVAL;
5384                                 goto out_free;
5385                         }
5386
5387                         if (!wiphy->bands[band])
5388                                 continue;
5389
5390                         err = ieee80211_get_ratemask(wiphy->bands[band],
5391                                                      nla_data(attr),
5392                                                      nla_len(attr),
5393                                                      &request->rates[band]);
5394                         if (err)
5395                                 goto out_free;
5396                 }
5397         }
5398
5399         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5400                 request->flags = nla_get_u32(
5401                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5402                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5403                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5404                         err = -EOPNOTSUPP;
5405                         goto out_free;
5406                 }
5407         }
5408
5409         request->no_cck =
5410                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5411
5412         request->wdev = wdev;
5413         request->wiphy = &rdev->wiphy;
5414         request->scan_start = jiffies;
5415
5416         rdev->scan_req = request;
5417         err = rdev_scan(rdev, request);
5418
5419         if (!err) {
5420                 nl80211_send_scan_start(rdev, wdev);
5421                 if (wdev->netdev)
5422                         dev_hold(wdev->netdev);
5423         } else {
5424  out_free:
5425                 rdev->scan_req = NULL;
5426                 kfree(request);
5427         }
5428
5429  unlock:
5430         return err;
5431 }
5432
5433 static int nl80211_start_sched_scan(struct sk_buff *skb,
5434                                     struct genl_info *info)
5435 {
5436         struct cfg80211_sched_scan_request *request;
5437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5438         struct net_device *dev = info->user_ptr[1];
5439         struct nlattr *attr;
5440         struct wiphy *wiphy;
5441         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5442         u32 interval;
5443         enum ieee80211_band band;
5444         size_t ie_len;
5445         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5446
5447         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5448             !rdev->ops->sched_scan_start)
5449                 return -EOPNOTSUPP;
5450
5451         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5452                 return -EINVAL;
5453
5454         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5455                 return -EINVAL;
5456
5457         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5458         if (interval == 0)
5459                 return -EINVAL;
5460
5461         wiphy = &rdev->wiphy;
5462
5463         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5464                 n_channels = validate_scan_freqs(
5465                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5466                 if (!n_channels)
5467                         return -EINVAL;
5468         } else {
5469                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5470         }
5471
5472         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5473                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5474                                     tmp)
5475                         n_ssids++;
5476
5477         if (n_ssids > wiphy->max_sched_scan_ssids)
5478                 return -EINVAL;
5479
5480         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH])
5481                 nla_for_each_nested(attr,
5482                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5483                                     tmp)
5484                         n_match_sets++;
5485
5486         if (n_match_sets > wiphy->max_match_sets)
5487                 return -EINVAL;
5488
5489         if (info->attrs[NL80211_ATTR_IE])
5490                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5491         else
5492                 ie_len = 0;
5493
5494         if (ie_len > wiphy->max_sched_scan_ie_len)
5495                 return -EINVAL;
5496
5497         if (rdev->sched_scan_req) {
5498                 err = -EINPROGRESS;
5499                 goto out;
5500         }
5501
5502         request = kzalloc(sizeof(*request)
5503                         + sizeof(*request->ssids) * n_ssids
5504                         + sizeof(*request->match_sets) * n_match_sets
5505                         + sizeof(*request->channels) * n_channels
5506                         + ie_len, GFP_KERNEL);
5507         if (!request) {
5508                 err = -ENOMEM;
5509                 goto out;
5510         }
5511
5512         if (n_ssids)
5513                 request->ssids = (void *)&request->channels[n_channels];
5514         request->n_ssids = n_ssids;
5515         if (ie_len) {
5516                 if (request->ssids)
5517                         request->ie = (void *)(request->ssids + n_ssids);
5518                 else
5519                         request->ie = (void *)(request->channels + n_channels);
5520         }
5521
5522         if (n_match_sets) {
5523                 if (request->ie)
5524                         request->match_sets = (void *)(request->ie + ie_len);
5525                 else if (request->ssids)
5526                         request->match_sets =
5527                                 (void *)(request->ssids + n_ssids);
5528                 else
5529                         request->match_sets =
5530                                 (void *)(request->channels + n_channels);
5531         }
5532         request->n_match_sets = n_match_sets;
5533
5534         i = 0;
5535         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5536                 /* user specified, bail out if channel not found */
5537                 nla_for_each_nested(attr,
5538                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5539                                     tmp) {
5540                         struct ieee80211_channel *chan;
5541
5542                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5543
5544                         if (!chan) {
5545                                 err = -EINVAL;
5546                                 goto out_free;
5547                         }
5548
5549                         /* ignore disabled channels */
5550                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5551                                 continue;
5552
5553                         request->channels[i] = chan;
5554                         i++;
5555                 }
5556         } else {
5557                 /* all channels */
5558                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5559                         int j;
5560                         if (!wiphy->bands[band])
5561                                 continue;
5562                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5563                                 struct ieee80211_channel *chan;
5564
5565                                 chan = &wiphy->bands[band]->channels[j];
5566
5567                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5568                                         continue;
5569
5570                                 request->channels[i] = chan;
5571                                 i++;
5572                         }
5573                 }
5574         }
5575
5576         if (!i) {
5577                 err = -EINVAL;
5578                 goto out_free;
5579         }
5580
5581         request->n_channels = i;
5582
5583         i = 0;
5584         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5585                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5586                                     tmp) {
5587                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5588                                 err = -EINVAL;
5589                                 goto out_free;
5590                         }
5591                         request->ssids[i].ssid_len = nla_len(attr);
5592                         memcpy(request->ssids[i].ssid, nla_data(attr),
5593                                nla_len(attr));
5594                         i++;
5595                 }
5596         }
5597
5598         i = 0;
5599         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5600                 nla_for_each_nested(attr,
5601                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5602                                     tmp) {
5603                         struct nlattr *ssid, *rssi;
5604
5605                         nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5606                                   nla_data(attr), nla_len(attr),
5607                                   nl80211_match_policy);
5608                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5609                         if (ssid) {
5610                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5611                                         err = -EINVAL;
5612                                         goto out_free;
5613                                 }
5614                                 memcpy(request->match_sets[i].ssid.ssid,
5615                                        nla_data(ssid), nla_len(ssid));
5616                                 request->match_sets[i].ssid.ssid_len =
5617                                         nla_len(ssid);
5618                         }
5619                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5620                         if (rssi)
5621                                 request->rssi_thold = nla_get_u32(rssi);
5622                         else
5623                                 request->rssi_thold =
5624                                                    NL80211_SCAN_RSSI_THOLD_OFF;
5625                         i++;
5626                 }
5627         }
5628
5629         if (info->attrs[NL80211_ATTR_IE]) {
5630                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5631                 memcpy((void *)request->ie,
5632                        nla_data(info->attrs[NL80211_ATTR_IE]),
5633                        request->ie_len);
5634         }
5635
5636         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5637                 request->flags = nla_get_u32(
5638                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5639                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5640                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5641                         err = -EOPNOTSUPP;
5642                         goto out_free;
5643                 }
5644         }
5645
5646         request->dev = dev;
5647         request->wiphy = &rdev->wiphy;
5648         request->interval = interval;
5649         request->scan_start = jiffies;
5650
5651         err = rdev_sched_scan_start(rdev, dev, request);
5652         if (!err) {
5653                 rdev->sched_scan_req = request;
5654                 nl80211_send_sched_scan(rdev, dev,
5655                                         NL80211_CMD_START_SCHED_SCAN);
5656                 goto out;
5657         }
5658
5659 out_free:
5660         kfree(request);
5661 out:
5662         return err;
5663 }
5664
5665 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5666                                    struct genl_info *info)
5667 {
5668         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5669
5670         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5671             !rdev->ops->sched_scan_stop)
5672                 return -EOPNOTSUPP;
5673
5674         return __cfg80211_stop_sched_scan(rdev, false);
5675 }
5676
5677 static int nl80211_start_radar_detection(struct sk_buff *skb,
5678                                          struct genl_info *info)
5679 {
5680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5681         struct net_device *dev = info->user_ptr[1];
5682         struct wireless_dev *wdev = dev->ieee80211_ptr;
5683         struct cfg80211_chan_def chandef;
5684         enum nl80211_dfs_regions dfs_region;
5685         int err;
5686
5687         dfs_region = reg_get_dfs_region(wdev->wiphy);
5688         if (dfs_region == NL80211_DFS_UNSET)
5689                 return -EINVAL;
5690
5691         err = nl80211_parse_chandef(rdev, info, &chandef);
5692         if (err)
5693                 return err;
5694
5695         if (netif_carrier_ok(dev))
5696                 return -EBUSY;
5697
5698         if (wdev->cac_started)
5699                 return -EBUSY;
5700
5701         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef);
5702         if (err < 0)
5703                 return err;
5704
5705         if (err == 0)
5706                 return -EINVAL;
5707
5708         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5709                 return -EINVAL;
5710
5711         if (!rdev->ops->start_radar_detection)
5712                 return -EOPNOTSUPP;
5713
5714         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5715                                            chandef.chan, CHAN_MODE_SHARED,
5716                                            BIT(chandef.width));
5717         if (err)
5718                 return err;
5719
5720         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef);
5721         if (!err) {
5722                 wdev->channel = chandef.chan;
5723                 wdev->cac_started = true;
5724                 wdev->cac_start_time = jiffies;
5725         }
5726         return err;
5727 }
5728
5729 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5730 {
5731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5732         struct net_device *dev = info->user_ptr[1];
5733         struct wireless_dev *wdev = dev->ieee80211_ptr;
5734         struct cfg80211_csa_settings params;
5735         /* csa_attrs is defined static to avoid waste of stack size - this
5736          * function is called under RTNL lock, so this should not be a problem.
5737          */
5738         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5739         u8 radar_detect_width = 0;
5740         int err;
5741         bool need_new_beacon = false;
5742
5743         if (!rdev->ops->channel_switch ||
5744             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5745                 return -EOPNOTSUPP;
5746
5747         switch (dev->ieee80211_ptr->iftype) {
5748         case NL80211_IFTYPE_AP:
5749         case NL80211_IFTYPE_P2P_GO:
5750                 need_new_beacon = true;
5751
5752                 /* useless if AP is not running */
5753                 if (!wdev->beacon_interval)
5754                         return -EINVAL;
5755                 break;
5756         case NL80211_IFTYPE_ADHOC:
5757         case NL80211_IFTYPE_MESH_POINT:
5758                 break;
5759         default:
5760                 return -EOPNOTSUPP;
5761         }
5762
5763         memset(&params, 0, sizeof(params));
5764
5765         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5766             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5767                 return -EINVAL;
5768
5769         /* only important for AP, IBSS and mesh create IEs internally */
5770         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5771                 return -EINVAL;
5772
5773         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5774
5775         if (!need_new_beacon)
5776                 goto skip_beacons;
5777
5778         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5779         if (err)
5780                 return err;
5781
5782         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5783                                info->attrs[NL80211_ATTR_CSA_IES],
5784                                nl80211_policy);
5785         if (err)
5786                 return err;
5787
5788         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5789         if (err)
5790                 return err;
5791
5792         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5793                 return -EINVAL;
5794
5795         params.counter_offset_beacon =
5796                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5797         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5798                 return -EINVAL;
5799
5800         /* sanity check - counters should be the same */
5801         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5802             params.count)
5803                 return -EINVAL;
5804
5805         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5806                 params.counter_offset_presp =
5807                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5808                 if (params.counter_offset_presp >=
5809                     params.beacon_csa.probe_resp_len)
5810                         return -EINVAL;
5811
5812                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5813                     params.count)
5814                         return -EINVAL;
5815         }
5816
5817 skip_beacons:
5818         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5819         if (err)
5820                 return err;
5821
5822         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef))
5823                 return -EINVAL;
5824
5825         if (dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP ||
5826             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO ||
5827             dev->ieee80211_ptr->iftype == NL80211_IFTYPE_ADHOC) {
5828                 err = cfg80211_chandef_dfs_required(wdev->wiphy,
5829                                                     &params.chandef);
5830                 if (err < 0) {
5831                         return err;
5832                 } else if (err) {
5833                         radar_detect_width = BIT(params.chandef.width);
5834                         params.radar_required = true;
5835                 }
5836         }
5837
5838         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5839                                            params.chandef.chan,
5840                                            CHAN_MODE_SHARED,
5841                                            radar_detect_width);
5842         if (err)
5843                 return err;
5844
5845         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5846                 params.block_tx = true;
5847
5848         wdev_lock(wdev);
5849         err = rdev_channel_switch(rdev, dev, &params);
5850         wdev_unlock(wdev);
5851
5852         return err;
5853 }
5854
5855 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5856                             u32 seq, int flags,
5857                             struct cfg80211_registered_device *rdev,
5858                             struct wireless_dev *wdev,
5859                             struct cfg80211_internal_bss *intbss)
5860 {
5861         struct cfg80211_bss *res = &intbss->pub;
5862         const struct cfg80211_bss_ies *ies;
5863         void *hdr;
5864         struct nlattr *bss;
5865         bool tsf = false;
5866
5867         ASSERT_WDEV_LOCK(wdev);
5868
5869         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
5870                              NL80211_CMD_NEW_SCAN_RESULTS);
5871         if (!hdr)
5872                 return -1;
5873
5874         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
5875
5876         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
5877                 goto nla_put_failure;
5878         if (wdev->netdev &&
5879             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
5880                 goto nla_put_failure;
5881         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
5882                 goto nla_put_failure;
5883
5884         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
5885         if (!bss)
5886                 goto nla_put_failure;
5887         if ((!is_zero_ether_addr(res->bssid) &&
5888              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
5889                 goto nla_put_failure;
5890
5891         rcu_read_lock();
5892         ies = rcu_dereference(res->ies);
5893         if (ies) {
5894                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5895                         goto fail_unlock_rcu;
5896                 tsf = true;
5897                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
5898                                         ies->len, ies->data))
5899                         goto fail_unlock_rcu;
5900         }
5901         ies = rcu_dereference(res->beacon_ies);
5902         if (ies) {
5903                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
5904                         goto fail_unlock_rcu;
5905                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
5906                                         ies->len, ies->data))
5907                         goto fail_unlock_rcu;
5908         }
5909         rcu_read_unlock();
5910
5911         if (res->beacon_interval &&
5912             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
5913                 goto nla_put_failure;
5914         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
5915             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
5916             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
5917             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
5918                         jiffies_to_msecs(jiffies - intbss->ts)))
5919                 goto nla_put_failure;
5920
5921         switch (rdev->wiphy.signal_type) {
5922         case CFG80211_SIGNAL_TYPE_MBM:
5923                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
5924                         goto nla_put_failure;
5925                 break;
5926         case CFG80211_SIGNAL_TYPE_UNSPEC:
5927                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
5928                         goto nla_put_failure;
5929                 break;
5930         default:
5931                 break;
5932         }
5933
5934         switch (wdev->iftype) {
5935         case NL80211_IFTYPE_P2P_CLIENT:
5936         case NL80211_IFTYPE_STATION:
5937                 if (intbss == wdev->current_bss &&
5938                     nla_put_u32(msg, NL80211_BSS_STATUS,
5939                                 NL80211_BSS_STATUS_ASSOCIATED))
5940                         goto nla_put_failure;
5941                 break;
5942         case NL80211_IFTYPE_ADHOC:
5943                 if (intbss == wdev->current_bss &&
5944                     nla_put_u32(msg, NL80211_BSS_STATUS,
5945                                 NL80211_BSS_STATUS_IBSS_JOINED))
5946                         goto nla_put_failure;
5947                 break;
5948         default:
5949                 break;
5950         }
5951
5952         nla_nest_end(msg, bss);
5953
5954         return genlmsg_end(msg, hdr);
5955
5956  fail_unlock_rcu:
5957         rcu_read_unlock();
5958  nla_put_failure:
5959         genlmsg_cancel(msg, hdr);
5960         return -EMSGSIZE;
5961 }
5962
5963 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
5964 {
5965         struct cfg80211_registered_device *rdev;
5966         struct cfg80211_internal_bss *scan;
5967         struct wireless_dev *wdev;
5968         int start = cb->args[2], idx = 0;
5969         int err;
5970
5971         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5972         if (err)
5973                 return err;
5974
5975         wdev_lock(wdev);
5976         spin_lock_bh(&rdev->bss_lock);
5977         cfg80211_bss_expire(rdev);
5978
5979         cb->seq = rdev->bss_generation;
5980
5981         list_for_each_entry(scan, &rdev->bss_list, list) {
5982                 if (++idx <= start)
5983                         continue;
5984                 if (nl80211_send_bss(skb, cb,
5985                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5986                                 rdev, wdev, scan) < 0) {
5987                         idx--;
5988                         break;
5989                 }
5990         }
5991
5992         spin_unlock_bh(&rdev->bss_lock);
5993         wdev_unlock(wdev);
5994
5995         cb->args[2] = idx;
5996         nl80211_finish_wdev_dump(rdev);
5997
5998         return skb->len;
5999 }
6000
6001 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6002                                 int flags, struct net_device *dev,
6003                                 struct survey_info *survey)
6004 {
6005         void *hdr;
6006         struct nlattr *infoattr;
6007
6008         hdr = nl80211hdr_put(msg, portid, seq, flags,
6009                              NL80211_CMD_NEW_SURVEY_RESULTS);
6010         if (!hdr)
6011                 return -ENOMEM;
6012
6013         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6014                 goto nla_put_failure;
6015
6016         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6017         if (!infoattr)
6018                 goto nla_put_failure;
6019
6020         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6021                         survey->channel->center_freq))
6022                 goto nla_put_failure;
6023
6024         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6025             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6026                 goto nla_put_failure;
6027         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6028             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6029                 goto nla_put_failure;
6030         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6031             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6032                         survey->channel_time))
6033                 goto nla_put_failure;
6034         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6035             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6036                         survey->channel_time_busy))
6037                 goto nla_put_failure;
6038         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6039             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6040                         survey->channel_time_ext_busy))
6041                 goto nla_put_failure;
6042         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6043             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6044                         survey->channel_time_rx))
6045                 goto nla_put_failure;
6046         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6047             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6048                         survey->channel_time_tx))
6049                 goto nla_put_failure;
6050
6051         nla_nest_end(msg, infoattr);
6052
6053         return genlmsg_end(msg, hdr);
6054
6055  nla_put_failure:
6056         genlmsg_cancel(msg, hdr);
6057         return -EMSGSIZE;
6058 }
6059
6060 static int nl80211_dump_survey(struct sk_buff *skb,
6061                         struct netlink_callback *cb)
6062 {
6063         struct survey_info survey;
6064         struct cfg80211_registered_device *dev;
6065         struct wireless_dev *wdev;
6066         int survey_idx = cb->args[2];
6067         int res;
6068
6069         res = nl80211_prepare_wdev_dump(skb, cb, &dev, &wdev);
6070         if (res)
6071                 return res;
6072
6073         if (!wdev->netdev) {
6074                 res = -EINVAL;
6075                 goto out_err;
6076         }
6077
6078         if (!dev->ops->dump_survey) {
6079                 res = -EOPNOTSUPP;
6080                 goto out_err;
6081         }
6082
6083         while (1) {
6084                 struct ieee80211_channel *chan;
6085
6086                 res = rdev_dump_survey(dev, wdev->netdev, survey_idx, &survey);
6087                 if (res == -ENOENT)
6088                         break;
6089                 if (res)
6090                         goto out_err;
6091
6092                 /* Survey without a channel doesn't make sense */
6093                 if (!survey.channel) {
6094                         res = -EINVAL;
6095                         goto out;
6096                 }
6097
6098                 chan = ieee80211_get_channel(&dev->wiphy,
6099                                              survey.channel->center_freq);
6100                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6101                         survey_idx++;
6102                         continue;
6103                 }
6104
6105                 if (nl80211_send_survey(skb,
6106                                 NETLINK_CB(cb->skb).portid,
6107                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6108                                 wdev->netdev, &survey) < 0)
6109                         goto out;
6110                 survey_idx++;
6111         }
6112
6113  out:
6114         cb->args[2] = survey_idx;
6115         res = skb->len;
6116  out_err:
6117         nl80211_finish_wdev_dump(dev);
6118         return res;
6119 }
6120
6121 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6122 {
6123         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6124                                   NL80211_WPA_VERSION_2));
6125 }
6126
6127 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6128 {
6129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6130         struct net_device *dev = info->user_ptr[1];
6131         struct ieee80211_channel *chan;
6132         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6133         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6134         enum nl80211_auth_type auth_type;
6135         struct key_parse key;
6136         bool local_state_change;
6137
6138         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6139                 return -EINVAL;
6140
6141         if (!info->attrs[NL80211_ATTR_MAC])
6142                 return -EINVAL;
6143
6144         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6145                 return -EINVAL;
6146
6147         if (!info->attrs[NL80211_ATTR_SSID])
6148                 return -EINVAL;
6149
6150         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6151                 return -EINVAL;
6152
6153         err = nl80211_parse_key(info, &key);
6154         if (err)
6155                 return err;
6156
6157         if (key.idx >= 0) {
6158                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6159                         return -EINVAL;
6160                 if (!key.p.key || !key.p.key_len)
6161                         return -EINVAL;
6162                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6163                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6164                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6165                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6166                         return -EINVAL;
6167                 if (key.idx > 4)
6168                         return -EINVAL;
6169         } else {
6170                 key.p.key_len = 0;
6171                 key.p.key = NULL;
6172         }
6173
6174         if (key.idx >= 0) {
6175                 int i;
6176                 bool ok = false;
6177                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6178                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6179                                 ok = true;
6180                                 break;
6181                         }
6182                 }
6183                 if (!ok)
6184                         return -EINVAL;
6185         }
6186
6187         if (!rdev->ops->auth)
6188                 return -EOPNOTSUPP;
6189
6190         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6191             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6192                 return -EOPNOTSUPP;
6193
6194         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6195         chan = ieee80211_get_channel(&rdev->wiphy,
6196                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6197         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6198                 return -EINVAL;
6199
6200         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6201         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6202
6203         if (info->attrs[NL80211_ATTR_IE]) {
6204                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6205                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6206         }
6207
6208         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6209         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6210                 return -EINVAL;
6211
6212         if (auth_type == NL80211_AUTHTYPE_SAE &&
6213             !info->attrs[NL80211_ATTR_SAE_DATA])
6214                 return -EINVAL;
6215
6216         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6217                 if (auth_type != NL80211_AUTHTYPE_SAE)
6218                         return -EINVAL;
6219                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6220                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6221                 /* need to include at least Auth Transaction and Status Code */
6222                 if (sae_data_len < 4)
6223                         return -EINVAL;
6224         }
6225
6226         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6227
6228         /*
6229          * Since we no longer track auth state, ignore
6230          * requests to only change local state.
