net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  */
   6
   7 #include <linux/if.h>
   8 #include <linux/module.h>
   9 #include <linux/err.h>
  10 #include <linux/slab.h>
  11 #include <linux/list.h>
  12 #include <linux/if_ether.h>
  13 #include <linux/ieee80211.h>
  14 #include <linux/nl80211.h>
  15 #include <linux/rtnetlink.h>
  16 #include <linux/netlink.h>
  17 #include <linux/etherdevice.h>
  18 #include <net/net_namespace.h>
  19 #include <net/genetlink.h>
  20 #include <net/cfg80211.h>
  21 #include <net/sock.h>
  22 #include <net/inet_connection_sock.h>
  23 #include "core.h"
  24 #include "nl80211.h"
  25 #include "reg.h"
  26 #include "rdev-ops.h"
  27
  28 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  29                                    struct genl_info *info,
  30                                    struct cfg80211_crypto_settings *settings,
  31                                    int cipher_limit);
  32
  33 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  34                             struct genl_info *info);
  35 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  36                               struct genl_info *info);
  37
  38 /* the netlink family */
  39 static struct genl_family nl80211_fam = {
  40         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  41         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  42         .hdrsize = 0,                   /* no private header */
  43         .version = 1,                   /* no particular meaning now */
  44         .maxattr = NL80211_ATTR_MAX,
  45         .netnsok = true,
  46         .pre_doit = nl80211_pre_doit,
  47         .post_doit = nl80211_post_doit,
  48 };
  49
  50 /* multicast groups */
  51 enum nl80211_multicast_groups {
  52         NL80211_MCGRP_CONFIG,
  53         NL80211_MCGRP_SCAN,
  54         NL80211_MCGRP_REGULATORY,
  55         NL80211_MCGRP_MLME,
  56         NL80211_MCGRP_VENDOR,
  57         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  58 };
  59
  60 static const struct genl_multicast_group nl80211_mcgrps[] = {
  61         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  62         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  63         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  64         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  65         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  66 #ifdef CONFIG_NL80211_TESTMODE
  67         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  68 #endif
  69 };
  70
  71 /* returns ERR_PTR values */
  72 static struct wireless_dev *
  73 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  74 {
  75         struct cfg80211_registered_device *rdev;
  76         struct wireless_dev *result = NULL;
  77         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  78         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  79         u64 wdev_id;
  80         int wiphy_idx = -1;
  81         int ifidx = -1;
  82
  83         ASSERT_RTNL();
  84
  85         if (!have_ifidx && !have_wdev_id)
  86                 return ERR_PTR(-EINVAL);
  87
  88         if (have_ifidx)
  89                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  90         if (have_wdev_id) {
  91                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  92                 wiphy_idx = wdev_id >> 32;
  93         }
  94
  95         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  96                 struct wireless_dev *wdev;
  97
  98                 if (wiphy_net(&rdev->wiphy) != netns)
  99                         continue;
 100
 101                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 102                         continue;
 103
 104                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 105                         if (have_ifidx && wdev->netdev &&
 106                             wdev->netdev->ifindex == ifidx) {
 107                                 result = wdev;
 108                                 break;
 109                         }
 110                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 111                                 result = wdev;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (result)
 117                         break;
 118         }
 119
 120         if (result)
 121                 return result;
 122         return ERR_PTR(-ENODEV);
 123 }
 124
 125 static struct cfg80211_registered_device *
 126 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 127 {
 128         struct cfg80211_registered_device *rdev = NULL, *tmp;
 129         struct net_device *netdev;
 130
 131         ASSERT_RTNL();
 132
 133         if (!attrs[NL80211_ATTR_WIPHY] &&
 134             !attrs[NL80211_ATTR_IFINDEX] &&
 135             !attrs[NL80211_ATTR_WDEV])
 136                 return ERR_PTR(-EINVAL);
 137
 138         if (attrs[NL80211_ATTR_WIPHY])
 139                 rdev = cfg80211_rdev_by_wiphy_idx(
 140                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 141
 142         if (attrs[NL80211_ATTR_WDEV]) {
 143                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 144                 struct wireless_dev *wdev;
 145                 bool found = false;
 146
 147                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 148                 if (tmp) {
 149                         /* make sure wdev exists */
 150                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 151                                 if (wdev->identifier != (u32)wdev_id)
 152                                         continue;
 153                                 found = true;
 154                                 break;
 155                         }
 156
 157                         if (!found)
 158                                 tmp = NULL;
 159
 160                         if (rdev && tmp != rdev)
 161                                 return ERR_PTR(-EINVAL);
 162                         rdev = tmp;
 163                 }
 164         }
 165
 166         if (attrs[NL80211_ATTR_IFINDEX]) {
 167                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 168                 netdev = __dev_get_by_index(netns, ifindex);
 169                 if (netdev) {
 170                         if (netdev->ieee80211_ptr)
 171                                 tmp = wiphy_to_rdev(
 172                                         netdev->ieee80211_ptr->wiphy);
 173                         else
 174                                 tmp = NULL;
 175
 176                         /* not wireless device -- return error */
 177                         if (!tmp)
 178                                 return ERR_PTR(-EINVAL);
 179
 180                         /* mismatch -- return error */
 181                         if (rdev && tmp != rdev)
 182                                 return ERR_PTR(-EINVAL);
 183
 184                         rdev = tmp;
 185                 }
 186         }
 187
 188         if (!rdev)
 189                 return ERR_PTR(-ENODEV);
 190
 191         if (netns != wiphy_net(&rdev->wiphy))
 192                 return ERR_PTR(-ENODEV);
 193
 194         return rdev;
 195 }
 196
 197 /*
 198  * This function returns a pointer to the driver
 199  * that the genl_info item that is passed refers to.
 200  *
 201  * The result of this can be a PTR_ERR and hence must
 202  * be checked with IS_ERR() for errors.
 203  */
 204 static struct cfg80211_registered_device *
 205 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 206 {
 207         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 208 }
 209
 210 /* policy for the attributes */