6231          */
6232         if (local_state_change)
6233                 return 0;
6234
6235         wdev_lock(dev->ieee80211_ptr);
6236         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6237                                  ssid, ssid_len, ie, ie_len,
6238                                  key.p.key, key.p.key_len, key.idx,
6239                                  sae_data, sae_data_len);
6240         wdev_unlock(dev->ieee80211_ptr);
6241         return err;
6242 }
6243
6244 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6245                                    struct genl_info *info,
6246                                    struct cfg80211_crypto_settings *settings,
6247                                    int cipher_limit)
6248 {
6249         memset(settings, 0, sizeof(*settings));
6250
6251         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6252
6253         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6254                 u16 proto;
6255                 proto = nla_get_u16(
6256                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6257                 settings->control_port_ethertype = cpu_to_be16(proto);
6258                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6259                     proto != ETH_P_PAE)
6260                         return -EINVAL;
6261                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6262                         settings->control_port_no_encrypt = true;
6263         } else
6264                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6265
6266         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6267                 void *data;
6268                 int len, i;
6269
6270                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6271                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6272                 settings->n_ciphers_pairwise = len / sizeof(u32);
6273
6274                 if (len % sizeof(u32))
6275                         return -EINVAL;
6276
6277                 if (settings->n_ciphers_pairwise > cipher_limit)
6278                         return -EINVAL;
6279
6280                 memcpy(settings->ciphers_pairwise, data, len);
6281
6282                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6283                         if (!cfg80211_supported_cipher_suite(
6284                                         &rdev->wiphy,
6285                                         settings->ciphers_pairwise[i]))
6286                                 return -EINVAL;
6287         }
6288
6289         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6290                 settings->cipher_group =
6291                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6292                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6293                                                      settings->cipher_group))
6294                         return -EINVAL;
6295         }
6296
6297         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6298                 settings->wpa_versions =
6299                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6300                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6301                         return -EINVAL;
6302         }
6303
6304         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6305                 void *data;
6306                 int len;
6307
6308                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6309                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6310                 settings->n_akm_suites = len / sizeof(u32);
6311
6312                 if (len % sizeof(u32))
6313                         return -EINVAL;
6314
6315                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6316                         return -EINVAL;
6317
6318                 memcpy(settings->akm_suites, data, len);
6319         }
6320
6321         return 0;
6322 }
6323
6324 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6325 {
6326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6327         struct net_device *dev = info->user_ptr[1];
6328         struct ieee80211_channel *chan;
6329         struct cfg80211_assoc_request req = {};
6330         const u8 *bssid, *ssid;
6331         int err, ssid_len = 0;
6332
6333         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6334                 return -EINVAL;
6335
6336         if (!info->attrs[NL80211_ATTR_MAC] ||
6337             !info->attrs[NL80211_ATTR_SSID] ||
6338             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6339                 return -EINVAL;
6340
6341         if (!rdev->ops->assoc)
6342                 return -EOPNOTSUPP;
6343
6344         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6345             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6346                 return -EOPNOTSUPP;
6347
6348         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6349
6350         chan = ieee80211_get_channel(&rdev->wiphy,
6351                 nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
6352         if (!chan || (chan->flags & IEEE80211_CHAN_DISABLED))
6353                 return -EINVAL;
6354
6355         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6356         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6357
6358         if (info->attrs[NL80211_ATTR_IE]) {
6359                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6360                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6361         }
6362
6363         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6364                 enum nl80211_mfp mfp =
6365                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6366                 if (mfp == NL80211_MFP_REQUIRED)
6367                         req.use_mfp = true;
6368                 else if (mfp != NL80211_MFP_NO)
6369                         return -EINVAL;
6370         }
6371
6372         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6373                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6374
6375         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6376                 req.flags |= ASSOC_REQ_DISABLE_HT;
6377
6378         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6379                 memcpy(&req.ht_capa_mask,
6380                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6381                        sizeof(req.ht_capa_mask));
6382
6383         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6384                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6385                         return -EINVAL;
6386                 memcpy(&req.ht_capa,
6387                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6388                        sizeof(req.ht_capa));
6389         }
6390
6391         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6392                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6393
6394         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6395                 memcpy(&req.vht_capa_mask,
6396                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6397                        sizeof(req.vht_capa_mask));
6398
6399         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6400                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6401                         return -EINVAL;
6402                 memcpy(&req.vht_capa,
6403                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6404                        sizeof(req.vht_capa));
6405         }
6406
6407         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6408         if (!err) {
6409                 wdev_lock(dev->ieee80211_ptr);
6410                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6411                                           ssid, ssid_len, &req);
6412                 wdev_unlock(dev->ieee80211_ptr);
6413         }
6414
6415         return err;
6416 }
6417
6418 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6419 {
6420         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6421         struct net_device *dev = info->user_ptr[1];
6422         const u8 *ie = NULL, *bssid;
6423         int ie_len = 0, err;
6424         u16 reason_code;
6425         bool local_state_change;
6426
6427         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6428                 return -EINVAL;
6429
6430         if (!info->attrs[NL80211_ATTR_MAC])
6431                 return -EINVAL;
6432
6433         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6434                 return -EINVAL;
6435
6436         if (!rdev->ops->deauth)
6437                 return -EOPNOTSUPP;
6438
6439         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6440             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6441                 return -EOPNOTSUPP;
6442
6443         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6444
6445         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6446         if (reason_code == 0) {
6447                 /* Reason Code 0 is reserved */
6448                 return -EINVAL;
6449         }
6450
6451         if (info->attrs[NL80211_ATTR_IE]) {
6452                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6453                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6454         }
6455
6456         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6457
6458         wdev_lock(dev->ieee80211_ptr);
6459         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6460                                    local_state_change);
6461         wdev_unlock(dev->ieee80211_ptr);
6462         return err;
6463 }
6464
6465 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6466 {
6467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6468         struct net_device *dev = info->user_ptr[1];
6469         const u8 *ie = NULL, *bssid;
6470         int ie_len = 0, err;
6471         u16 reason_code;
6472         bool local_state_change;
6473
6474         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6475                 return -EINVAL;
6476
6477         if (!info->attrs[NL80211_ATTR_MAC])
6478                 return -EINVAL;
6479
6480         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6481                 return -EINVAL;
6482
6483         if (!rdev->ops->disassoc)
6484                 return -EOPNOTSUPP;
6485
6486         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6487             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6488                 return -EOPNOTSUPP;
6489
6490         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6491
6492         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6493         if (reason_code == 0) {
6494                 /* Reason Code 0 is reserved */
6495                 return -EINVAL;
6496         }
6497
6498         if (info->attrs[NL80211_ATTR_IE]) {
6499                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6500                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6501         }
6502
6503         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6504
6505         wdev_lock(dev->ieee80211_ptr);
6506         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6507                                      local_state_change);
6508         wdev_unlock(dev->ieee80211_ptr);
6509         return err;
6510 }
6511
6512 static bool
6513 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6514                          int mcast_rate[IEEE80211_NUM_BANDS],
6515                          int rateval)
6516 {
6517         struct wiphy *wiphy = &rdev->wiphy;
6518         bool found = false;
6519         int band, i;
6520
6521         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6522                 struct ieee80211_supported_band *sband;
6523
6524                 sband = wiphy->bands[band];
6525                 if (!sband)
6526                         continue;
6527
6528                 for (i = 0; i < sband->n_bitrates; i++) {
6529                         if (sband->bitrates[i].bitrate == rateval) {
6530                                 mcast_rate[band] = i + 1;
6531                                 found = true;
6532                                 break;
6533                         }
6534                 }
6535         }
6536
6537         return found;
6538 }
6539
6540 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6541 {
6542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6543         struct net_device *dev = info->user_ptr[1];
6544         struct cfg80211_ibss_params ibss;
6545         struct wiphy *wiphy;
6546         struct cfg80211_cached_keys *connkeys = NULL;
6547         int err;
6548
6549         memset(&ibss, 0, sizeof(ibss));
6550
6551         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6552                 return -EINVAL;
6553
6554         if (!info->attrs[NL80211_ATTR_SSID] ||
6555             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6556                 return -EINVAL;
6557
6558         ibss.beacon_interval = 100;
6559
6560         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6561                 ibss.beacon_interval =
6562                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6563                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6564                         return -EINVAL;
6565         }
6566
6567         if (!rdev->ops->join_ibss)
6568                 return -EOPNOTSUPP;
6569
6570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6571                 return -EOPNOTSUPP;
6572
6573         wiphy = &rdev->wiphy;
6574
6575         if (info->attrs[NL80211_ATTR_MAC]) {
6576                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6577
6578                 if (!is_valid_ether_addr(ibss.bssid))
6579                         return -EINVAL;
6580         }
6581         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6582         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6583
6584         if (info->attrs[NL80211_ATTR_IE]) {
6585                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6586                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6587         }
6588
6589         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6590         if (err)
6591                 return err;
6592
6593         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef))
6594                 return -EINVAL;
6595
6596         switch (ibss.chandef.width) {
6597         case NL80211_CHAN_WIDTH_5:
6598         case NL80211_CHAN_WIDTH_10:
6599         case NL80211_CHAN_WIDTH_20_NOHT:
6600                 break;
6601         case NL80211_CHAN_WIDTH_20:
6602         case NL80211_CHAN_WIDTH_40:
6603                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6604                         break;
6605         default:
6606                 return -EINVAL;
6607         }
6608
6609         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6610         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6611
6612         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6613                 u8 *rates =
6614                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6615                 int n_rates =
6616                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6617                 struct ieee80211_supported_band *sband =
6618                         wiphy->bands[ibss.chandef.chan->band];
6619
6620                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6621                                              &ibss.basic_rates);
6622                 if (err)
6623                         return err;
6624         }
6625
6626         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6627                 memcpy(&ibss.ht_capa_mask,
6628                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6629                        sizeof(ibss.ht_capa_mask));
6630
6631         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6632                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6633                         return -EINVAL;
6634                 memcpy(&ibss.ht_capa,
6635                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6636                        sizeof(ibss.ht_capa));
6637         }
6638
6639         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6640             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6641                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6642                 return -EINVAL;
6643
6644         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6645                 bool no_ht = false;
6646
6647                 connkeys = nl80211_parse_connkeys(rdev,
6648                                           info->attrs[NL80211_ATTR_KEYS],
6649                                           &no_ht);
6650                 if (IS_ERR(connkeys))
6651                         return PTR_ERR(connkeys);
6652
6653                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6654                     no_ht) {
6655                         kfree(connkeys);
6656                         return -EINVAL;
6657                 }
6658         }
6659
6660         ibss.control_port =
6661                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6662
6663         ibss.userspace_handles_dfs =
6664                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6665
6666         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6667         if (err)
6668                 kfree(connkeys);
6669         return err;
6670 }
6671
6672 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6673 {
6674         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6675         struct net_device *dev = info->user_ptr[1];
6676
6677         if (!rdev->ops->leave_ibss)
6678                 return -EOPNOTSUPP;
6679
6680         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6681                 return -EOPNOTSUPP;
6682
6683         return cfg80211_leave_ibss(rdev, dev, false);
6684 }
6685
6686 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6687 {
6688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6689         struct net_device *dev = info->user_ptr[1];
6690         int mcast_rate[IEEE80211_NUM_BANDS];
6691         u32 nla_rate;
6692         int err;
6693
6694         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6695             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6696                 return -EOPNOTSUPP;
6697
6698         if (!rdev->ops->set_mcast_rate)
6699                 return -EOPNOTSUPP;
6700
6701         memset(mcast_rate, 0, sizeof(mcast_rate));
6702
6703         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6704                 return -EINVAL;
6705
6706         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6707         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6708                 return -EINVAL;
6709
6710         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6711
6712         return err;
6713 }
6714
6715 static struct sk_buff *
6716 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6717                             int approxlen, u32 portid, u32 seq,
6718                             enum nl80211_commands cmd,
6719                             enum nl80211_attrs attr,
6720                             const struct nl80211_vendor_cmd_info *info,
6721                             gfp_t gfp)
6722 {
6723         struct sk_buff *skb;
6724         void *hdr;
6725         struct nlattr *data;
6726
6727         skb = nlmsg_new(approxlen + 100, gfp);
6728         if (!skb)
6729                 return NULL;
6730
6731         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6732         if (!hdr) {
6733                 kfree_skb(skb);
6734                 return NULL;
6735         }
6736
6737         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6738                 goto nla_put_failure;
6739
6740         if (info) {
6741                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6742                                 info->vendor_id))
6743                         goto nla_put_failure;
6744                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6745                                 info->subcmd))
6746                         goto nla_put_failure;
6747         }
6748
6749         data = nla_nest_start(skb, attr);
6750
6751         ((void **)skb->cb)[0] = rdev;
6752         ((void **)skb->cb)[1] = hdr;
6753         ((void **)skb->cb)[2] = data;
6754
6755         return skb;
6756
6757  nla_put_failure:
6758         kfree_skb(skb);
6759         return NULL;
6760 }
6761
6762 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6763                                            enum nl80211_commands cmd,
6764                                            enum nl80211_attrs attr,
6765                                            int vendor_event_idx,
6766                                            int approxlen, gfp_t gfp)
6767 {
6768         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
6769         const struct nl80211_vendor_cmd_info *info;
6770
6771         switch (cmd) {
6772         case NL80211_CMD_TESTMODE:
6773                 if (WARN_ON(vendor_event_idx != -1))
6774                         return NULL;
6775                 info = NULL;
6776                 break;
6777         case NL80211_CMD_VENDOR:
6778                 if (WARN_ON(vendor_event_idx < 0 ||
6779                             vendor_event_idx >= wiphy->n_vendor_events))
6780                         return NULL;
6781                 info = &wiphy->vendor_events[vendor_event_idx];
6782                 break;
6783         default:
6784                 WARN_ON(1);
6785                 return NULL;
6786         }
6787
6788         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6789                                            cmd, attr, info, gfp);
6790 }
6791 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6792
6793 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6794 {
6795         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6796         void *hdr = ((void **)skb->cb)[1];
6797         struct nlattr *data = ((void **)skb->cb)[2];
6798         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6799
6800         nla_nest_end(skb, data);
6801         genlmsg_end(skb, hdr);
6802
6803         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6804                 mcgrp = NL80211_MCGRP_VENDOR;
6805
6806         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6807                                 mcgrp, gfp);
6808 }
6809 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6810
6811 #ifdef CONFIG_NL80211_TESTMODE
6812 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6813 {
6814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6815         struct wireless_dev *wdev =
6816                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6817         int err;
6818
6819         if (!rdev->ops->testmode_cmd)
6820                 return -EOPNOTSUPP;
6821
6822         if (IS_ERR(wdev)) {
6823                 err = PTR_ERR(wdev);
6824                 if (err != -EINVAL)
6825                         return err;
6826                 wdev = NULL;
6827         } else if (wdev->wiphy != &rdev->wiphy) {
6828                 return -EINVAL;
6829         }
6830
6831         if (!info->attrs[NL80211_ATTR_TESTDATA])
6832                 return -EINVAL;
6833
6834         rdev->cur_cmd_info = info;
6835         err = rdev_testmode_cmd(rdev, wdev,
6836                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6837                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6838         rdev->cur_cmd_info = NULL;
6839
6840         return err;
6841 }
6842
6843 static int nl80211_testmode_dump(struct sk_buff *skb,
6844                                  struct netlink_callback *cb)
6845 {
6846         struct cfg80211_registered_device *rdev;
6847         int err;
6848         long phy_idx;
6849         void *data = NULL;
6850         int data_len = 0;
6851
6852         rtnl_lock();
6853
6854         if (cb->args[0]) {
6855                 /*
6856                  * 0 is a valid index, but not valid for args[0],
6857                  * so we need to offset by 1.
6858                  */
6859                 phy_idx = cb->args[0] - 1;
6860         } else {
6861                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6862                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6863                                   nl80211_policy);
6864                 if (err)
6865                         goto out_err;
6866
6867                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
6868                                                   nl80211_fam.attrbuf);
6869                 if (IS_ERR(rdev)) {
6870                         err = PTR_ERR(rdev);
6871                         goto out_err;
6872                 }
6873                 phy_idx = rdev->wiphy_idx;
6874                 rdev = NULL;
6875
6876                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
6877                         cb->args[1] =
6878                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
6879         }
6880
6881         if (cb->args[1]) {
6882                 data = nla_data((void *)cb->args[1]);
6883                 data_len = nla_len((void *)cb->args[1]);
6884         }
6885
6886         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
6887         if (!rdev) {
6888                 err = -ENOENT;
6889                 goto out_err;
6890         }
6891
6892         if (!rdev->ops->testmode_dump) {
6893                 err = -EOPNOTSUPP;
6894                 goto out_err;
6895         }
6896
6897         while (1) {
6898                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
6899                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
6900                                            NL80211_CMD_TESTMODE);
6901                 struct nlattr *tmdata;
6902
6903                 if (!hdr)
6904                         break;
6905
6906                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
6907                         genlmsg_cancel(skb, hdr);
6908                         break;
6909                 }
6910
6911                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
6912                 if (!tmdata) {
6913                         genlmsg_cancel(skb, hdr);
6914                         break;
6915                 }
6916                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
6917                 nla_nest_end(skb, tmdata);
6918
6919                 if (err == -ENOBUFS || err == -ENOENT) {
6920                         genlmsg_cancel(skb, hdr);
6921                         break;
6922                 } else if (err) {
6923                         genlmsg_cancel(skb, hdr);
6924                         goto out_err;
6925                 }
6926
6927                 genlmsg_end(skb, hdr);
6928         }
6929
6930         err = skb->len;
6931         /* see above */
6932         cb->args[0] = phy_idx + 1;
6933  out_err:
6934         rtnl_unlock();
6935         return err;
6936 }
6937 #endif
6938
6939 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
6940 {
6941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6942         struct net_device *dev = info->user_ptr[1];
6943         struct cfg80211_connect_params connect;
6944         struct wiphy *wiphy;
6945         struct cfg80211_cached_keys *connkeys = NULL;
6946         int err;
6947
6948         memset(&connect, 0, sizeof(connect));
6949
6950         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6951                 return -EINVAL;
6952
6953         if (!info->attrs[NL80211_ATTR_SSID] ||
6954             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6955                 return -EINVAL;
6956
6957         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
6958                 connect.auth_type =
6959                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6960                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
6961                                              NL80211_CMD_CONNECT))
6962                         return -EINVAL;
6963         } else
6964                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6965
6966         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
6967
6968         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
6969                                       NL80211_MAX_NR_CIPHER_SUITES);
6970         if (err)
6971                 return err;
6972
6973         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6974             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6975                 return -EOPNOTSUPP;
6976
6977         wiphy = &rdev->wiphy;
6978
6979         connect.bg_scan_period = -1;
6980         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
6981                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
6982                 connect.bg_scan_period =
6983                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
6984         }
6985
6986         if (info->attrs[NL80211_ATTR_MAC])
6987                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6988         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6989         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6990
6991         if (info->attrs[NL80211_ATTR_IE]) {
6992                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6993                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6994         }
6995
6996         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6997                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6998                 if (connect.mfp != NL80211_MFP_REQUIRED &&
6999                     connect.mfp != NL80211_MFP_NO)
7000                         return -EINVAL;
7001         } else {
7002                 connect.mfp = NL80211_MFP_NO;
7003         }
7004
7005         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7006                 connect.channel =
7007                         ieee80211_get_channel(wiphy,
7008                             nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
7009                 if (!connect.channel ||
7010                     connect.channel->flags & IEEE80211_CHAN_DISABLED)
7011                         return -EINVAL;
7012         }
7013
7014         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7015                 connkeys = nl80211_parse_connkeys(rdev,
7016                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7017                 if (IS_ERR(connkeys))
7018                         return PTR_ERR(connkeys);
7019         }
7020
7021         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7022                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7023
7024         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7025                 memcpy(&connect.ht_capa_mask,
7026                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7027                        sizeof(connect.ht_capa_mask));
7028
7029         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7030                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7031                         kfree(connkeys);
7032                         return -EINVAL;
7033                 }
7034                 memcpy(&connect.ht_capa,
7035                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7036                        sizeof(connect.ht_capa));
7037         }
7038
7039         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7040                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7041
7042         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7043                 memcpy(&connect.vht_capa_mask,
7044                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7045                        sizeof(connect.vht_capa_mask));
7046
7047         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7048                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7049                         kfree(connkeys);
7050                         return -EINVAL;
7051                 }
7052                 memcpy(&connect.vht_capa,
7053                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7054                        sizeof(connect.vht_capa));
7055         }
7056
7057         wdev_lock(dev->ieee80211_ptr);
7058         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7059         wdev_unlock(dev->ieee80211_ptr);
7060         if (err)
7061                 kfree(connkeys);
7062         return err;
7063 }
7064
7065 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7066 {
7067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7068         struct net_device *dev = info->user_ptr[1];
7069         u16 reason;
7070         int ret;
7071
7072         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7073                 reason = WLAN_REASON_DEAUTH_LEAVING;
7074         else
7075                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7076
7077         if (reason == 0)
7078                 return -EINVAL;
7079
7080         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7081             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7082                 return -EOPNOTSUPP;
7083
7084         wdev_lock(dev->ieee80211_ptr);
7085         ret = cfg80211_disconnect(rdev, dev, reason, true);
7086         wdev_unlock(dev->ieee80211_ptr);
7087         return ret;
7088 }
7089
7090 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7091 {
7092         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7093         struct net *net;
7094         int err;
7095         u32 pid;
7096
7097         if (!info->attrs[NL80211_ATTR_PID])
7098                 return -EINVAL;
7099
7100         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7101
7102         net = get_net_ns_by_pid(pid);
7103         if (IS_ERR(net))
7104                 return PTR_ERR(net);
7105
7106         err = 0;
7107
7108         /* check if anything to do */
7109         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7110                 err = cfg80211_switch_netns(rdev, net);
7111
7112         put_net(net);
7113         return err;
7114 }
7115
7116 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7117 {
7118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7119         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7120                         struct cfg80211_pmksa *pmksa) = NULL;
7121         struct net_device *dev = info->user_ptr[1];
7122         struct cfg80211_pmksa pmksa;
7123
7124         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7125
7126         if (!info->attrs[NL80211_ATTR_MAC])
7127                 return -EINVAL;
7128
7129         if (!info->attrs[NL80211_ATTR_PMKID])
7130                 return -EINVAL;
7131
7132         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7133         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7134
7135         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7136             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7137                 return -EOPNOTSUPP;
7138
7139         switch (info->genlhdr->cmd) {
7140         case NL80211_CMD_SET_PMKSA:
7141                 rdev_ops = rdev->ops->set_pmksa;
7142                 break;
7143         case NL80211_CMD_DEL_PMKSA:
7144                 rdev_ops = rdev->ops->del_pmksa;
7145                 break;
7146         default:
7147                 WARN_ON(1);
7148                 break;
7149         }
7150
7151         if (!rdev_ops)
7152                 return -EOPNOTSUPP;
7153
7154         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7155 }
7156
7157 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7158 {
7159         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7160         struct net_device *dev = info->user_ptr[1];
7161
7162         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7163             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7164                 return -EOPNOTSUPP;
7165
7166         if (!rdev->ops->flush_pmksa)
7167                 return -EOPNOTSUPP;
7168
7169         return rdev_flush_pmksa(rdev, dev);
7170 }
7171
7172 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7173 {
7174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7175         struct net_device *dev = info->user_ptr[1];
7176         u8 action_code, dialog_token;
7177         u16 status_code;
7178         u8 *peer;
7179
7180         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7181             !rdev->ops->tdls_mgmt)
7182                 return -EOPNOTSUPP;
7183
7184         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7185             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7186             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7187             !info->attrs[NL80211_ATTR_IE] ||
7188             !info->attrs[NL80211_ATTR_MAC])
7189                 return -EINVAL;
7190
7191         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7192         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7193         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7194         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7195
7196         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7197                               dialog_token, status_code,
7198                               nla_data(info->attrs[NL80211_ATTR_IE]),
7199                               nla_len(info->attrs[NL80211_ATTR_IE]));
7200 }
7201
7202 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7203 {
7204         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7205         struct net_device *dev = info->user_ptr[1];
7206         enum nl80211_tdls_operation operation;
7207         u8 *peer;
7208
7209         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7210             !rdev->ops->tdls_oper)
7211                 return -EOPNOTSUPP;
7212
7213         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7214             !info->attrs[NL80211_ATTR_MAC])
7215                 return -EINVAL;
7216
7217         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7218         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7219
7220         return rdev_tdls_oper(rdev, dev, peer, operation);
7221 }
7222
7223 static int nl80211_remain_on_channel(struct sk_buff *skb,
7224                                      struct genl_info *info)
7225 {
7226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7227         struct wireless_dev *wdev = info->user_ptr[1];
7228         struct cfg80211_chan_def chandef;
7229         struct sk_buff *msg;
7230         void *hdr;
7231         u64 cookie;
7232         u32 duration;
7233         int err;
7234
7235         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7236             !info->attrs[NL80211_ATTR_DURATION])
7237                 return -EINVAL;
7238
7239         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7240
7241         if (!rdev->ops->remain_on_channel ||
7242             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7243                 return -EOPNOTSUPP;
7244
7245         /*
7246          * We should be on that channel for at least a minimum amount of
7247          * time (10ms) but no longer than the driver supports.
7248          */
7249         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7250             duration > rdev->wiphy.max_remain_on_channel_duration)
7251                 return -EINVAL;
7252
7253         err = nl80211_parse_chandef(rdev, info, &chandef);
7254         if (err)
7255                 return err;
7256
7257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7258         if (!msg)
7259                 return -ENOMEM;
7260
7261         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7262                              NL80211_CMD_REMAIN_ON_CHANNEL);
7263         if (!hdr) {
7264                 err = -ENOBUFS;
7265                 goto free_msg;
7266         }
7267
7268         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7269                                      duration, &cookie);
7270
7271         if (err)
7272                 goto free_msg;
7273
7274         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7275                 goto nla_put_failure;
7276
7277         genlmsg_end(msg, hdr);
7278
7279         return genlmsg_reply(msg, info);
7280
7281  nla_put_failure:
7282         err = -ENOBUFS;
7283  free_msg:
7284         nlmsg_free(msg);
7285         return err;
7286 }
7287
7288 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7289                                             struct genl_info *info)
7290 {
7291         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7292         struct wireless_dev *wdev = info->user_ptr[1];
7293         u64 cookie;
7294
7295         if (!info->attrs[NL80211_ATTR_COOKIE])
7296                 return -EINVAL;
7297
7298         if (!rdev->ops->cancel_remain_on_channel)
7299                 return -EOPNOTSUPP;
7300
7301         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7302
7303         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7304 }
7305
7306 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7307                            u8 *rates, u8 rates_len)
7308 {
7309         u8 i;
7310         u32 mask = 0;
7311
7312         for (i = 0; i < rates_len; i++) {
7313                 int rate = (rates[i] & 0x7f) * 5;
7314                 int ridx;
7315                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7316                         struct ieee80211_rate *srate =
7317                                 &sband->bitrates[ridx];
7318                         if (rate == srate->bitrate) {
7319                                 mask |= 1 << ridx;
7320                                 break;
7321                         }
7322                 }
7323                 if (ridx == sband->n_bitrates)
7324                         return 0; /* rate not found */
7325         }
7326
7327         return mask;
7328 }
7329
7330 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7331                                u8 *rates, u8 rates_len,
7332                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7333 {
7334         u8 i;
7335
7336         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7337
7338         for (i = 0; i < rates_len; i++) {
7339                 int ridx, rbit;
7340
7341                 ridx = rates[i] / 8;
7342                 rbit = BIT(rates[i] % 8);
7343
7344                 /* check validity */
7345                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7346                         return false;
7347
7348                 /* check availability */
7349                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7350                         mcs[ridx] |= rbit;
7351                 else
7352                         return false;
7353         }
7354
7355         return true;
7356 }
7357
7358 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7359 {
7360         u16 mcs_mask = 0;
7361
7362         switch (vht_mcs_map) {
7363         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7364                 break;
7365         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7366                 mcs_mask = 0x00FF;
7367                 break;
7368         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7369                 mcs_mask = 0x01FF;
7370                 break;
7371         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7372                 mcs_mask = 0x03FF;
7373                 break;
7374         default:
7375                 break;
7376         }
7377
7378         return mcs_mask;
7379 }
7380
7381 static void vht_build_mcs_mask(u16 vht_mcs_map,
7382                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7383 {
7384         u8 nss;
7385
7386         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7387                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7388                 vht_mcs_map >>= 2;
7389         }
7390 }
7391
7392 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7393                              struct nl80211_txrate_vht *txrate,
7394                              u16 mcs[NL80211_VHT_NSS_MAX])
7395 {
7396         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7397         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7398         u8 i;
7399
7400         if (!sband->vht_cap.vht_supported)
7401                 return false;
7402
7403         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7404
7405         /* Build vht_mcs_mask from VHT capabilities */
7406         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7407
7408         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7409                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7410                         mcs[i] = txrate->mcs[i];
7411                 else
7412                         return false;
7413         }
7414
7415         return true;
7416 }
7417
7418 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7419         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7420                                     .len = NL80211_MAX_SUPP_RATES },
7421         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7422                                 .len = NL80211_MAX_SUPP_HT_RATES },
7423         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7424 };
7425
7426 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7427                                        struct genl_info *info)
7428 {
7429         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7431         struct cfg80211_bitrate_mask mask;
7432         int rem, i;
7433         struct net_device *dev = info->user_ptr[1];
7434         struct nlattr *tx_rates;
7435         struct ieee80211_supported_band *sband;
7436         u16 vht_tx_mcs_map;
7437
7438         if (!rdev->ops->set_bitrate_mask)
7439                 return -EOPNOTSUPP;
7440
7441         memset(&mask, 0, sizeof(mask));
7442         /* Default to all rates enabled */
7443         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7444                 sband = rdev->wiphy.bands[i];
7445
7446                 if (!sband)
7447                         continue;
7448
7449                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7450                 memcpy(mask.control[i].ht_mcs,
7451                        sband->ht_cap.mcs.rx_mask,
7452                        sizeof(mask.control[i].ht_mcs));
7453
7454                 if (!sband->vht_cap.vht_supported)
7455                         continue;
7456
7457                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7458                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7459         }
7460
7461         /* if no rates are given set it back to the defaults */
7462         if (!info->attrs[NL80211_ATTR_TX_RATES])
7463                 goto out;
7464
7465         /*
7466          * The nested attribute uses enum nl80211_band as the index. This maps
7467          * directly to the enum ieee80211_band values used in cfg80211.
7468          */
7469         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7470         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem)
7471         {
7472                 enum ieee80211_band band = nla_type(tx_rates);
7473                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7474                         return -EINVAL;
7475                 sband = rdev->wiphy.bands[band];
7476                 if (sband == NULL)
7477                         return -EINVAL;
7478                 nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7479                           nla_len(tx_rates), nl80211_txattr_policy);
7480                 if (tb[NL80211_TXRATE_LEGACY]) {
7481                         mask.control[band].legacy = rateset_to_mask(
7482                                 sband,
7483                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7484                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7485                         if ((mask.control[band].legacy == 0) &&
7486                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7487                                 return -EINVAL;
7488                 }
7489                 if (tb[NL80211_TXRATE_HT]) {
7490                         if (!ht_rateset_to_mask(
7491                                         sband,
7492                                         nla_data(tb[NL80211_TXRATE_HT]),
7493                                         nla_len(tb[NL80211_TXRATE_HT]),
7494                                         mask.control[band].ht_mcs))
7495                                 return -EINVAL;
7496                 }
7497                 if (tb[NL80211_TXRATE_VHT]) {
7498                         if (!vht_set_mcs_mask(
7499                                         sband,
7500                                         nla_data(tb[NL80211_TXRATE_VHT]),
7501                                         mask.control[band].vht_mcs))
7502                                 return -EINVAL;
7503                 }
7504
7505                 if (mask.control[band].legacy == 0) {
7506                         /* don't allow empty legacy rates if HT or VHT
7507                          * are not even supported.
7508                          */
7509                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7510                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7511                                 return -EINVAL;
7512
7513                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7514                                 if (mask.control[band].ht_mcs[i])
7515                                         goto out;
7516
7517                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7518                                 if (mask.control[band].vht_mcs[i])
7519                                         goto out;
7520
7521                         /* legacy and mcs rates may not be both empty */
7522                         return -EINVAL;
7523                 }
7524         }
7525
7526 out:
7527         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7528 }
7529
7530 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7531 {
7532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7533         struct wireless_dev *wdev = info->user_ptr[1];
7534         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7535
7536         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7537                 return -EINVAL;
7538
7539         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7540                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7541
7542         switch (wdev->iftype) {
7543         case NL80211_IFTYPE_STATION:
7544         case NL80211_IFTYPE_ADHOC:
7545         case NL80211_IFTYPE_P2P_CLIENT:
7546         case NL80211_IFTYPE_AP:
7547         case NL80211_IFTYPE_AP_VLAN:
7548         case NL80211_IFTYPE_MESH_POINT:
7549         case NL80211_IFTYPE_P2P_GO:
7550         case NL80211_IFTYPE_P2P_DEVICE:
7551                 break;
7552         default:
7553                 return -EOPNOTSUPP;
7554         }
7555
7556         /* not much point in registering if we can't reply */
7557         if (!rdev->ops->mgmt_tx)
7558                 return -EOPNOTSUPP;
7559
7560         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7561                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7562                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7563 }
7564
7565 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7566 {
7567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7568         struct wireless_dev *wdev = info->user_ptr[1];
7569         struct cfg80211_chan_def chandef;
7570         int err;
7571         void *hdr = NULL;
7572         u64 cookie;
7573         struct sk_buff *msg = NULL;
7574         struct cfg80211_mgmt_tx_params params = {
7575                 .dont_wait_for_ack =
7576                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7577         };
7578
7579         if (!info->attrs[NL80211_ATTR_FRAME])
7580                 return -EINVAL;
7581
7582         if (!rdev->ops->mgmt_tx)
7583                 return -EOPNOTSUPP;
7584
7585         switch (wdev->iftype) {
7586         case NL80211_IFTYPE_P2P_DEVICE:
7587                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7588                         return -EINVAL;
7589         case NL80211_IFTYPE_STATION:
7590         case NL80211_IFTYPE_ADHOC:
7591         case NL80211_IFTYPE_P2P_CLIENT:
7592         case NL80211_IFTYPE_AP:
7593         case NL80211_IFTYPE_AP_VLAN:
7594         case NL80211_IFTYPE_MESH_POINT:
7595         case NL80211_IFTYPE_P2P_GO:
7596                 break;
7597         default:
7598                 return -EOPNOTSUPP;
7599         }
7600
7601         if (info->attrs[NL80211_ATTR_DURATION]) {
7602                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7603                         return -EINVAL;
7604                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7605
7606                 /*
7607                  * We should wait on the channel for at least a minimum amount
7608                  * of time (10ms) but no longer than the driver supports.