 211 static const struct nla_policy nl80211_policy[NL80211_ATTR_MAX+1] = {
 212         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 213         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 214                                       .len = 20-1 },
 215         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 216
 217         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 219         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 222
 223         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 224         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 226         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 228
 229         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 230         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 231         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 232
 233         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 234         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 235
 236         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 237         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 238                                     .len = WLAN_MAX_KEY_LEN },
 239         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 240         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 241         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 242         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 243         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 244
 245         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 246         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 247         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 248                                        .len = IEEE80211_MAX_DATA_LEN },
 249         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 252         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 253         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 255                                                .len = NL80211_MAX_SUPP_RATES },
 256         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 257         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 258         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 259         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 260                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 261         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 262
 263         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 264         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 265
 266         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 267         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 268         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 270                                            .len = NL80211_MAX_SUPP_RATES },
 271         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 272
 273         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 275
 276         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 277
 278         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 279         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 280                               .len = IEEE80211_MAX_DATA_LEN },
 281         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 282         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 283
 284         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 285                                 .len = IEEE80211_MAX_SSID_LEN },
 286         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 287         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_STA_FLAGS2] = {
 292                 .len = sizeof(struct nl80211_sta_flag_update),
 293         },
 294         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 295         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 296         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 298         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 300         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 301         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 302         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 303                                  .len = WLAN_PMKID_LEN },
 304         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 305         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 306         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 307         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 308                                  .len = IEEE80211_MAX_DATA_LEN },
 309         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 310         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 312         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 313         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 314         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 315         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 317         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 318         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 319         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 320         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 321         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 322         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 323         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 324         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 326         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 327         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 328         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 329                                          .len = IEEE80211_MAX_DATA_LEN },
 330         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 337         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 342                                       .len = IEEE80211_MAX_DATA_LEN },
 343         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 344         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 345         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 346                 .len = NL80211_HT_CAPABILITY_LEN
 347         },
 348         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 349         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 350         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 351         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 352         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 353         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 354         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 355         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 356         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 357         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 358         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 359         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 360         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 361         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 362         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 363         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 364         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 365                 .len = NL80211_VHT_CAPABILITY_LEN,
 366         },
 367         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 368         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 369                                   .len = IEEE80211_MAX_DATA_LEN },
 370         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 372         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 374         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_U16 },
 375         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_U16 },
 376         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 377         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 379         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 380         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 381         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 382         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 384                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 385         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 386         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 387         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 388         [NL80211_ATTR_IFACE_SOCKET_OWNER] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 390 };
 391
 392 /* policy for the key attributes */
 393 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 394         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 395         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 396         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 397         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 398         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 399         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 400         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 401         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 402 };
 403
 404 /* policy for the key default flags */
 405 static const struct nla_policy
 406 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 407         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 408         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 409 };
 410
 411 /* policy for WoWLAN attributes */
 412 static const struct nla_policy
 413 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 414         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 415         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 416         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 417         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 418         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 419         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 420         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 421         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 422         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 423 };
 424
 425 static const struct nla_policy
 426 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 427         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 428         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 429         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 430         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 431         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 432         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 433         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 434                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 435         },
 436         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 437                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 438         },
 439         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 440         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 441         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 442 };
 443
 444 /* policy for coalesce rule attributes */
 445 static const struct nla_policy
 446 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 447         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 448         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 449         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 450 };
 451
 452 /* policy for GTK rekey offload attributes */
 453 static const struct nla_policy
 454 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 455         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 456         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 457         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 462         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 463                                                  .len = IEEE80211_MAX_SSID_LEN },
 464         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 465 };
 466
 467 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 468                                      struct netlink_callback *cb,
 469                                      struct cfg80211_registered_device **rdev,
 470                                      struct wireless_dev **wdev)
 471 {
 472         int err;
 473
 474         rtnl_lock();
 475
 476         if (!cb->args[0]) {
 477                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 478                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 479                                   nl80211_policy);
 480                 if (err)
 481                         goto out_unlock;
 482
 483                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 484                                                    nl80211_fam.attrbuf);
 485                 if (IS_ERR(*wdev)) {
 486                         err = PTR_ERR(*wdev);
 487                         goto out_unlock;
 488                 }
 489                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 490                 /* 0 is the first index - add 1 to parse only once */
 491                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 492                 cb->args[1] = (*wdev)->identifier;
 493         } else {
 494                 /* subtract the 1 again here */
 495                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 496                 struct wireless_dev *tmp;
 497
 498                 if (!wiphy) {
 499                         err = -ENODEV;
 500                         goto out_unlock;
 501                 }
 502                 *rdev = wiphy_to_rdev(wiphy);
 503                 *wdev = NULL;
 504
 505                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 506                         if (tmp->identifier == cb->args[1]) {
 507                                 *wdev = tmp;
 508                                 break;
 509                         }
 510                 }
 511
 512                 if (!*wdev) {
 513                         err = -ENODEV;
 514                         goto out_unlock;
 515                 }
 516         }
 517
 518         return 0;
 519  out_unlock:
 520         rtnl_unlock();
 521         return err;
 522 }
 523
 524 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 525 {
 526         rtnl_unlock();
 527 }
 528
 529 /* IE validation */
 530 static bool is_valid_ie_attr(const struct nlattr *attr)
 531 {
 532         const u8 *pos;
 533         int len;
 534
 535         if (!attr)
 536                 return true;
 537
 538         pos = nla_data(attr);
 539         len = nla_len(attr);
 540
 541         while (len) {
 542                 u8 elemlen;
 543
 544                 if (len < 2)
 545                         return false;
 546                 len -= 2;
 547
 548                 elemlen = pos[1];
 549                 if (elemlen > len)
 550                         return false;
 551
 552                 len -= elemlen;
 553                 pos += 2 + elemlen;
 554         }
 555
 556         return true;