7609                  */
7610                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7611                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7612                         return -EINVAL;
7613
7614         }
7615
7616         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7617
7618         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7619                 return -EINVAL;
7620
7621         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7622
7623         /* get the channel if any has been specified, otherwise pass NULL to
7624          * the driver. The latter will use the current one
7625          */
7626         chandef.chan = NULL;
7627         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7628                 err = nl80211_parse_chandef(rdev, info, &chandef);
7629                 if (err)
7630                         return err;
7631         }
7632
7633         if (!chandef.chan && params.offchan)
7634                 return -EINVAL;
7635
7636         if (!params.dont_wait_for_ack) {
7637                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7638                 if (!msg)
7639                         return -ENOMEM;
7640
7641                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7642                                      NL80211_CMD_FRAME);
7643                 if (!hdr) {
7644                         err = -ENOBUFS;
7645                         goto free_msg;
7646                 }
7647         }
7648
7649         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7650         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7651         params.chan = chandef.chan;
7652         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7653         if (err)
7654                 goto free_msg;
7655
7656         if (msg) {
7657                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7658                         goto nla_put_failure;
7659
7660                 genlmsg_end(msg, hdr);
7661                 return genlmsg_reply(msg, info);
7662         }
7663
7664         return 0;
7665
7666  nla_put_failure:
7667         err = -ENOBUFS;
7668  free_msg:
7669         nlmsg_free(msg);
7670         return err;
7671 }
7672
7673 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7674 {
7675         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7676         struct wireless_dev *wdev = info->user_ptr[1];
7677         u64 cookie;
7678
7679         if (!info->attrs[NL80211_ATTR_COOKIE])
7680                 return -EINVAL;
7681
7682         if (!rdev->ops->mgmt_tx_cancel_wait)
7683                 return -EOPNOTSUPP;
7684
7685         switch (wdev->iftype) {
7686         case NL80211_IFTYPE_STATION:
7687         case NL80211_IFTYPE_ADHOC:
7688         case NL80211_IFTYPE_P2P_CLIENT:
7689         case NL80211_IFTYPE_AP:
7690         case NL80211_IFTYPE_AP_VLAN:
7691         case NL80211_IFTYPE_P2P_GO:
7692         case NL80211_IFTYPE_P2P_DEVICE:
7693                 break;
7694         default:
7695                 return -EOPNOTSUPP;
7696         }
7697
7698         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7699
7700         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7701 }
7702
7703 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7704 {
7705         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7706         struct wireless_dev *wdev;
7707         struct net_device *dev = info->user_ptr[1];
7708         u8 ps_state;
7709         bool state;
7710         int err;
7711
7712         if (!info->attrs[NL80211_ATTR_PS_STATE])
7713                 return -EINVAL;
7714
7715         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7716
7717         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7718                 return -EINVAL;
7719
7720         wdev = dev->ieee80211_ptr;
7721
7722         if (!rdev->ops->set_power_mgmt)
7723                 return -EOPNOTSUPP;
7724
7725         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7726
7727         if (state == wdev->ps)
7728                 return 0;
7729
7730         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7731         if (!err)
7732                 wdev->ps = state;
7733         return err;
7734 }
7735
7736 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7737 {
7738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7739         enum nl80211_ps_state ps_state;
7740         struct wireless_dev *wdev;
7741         struct net_device *dev = info->user_ptr[1];
7742         struct sk_buff *msg;
7743         void *hdr;
7744         int err;
7745
7746         wdev = dev->ieee80211_ptr;
7747
7748         if (!rdev->ops->set_power_mgmt)
7749                 return -EOPNOTSUPP;
7750
7751         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7752         if (!msg)
7753                 return -ENOMEM;
7754
7755         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7756                              NL80211_CMD_GET_POWER_SAVE);
7757         if (!hdr) {
7758                 err = -ENOBUFS;
7759                 goto free_msg;
7760         }
7761
7762         if (wdev->ps)
7763                 ps_state = NL80211_PS_ENABLED;
7764         else
7765                 ps_state = NL80211_PS_DISABLED;
7766
7767         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7768                 goto nla_put_failure;
7769
7770         genlmsg_end(msg, hdr);
7771         return genlmsg_reply(msg, info);
7772
7773  nla_put_failure:
7774         err = -ENOBUFS;
7775  free_msg:
7776         nlmsg_free(msg);
7777         return err;
7778 }
7779
7780 static struct nla_policy
7781 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] __read_mostly = {
7782         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7783         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7784         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7785         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7786         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7787         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7788 };
7789
7790 static int nl80211_set_cqm_txe(struct genl_info *info,
7791                                u32 rate, u32 pkts, u32 intvl)
7792 {
7793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7794         struct net_device *dev = info->user_ptr[1];
7795         struct wireless_dev *wdev = dev->ieee80211_ptr;
7796
7797         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7798                 return -EINVAL;
7799
7800         if (!rdev->ops->set_cqm_txe_config)
7801                 return -EOPNOTSUPP;
7802
7803         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7804             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7805                 return -EOPNOTSUPP;
7806
7807         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7808 }
7809
7810 static int nl80211_set_cqm_rssi(struct genl_info *info,
7811                                 s32 threshold, u32 hysteresis)
7812 {
7813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7814         struct net_device *dev = info->user_ptr[1];
7815         struct wireless_dev *wdev = dev->ieee80211_ptr;
7816
7817         if (threshold > 0)
7818                 return -EINVAL;
7819
7820         /* disabling - hysteresis should also be zero then */
7821         if (threshold == 0)
7822                 hysteresis = 0;
7823
7824         if (!rdev->ops->set_cqm_rssi_config)
7825                 return -EOPNOTSUPP;
7826
7827         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7828             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7829                 return -EOPNOTSUPP;
7830
7831         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
7832 }
7833
7834 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
7835 {
7836         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
7837         struct nlattr *cqm;
7838         int err;
7839
7840         cqm = info->attrs[NL80211_ATTR_CQM];
7841         if (!cqm)
7842                 return -EINVAL;
7843
7844         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
7845                                nl80211_attr_cqm_policy);
7846         if (err)
7847                 return err;
7848
7849         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
7850             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
7851                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
7852                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
7853
7854                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
7855         }
7856
7857         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
7858             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
7859             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
7860                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
7861                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
7862                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
7863
7864                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
7865         }
7866
7867         return -EINVAL;
7868 }
7869
7870 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
7871 {
7872         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7873         struct net_device *dev = info->user_ptr[1];
7874         struct mesh_config cfg;
7875         struct mesh_setup setup;
7876         int err;
7877
7878         /* start with default */
7879         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
7880         memcpy(&setup, &default_mesh_setup, sizeof(setup));
7881
7882         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
7883                 /* and parse parameters if given */
7884                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
7885                 if (err)
7886                         return err;
7887         }
7888
7889         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
7890             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
7891                 return -EINVAL;
7892
7893         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
7894         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
7895
7896         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
7897             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
7898                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
7899                         return -EINVAL;
7900
7901         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
7902                 setup.beacon_interval =
7903                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
7904                 if (setup.beacon_interval < 10 ||
7905                     setup.beacon_interval > 10000)
7906                         return -EINVAL;
7907         }
7908
7909         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
7910                 setup.dtim_period =
7911                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
7912                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
7913                         return -EINVAL;
7914         }
7915
7916         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
7917                 /* parse additional setup parameters if given */
7918                 err = nl80211_parse_mesh_setup(info, &setup);
7919                 if (err)
7920                         return err;
7921         }
7922
7923         if (setup.user_mpm)
7924                 cfg.auto_open_plinks = false;
7925
7926         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7927                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
7928                 if (err)
7929                         return err;
7930         } else {
7931                 /* cfg80211_join_mesh() will sort it out */
7932                 setup.chandef.chan = NULL;
7933         }
7934
7935         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7936                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7937                 int n_rates =
7938                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7939                 struct ieee80211_supported_band *sband;
7940
7941                 if (!setup.chandef.chan)
7942                         return -EINVAL;
7943
7944                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
7945
7946                 err = ieee80211_get_ratemask(sband, rates, n_rates,
7947                                              &setup.basic_rates);
7948                 if (err)
7949                         return err;
7950         }
7951
7952         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
7953 }
7954
7955 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
7956 {
7957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7958         struct net_device *dev = info->user_ptr[1];
7959
7960         return cfg80211_leave_mesh(rdev, dev);
7961 }
7962
7963 #ifdef CONFIG_PM
7964 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
7965                                         struct cfg80211_registered_device *rdev)
7966 {
7967         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
7968         struct nlattr *nl_pats, *nl_pat;
7969         int i, pat_len;
7970
7971         if (!wowlan->n_patterns)
7972                 return 0;
7973
7974         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
7975         if (!nl_pats)
7976                 return -ENOBUFS;
7977
7978         for (i = 0; i < wowlan->n_patterns; i++) {
7979                 nl_pat = nla_nest_start(msg, i + 1);
7980                 if (!nl_pat)
7981                         return -ENOBUFS;
7982                 pat_len = wowlan->patterns[i].pattern_len;
7983                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
7984                             wowlan->patterns[i].mask) ||
7985                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
7986                             wowlan->patterns[i].pattern) ||
7987                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
7988                                 wowlan->patterns[i].pkt_offset))
7989                         return -ENOBUFS;
7990                 nla_nest_end(msg, nl_pat);
7991         }
7992         nla_nest_end(msg, nl_pats);
7993
7994         return 0;
7995 }
7996
7997 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
7998                                    struct cfg80211_wowlan_tcp *tcp)
7999 {
8000         struct nlattr *nl_tcp;
8001
8002         if (!tcp)
8003                 return 0;
8004
8005         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8006         if (!nl_tcp)
8007                 return -ENOBUFS;
8008
8009         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8010             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8011             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8012             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8013             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8014             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8015                     tcp->payload_len, tcp->payload) ||
8016             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8017                         tcp->data_interval) ||
8018             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8019                     tcp->wake_len, tcp->wake_data) ||
8020             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8021                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8022                 return -ENOBUFS;
8023
8024         if (tcp->payload_seq.len &&
8025             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8026                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8027                 return -ENOBUFS;
8028
8029         if (tcp->payload_tok.len &&
8030             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8031                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8032                     &tcp->payload_tok))
8033                 return -ENOBUFS;
8034
8035         nla_nest_end(msg, nl_tcp);
8036
8037         return 0;
8038 }
8039
8040 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8041 {
8042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8043         struct sk_buff *msg;
8044         void *hdr;
8045         u32 size = NLMSG_DEFAULT_SIZE;
8046
8047         if (!rdev->wiphy.wowlan)
8048                 return -EOPNOTSUPP;
8049
8050         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8051                 /* adjust size to have room for all the data */
8052                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8053                         rdev->wiphy.wowlan_config->tcp->payload_len +
8054                         rdev->wiphy.wowlan_config->tcp->wake_len +
8055                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8056         }
8057
8058         msg = nlmsg_new(size, GFP_KERNEL);
8059         if (!msg)
8060                 return -ENOMEM;
8061
8062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8063                              NL80211_CMD_GET_WOWLAN);
8064         if (!hdr)
8065                 goto nla_put_failure;
8066
8067         if (rdev->wiphy.wowlan_config) {
8068                 struct nlattr *nl_wowlan;
8069
8070                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8071                 if (!nl_wowlan)
8072                         goto nla_put_failure;
8073
8074                 if ((rdev->wiphy.wowlan_config->any &&
8075                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8076                     (rdev->wiphy.wowlan_config->disconnect &&
8077                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8078                     (rdev->wiphy.wowlan_config->magic_pkt &&
8079                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8080                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8081                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8082                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8083                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8084                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8085                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8086                     (rdev->wiphy.wowlan_config->rfkill_release &&
8087                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8088                         goto nla_put_failure;
8089
8090                 if (nl80211_send_wowlan_patterns(msg, rdev))
8091                         goto nla_put_failure;
8092
8093                 if (nl80211_send_wowlan_tcp(msg,
8094                                             rdev->wiphy.wowlan_config->tcp))
8095                         goto nla_put_failure;
8096
8097                 nla_nest_end(msg, nl_wowlan);
8098         }
8099
8100         genlmsg_end(msg, hdr);
8101         return genlmsg_reply(msg, info);
8102
8103 nla_put_failure:
8104         nlmsg_free(msg);
8105         return -ENOBUFS;
8106 }
8107
8108 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8109                                     struct nlattr *attr,
8110                                     struct cfg80211_wowlan *trig)
8111 {
8112         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8113         struct cfg80211_wowlan_tcp *cfg;
8114         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8115         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8116         u32 size;
8117         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8118         int err, port;
8119
8120         if (!rdev->wiphy.wowlan->tcp)
8121                 return -EINVAL;
8122
8123         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8124                         nla_data(attr), nla_len(attr),
8125                         nl80211_wowlan_tcp_policy);
8126         if (err)
8127                 return err;
8128
8129         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8130             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8131             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8132             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8133             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8134             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8135             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8136             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8137                 return -EINVAL;
8138
8139         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8140         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8141                 return -EINVAL;
8142
8143         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8144                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8145             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8146                 return -EINVAL;
8147
8148         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8149         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8150                 return -EINVAL;
8151
8152         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8153         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8154                 return -EINVAL;
8155
8156         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8157                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8158
8159                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8160                 tokens_size = tokln - sizeof(*tok);
8161
8162                 if (!tok->len || tokens_size % tok->len)
8163                         return -EINVAL;
8164                 if (!rdev->wiphy.wowlan->tcp->tok)
8165                         return -EINVAL;
8166                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8167                         return -EINVAL;
8168                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8169                         return -EINVAL;
8170                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8171                         return -EINVAL;
8172                 if (tok->offset + tok->len > data_size)
8173                         return -EINVAL;
8174         }
8175
8176         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8177                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8178                 if (!rdev->wiphy.wowlan->tcp->seq)
8179                         return -EINVAL;
8180                 if (seq->len == 0 || seq->len > 4)
8181                         return -EINVAL;
8182                 if (seq->len + seq->offset > data_size)
8183                         return -EINVAL;
8184         }
8185
8186         size = sizeof(*cfg);
8187         size += data_size;
8188         size += wake_size + wake_mask_size;
8189         size += tokens_size;
8190
8191         cfg = kzalloc(size, GFP_KERNEL);
8192         if (!cfg)
8193                 return -ENOMEM;
8194         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8195         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8196         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8197                ETH_ALEN);
8198         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8199                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8200         else
8201                 port = 0;
8202 #ifdef CONFIG_INET
8203         /* allocate a socket and port for it and use it */
8204         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8205                             IPPROTO_TCP, &cfg->sock, 1);
8206         if (err) {
8207                 kfree(cfg);
8208                 return err;
8209         }
8210         if (inet_csk_get_port(cfg->sock->sk, port)) {
8211                 sock_release(cfg->sock);
8212                 kfree(cfg);
8213                 return -EADDRINUSE;
8214         }
8215         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8216 #else
8217         if (!port) {
8218                 kfree(cfg);
8219                 return -EINVAL;
8220         }
8221         cfg->src_port = port;
8222 #endif
8223
8224         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8225         cfg->payload_len = data_size;
8226         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8227         memcpy((void *)cfg->payload,
8228                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8229                data_size);
8230         if (seq)
8231                 cfg->payload_seq = *seq;
8232         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8233         cfg->wake_len = wake_size;
8234         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8235         memcpy((void *)cfg->wake_data,
8236                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8237                wake_size);
8238         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8239                          data_size + wake_size;
8240         memcpy((void *)cfg->wake_mask,
8241                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8242                wake_mask_size);
8243         if (tok) {
8244                 cfg->tokens_size = tokens_size;
8245                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8246         }
8247
8248         trig->tcp = cfg;
8249
8250         return 0;
8251 }
8252
8253 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8254 {
8255         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8256         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8257         struct cfg80211_wowlan new_triggers = {};
8258         struct cfg80211_wowlan *ntrig;
8259         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8260         int err, i;
8261         bool prev_enabled = rdev->wiphy.wowlan_config;
8262
8263         if (!wowlan)
8264                 return -EOPNOTSUPP;
8265
8266         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8267                 cfg80211_rdev_free_wowlan(rdev);
8268                 rdev->wiphy.wowlan_config = NULL;
8269                 goto set_wakeup;
8270         }
8271
8272         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8273                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8274                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8275                         nl80211_wowlan_policy);
8276         if (err)
8277                 return err;
8278
8279         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8280                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8281                         return -EINVAL;
8282                 new_triggers.any = true;
8283         }
8284
8285         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8286                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8287                         return -EINVAL;
8288                 new_triggers.disconnect = true;
8289         }
8290
8291         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8292                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8293                         return -EINVAL;
8294                 new_triggers.magic_pkt = true;
8295         }
8296
8297         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8298                 return -EINVAL;
8299
8300         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8301                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8302                         return -EINVAL;
8303                 new_triggers.gtk_rekey_failure = true;
8304         }
8305
8306         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8307                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8308                         return -EINVAL;
8309                 new_triggers.eap_identity_req = true;
8310         }
8311
8312         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8313                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8314                         return -EINVAL;
8315                 new_triggers.four_way_handshake = true;
8316         }
8317
8318         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8319                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8320                         return -EINVAL;
8321                 new_triggers.rfkill_release = true;
8322         }
8323
8324         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8325                 struct nlattr *pat;
8326                 int n_patterns = 0;
8327                 int rem, pat_len, mask_len, pkt_offset;
8328                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8329
8330                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8331                                     rem)
8332                         n_patterns++;
8333                 if (n_patterns > wowlan->n_patterns)
8334                         return -EINVAL;
8335
8336                 new_triggers.patterns = kcalloc(n_patterns,
8337                                                 sizeof(new_triggers.patterns[0]),
8338                                                 GFP_KERNEL);
8339                 if (!new_triggers.patterns)
8340                         return -ENOMEM;
8341
8342                 new_triggers.n_patterns = n_patterns;
8343                 i = 0;
8344
8345                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8346                                     rem) {
8347                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8348                                   nla_len(pat), NULL);
8349                         err = -EINVAL;
8350                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8351                             !pat_tb[NL80211_PKTPAT_PATTERN])
8352                                 goto error;
8353                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8354                         mask_len = DIV_ROUND_UP(pat_len, 8);
8355                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8356                                 goto error;
8357                         if (pat_len > wowlan->pattern_max_len ||
8358                             pat_len < wowlan->pattern_min_len)
8359                                 goto error;
8360
8361                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8362                                 pkt_offset = 0;
8363                         else
8364                                 pkt_offset = nla_get_u32(
8365                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8366                         if (pkt_offset > wowlan->max_pkt_offset)
8367                                 goto error;
8368                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8369
8370                         new_triggers.patterns[i].mask =
8371                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8372                         if (!new_triggers.patterns[i].mask) {
8373                                 err = -ENOMEM;
8374                                 goto error;
8375                         }
8376                         new_triggers.patterns[i].pattern =
8377                                 new_triggers.patterns[i].mask + mask_len;
8378                         memcpy(new_triggers.patterns[i].mask,
8379                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8380                                mask_len);
8381                         new_triggers.patterns[i].pattern_len = pat_len;
8382                         memcpy(new_triggers.patterns[i].pattern,
8383                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8384                                pat_len);
8385                         i++;
8386                 }
8387         }
8388
8389         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8390                 err = nl80211_parse_wowlan_tcp(
8391                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8392                         &new_triggers);
8393                 if (err)
8394                         goto error;
8395         }
8396
8397         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8398         if (!ntrig) {
8399                 err = -ENOMEM;
8400                 goto error;
8401         }
8402         cfg80211_rdev_free_wowlan(rdev);
8403         rdev->wiphy.wowlan_config = ntrig;
8404
8405  set_wakeup:
8406         if (rdev->ops->set_wakeup &&
8407             prev_enabled != !!rdev->wiphy.wowlan_config)
8408                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8409
8410         return 0;
8411  error:
8412         for (i = 0; i < new_triggers.n_patterns; i++)
8413                 kfree(new_triggers.patterns[i].mask);
8414         kfree(new_triggers.patterns);
8415         if (new_triggers.tcp && new_triggers.tcp->sock)
8416                 sock_release(new_triggers.tcp->sock);
8417         kfree(new_triggers.tcp);
8418         return err;
8419 }
8420 #endif
8421
8422 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8423                                        struct cfg80211_registered_device *rdev)
8424 {
8425         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8426         int i, j, pat_len;
8427         struct cfg80211_coalesce_rules *rule;
8428
8429         if (!rdev->coalesce->n_rules)
8430                 return 0;
8431
8432         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8433         if (!nl_rules)
8434                 return -ENOBUFS;
8435
8436         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8437                 nl_rule = nla_nest_start(msg, i + 1);