 557 }
 558
 559 /* message building helper */
 560 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 561                                    int flags, u8 cmd)
 562 {
 563         /* since there is no private header just add the generic one */
 564         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 565 }
 566
 567 static int nl80211_msg_put_channel(struct sk_buff *msg,
 568                                    struct ieee80211_channel *chan,
 569                                    bool large)
 570 {
 571         /* Some channels must be completely excluded from the
 572          * list to protect old user-space tools from breaking
 573          */
 574         if (!large && chan->flags &
 575             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 576                 return 0;
 577
 578         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 579                         chan->center_freq))
 580                 goto nla_put_failure;
 581
 582         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 583             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 584                 goto nla_put_failure;
 585         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 586                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 587                         goto nla_put_failure;
 588                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 589                         goto nla_put_failure;
 590         }
 591         if (chan->flags & IEEE80211_CHAN_RADAR) {
 592                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 593                         goto nla_put_failure;
 594                 if (large) {
 595                         u32 time;
 596
 597                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 598
 599                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 600                                         chan->dfs_state))
 601                                 goto nla_put_failure;
 602                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 603                                         time))
 604                                 goto nla_put_failure;
 605                         if (nla_put_u32(msg,
 606                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 607                                         chan->dfs_cac_ms))
 608                                 goto nla_put_failure;
 609                 }
 610         }
 611
 612         if (large) {
 613                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 614                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 615                         goto nla_put_failure;
 616                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 617                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 618                         goto nla_put_failure;
 619                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 620                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 621                         goto nla_put_failure;
 622                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 623                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 624                         goto nla_put_failure;
 625                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 626                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 627                         goto nla_put_failure;
 628                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 629                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 630                         goto nla_put_failure;
 631                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 632                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 633                         goto nla_put_failure;
 634                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 635                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 636                         goto nla_put_failure;
 637         }
 638
 639         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 640                         DBM_TO_MBM(chan->max_power)))
 641                 goto nla_put_failure;
 642
 643         return 0;
 644
 645  nla_put_failure:
 646         return -ENOBUFS;
 647 }
 648
 649 /* netlink command implementations */
 650
 651 struct key_parse {
 652         struct key_params p;
 653         int idx;
 654         int type;
 655         bool def, defmgmt;
 656         bool def_uni, def_multi;
 657 };
 658
 659 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 660 {
 661         struct nlattr *tb[NL80211_KEY_MAX + 1];
 662         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 663                                    nl80211_key_policy);
 664         if (err)
 665                 return err;
 666
 667         k->def = !!tb[NL80211_KEY_DEFAULT];
 668         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 669
 670         if (k->def) {
 671                 k->def_uni = true;
 672                 k->def_multi = true;
 673         }
 674         if (k->defmgmt)
 675                 k->def_multi = true;
 676
 677         if (tb[NL80211_KEY_IDX])
 678                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 679
 680         if (tb[NL80211_KEY_DATA]) {
 681                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 682                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 683         }
 684
 685         if (tb[NL80211_KEY_SEQ]) {
 686                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 687                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 688         }
 689
 690         if (tb[NL80211_KEY_CIPHER])
 691                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 692
 693         if (tb[NL80211_KEY_TYPE]) {
 694                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 695                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 696                         return -EINVAL;
 697         }
 698
 699         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 700                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 701                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 702                                        tb[NL80211_KEY_DEFAULT_TYPES],
 703                                        nl80211_key_default_policy);
 704                 if (err)
 705                         return err;
 706
 707                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 708                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 709         }
 710
 711         return 0;
 712 }
 713
 714 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 715 {
 716         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 717                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 718                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 719         }
 720
 721         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 722                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 723                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 724         }
 725
 726         if (info->attrs[NL80211_ATTR_KEY_IDX])
 727                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 728
 729         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 730                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 731
 732         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 733         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 734
 735         if (k->def) {