8438                 if (!nl_rule)
8439                         return -ENOBUFS;
8440
8441                 rule = &rdev->coalesce->rules[i];
8442                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8443                                 rule->delay))
8444                         return -ENOBUFS;
8445
8446                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8447                                 rule->condition))
8448                         return -ENOBUFS;
8449
8450                 nl_pats = nla_nest_start(msg,
8451                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8452                 if (!nl_pats)
8453                         return -ENOBUFS;
8454
8455                 for (j = 0; j < rule->n_patterns; j++) {
8456                         nl_pat = nla_nest_start(msg, j + 1);
8457                         if (!nl_pat)
8458                                 return -ENOBUFS;
8459                         pat_len = rule->patterns[j].pattern_len;
8460                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8461                                     DIV_ROUND_UP(pat_len, 8),
8462                                     rule->patterns[j].mask) ||
8463                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8464                                     rule->patterns[j].pattern) ||
8465                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8466                                         rule->patterns[j].pkt_offset))
8467                                 return -ENOBUFS;
8468                         nla_nest_end(msg, nl_pat);
8469                 }
8470                 nla_nest_end(msg, nl_pats);
8471                 nla_nest_end(msg, nl_rule);
8472         }
8473         nla_nest_end(msg, nl_rules);
8474
8475         return 0;
8476 }
8477
8478 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8479 {
8480         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8481         struct sk_buff *msg;
8482         void *hdr;
8483
8484         if (!rdev->wiphy.coalesce)
8485                 return -EOPNOTSUPP;
8486
8487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8488         if (!msg)
8489                 return -ENOMEM;
8490
8491         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8492                              NL80211_CMD_GET_COALESCE);
8493         if (!hdr)
8494                 goto nla_put_failure;
8495
8496         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8497                 goto nla_put_failure;
8498
8499         genlmsg_end(msg, hdr);
8500         return genlmsg_reply(msg, info);
8501
8502 nla_put_failure:
8503         nlmsg_free(msg);
8504         return -ENOBUFS;
8505 }
8506
8507 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8508 {
8509         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8510         int i, j;
8511         struct cfg80211_coalesce_rules *rule;
8512
8513         if (!coalesce)
8514                 return;
8515
8516         for (i = 0; i < coalesce->n_rules; i++) {
8517                 rule = &coalesce->rules[i];
8518                 for (j = 0; j < rule->n_patterns; j++)
8519                         kfree(rule->patterns[j].mask);
8520                 kfree(rule->patterns);
8521         }
8522         kfree(coalesce->rules);
8523         kfree(coalesce);
8524         rdev->coalesce = NULL;
8525 }
8526
8527 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8528                                        struct nlattr *rule,
8529                                        struct cfg80211_coalesce_rules *new_rule)
8530 {
8531         int err, i;
8532         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8533         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8534         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8535         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8536
8537         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8538                         nla_len(rule), nl80211_coalesce_policy);
8539         if (err)
8540                 return err;
8541
8542         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8543                 new_rule->delay =
8544                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8545         if (new_rule->delay > coalesce->max_delay)
8546                 return -EINVAL;
8547
8548         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8549                 new_rule->condition =
8550                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8551         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8552             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8553                 return -EINVAL;
8554
8555         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8556                 return -EINVAL;
8557
8558         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8559                             rem)
8560                 n_patterns++;
8561         if (n_patterns > coalesce->n_patterns)
8562                 return -EINVAL;
8563
8564         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8565                                      GFP_KERNEL);
8566         if (!new_rule->patterns)
8567                 return -ENOMEM;
8568
8569         new_rule->n_patterns = n_patterns;
8570         i = 0;
8571
8572         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8573                             rem) {
8574                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8575                           nla_len(pat), NULL);
8576                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8577                     !pat_tb[NL80211_PKTPAT_PATTERN])
8578                         return -EINVAL;
8579                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8580                 mask_len = DIV_ROUND_UP(pat_len, 8);
8581                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8582                         return -EINVAL;
8583                 if (pat_len > coalesce->pattern_max_len ||
8584                     pat_len < coalesce->pattern_min_len)
8585                         return -EINVAL;
8586
8587                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8588                         pkt_offset = 0;
8589                 else
8590                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8591                 if (pkt_offset > coalesce->max_pkt_offset)
8592                         return -EINVAL;
8593                 new_rule->patterns[i].pkt_offset = pkt_offset;
8594
8595                 new_rule->patterns[i].mask =
8596                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8597                 if (!new_rule->patterns[i].mask)
8598                         return -ENOMEM;
8599                 new_rule->patterns[i].pattern =
8600                         new_rule->patterns[i].mask + mask_len;
8601                 memcpy(new_rule->patterns[i].mask,
8602                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8603                 new_rule->patterns[i].pattern_len = pat_len;
8604                 memcpy(new_rule->patterns[i].pattern,
8605                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8606                 i++;
8607         }
8608
8609         return 0;
8610 }
8611
8612 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8613 {
8614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8615         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8616         struct cfg80211_coalesce new_coalesce = {};
8617         struct cfg80211_coalesce *n_coalesce;
8618         int err, rem_rule, n_rules = 0, i, j;
8619         struct nlattr *rule;
8620         struct cfg80211_coalesce_rules *tmp_rule;
8621
8622         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8623                 return -EOPNOTSUPP;
8624
8625         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8626                 cfg80211_rdev_free_coalesce(rdev);
8627                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8628                 return 0;
8629         }
8630
8631         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8632                             rem_rule)
8633                 n_rules++;
8634         if (n_rules > coalesce->n_rules)
8635                 return -EINVAL;
8636
8637         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8638                                      GFP_KERNEL);
8639         if (!new_coalesce.rules)
8640                 return -ENOMEM;
8641
8642         new_coalesce.n_rules = n_rules;
8643         i = 0;
8644
8645         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8646                             rem_rule) {
8647                 err = nl80211_parse_coalesce_rule(rdev, rule,
8648                                                   &new_coalesce.rules[i]);
8649                 if (err)
8650                         goto error;
8651
8652                 i++;
8653         }
8654
8655         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8656         if (err)
8657                 goto error;
8658
8659         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8660         if (!n_coalesce) {
8661                 err = -ENOMEM;
8662                 goto error;
8663         }
8664         cfg80211_rdev_free_coalesce(rdev);
8665         rdev->coalesce = n_coalesce;
8666
8667         return 0;
8668 error:
8669         for (i = 0; i < new_coalesce.n_rules; i++) {
8670                 tmp_rule = &new_coalesce.rules[i];
8671                 for (j = 0; j < tmp_rule->n_patterns; j++)
8672                         kfree(tmp_rule->patterns[j].mask);
8673                 kfree(tmp_rule->patterns);
8674         }
8675         kfree(new_coalesce.rules);
8676
8677         return err;
8678 }
8679
8680 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8681 {
8682         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8683         struct net_device *dev = info->user_ptr[1];
8684         struct wireless_dev *wdev = dev->ieee80211_ptr;
8685         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8686         struct cfg80211_gtk_rekey_data rekey_data;
8687         int err;
8688
8689         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8690                 return -EINVAL;
8691
8692         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8693                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8694                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8695                         nl80211_rekey_policy);
8696         if (err)
8697                 return err;
8698
8699         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8700                 return -ERANGE;
8701         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8702                 return -ERANGE;
8703         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8704                 return -ERANGE;
8705
8706         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8707                NL80211_KEK_LEN);
8708         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8709                NL80211_KCK_LEN);
8710         memcpy(rekey_data.replay_ctr,
8711                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8712                NL80211_REPLAY_CTR_LEN);
8713
8714         wdev_lock(wdev);
8715         if (!wdev->current_bss) {
8716                 err = -ENOTCONN;
8717                 goto out;
8718         }
8719
8720         if (!rdev->ops->set_rekey_data) {
8721                 err = -EOPNOTSUPP;
8722                 goto out;
8723         }
8724
8725         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8726  out:
8727         wdev_unlock(wdev);
8728         return err;
8729 }
8730
8731 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8732                                              struct genl_info *info)
8733 {
8734         struct net_device *dev = info->user_ptr[1];
8735         struct wireless_dev *wdev = dev->ieee80211_ptr;
8736
8737         if (wdev->iftype != NL80211_IFTYPE_AP &&
8738             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8739                 return -EINVAL;
8740
8741         if (wdev->ap_unexpected_nlportid)
8742                 return -EBUSY;
8743
8744         wdev->ap_unexpected_nlportid = info->snd_portid;
8745         return 0;
8746 }
8747
8748 static int nl80211_probe_client(struct sk_buff *skb,
8749                                 struct genl_info *info)
8750 {
8751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8752         struct net_device *dev = info->user_ptr[1];
8753         struct wireless_dev *wdev = dev->ieee80211_ptr;
8754         struct sk_buff *msg;
8755         void *hdr;
8756         const u8 *addr;
8757         u64 cookie;
8758         int err;
8759
8760         if (wdev->iftype != NL80211_IFTYPE_AP &&
8761             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8762                 return -EOPNOTSUPP;
8763
8764         if (!info->attrs[NL80211_ATTR_MAC])
8765                 return -EINVAL;
8766
8767         if (!rdev->ops->probe_client)
8768                 return -EOPNOTSUPP;
8769
8770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8771         if (!msg)
8772                 return -ENOMEM;
8773
8774         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8775                              NL80211_CMD_PROBE_CLIENT);
8776         if (!hdr) {
8777                 err = -ENOBUFS;
8778                 goto free_msg;
8779         }
8780
8781         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8782
8783         err = rdev_probe_client(rdev, dev, addr, &cookie);
8784         if (err)
8785                 goto free_msg;
8786
8787         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8788                 goto nla_put_failure;
8789
8790         genlmsg_end(msg, hdr);
8791
8792         return genlmsg_reply(msg, info);
8793
8794  nla_put_failure:
8795         err = -ENOBUFS;
8796  free_msg:
8797         nlmsg_free(msg);
8798         return err;
8799 }
8800
8801 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8802 {
8803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8804         struct cfg80211_beacon_registration *reg, *nreg;
8805         int rv;
8806
8807         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8808                 return -EOPNOTSUPP;
8809
8810         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8811         if (!nreg)
8812                 return -ENOMEM;
8813
8814         /* First, check if already registered. */
8815         spin_lock_bh(&rdev->beacon_registrations_lock);
8816         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8817                 if (reg->nlportid == info->snd_portid) {
8818                         rv = -EALREADY;
8819                         goto out_err;
8820                 }
8821         }
8822         /* Add it to the list */
8823         nreg->nlportid = info->snd_portid;
8824         list_add(&nreg->list, &rdev->beacon_registrations);
8825
8826         spin_unlock_bh(&rdev->beacon_registrations_lock);
8827
8828         return 0;
8829 out_err:
8830         spin_unlock_bh(&rdev->beacon_registrations_lock);
8831         kfree(nreg);
8832         return rv;
8833 }
8834
8835 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
8836 {
8837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8838         struct wireless_dev *wdev = info->user_ptr[1];
8839         int err;
8840
8841         if (!rdev->ops->start_p2p_device)
8842                 return -EOPNOTSUPP;
8843
8844         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8845                 return -EOPNOTSUPP;
8846
8847         if (wdev->p2p_started)
8848                 return 0;
8849
8850         err = cfg80211_can_add_interface(rdev, wdev->iftype);
8851         if (err)
8852                 return err;
8853
8854         err = rdev_start_p2p_device(rdev, wdev);
8855         if (err)
8856                 return err;
8857
8858         wdev->p2p_started = true;
8859         rdev->opencount++;
8860
8861         return 0;
8862 }
8863
8864 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
8865 {
8866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8867         struct wireless_dev *wdev = info->user_ptr[1];
8868
8869         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
8870                 return -EOPNOTSUPP;
8871
8872         if (!rdev->ops->stop_p2p_device)
8873                 return -EOPNOTSUPP;
8874
8875         cfg80211_stop_p2p_device(rdev, wdev);
8876
8877         return 0;
8878 }
8879
8880 static int nl80211_get_protocol_features(struct sk_buff *skb,
8881                                          struct genl_info *info)
8882 {
8883         void *hdr;
8884         struct sk_buff *msg;
8885
8886         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8887         if (!msg)
8888                 return -ENOMEM;
8889
8890         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8891                              NL80211_CMD_GET_PROTOCOL_FEATURES);
8892         if (!hdr)
8893                 goto nla_put_failure;
8894
8895         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
8896                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
8897                 goto nla_put_failure;
8898
8899         genlmsg_end(msg, hdr);
8900         return genlmsg_reply(msg, info);
8901
8902  nla_put_failure:
8903         kfree_skb(msg);
8904         return -ENOBUFS;
8905 }
8906
8907 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
8908 {
8909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8910         struct cfg80211_update_ft_ies_params ft_params;
8911         struct net_device *dev = info->user_ptr[1];
8912
8913         if (!rdev->ops->update_ft_ies)
8914                 return -EOPNOTSUPP;
8915
8916         if (!info->attrs[NL80211_ATTR_MDID] ||
8917             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8918                 return -EINVAL;
8919
8920         memset(&ft_params, 0, sizeof(ft_params));
8921         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
8922         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8923         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8924
8925         return rdev_update_ft_ies(rdev, dev, &ft_params);
8926 }
8927
8928 static int nl80211_crit_protocol_start(struct sk_buff *skb,
8929                                        struct genl_info *info)
8930 {
8931         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8932         struct wireless_dev *wdev = info->user_ptr[1];
8933         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
8934         u16 duration;
8935         int ret;
8936
8937         if (!rdev->ops->crit_proto_start)
8938                 return -EOPNOTSUPP;
8939
8940         if (WARN_ON(!rdev->ops->crit_proto_stop))
8941                 return -EINVAL;
8942
8943         if (rdev->crit_proto_nlportid)
8944                 return -EBUSY;
8945
8946         /* determine protocol if provided */
8947         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
8948                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
8949
8950         if (proto >= NUM_NL80211_CRIT_PROTO)
8951                 return -EINVAL;
8952
8953         /* timeout must be provided */
8954         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
8955                 return -EINVAL;
8956
8957         duration =
8958                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
8959
8960         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
8961                 return -ERANGE;
8962
8963         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
8964         if (!ret)
8965                 rdev->crit_proto_nlportid = info->snd_portid;
8966
8967         return ret;
8968 }
8969
8970 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
8971                                       struct genl_info *info)
8972 {
8973         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8974         struct wireless_dev *wdev = info->user_ptr[1];
8975
8976         if (!rdev->ops->crit_proto_stop)
8977                 return -EOPNOTSUPP;
8978
8979         if (rdev->crit_proto_nlportid) {
8980                 rdev->crit_proto_nlportid = 0;
8981                 rdev_crit_proto_stop(rdev, wdev);
8982         }
8983         return 0;
8984 }
8985
8986 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
8987 {
8988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8989         struct wireless_dev *wdev =
8990                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8991         int i, err;
8992         u32 vid, subcmd;
8993
8994         if (!rdev->wiphy.vendor_commands)
8995                 return -EOPNOTSUPP;
8996
8997         if (IS_ERR(wdev)) {
8998                 err = PTR_ERR(wdev);
8999                 if (err != -EINVAL)
9000                         return err;
9001                 wdev = NULL;
9002         } else if (wdev->wiphy != &rdev->wiphy) {
9003                 return -EINVAL;
9004         }
9005
9006         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9007             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9008                 return -EINVAL;
9009
9010         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9011         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9012         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9013                 const struct wiphy_vendor_command *vcmd;
9014                 void *data = NULL;
9015                 int len = 0;
9016
9017                 vcmd = &rdev->wiphy.vendor_commands[i];
9018
9019                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9020                         continue;
9021
9022                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9023                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9024                         if (!wdev)
9025                                 return -EINVAL;
9026                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9027                             !wdev->netdev)
9028                                 return -EINVAL;
9029
9030                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9031                                 if (wdev->netdev &&
9032                                     !netif_running(wdev->netdev))
9033                                         return -ENETDOWN;
9034                                 if (!wdev->netdev && !wdev->p2p_started)
9035                                         return -ENETDOWN;
9036                         }
9037                 } else {
9038                         wdev = NULL;
9039                 }
9040
9041                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9042                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9043                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9044                 }
9045
9046                 rdev->cur_cmd_info = info;
9047                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9048                                                           data, len);
9049                 rdev->cur_cmd_info = NULL;
9050                 return err;
9051         }
9052
9053         return -EOPNOTSUPP;
9054 }
9055
9056 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9057                                            enum nl80211_commands cmd,
9058                                            enum nl80211_attrs attr,
9059                                            int approxlen)
9060 {
9061         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
9062
9063         if (WARN_ON(!rdev->cur_cmd_info))
9064                 return NULL;
9065
9066         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9067                                            rdev->cur_cmd_info->snd_portid,
9068                                            rdev->cur_cmd_info->snd_seq,
9069                                            cmd, attr, NULL, GFP_KERNEL);
9070 }
9071 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9072
9073 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9074 {
9075         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9076         void *hdr = ((void **)skb->cb)[1];
9077         struct nlattr *data = ((void **)skb->cb)[2];
9078
9079         if (WARN_ON(!rdev->cur_cmd_info)) {
9080                 kfree_skb(skb);
9081                 return -EINVAL;
9082         }
9083
9084         nla_nest_end(skb, data);
9085         genlmsg_end(skb, hdr);
9086         return genlmsg_reply(skb, rdev->cur_cmd_info);
9087 }
9088 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9089
9090
9091 static int nl80211_set_qos_map(struct sk_buff *skb,
9092                                struct genl_info *info)
9093 {
9094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9095         struct cfg80211_qos_map *qos_map = NULL;
9096         struct net_device *dev = info->user_ptr[1];
9097         u8 *pos, len, num_des, des_len, des;
9098         int ret;
9099
9100         if (!rdev->ops->set_qos_map)
9101                 return -EOPNOTSUPP;
9102
9103         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9104                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9105                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9106
9107                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9108                     len > IEEE80211_QOS_MAP_LEN_MAX)
9109                         return -EINVAL;
9110
9111                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9112                 if (!qos_map)
9113                         return -ENOMEM;
9114
9115                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9116                 if (num_des) {
9117                         des_len = num_des *
9118                                 sizeof(struct cfg80211_dscp_exception);
9119                         memcpy(qos_map->dscp_exception, pos, des_len);
9120                         qos_map->num_des = num_des;
9121                         for (des = 0; des < num_des; des++) {
9122                                 if (qos_map->dscp_exception[des].up > 7) {
9123                                         kfree(qos_map);
9124                                         return -EINVAL;
9125                                 }
9126                         }
9127                         pos += des_len;
9128                 }
9129                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9130         }
9131
9132         wdev_lock(dev->ieee80211_ptr);
9133         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9134         if (!ret)
9135                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9136         wdev_unlock(dev->ieee80211_ptr);
9137
9138         kfree(qos_map);
9139         return ret;
9140 }
9141
9142 #define NL80211_FLAG_NEED_WIPHY         0x01
9143 #define NL80211_FLAG_NEED_NETDEV        0x02
9144 #define NL80211_FLAG_NEED_RTNL          0x04
9145 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9146 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9147                                          NL80211_FLAG_CHECK_NETDEV_UP)
9148 #define NL80211_FLAG_NEED_WDEV          0x10
9149 /* If a netdev is associated, it must be UP, P2P must be started */
9150 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9151                                          NL80211_FLAG_CHECK_NETDEV_UP)
9152
9153 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9154                             struct genl_info *info)
9155 {
9156         struct cfg80211_registered_device *rdev;
9157         struct wireless_dev *wdev;
9158         struct net_device *dev;
9159         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9160
9161         if (rtnl)
9162                 rtnl_lock();
9163
9164         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9165                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9166                 if (IS_ERR(rdev)) {
9167                         if (rtnl)
9168                                 rtnl_unlock();
9169                         return PTR_ERR(rdev);
9170                 }
9171                 info->user_ptr[0] = rdev;
9172         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9173                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9174                 ASSERT_RTNL();
9175
9176                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9177                                                   info->attrs);
9178                 if (IS_ERR(wdev)) {
9179                         if (rtnl)
9180                                 rtnl_unlock();
9181                         return PTR_ERR(wdev);
9182                 }
9183
9184                 dev = wdev->netdev;
9185                 rdev = wiphy_to_dev(wdev->wiphy);
9186
9187                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9188                         if (!dev) {
9189                                 if (rtnl)
9190                                         rtnl_unlock();
9191                                 return -EINVAL;
9192                         }
9193
9194                         info->user_ptr[1] = dev;
9195                 } else {
9196                         info->user_ptr[1] = wdev;
9197                 }
9198
9199                 if (dev) {
9200                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9201                             !netif_running(dev)) {
9202                                 if (rtnl)
9203                                         rtnl_unlock();
9204                                 return -ENETDOWN;
9205                         }
9206
9207                         dev_hold(dev);
9208                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9209                         if (!wdev->p2p_started) {
9210                                 if (rtnl)
9211                                         rtnl_unlock();
9212                                 return -ENETDOWN;
9213                         }
9214                 }
9215
9216                 info->user_ptr[0] = rdev;
9217         }
9218
9219         return 0;
9220 }
9221
9222 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9223                               struct genl_info *info)
9224 {
9225         if (info->user_ptr[1]) {
9226                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9227                         struct wireless_dev *wdev = info->user_ptr[1];
9228
9229                         if (wdev->netdev)
9230                                 dev_put(wdev->netdev);
9231                 } else {
9232                         dev_put(info->user_ptr[1]);
9233                 }
9234         }
9235         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9236                 rtnl_unlock();
9237 }
9238
9239 static const struct genl_ops nl80211_ops[] = {
9240         {
9241                 .cmd = NL80211_CMD_GET_WIPHY,
9242                 .doit = nl80211_get_wiphy,
9243                 .dumpit = nl80211_dump_wiphy,
9244                 .done = nl80211_dump_wiphy_done,
9245                 .policy = nl80211_policy,
9246                 /* can be retrieved by unprivileged users */
9247                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9248                                   NL80211_FLAG_NEED_RTNL,
9249         },
9250         {
9251                 .cmd = NL80211_CMD_SET_WIPHY,
9252                 .doit = nl80211_set_wiphy,
9253                 .policy = nl80211_policy,
9254                 .flags = GENL_ADMIN_PERM,
9255                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9256         },
9257         {
9258                 .cmd = NL80211_CMD_GET_INTERFACE,
9259                 .doit = nl80211_get_interface,
9260                 .dumpit = nl80211_dump_interface,
9261                 .policy = nl80211_policy,
9262                 /* can be retrieved by unprivileged users */
9263                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9264                                   NL80211_FLAG_NEED_RTNL,
9265         },
9266         {
9267                 .cmd = NL80211_CMD_SET_INTERFACE,
9268                 .doit = nl80211_set_interface,
9269                 .policy = nl80211_policy,
9270                 .flags = GENL_ADMIN_PERM,
9271                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9272                                   NL80211_FLAG_NEED_RTNL,
9273         },
9274         {
9275                 .cmd = NL80211_CMD_NEW_INTERFACE,
9276                 .doit = nl80211_new_interface,
9277                 .policy = nl80211_policy,
9278                 .flags = GENL_ADMIN_PERM,
9279                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9280                                   NL80211_FLAG_NEED_RTNL,
9281         },
9282         {
9283                 .cmd = NL80211_CMD_DEL_INTERFACE,
9284                 .doit = nl80211_del_interface,
9285                 .policy = nl80211_policy,
9286                 .flags = GENL_ADMIN_PERM,
9287                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9288                                   NL80211_FLAG_NEED_RTNL,
9289         },
9290         {
9291                 .cmd = NL80211_CMD_GET_KEY,
9292                 .doit = nl80211_get_key,
9293                 .policy = nl80211_policy,
9294                 .flags = GENL_ADMIN_PERM,
9295                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9296                                   NL80211_FLAG_NEED_RTNL,
9297         },
9298         {
9299                 .cmd = NL80211_CMD_SET_KEY,
9300                 .doit = nl80211_set_key,
9301                 .policy = nl80211_policy,
9302                 .flags = GENL_ADMIN_PERM,
9303                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9304                                   NL80211_FLAG_NEED_RTNL,
9305         },
9306         {
9307                 .cmd = NL80211_CMD_NEW_KEY,
9308                 .doit = nl80211_new_key,
9309                 .policy = nl80211_policy,
9310                 .flags = GENL_ADMIN_PERM,
9311                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9312                                   NL80211_FLAG_NEED_RTNL,
9313         },
9314         {
9315                 .cmd = NL80211_CMD_DEL_KEY,
9316                 .doit = nl80211_del_key,
9317                 .policy = nl80211_policy,
9318                 .flags = GENL_ADMIN_PERM,
9319                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9320                                   NL80211_FLAG_NEED_RTNL,
9321         },
9322         {
9323                 .cmd = NL80211_CMD_SET_BEACON,
9324                 .policy = nl80211_policy,
9325                 .flags = GENL_ADMIN_PERM,
9326                 .doit = nl80211_set_beacon,
9327                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9328                                   NL80211_FLAG_NEED_RTNL,
9329         },
9330         {
9331                 .cmd = NL80211_CMD_START_AP,
9332                 .policy = nl80211_policy,
9333                 .flags = GENL_ADMIN_PERM,
9334                 .doit = nl80211_start_ap,
9335                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9336                                   NL80211_FLAG_NEED_RTNL,
9337         },
9338         {
9339                 .cmd = NL80211_CMD_STOP_AP,
9340                 .policy = nl80211_policy,
9341                 .flags = GENL_ADMIN_PERM,
9342                 .doit = nl80211_stop_ap,
9343                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9344                                   NL80211_FLAG_NEED_RTNL,
9345         },
9346         {
9347                 .cmd = NL80211_CMD_GET_STATION,
9348                 .doit = nl80211_get_station,
9349                 .dumpit = nl80211_dump_station,
9350                 .policy = nl80211_policy,
9351                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9352                                   NL80211_FLAG_NEED_RTNL,
9353         },
9354         {
9355                 .cmd = NL80211_CMD_SET_STATION,
9356                 .doit = nl80211_set_station,
9357                 .policy = nl80211_policy,
9358                 .flags = GENL_ADMIN_PERM,
9359                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9360                                   NL80211_FLAG_NEED_RTNL,
9361         },
9362         {
9363                 .cmd = NL80211_CMD_NEW_STATION,
9364                 .doit = nl80211_new_station,
9365                 .policy = nl80211_policy,
9366                 .flags = GENL_ADMIN_PERM,
9367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9368                                   NL80211_FLAG_NEED_RTNL,
9369         },
9370         {
9371                 .cmd = NL80211_CMD_DEL_STATION,
9372                 .doit = nl80211_del_station,
9373                 .policy = nl80211_policy,
9374                 .flags = GENL_ADMIN_PERM,
9375                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9376                                   NL80211_FLAG_NEED_RTNL,
9377         },
9378         {
9379                 .cmd = NL80211_CMD_GET_MPATH,
9380                 .doit = nl80211_get_mpath,
9381                 .dumpit = nl80211_dump_mpath,
9382                 .policy = nl80211_policy,
9383                 .flags = GENL_ADMIN_PERM,
9384                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9385                                   NL80211_FLAG_NEED_RTNL,
9386         },
9387         {
9388                 .cmd = NL80211_CMD_SET_MPATH,
9389                 .doit = nl80211_set_mpath,
9390                 .policy = nl80211_policy,
9391                 .flags = GENL_ADMIN_PERM,
9392                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9393                                   NL80211_FLAG_NEED_RTNL,
9394         },
9395         {
9396                 .cmd = NL80211_CMD_NEW_MPATH,
9397                 .doit = nl80211_new_mpath,
9398                 .policy = nl80211_policy,
9399                 .flags = GENL_ADMIN_PERM,
9400                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9401                                   NL80211_FLAG_NEED_RTNL,
9402         },
9403         {
9404                 .cmd = NL80211_CMD_DEL_MPATH,
9405                 .doit = nl80211_del_mpath,
9406                 .policy = nl80211_policy,
9407                 .flags = GENL_ADMIN_PERM,
9408                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9409                                   NL80211_FLAG_NEED_RTNL,
9410         },
9411         {
9412                 .cmd = NL80211_CMD_SET_BSS,
9413                 .doit = nl80211_set_bss,
9414                 .policy = nl80211_policy,
9415                 .flags = GENL_ADMIN_PERM,
9416                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9417                                   NL80211_FLAG_NEED_RTNL,
9418         },
9419         {
9420                 .cmd = NL80211_CMD_GET_REG,
9421                 .doit = nl80211_get_reg,
9422                 .policy = nl80211_policy,
9423                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9424                 /* can be retrieved by unprivileged users */
9425         },
9426         {
9427                 .cmd = NL80211_CMD_SET_REG,
9428                 .doit = nl80211_set_reg,
9429                 .policy = nl80211_policy,
9430                 .flags = GENL_ADMIN_PERM,
9431                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9432         },
9433         {
9434                 .cmd = NL80211_CMD_REQ_SET_REG,
9435                 .doit = nl80211_req_set_reg,
9436                 .policy = nl80211_policy,
9437                 .flags = GENL_ADMIN_PERM,
9438         },
9439         {
9440                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9441                 .doit = nl80211_get_mesh_config,
9442                 .policy = nl80211_policy,
9443                 /* can be retrieved by unprivileged users */
9444                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9445                                   NL80211_FLAG_NEED_RTNL,
9446         },
9447         {
9448                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9449                 .doit = nl80211_update_mesh_config,
9450                 .policy = nl80211_policy,
9451                 .flags = GENL_ADMIN_PERM,
9452                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9453                                   NL80211_FLAG_NEED_RTNL,
9454         },
9455         {
9456                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9457                 .doit = nl80211_trigger_scan,
9458                 .policy = nl80211_policy,
9459                 .flags = GENL_ADMIN_PERM,
9460                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9461                                   NL80211_FLAG_NEED_RTNL,
9462         },
9463         {
9464                 .cmd = NL80211_CMD_GET_SCAN,
9465                 .policy = nl80211_policy,
9466                 .dumpit = nl80211_dump_scan,
9467         },
9468         {
9469                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9470                 .doit = nl80211_start_sched_scan,
9471                 .policy = nl80211_policy,
9472                 .flags = GENL_ADMIN_PERM,
9473                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9474                                   NL80211_FLAG_NEED_RTNL,
9475         },
9476         {
9477                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9478                 .doit = nl80211_stop_sched_scan,
9479                 .policy = nl80211_policy,
9480                 .flags = GENL_ADMIN_PERM,
9481                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9482                                   NL80211_FLAG_NEED_RTNL,
9483         },
9484         {
9485                 .cmd = NL80211_CMD_AUTHENTICATE,
9486                 .doit = nl80211_authenticate,
9487                 .policy = nl80211_policy,
9488                 .flags = GENL_ADMIN_PERM,
9489                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9490                                   NL80211_FLAG_NEED_RTNL,
9491         },
9492         {
9493                 .cmd = NL80211_CMD_ASSOCIATE,
9494                 .doit = nl80211_associate,
9495                 .policy = nl80211_policy,
9496                 .flags = GENL_ADMIN_PERM,
9497                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9498                                   NL80211_FLAG_NEED_RTNL,
9499         },
9500         {
9501                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9502                 .doit = nl80211_deauthenticate,
9503                 .policy = nl80211_policy,
9504                 .flags = GENL_ADMIN_PERM,
9505                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9506                                   NL80211_FLAG_NEED_RTNL,
9507         },
9508         {
9509                 .cmd = NL80211_CMD_DISASSOCIATE,
9510                 .doit = nl80211_disassociate,
9511                 .policy = nl80211_policy,
9512                 .flags = GENL_ADMIN_PERM,
9513                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9514                                   NL80211_FLAG_NEED_RTNL,
9515         },
9516         {
9517                 .cmd = NL80211_CMD_JOIN_IBSS,
9518                 .doit = nl80211_join_ibss,
9519                 .policy = nl80211_policy,
9520                 .flags = GENL_ADMIN_PERM,
9521                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9522                                   NL80211_FLAG_NEED_RTNL,
9523         },
9524         {
9525                 .cmd = NL80211_CMD_LEAVE_IBSS,
9526                 .doit = nl80211_leave_ibss,
9527                 .policy = nl80211_policy,
9528                 .flags = GENL_ADMIN_PERM,
9529                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9530                                   NL80211_FLAG_NEED_RTNL,
9531         },
9532 #ifdef CONFIG_NL80211_TESTMODE
9533         {
9534                 .cmd = NL80211_CMD_TESTMODE,
9535                 .doit = nl80211_testmode_do,
9536                 .dumpit = nl80211_testmode_dump,
9537                 .policy = nl80211_policy,
9538                 .flags = GENL_ADMIN_PERM,
9539                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9540                                   NL80211_FLAG_NEED_RTNL,
9541         },
9542 #endif
9543         {
9544                 .cmd = NL80211_CMD_CONNECT,
9545                 .doit = nl80211_connect,
9546                 .policy = nl80211_policy,
9547                 .flags = GENL_ADMIN_PERM,
9548                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9549                                   NL80211_FLAG_NEED_RTNL,
9550         },
9551         {
9552                 .cmd = NL80211_CMD_DISCONNECT,
9553                 .doit = nl80211_disconnect,
9554                 .policy = nl80211_policy,
9555                 .flags = GENL_ADMIN_PERM,
9556                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9557                                   NL80211_FLAG_NEED_RTNL,
9558         },
9559         {
9560                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9561                 .doit = nl80211_wiphy_netns,
9562                 .policy = nl80211_policy,
9563                 .flags = GENL_ADMIN_PERM,
9564                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9565                                   NL80211_FLAG_NEED_RTNL,
9566         },
9567         {
9568                 .cmd = NL80211_CMD_GET_SURVEY,
9569                 .policy = nl80211_policy,
9570                 .dumpit = nl80211_dump_survey,
9571         },
9572         {
9573                 .cmd = NL80211_CMD_SET_PMKSA,
9574                 .doit = nl80211_setdel_pmksa,
9575                 .policy = nl80211_policy,
9576                 .flags = GENL_ADMIN_PERM,
9577                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9578                                   NL80211_FLAG_NEED_RTNL,
9579         },
9580         {
9581                 .cmd = NL80211_CMD_DEL_PMKSA,
9582                 .doit = nl80211_setdel_pmksa,
9583                 .policy = nl80211_policy,
9584                 .flags = GENL_ADMIN_PERM,
9585                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9586                                   NL80211_FLAG_NEED_RTNL,
9587         },
9588         {
9589                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9590                 .doit = nl80211_flush_pmksa,
9591                 .policy = nl80211_policy,
9592                 .flags = GENL_ADMIN_PERM,
9593                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9594                                   NL80211_FLAG_NEED_RTNL,
9595         },
9596         {
9597                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9598                 .doit = nl80211_remain_on_channel,
9599                 .policy = nl80211_policy,
9600                 .flags = GENL_ADMIN_PERM,
9601                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9602                                   NL80211_FLAG_NEED_RTNL,
9603         },
9604         {
9605                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9606                 .doit = nl80211_cancel_remain_on_channel,
9607                 .policy = nl80211_policy,
9608                 .flags = GENL_ADMIN_PERM,
9609                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9610                                   NL80211_FLAG_NEED_RTNL,
9611         },
9612         {
9613                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9614                 .doit = nl80211_set_tx_bitrate_mask,
9615                 .policy = nl80211_policy,
9616                 .flags = GENL_ADMIN_PERM,
9617                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9618                                   NL80211_FLAG_NEED_RTNL,
9619         },
9620         {
9621                 .cmd = NL80211_CMD_REGISTER_FRAME,
9622                 .doit = nl80211_register_mgmt,
9623                 .policy = nl80211_policy,
9624                 .flags = GENL_ADMIN_PERM,
9625                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9626                                   NL80211_FLAG_NEED_RTNL,
9627         },
9628         {
9629                 .cmd = NL80211_CMD_FRAME,
9630                 .doit = nl80211_tx_mgmt,
9631                 .policy = nl80211_policy,
9632                 .flags = GENL_ADMIN_PERM,
9633                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9634                                   NL80211_FLAG_NEED_RTNL,
9635         },
9636         {
9637                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9638                 .doit = nl80211_tx_mgmt_cancel_wait,
9639                 .policy = nl80211_policy,
9640                 .flags = GENL_ADMIN_PERM,
9641                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9642                                   NL80211_FLAG_NEED_RTNL,
9643         },
9644         {
9645                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9646                 .doit = nl80211_set_power_save,
9647                 .policy = nl80211_policy,
9648                 .flags = GENL_ADMIN_PERM,
9649                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9650                                   NL80211_FLAG_NEED_RTNL,
9651         },
9652         {
9653                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9654                 .doit = nl80211_get_power_save,
9655                 .policy = nl80211_policy,
9656                 /* can be retrieved by unprivileged users */
9657                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9658                                   NL80211_FLAG_NEED_RTNL,
9659         },
9660         {
9661                 .cmd = NL80211_CMD_SET_CQM,
9662                 .doit = nl80211_set_cqm,
9663                 .policy = nl80211_policy,
9664                 .flags = GENL_ADMIN_PERM,
9665                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9666                                   NL80211_FLAG_NEED_RTNL,
9667         },
9668         {
9669                 .cmd = NL80211_CMD_SET_CHANNEL,
9670                 .doit = nl80211_set_channel,
9671                 .policy = nl80211_policy,
9672                 .flags = GENL_ADMIN_PERM,
9673                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9674                                   NL80211_FLAG_NEED_RTNL,
9675         },
9676         {
9677                 .cmd = NL80211_CMD_SET_WDS_PEER,
9678                 .doit = nl80211_set_wds_peer,
9679                 .policy = nl80211_policy,
9680                 .flags = GENL_ADMIN_PERM,
9681                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9682                                   NL80211_FLAG_NEED_RTNL,
9683         },
9684         {
9685                 .cmd = NL80211_CMD_JOIN_MESH,
9686                 .doit = nl80211_join_mesh,
9687                 .policy = nl80211_policy,
9688                 .flags = GENL_ADMIN_PERM,
9689                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9690                                   NL80211_FLAG_NEED_RTNL,
9691         },
9692         {
9693                 .cmd = NL80211_CMD_LEAVE_MESH,
9694                 .doit = nl80211_leave_mesh,
9695                 .policy = nl80211_policy,
9696                 .flags = GENL_ADMIN_PERM,
9697                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9698                                   NL80211_FLAG_NEED_RTNL,
9699         },
9700 #ifdef CONFIG_PM
9701         {
9702                 .cmd = NL80211_CMD_GET_WOWLAN,
9703                 .doit = nl80211_get_wowlan,
9704                 .policy = nl80211_policy,
9705                 /* can be retrieved by unprivileged users */
9706                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9707                                   NL80211_FLAG_NEED_RTNL,
9708         },
9709         {
9710                 .cmd = NL80211_CMD_SET_WOWLAN,
9711                 .doit = nl80211_set_wowlan,
9712                 .policy = nl80211_policy,
9713                 .flags = GENL_ADMIN_PERM,
9714                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9715                                   NL80211_FLAG_NEED_RTNL,
9716         },
9717 #endif
9718         {
9719                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9720                 .doit = nl80211_set_rekey_data,
9721                 .policy = nl80211_policy,
9722                 .flags = GENL_ADMIN_PERM,
9723                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9724                                   NL80211_FLAG_NEED_RTNL,
9725         },
9726         {
9727                 .cmd = NL80211_CMD_TDLS_MGMT,
9728                 .doit = nl80211_tdls_mgmt,
9729                 .policy = nl80211_policy,
9730                 .flags = GENL_ADMIN_PERM,
9731                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9732                                   NL80211_FLAG_NEED_RTNL,
9733         },
9734         {
9735                 .cmd = NL80211_CMD_TDLS_OPER,
9736                 .doit = nl80211_tdls_oper,
9737                 .policy = nl80211_policy,
9738                 .flags = GENL_ADMIN_PERM,
9739                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9740                                   NL80211_FLAG_NEED_RTNL,
9741         },
9742         {
9743                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9744                 .doit = nl80211_register_unexpected_frame,
9745                 .policy = nl80211_policy,
9746                 .flags = GENL_ADMIN_PERM,
9747                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9748                                   NL80211_FLAG_NEED_RTNL,
9749         },
9750         {
9751                 .cmd = NL80211_CMD_PROBE_CLIENT,
9752                 .doit = nl80211_probe_client,
9753                 .policy = nl80211_policy,
9754                 .flags = GENL_ADMIN_PERM,
9755                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9756                                   NL80211_FLAG_NEED_RTNL,
9757         },
9758         {
9759                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9760                 .doit = nl80211_register_beacons,
9761                 .policy = nl80211_policy,
9762                 .flags = GENL_ADMIN_PERM,
9763                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9764                                   NL80211_FLAG_NEED_RTNL,
9765         },
9766         {
9767                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9768                 .doit = nl80211_set_noack_map,
9769                 .policy = nl80211_policy,
9770                 .flags = GENL_ADMIN_PERM,
9771                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9772                                   NL80211_FLAG_NEED_RTNL,
9773         },
9774         {
9775                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9776                 .doit = nl80211_start_p2p_device,
9777                 .policy = nl80211_policy,
9778                 .flags = GENL_ADMIN_PERM,
9779                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9780                                   NL80211_FLAG_NEED_RTNL,
9781         },
9782         {
9783                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9784                 .doit = nl80211_stop_p2p_device,
9785                 .policy = nl80211_policy,
9786                 .flags = GENL_ADMIN_PERM,
9787                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9788                                   NL80211_FLAG_NEED_RTNL,
9789         },
9790         {
9791                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9792                 .doit = nl80211_set_mcast_rate,
9793                 .policy = nl80211_policy,
9794                 .flags = GENL_ADMIN_PERM,
9795                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9796                                   NL80211_FLAG_NEED_RTNL,
9797         },
9798         {
9799                 .cmd = NL80211_CMD_SET_MAC_ACL,
9800                 .doit = nl80211_set_mac_acl,
9801                 .policy = nl80211_policy,
9802                 .flags = GENL_ADMIN_PERM,
9803                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9804                                   NL80211_FLAG_NEED_RTNL,
9805         },
9806         {
9807                 .cmd = NL80211_CMD_RADAR_DETECT,
9808                 .doit = nl80211_start_radar_detection,
9809                 .policy = nl80211_policy,
9810                 .flags = GENL_ADMIN_PERM,
9811                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9812                                   NL80211_FLAG_NEED_RTNL,
9813         },
9814         {
9815                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9816                 .doit = nl80211_get_protocol_features,
9817                 .policy = nl80211_policy,
9818         },
9819         {
9820                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9821                 .doit = nl80211_update_ft_ies,
9822                 .policy = nl80211_policy,
9823                 .flags = GENL_ADMIN_PERM,
9824                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9825                                   NL80211_FLAG_NEED_RTNL,
9826         },
9827         {
9828                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
9829                 .doit = nl80211_crit_protocol_start,
9830                 .policy = nl80211_policy,
9831                 .flags = GENL_ADMIN_PERM,
9832                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9833                                   NL80211_FLAG_NEED_RTNL,
9834         },
9835         {
9836                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
9837                 .doit = nl80211_crit_protocol_stop,
9838                 .policy = nl80211_policy,
9839                 .flags = GENL_ADMIN_PERM,
9840                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9841                                   NL80211_FLAG_NEED_RTNL,
9842         },
9843         {
9844                 .cmd = NL80211_CMD_GET_COALESCE,
9845                 .doit = nl80211_get_coalesce,
9846                 .policy = nl80211_policy,
9847                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9848                                   NL80211_FLAG_NEED_RTNL,
9849         },
9850         {
9851                 .cmd = NL80211_CMD_SET_COALESCE,
9852                 .doit = nl80211_set_coalesce,
9853                 .policy = nl80211_policy,
9854                 .flags = GENL_ADMIN_PERM,
9855                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9856                                   NL80211_FLAG_NEED_RTNL,
9857         },
9858         {
9859                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
9860                 .doit = nl80211_channel_switch,
9861                 .policy = nl80211_policy,
9862                 .flags = GENL_ADMIN_PERM,
9863                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9864                                   NL80211_FLAG_NEED_RTNL,
9865         },
9866         {
9867                 .cmd = NL80211_CMD_VENDOR,
9868                 .doit = nl80211_vendor_cmd,
9869                 .policy = nl80211_policy,
9870                 .flags = GENL_ADMIN_PERM,
9871                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9872                                   NL80211_FLAG_NEED_RTNL,
9873         },
9874         {
9875                 .cmd = NL80211_CMD_SET_QOS_MAP,
9876                 .doit = nl80211_set_qos_map,
9877                 .policy = nl80211_policy,
9878                 .flags = GENL_ADMIN_PERM,
9879                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9880                                   NL80211_FLAG_NEED_RTNL,
9881         },
9882 };
9883
9884 /* notification functions */
9885
9886 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
9887 {
9888         struct sk_buff *msg;
9889         struct nl80211_dump_wiphy_state state = {};
9890
9891         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9892         if (!msg)
9893                 return;
9894
9895         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
9896                 nlmsg_free(msg);
9897                 return;
9898         }
9899
9900         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
9901                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
9902 }
9903
9904 static int nl80211_add_scan_req(struct sk_buff *msg,
9905                                 struct cfg80211_registered_device *rdev)
9906 {
9907         struct cfg80211_scan_request *req = rdev->scan_req;
9908         struct nlattr *nest;
9909         int i;
9910
9911         if (WARN_ON(!req))
9912                 return 0;
9913
9914         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
9915         if (!nest)
9916                 goto nla_put_failure;
9917         for (i = 0; i < req->n_ssids; i++) {
9918                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
9919                         goto nla_put_failure;
9920         }
9921         nla_nest_end(msg, nest);
9922
9923         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
9924         if (!nest)
9925                 goto nla_put_failure;
9926         for (i = 0; i < req->n_channels; i++) {
9927                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
9928                         goto nla_put_failure;
9929         }
9930         nla_nest_end(msg, nest);
9931
9932         if (req->ie &&
9933             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
9934                 goto nla_put_failure;
9935
9936         if (req->flags &&
9937             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
9938                 goto nla_put_failure;
9939
9940         return 0;
9941  nla_put_failure:
9942         return -ENOBUFS;
9943 }
9944
9945 static int nl80211_send_scan_msg(struct sk_buff *msg,
9946                                  struct cfg80211_registered_device *rdev,
9947                                  struct wireless_dev *wdev,
9948                                  u32 portid, u32 seq, int flags,
9949                                  u32 cmd)
9950 {
9951         void *hdr;
9952
9953         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9954         if (!hdr)
9955                 return -1;
9956
9957         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9958             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
9959                                          wdev->netdev->ifindex)) ||
9960             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
9961                 goto nla_put_failure;
9962
9963         /* ignore errors and send incomplete event anyway */
9964         nl80211_add_scan_req(msg, rdev);
9965
9966         return genlmsg_end(msg, hdr);
9967
9968  nla_put_failure:
9969         genlmsg_cancel(msg, hdr);
9970         return -EMSGSIZE;
9971 }
9972
9973 static int
9974 nl80211_send_sched_scan_msg(struct sk_buff *msg,
9975                             struct cfg80211_registered_device *rdev,
9976                             struct net_device *netdev,
9977                             u32 portid, u32 seq, int flags, u32 cmd)
9978 {
9979         void *hdr;
9980
9981         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
9982         if (!hdr)
9983                 return -1;
9984
9985         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
9986             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
9987                 goto nla_put_failure;
9988
9989         return genlmsg_end(msg, hdr);
9990
9991  nla_put_failure:
9992         genlmsg_cancel(msg, hdr);
9993         return -EMSGSIZE;
9994 }
9995
9996 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
9997                              struct wireless_dev *wdev)
9998 {
9999         struct sk_buff *msg;
10000
10001         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10002         if (!msg)
10003                 return;
10004
10005         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10006                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10007                 nlmsg_free(msg);
10008                 return;
10009         }
10010
10011         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10012                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10013 }
10014
10015 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10016                                        struct wireless_dev *wdev, bool aborted)
10017 {
10018         struct sk_buff *msg;
10019
10020         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10021         if (!msg)
10022                 return NULL;
10023
10024         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10025                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10026                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10027                 nlmsg_free(msg);
10028                 return NULL;
10029         }
10030
10031         return msg;
10032 }
10033
10034 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10035                               struct sk_buff *msg)
10036 {
10037         if (!msg)
10038                 return;
10039
10040         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10041                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10042 }
10043
10044 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10045                                      struct net_device *netdev)
10046 {
10047         struct sk_buff *msg;
10048
10049         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10050         if (!msg)
10051                 return;
10052
10053         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10054                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10055                 nlmsg_free(msg);
10056                 return;
10057         }
10058
10059         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10060                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10061 }
10062
10063 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10064                              struct net_device *netdev, u32 cmd)
10065 {
10066         struct sk_buff *msg;
10067
10068         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10069         if (!msg)
10070                 return;
10071
10072         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10073                 nlmsg_free(msg);
10074                 return;
10075         }
10076
10077         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10078                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10079 }
10080
10081 /*
10082  * This can happen on global regulatory changes or device specific settings
10083  * based on custom world regulatory domains.
10084  */
10085 void nl80211_send_reg_change_event(struct regulatory_request *request)
10086 {
10087         struct sk_buff *msg;
10088         void *hdr;
10089
10090         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10091         if (!msg)
10092                 return;
10093
10094         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10095         if (!hdr) {
10096                 nlmsg_free(msg);
10097                 return;
10098         }
10099
10100         /* Userspace can always count this one always being set */
10101         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10102                 goto nla_put_failure;
10103
10104         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10105                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10106                                NL80211_REGDOM_TYPE_WORLD))
10107                         goto nla_put_failure;
10108         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10109                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10110                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10111                         goto nla_put_failure;
10112         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10113                    request->intersect) {
10114                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10115                                NL80211_REGDOM_TYPE_INTERSECTION))
10116                         goto nla_put_failure;
10117         } else {
10118                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10119                                NL80211_REGDOM_TYPE_COUNTRY) ||
10120                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10121                                    request->alpha2))
10122                         goto nla_put_failure;
10123         }
10124
10125         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10126             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10127                 goto nla_put_failure;
10128
10129         genlmsg_end(msg, hdr);
10130
10131         rcu_read_lock();
10132         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10133                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10134         rcu_read_unlock();
10135
10136         return;
10137
10138 nla_put_failure:
10139         genlmsg_cancel(msg, hdr);
10140         nlmsg_free(msg);
10141 }
10142
10143 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10144                                     struct net_device *netdev,
10145                                     const u8 *buf, size_t len,
10146                                     enum nl80211_commands cmd, gfp_t gfp)
10147 {
10148         struct sk_buff *msg;
10149         void *hdr;
10150
10151         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10152         if (!msg)
10153                 return;
10154
10155         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10156         if (!hdr) {
10157                 nlmsg_free(msg);
10158                 return;
10159         }
10160
10161         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10162             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10163             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10164                 goto nla_put_failure;
10165
10166         genlmsg_end(msg, hdr);
10167
10168         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10169                                 NL80211_MCGRP_MLME, gfp);
10170         return;
10171
10172  nla_put_failure:
10173         genlmsg_cancel(msg, hdr);
10174         nlmsg_free(msg);
10175 }
10176
10177 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10178                           struct net_device *netdev, const u8 *buf,
10179                           size_t len, gfp_t gfp)
10180 {
10181         nl80211_send_mlme_event(rdev, netdev, buf, len,
10182                                 NL80211_CMD_AUTHENTICATE, gfp);
10183 }
10184
10185 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10186                            struct net_device *netdev, const u8 *buf,
10187                            size_t len, gfp_t gfp)
10188 {
10189         nl80211_send_mlme_event(rdev, netdev, buf, len,
10190                                 NL80211_CMD_ASSOCIATE, gfp);
10191 }
10192
10193 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10194                          struct net_device *netdev, const u8 *buf,
10195                          size_t len, gfp_t gfp)
10196 {
10197         nl80211_send_mlme_event(rdev, netdev, buf, len,
10198                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10199 }
10200
10201 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10202                            struct net_device *netdev, const u8 *buf,
10203                            size_t len, gfp_t gfp)
10204 {
10205         nl80211_send_mlme_event(rdev, netdev, buf, len,
10206                                 NL80211_CMD_DISASSOCIATE, gfp);
10207 }
10208
10209 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10210                                   size_t len)
10211 {
10212         struct wireless_dev *wdev = dev->ieee80211_ptr;
10213         struct wiphy *wiphy = wdev->wiphy;
10214         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10215         const struct ieee80211_mgmt *mgmt = (void *)buf;
10216         u32 cmd;
10217
10218         if (WARN_ON(len < 2))
10219                 return;
10220
10221         if (ieee80211_is_deauth(mgmt->frame_control))
10222                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10223         else
10224                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10225
10226         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10227         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10228 }
10229 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10230
10231 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10232                                       struct net_device *netdev, int cmd,
10233                                       const u8 *addr, gfp_t gfp)
10234 {
10235         struct sk_buff *msg;
10236         void *hdr;
10237
10238         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10239         if (!msg)
10240                 return;
10241
10242         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10243         if (!hdr) {
10244                 nlmsg_free(msg);
10245                 return;
10246         }
10247
10248         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10249             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10250             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10251             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10252                 goto nla_put_failure;
10253
10254         genlmsg_end(msg, hdr);
10255
10256         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10257                                 NL80211_MCGRP_MLME, gfp);
10258         return;
10259
10260  nla_put_failure:
10261         genlmsg_cancel(msg, hdr);
10262         nlmsg_free(msg);
10263 }
10264
10265 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10266                                struct net_device *netdev, const u8 *addr,
10267                                gfp_t gfp)
10268 {
10269         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10270                                   addr, gfp);
10271 }
10272
10273 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10274                                 struct net_device *netdev, const u8 *addr,
10275                                 gfp_t gfp)
10276 {
10277         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10278                                   addr, gfp);
10279 }
10280
10281 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10282                                  struct net_device *netdev, const u8 *bssid,
10283                                  const u8 *req_ie, size_t req_ie_len,
10284                                  const u8 *resp_ie, size_t resp_ie_len,
10285                                  u16 status, gfp_t gfp)
10286 {
10287         struct sk_buff *msg;
10288         void *hdr;
10289
10290         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10291         if (!msg)
10292                 return;
10293
10294         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10295         if (!hdr) {
10296                 nlmsg_free(msg);
10297                 return;
10298         }
10299
10300         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10301             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10302             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10303             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10304             (req_ie &&
10305              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10306             (resp_ie &&
10307              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10308                 goto nla_put_failure;
10309
10310         genlmsg_end(msg, hdr);
10311
10312         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10313                                 NL80211_MCGRP_MLME, gfp);
10314         return;
10315
10316  nla_put_failure:
10317         genlmsg_cancel(msg, hdr);
10318         nlmsg_free(msg);
10319
10320 }
10321
10322 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10323                          struct net_device *netdev, const u8 *bssid,
10324                          const u8 *req_ie, size_t req_ie_len,
10325                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10326 {
10327         struct sk_buff *msg;
10328         void *hdr;
10329
10330         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10331         if (!msg)
10332                 return;
10333
10334         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10335         if (!hdr) {
10336                 nlmsg_free(msg);
10337                 return;
10338         }
10339
10340         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10341             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10342             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10343             (req_ie &&
10344              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10345             (resp_ie &&
10346              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10347                 goto nla_put_failure;
10348
10349         genlmsg_end(msg, hdr);
10350
10351         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10352                                 NL80211_MCGRP_MLME, gfp);
10353         return;
10354
10355  nla_put_failure:
10356         genlmsg_cancel(msg, hdr);
10357         nlmsg_free(msg);
10358
10359 }
10360
10361 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10362                                struct net_device *netdev, u16 reason,
10363                                const u8 *ie, size_t ie_len, bool from_ap)
10364 {
10365         struct sk_buff *msg;
10366         void *hdr;
10367
10368         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10369         if (!msg)
10370                 return;
10371
10372         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10373         if (!hdr) {
10374                 nlmsg_free(msg);
10375                 return;
10376         }
10377
10378         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10379             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10380             (from_ap && reason &&
10381              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10382             (from_ap &&
10383              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10384             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10385                 goto nla_put_failure;
10386
10387         genlmsg_end(msg, hdr);
10388
10389         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10390                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10391         return;
10392
10393  nla_put_failure:
10394         genlmsg_cancel(msg, hdr);
10395         nlmsg_free(msg);
10396
10397 }
10398
10399 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10400                              struct net_device *netdev, const u8 *bssid,
10401                              gfp_t gfp)
10402 {
10403         struct sk_buff *msg;
10404         void *hdr;
10405
10406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10407         if (!msg)
10408                 return;
10409
10410         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10411         if (!hdr) {
10412                 nlmsg_free(msg);
10413                 return;
10414         }
10415
10416         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10417             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10418             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10419                 goto nla_put_failure;
10420
10421         genlmsg_end(msg, hdr);
10422
10423         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10424                                 NL80211_MCGRP_MLME, gfp);
10425         return;
10426
10427  nla_put_failure:
10428         genlmsg_cancel(msg, hdr);
10429         nlmsg_free(msg);
10430 }
10431
10432 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10433                                         const u8* ie, u8 ie_len, gfp_t gfp)
10434 {
10435         struct wireless_dev *wdev = dev->ieee80211_ptr;
10436         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10437         struct sk_buff *msg;
10438         void *hdr;
10439
10440         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10441                 return;
10442
10443         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10444
10445         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10446         if (!msg)
10447                 return;
10448
10449         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10450         if (!hdr) {
10451                 nlmsg_free(msg);
10452                 return;
10453         }
10454
10455         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10456             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10457             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10458             (ie_len && ie &&
10459              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10460                 goto nla_put_failure;
10461
10462         genlmsg_end(msg, hdr);
10463
10464         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10465                                 NL80211_MCGRP_MLME, gfp);
10466         return;
10467
10468  nla_put_failure:
10469         genlmsg_cancel(msg, hdr);
10470         nlmsg_free(msg);
10471 }
10472 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10473
10474 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10475                                  struct net_device *netdev, const u8 *addr,
10476                                  enum nl80211_key_type key_type, int key_id,
10477                                  const u8 *tsc, gfp_t gfp)
10478 {
10479         struct sk_buff *msg;
10480         void *hdr;
10481
10482         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10483         if (!msg)
10484                 return;
10485
10486         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10487         if (!hdr) {
10488                 nlmsg_free(msg);
10489                 return;
10490         }
10491
10492         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10493             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10494             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10495             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10496             (key_id != -1 &&
10497              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10498             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10499                 goto nla_put_failure;
10500
10501         genlmsg_end(msg, hdr);
10502
10503         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10504                                 NL80211_MCGRP_MLME, gfp);
10505         return;
10506
10507  nla_put_failure:
10508         genlmsg_cancel(msg, hdr);
10509         nlmsg_free(msg);
10510 }
10511
10512 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10513                                     struct ieee80211_channel *channel_before,
10514                                     struct ieee80211_channel *channel_after)
10515 {
10516         struct sk_buff *msg;
10517         void *hdr;
10518         struct nlattr *nl_freq;
10519
10520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10521         if (!msg)
10522                 return;
10523
10524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10525         if (!hdr) {
10526                 nlmsg_free(msg);
10527                 return;
10528         }
10529
10530         /*
10531          * Since we are applying the beacon hint to a wiphy we know its
10532          * wiphy_idx is valid
10533          */
10534         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10535                 goto nla_put_failure;
10536
10537         /* Before */
10538         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10539         if (!nl_freq)
10540                 goto nla_put_failure;
10541         if (nl80211_msg_put_channel(msg, channel_before, false))
10542                 goto nla_put_failure;
10543         nla_nest_end(msg, nl_freq);
10544
10545         /* After */
10546         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10547         if (!nl_freq)
10548                 goto nla_put_failure;
10549         if (nl80211_msg_put_channel(msg, channel_after, false))
10550                 goto nla_put_failure;
10551         nla_nest_end(msg, nl_freq);
10552
10553         genlmsg_end(msg, hdr);
10554
10555         rcu_read_lock();
10556         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10557                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10558         rcu_read_unlock();
10559
10560         return;
10561
10562 nla_put_failure:
10563         genlmsg_cancel(msg, hdr);
10564         nlmsg_free(msg);
10565 }
10566
10567 static void nl80211_send_remain_on_chan_event(
10568         int cmd, struct cfg80211_registered_device *rdev,
10569         struct wireless_dev *wdev, u64 cookie,
10570         struct ieee80211_channel *chan,
10571         unsigned int duration, gfp_t gfp)
10572 {
10573         struct sk_buff *msg;
10574         void *hdr;
10575
10576         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10577         if (!msg)
10578                 return;
10579
10580         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10581         if (!hdr) {
10582                 nlmsg_free(msg);
10583                 return;
10584         }
10585
10586         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10587             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10588                                          wdev->netdev->ifindex)) ||
10589             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10590             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10591             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10592                         NL80211_CHAN_NO_HT) ||
10593             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10594                 goto nla_put_failure;
10595
10596         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10597             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10598                 goto nla_put_failure;
10599
10600         genlmsg_end(msg, hdr);
10601
10602         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10603                                 NL80211_MCGRP_MLME, gfp);
10604         return;
10605
10606  nla_put_failure:
10607         genlmsg_cancel(msg, hdr);
10608         nlmsg_free(msg);
10609 }
10610
10611 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10612                                struct ieee80211_channel *chan,
10613                                unsigned int duration, gfp_t gfp)
10614 {
10615         struct wiphy *wiphy = wdev->wiphy;
10616         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10617
10618         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10619         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10620                                           rdev, wdev, cookie, chan,
10621                                           duration, gfp);
10622 }
10623 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10624
10625 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10626                                         struct ieee80211_channel *chan,
10627                                         gfp_t gfp)
10628 {
10629         struct wiphy *wiphy = wdev->wiphy;
10630         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10631
10632         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10633         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10634                                           rdev, wdev, cookie, chan, 0, gfp);
10635 }
10636 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10637
10638 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10639                       struct station_info *sinfo, gfp_t gfp)
10640 {
10641         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10642         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10643         struct sk_buff *msg;
10644
10645         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10646
10647         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10648         if (!msg)
10649                 return;
10650
10651         if (nl80211_send_station(msg, 0, 0, 0,
10652                                  rdev, dev, mac_addr, sinfo) < 0) {
10653                 nlmsg_free(msg);
10654                 return;
10655         }
10656
10657         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10658                                 NL80211_MCGRP_MLME, gfp);
10659 }
10660 EXPORT_SYMBOL(cfg80211_new_sta);
10661
10662 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10663 {
10664         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10665         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10666         struct sk_buff *msg;
10667         void *hdr;
10668
10669         trace_cfg80211_del_sta(dev, mac_addr);
10670
10671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10672         if (!msg)
10673                 return;
10674
10675         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10676         if (!hdr) {
10677                 nlmsg_free(msg);
10678                 return;
10679         }
10680
10681         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10682             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10683                 goto nla_put_failure;
10684
10685         genlmsg_end(msg, hdr);
10686
10687         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10688                                 NL80211_MCGRP_MLME, gfp);
10689         return;
10690
10691  nla_put_failure:
10692         genlmsg_cancel(msg, hdr);
10693         nlmsg_free(msg);
10694 }
10695 EXPORT_SYMBOL(cfg80211_del_sta);
10696
10697 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10698                           enum nl80211_connect_failed_reason reason,
10699                           gfp_t gfp)
10700 {
10701         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10702         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10703         struct sk_buff *msg;
10704         void *hdr;
10705
10706         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10707         if (!msg)
10708                 return;
10709
10710         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10711         if (!hdr) {
10712                 nlmsg_free(msg);
10713                 return;
10714         }
10715
10716         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10717             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10718             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10719                 goto nla_put_failure;
10720
10721         genlmsg_end(msg, hdr);
10722
10723         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10724                                 NL80211_MCGRP_MLME, gfp);
10725         return;
10726
10727  nla_put_failure:
10728         genlmsg_cancel(msg, hdr);
10729         nlmsg_free(msg);
10730 }
10731 EXPORT_SYMBOL(cfg80211_conn_failed);
10732
10733 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10734                                        const u8 *addr, gfp_t gfp)
10735 {
10736         struct wireless_dev *wdev = dev->ieee80211_ptr;
10737         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
10738         struct sk_buff *msg;
10739         void *hdr;
10740         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10741
10742         if (!nlportid)
10743                 return false;
10744
10745         msg = nlmsg_new(100, gfp);
10746         if (!msg)
10747                 return true;
10748
10749         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10750         if (!hdr) {
10751                 nlmsg_free(msg);
10752                 return true;
10753         }
10754
10755         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10756             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10757             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10758                 goto nla_put_failure;
10759
10760         genlmsg_end(msg, hdr);
10761         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10762         return true;
10763
10764  nla_put_failure:
10765         genlmsg_cancel(msg, hdr);
10766         nlmsg_free(msg);
10767         return true;
10768 }
10769
10770 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10771                                 const u8 *addr, gfp_t gfp)
10772 {
10773         struct wireless_dev *wdev = dev->ieee80211_ptr;
10774         bool ret;
10775
10776         trace_cfg80211_rx_spurious_frame(dev, addr);
10777
10778         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10779                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10780                 trace_cfg80211_return_bool(false);
10781                 return false;
10782         }
10783         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10784                                          addr, gfp);
10785         trace_cfg80211_return_bool(ret);
10786         return ret;
10787 }
10788 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10789
10790 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10791                                         const u8 *addr, gfp_t gfp)
10792 {
10793         struct wireless_dev *wdev = dev->ieee80211_ptr;
10794         bool ret;
10795
10796         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10797
10798         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10799                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10800                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10801                 trace_cfg80211_return_bool(false);
10802                 return false;
10803         }
10804         ret = __nl80211_unexpected_frame(dev,
10805                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10806                                          addr, gfp);
10807         trace_cfg80211_return_bool(ret);
10808         return ret;
10809 }
10810 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10811
10812 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10813                       struct wireless_dev *wdev, u32 nlportid,
10814                       int freq, int sig_dbm,
10815                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10816 {
10817         struct net_device *netdev = wdev->netdev;
10818         struct sk_buff *msg;
10819         void *hdr;
10820
10821         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10822         if (!msg)
10823                 return -ENOMEM;
10824
10825         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10826         if (!hdr) {
10827                 nlmsg_free(msg);
10828                 return -ENOMEM;
10829         }
10830
10831         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10832             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10833                                         netdev->ifindex)) ||
10834             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10835             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
10836             (sig_dbm &&
10837              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
10838             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10839             (flags &&
10840              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
10841                 goto nla_put_failure;
10842
10843         genlmsg_end(msg, hdr);
10844
10845         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10846
10847  nla_put_failure:
10848         genlmsg_cancel(msg, hdr);
10849         nlmsg_free(msg);
10850         return -ENOBUFS;
10851 }
10852
10853 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
10854                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
10855 {
10856         struct wiphy *wiphy = wdev->wiphy;
10857         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10858         struct net_device *netdev = wdev->netdev;
10859         struct sk_buff *msg;
10860         void *hdr;
10861
10862         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
10863
10864         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10865         if (!msg)
10866                 return;
10867
10868         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
10869         if (!hdr) {
10870                 nlmsg_free(msg);
10871                 return;
10872         }
10873
10874         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10875             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10876                                    netdev->ifindex)) ||
10877             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10878             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
10879             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
10880             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
10881                 goto nla_put_failure;
10882
10883         genlmsg_end(msg, hdr);
10884
10885         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10886                                 NL80211_MCGRP_MLME, gfp);
10887         return;
10888
10889  nla_put_failure:
10890         genlmsg_cancel(msg, hdr);
10891         nlmsg_free(msg);
10892 }
10893 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
10894
10895 void cfg80211_cqm_rssi_notify(struct net_device *dev,
10896                               enum nl80211_cqm_rssi_threshold_event rssi_event,
10897                               gfp_t gfp)
10898 {
10899         struct wireless_dev *wdev = dev->ieee80211_ptr;
10900         struct wiphy *wiphy = wdev->wiphy;
10901         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10902         struct sk_buff *msg;
10903         struct nlattr *pinfoattr;
10904         void *hdr;
10905
10906         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
10907
10908         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10909         if (!msg)
10910                 return;
10911
10912         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
10913         if (!hdr) {
10914                 nlmsg_free(msg);
10915                 return;
10916         }
10917
10918         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10919             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10920                 goto nla_put_failure;
10921
10922         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
10923         if (!pinfoattr)
10924                 goto nla_put_failure;
10925
10926         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
10927                         rssi_event))
10928                 goto nla_put_failure;
10929
10930         nla_nest_end(msg, pinfoattr);
10931
10932         genlmsg_end(msg, hdr);
10933
10934         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10935                                 NL80211_MCGRP_MLME, gfp);
10936         return;
10937
10938  nla_put_failure:
10939         genlmsg_cancel(msg, hdr);
10940         nlmsg_free(msg);
10941 }
10942 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
10943
10944 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
10945                                      struct net_device *netdev, const u8 *bssid,
10946                                      const u8 *replay_ctr, gfp_t gfp)
10947 {
10948         struct sk_buff *msg;
10949         struct nlattr *rekey_attr;
10950         void *hdr;
10951
10952         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10953         if (!msg)
10954                 return;
10955
10956         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
10957         if (!hdr) {
10958                 nlmsg_free(msg);
10959                 return;
10960         }
10961
10962         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10963             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10964             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10965                 goto nla_put_failure;
10966
10967         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
10968         if (!rekey_attr)
10969                 goto nla_put_failure;
10970
10971         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
10972                     NL80211_REPLAY_CTR_LEN, replay_ctr))
10973                 goto nla_put_failure;
10974
10975         nla_nest_end(msg, rekey_attr);
10976
10977         genlmsg_end(msg, hdr);
10978
10979         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10980                                 NL80211_MCGRP_MLME, gfp);
10981         return;
10982
10983  nla_put_failure:
10984         genlmsg_cancel(msg, hdr);
10985         nlmsg_free(msg);
10986 }
10987
10988 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
10989                                const u8 *replay_ctr, gfp_t gfp)
10990 {
10991         struct wireless_dev *wdev = dev->ieee80211_ptr;
10992         struct wiphy *wiphy = wdev->wiphy;
10993         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
10994
10995         trace_cfg80211_gtk_rekey_notify(dev, bssid);
10996         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
10997 }
10998 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
10999
11000 static void
11001 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11002                                struct net_device *netdev, int index,
11003                                const u8 *bssid, bool preauth, gfp_t gfp)
11004 {
11005         struct sk_buff *msg;
11006         struct nlattr *attr;
11007         void *hdr;
11008
11009         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11010         if (!msg)
11011                 return;
11012
11013         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11014         if (!hdr) {
11015                 nlmsg_free(msg);
11016                 return;
11017         }
11018
11019         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11020             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11021                 goto nla_put_failure;
11022
11023         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11024         if (!attr)
11025                 goto nla_put_failure;
11026
11027         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11028             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11029             (preauth &&
11030              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11031                 goto nla_put_failure;
11032
11033         nla_nest_end(msg, attr);
11034
11035         genlmsg_end(msg, hdr);
11036
11037         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11038                                 NL80211_MCGRP_MLME, gfp);
11039         return;
11040
11041  nla_put_failure:
11042         genlmsg_cancel(msg, hdr);
11043         nlmsg_free(msg);
11044 }
11045
11046 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11047                                      const u8 *bssid, bool preauth, gfp_t gfp)
11048 {
11049         struct wireless_dev *wdev = dev->ieee80211_ptr;
11050         struct wiphy *wiphy = wdev->wiphy;
11051         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11052
11053         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11054         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11055 }
11056 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11057
11058 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11059                                      struct net_device *netdev,
11060                                      struct cfg80211_chan_def *chandef,
11061                                      gfp_t gfp)
11062 {
11063         struct sk_buff *msg;
11064         void *hdr;
11065
11066         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11067         if (!msg)
11068                 return;
11069
11070         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11071         if (!hdr) {
11072                 nlmsg_free(msg);
11073                 return;
11074         }
11075
11076         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11077                 goto nla_put_failure;
11078
11079         if (nl80211_send_chandef(msg, chandef))
11080                 goto nla_put_failure;
11081
11082         genlmsg_end(msg, hdr);
11083
11084         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11085                                 NL80211_MCGRP_MLME, gfp);
11086         return;
11087
11088  nla_put_failure:
11089         genlmsg_cancel(msg, hdr);
11090         nlmsg_free(msg);
11091 }
11092
11093 void cfg80211_ch_switch_notify(struct net_device *dev,
11094                                struct cfg80211_chan_def *chandef)
11095 {
11096         struct wireless_dev *wdev = dev->ieee80211_ptr;
11097         struct wiphy *wiphy = wdev->wiphy;
11098         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11099
11100         ASSERT_WDEV_LOCK(wdev);
11101
11102         trace_cfg80211_ch_switch_notify(dev, chandef);
11103
11104         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11105                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11106                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11107                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11108                 return;
11109
11110         wdev->channel = chandef->chan;
11111         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11112 }
11113 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11114
11115 void cfg80211_cqm_txe_notify(struct net_device *dev,
11116                              const u8 *peer, u32 num_packets,
11117                              u32 rate, u32 intvl, gfp_t gfp)
11118 {
11119         struct wireless_dev *wdev = dev->ieee80211_ptr;
11120         struct wiphy *wiphy = wdev->wiphy;
11121         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11122         struct sk_buff *msg;
11123         struct nlattr *pinfoattr;
11124         void *hdr;
11125
11126         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11127         if (!msg)
11128                 return;
11129
11130         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11131         if (!hdr) {
11132                 nlmsg_free(msg);
11133                 return;
11134         }
11135
11136         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11137             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11138             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11139                 goto nla_put_failure;
11140
11141         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11142         if (!pinfoattr)
11143                 goto nla_put_failure;
11144
11145         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11146                 goto nla_put_failure;
11147
11148         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11149                 goto nla_put_failure;
11150
11151         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11152                 goto nla_put_failure;
11153
11154         nla_nest_end(msg, pinfoattr);
11155
11156         genlmsg_end(msg, hdr);
11157
11158         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11159                                 NL80211_MCGRP_MLME, gfp);
11160         return;
11161
11162  nla_put_failure:
11163         genlmsg_cancel(msg, hdr);
11164         nlmsg_free(msg);
11165 }
11166 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11167
11168 void
11169 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11170                      const struct cfg80211_chan_def *chandef,
11171                      enum nl80211_radar_event event,
11172                      struct net_device *netdev, gfp_t gfp)
11173 {
11174         struct sk_buff *msg;
11175         void *hdr;
11176
11177         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11178         if (!msg)
11179                 return;
11180
11181         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11182         if (!hdr) {
11183                 nlmsg_free(msg);
11184                 return;
11185         }
11186
11187         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11188                 goto nla_put_failure;
11189
11190         /* NOP and radar events don't need a netdev parameter */
11191         if (netdev) {
11192                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11193
11194                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11195                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11196                         goto nla_put_failure;
11197         }
11198
11199         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11200                 goto nla_put_failure;
11201
11202         if (nl80211_send_chandef(msg, chandef))
11203                 goto nla_put_failure;
11204
11205         genlmsg_end(msg, hdr);
11206
11207         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11208                                 NL80211_MCGRP_MLME, gfp);
11209         return;
11210
11211  nla_put_failure:
11212         genlmsg_cancel(msg, hdr);
11213         nlmsg_free(msg);
11214 }
11215
11216 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11217                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11218 {
11219         struct wireless_dev *wdev = dev->ieee80211_ptr;
11220         struct wiphy *wiphy = wdev->wiphy;
11221         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11222         struct sk_buff *msg;
11223         struct nlattr *pinfoattr;
11224         void *hdr;
11225
11226         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11227
11228         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11229         if (!msg)
11230                 return;
11231
11232         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11233         if (!hdr) {
11234                 nlmsg_free(msg);
11235                 return;
11236         }
11237
11238         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11239             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11240             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11241                 goto nla_put_failure;
11242
11243         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11244         if (!pinfoattr)
11245                 goto nla_put_failure;
11246
11247         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11248                 goto nla_put_failure;
11249
11250         nla_nest_end(msg, pinfoattr);
11251
11252         genlmsg_end(msg, hdr);
11253
11254         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11255                                 NL80211_MCGRP_MLME, gfp);
11256         return;
11257
11258  nla_put_failure:
11259         genlmsg_cancel(msg, hdr);
11260         nlmsg_free(msg);
11261 }
11262 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11263
11264 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11265                            u64 cookie, bool acked, gfp_t gfp)
11266 {
11267         struct wireless_dev *wdev = dev->ieee80211_ptr;
11268         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11269         struct sk_buff *msg;
11270         void *hdr;
11271
11272         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11273
11274         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11275
11276         if (!msg)
11277                 return;
11278
11279         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11280         if (!hdr) {
11281                 nlmsg_free(msg);
11282                 return;
11283         }
11284
11285         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11286             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11287             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11288             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11289             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11290                 goto nla_put_failure;
11291
11292         genlmsg_end(msg, hdr);
11293
11294         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11295                                 NL80211_MCGRP_MLME, gfp);
11296         return;
11297
11298  nla_put_failure:
11299         genlmsg_cancel(msg, hdr);
11300         nlmsg_free(msg);
11301 }
11302 EXPORT_SYMBOL(cfg80211_probe_status);
11303
11304 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11305                                  const u8 *frame, size_t len,
11306                                  int freq, int sig_dbm)
11307 {
11308         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11309         struct sk_buff *msg;
11310         void *hdr;
11311         struct cfg80211_beacon_registration *reg;
11312
11313         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11314
11315         spin_lock_bh(&rdev->beacon_registrations_lock);
11316         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11317                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11318                 if (!msg) {
11319                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11320                         return;
11321                 }
11322
11323                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11324                 if (!hdr)
11325                         goto nla_put_failure;
11326
11327                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11328                     (freq &&
11329                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11330                     (sig_dbm &&
11331                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11332                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11333                         goto nla_put_failure;
11334
11335                 genlmsg_end(msg, hdr);
11336
11337                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11338         }
11339         spin_unlock_bh(&rdev->beacon_registrations_lock);
11340         return;
11341
11342  nla_put_failure:
11343         spin_unlock_bh(&rdev->beacon_registrations_lock);
11344         if (hdr)
11345                 genlmsg_cancel(msg, hdr);
11346         nlmsg_free(msg);
11347 }
11348 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11349
11350 #ifdef CONFIG_PM
11351 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11352                                    struct cfg80211_wowlan_wakeup *wakeup,
11353                                    gfp_t gfp)
11354 {
11355         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11356         struct sk_buff *msg;
11357         void *hdr;
11358         int size = 200;
11359
11360         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11361
11362         if (wakeup)
11363                 size += wakeup->packet_present_len;
11364
11365         msg = nlmsg_new(size, gfp);
11366         if (!msg)
11367                 return;
11368
11369         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11370         if (!hdr)
11371                 goto free_msg;
11372
11373         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11374             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11375                 goto free_msg;
11376
11377         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11378                                         wdev->netdev->ifindex))
11379                 goto free_msg;
11380
11381         if (wakeup) {
11382                 struct nlattr *reasons;
11383
11384                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11385                 if (!reasons)
11386                         goto free_msg;
11387
11388                 if (wakeup->disconnect &&
11389                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11390                         goto free_msg;
11391                 if (wakeup->magic_pkt &&
11392                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11393                         goto free_msg;
11394                 if (wakeup->gtk_rekey_failure &&
11395                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11396                         goto free_msg;
11397                 if (wakeup->eap_identity_req &&
11398                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11399                         goto free_msg;
11400                 if (wakeup->four_way_handshake &&
11401                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11402                         goto free_msg;
11403                 if (wakeup->rfkill_release &&
11404                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11405                         goto free_msg;
11406
11407                 if (wakeup->pattern_idx >= 0 &&
11408                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11409                                 wakeup->pattern_idx))
11410                         goto free_msg;
11411
11412                 if (wakeup->tcp_match &&
11413                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11414                         goto free_msg;
11415
11416                 if (wakeup->tcp_connlost &&
11417                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11418                         goto free_msg;
11419
11420                 if (wakeup->tcp_nomoretokens &&
11421                     nla_put_flag(msg,
11422                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11423                         goto free_msg;
11424
11425                 if (wakeup->packet) {
11426                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11427                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11428
11429                         if (!wakeup->packet_80211) {
11430                                 pkt_attr =
11431                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11432                                 len_attr =
11433                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11434                         }
11435
11436                         if (wakeup->packet_len &&
11437                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11438                                 goto free_msg;
11439
11440                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11441                                     wakeup->packet))
11442                                 goto free_msg;
11443                 }
11444
11445                 nla_nest_end(msg, reasons);
11446         }
11447
11448         genlmsg_end(msg, hdr);
11449
11450         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11451                                 NL80211_MCGRP_MLME, gfp);
11452         return;
11453
11454  free_msg:
11455         nlmsg_free(msg);
11456 }
11457 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11458 #endif
11459
11460 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11461                                 enum nl80211_tdls_operation oper,
11462                                 u16 reason_code, gfp_t gfp)
11463 {
11464         struct wireless_dev *wdev = dev->ieee80211_ptr;
11465         struct cfg80211_registered_device *rdev = wiphy_to_dev(wdev->wiphy);
11466         struct sk_buff *msg;
11467         void *hdr;
11468
11469         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11470                                          reason_code);
11471
11472         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11473         if (!msg)
11474                 return;
11475
11476         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11477         if (!hdr) {
11478                 nlmsg_free(msg);
11479                 return;
11480         }
11481
11482         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11483             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11484             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11485             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11486             (reason_code > 0 &&
11487              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11488                 goto nla_put_failure;
11489
11490         genlmsg_end(msg, hdr);
11491
11492         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11493                                 NL80211_MCGRP_MLME, gfp);
11494         return;
11495
11496  nla_put_failure:
11497         genlmsg_cancel(msg, hdr);
11498         nlmsg_free(msg);
11499 }
11500 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11501
11502 static int nl80211_netlink_notify(struct notifier_block * nb,
11503                                   unsigned long state,
11504                                   void *_notify)
11505 {
11506         struct netlink_notify *notify = _notify;
11507         struct cfg80211_registered_device *rdev;
11508         struct wireless_dev *wdev;
11509         struct cfg80211_beacon_registration *reg, *tmp;
11510
11511         if (state != NETLINK_URELEASE)
11512                 return NOTIFY_DONE;
11513
11514         rcu_read_lock();
11515
11516         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11517                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list)
11518                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11519
11520                 spin_lock_bh(&rdev->beacon_registrations_lock);
11521                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11522                                          list) {
11523                         if (reg->nlportid == notify->portid) {
11524                                 list_del(&reg->list);
11525                                 kfree(reg);
11526                                 break;
11527                         }
11528                 }
11529                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11530         }
11531
11532         rcu_read_unlock();
11533
11534         return NOTIFY_DONE;
11535 }
11536
11537 static struct notifier_block nl80211_netlink_notifier = {
11538         .notifier_call = nl80211_netlink_notify,
11539 };
11540
11541 void cfg80211_ft_event(struct net_device *netdev,
11542                        struct cfg80211_ft_event_params *ft_event)
11543 {
11544         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11545         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
11546         struct sk_buff *msg;
11547         void *hdr;
11548
11549         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11550
11551         if (!ft_event->target_ap)
11552                 return;
11553
11554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11555         if (!msg)
11556                 return;
11557
11558         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11559         if (!hdr)
11560                 goto out;
11561
11562         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11563             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11564             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11565                 goto out;
11566
11567         if (ft_event->ies &&
11568             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11569                 goto out;
11570         if (ft_event->ric_ies &&
11571             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11572                     ft_event->ric_ies))
11573                 goto out;
11574
11575         genlmsg_end(msg, hdr);
11576
11577         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11578                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11579         return;
11580  out:
11581         nlmsg_free(msg);
11582 }
11583 EXPORT_SYMBOL(cfg80211_ft_event);
11584
11585 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11586 {
11587         struct cfg80211_registered_device *rdev;
11588         struct sk_buff *msg;
11589         void *hdr;
11590         u32 nlportid;
11591
11592         rdev = wiphy_to_dev(wdev->wiphy);
11593         if (!rdev->crit_proto_nlportid)
11594                 return;
11595
11596         nlportid = rdev->crit_proto_nlportid;
11597         rdev->crit_proto_nlportid = 0;
11598
11599         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11600         if (!msg)
11601                 return;
11602
11603         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11604         if (!hdr)
11605                 goto nla_put_failure;
11606
11607         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11608             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11609                 goto nla_put_failure;
11610
11611         genlmsg_end(msg, hdr);
11612
11613         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11614         return;
11615
11616  nla_put_failure:
11617         if (hdr)
11618                 genlmsg_cancel(msg, hdr);
11619         nlmsg_free(msg);
11620
11621 }
11622 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11623
11624 /* initialisation/exit functions */
11625
11626 int nl80211_init(void)
11627 {
11628         int err;
11629
11630         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11631                                                    nl80211_mcgrps);
11632         if (err)
11633                 return err;
11634
11635         err = netlink_register_notifier(&nl80211_netlink_notifier);
11636         if (err)
11637                 goto err_out;
11638
11639         return 0;
11640  err_out:
11641         genl_unregister_family(&nl80211_fam);
11642         return err;
11643 }
11644
11645 void nl80211_exit(void)
11646 {
11647         netlink_unregister_notifier(&nl80211_netlink_notifier);
11648         genl_unregister_family(&nl80211_fam);
11649 }