 736                 k->def_uni = true;
 737                 k->def_multi = true;
 738         }
 739         if (k->defmgmt)
 740                 k->def_multi = true;
 741
 742         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 743                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 744                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 745                         return -EINVAL;
 746         }
 747
 748         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 749                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 750                 int err = nla_parse_nested(
 751                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 752                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 753                                 nl80211_key_default_policy);
 754                 if (err)
 755                         return err;
 756
 757                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 758                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 759         }
 760
 761         return 0;
 762 }
 763
 764 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 765 {
 766         int err;
 767
 768         memset(k, 0, sizeof(*k));
 769         k->idx = -1;
 770         k->type = -1;
 771
 772         if (info->attrs[NL80211_ATTR_KEY])
 773                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 774         else
 775                 err = nl80211_parse_key_old(info, k);
 776
 777         if (err)
 778                 return err;
 779
 780         if (k->def && k->defmgmt)
 781                 return -EINVAL;
 782
 783         if (k->defmgmt) {
 784                 if (k->def_uni || !k->def_multi)
 785                         return -EINVAL;
 786         }
 787
 788         if (k->idx != -1) {
 789                 if (k->defmgmt) {
 790                         if (k->idx < 4 || k->idx > 5)
 791                                 return -EINVAL;
 792                 } else if (k->def) {
 793                         if (k->idx < 0 || k->idx > 3)
 794                                 return -EINVAL;
 795                 } else {
 796                         if (k->idx < 0 || k->idx > 5)
 797                                 return -EINVAL;
 798                 }
 799         }
 800
 801         return 0;
 802 }
 803
 804 static struct cfg80211_cached_keys *
 805 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 806                        struct nlattr *keys, bool *no_ht)
 807 {
 808         struct key_parse parse;
 809         struct nlattr *key;
 810         struct cfg80211_cached_keys *result;
 811         int rem, err, def = 0;
 812
 813         result = kzalloc(sizeof(*result), GFP_KERNEL);
 814         if (!result)
 815                 return ERR_PTR(-ENOMEM);
 816
 817         result->def = -1;
 818         result->defmgmt = -1;
 819
 820         nla_for_each_nested(key, keys, rem) {
 821                 memset(&parse, 0, sizeof(parse));
 822                 parse.idx = -1;
 823
 824                 err = nl80211_parse_key_new(key, &parse);
 825                 if (err)
 826                         goto error;
 827                 err = -EINVAL;
 828                 if (!parse.p.key)
 829                         goto error;
 830                 if (parse.idx < 0 || parse.idx > 4)
 831                         goto error;
 832                 if (parse.def) {
 833                         if (def)
 834                                 goto error;
 835                         def = 1;
 836                         result->def = parse.idx;
 837                         if (!parse.def_uni || !parse.def_multi)
 838                                 goto error;
 839                 } else if (parse.defmgmt)
 840                         goto error;
 841                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 842                                                      parse.idx, false, NULL);
 843                 if (err)
 844                         goto error;
 845                 result->params[parse.idx].cipher = parse.p.cipher;
 846                 result->params[parse.idx].key_len = parse.p.key_len;
 847                 result->params[parse.idx].key = result->data[parse.idx];
 848                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 849
 850                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 851                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 852                         if (no_ht)
 853                                 *no_ht = true;
 854                 }
 855         }
 856
 857         return result;
 858  error:
 859         kfree(result);
 860         return ERR_PTR(err);
 861 }
 862
 863 static int nl80211_key_allowed(struct wireless_dev *wdev)
 864 {
 865         ASSERT_WDEV_LOCK(wdev);
 866
 867         switch (wdev->iftype) {
 868         case NL80211_IFTYPE_AP:
 869         case NL80211_IFTYPE_AP_VLAN:
 870         case NL80211_IFTYPE_P2P_GO:
 871         case NL80211_IFTYPE_MESH_POINT:
 872                 break;
 873         case NL80211_IFTYPE_ADHOC:
 874         case NL80211_IFTYPE_STATION:
 875         case NL80211_IFTYPE_P2P_CLIENT:
 876                 if (!wdev->current_bss)
 877                         return -ENOLINK;
 878                 break;
 879         default:
 880                 return -EINVAL;
 881         }
 882
 883         return 0;
 884 }
 885
 886 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 887                                                         struct nlattr *tb)
 888 {
 889         struct ieee80211_channel *chan;
 890
 891         if (tb == NULL)
 892                 return NULL;
 893         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 894         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 895                 return NULL;
 896         return chan;
 897 }
 898
 899 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 900 {
 901         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 902         int i;
 903
 904         if (!nl_modes)
 905                 goto nla_put_failure;
 906
 907         i = 0;
 908         while (ifmodes) {
 909                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 910                         goto nla_put_failure;
 911                 ifmodes >>= 1;
 912                 i++;
 913         }
 914
 915         nla_nest_end(msg, nl_modes);
 916         return 0;
 917
 918 nla_put_failure:
 919         return -ENOBUFS;
 920 }
 921
 922 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 923                                           struct sk_buff *msg,
 924                                           bool large)
 925 {
 926         struct nlattr *nl_combis;
 927         int i, j;
 928
 929         nl_combis = nla_nest_start(msg,
 930                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 931         if (!nl_combis)
 932                 goto nla_put_failure;
 933
 934         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 935                 const struct ieee80211_iface_combination *c;
 936                 struct nlattr *nl_combi, *nl_limits;
 937
 938                 c = &wiphy->iface_combinations[i];
 939
 940                 nl_combi = nla_nest_start(msg, i + 1);
 941                 if (!nl_combi)
 942                         goto nla_put_failure;
 943
 944                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 945                 if (!nl_limits)
 946                         goto nla_put_failure;
 947
 948                 for (j = 0; j < c->n_limits; j++) {
 949                         struct nlattr *nl_limit;
 950
 951                         nl_limit = nla_nest_start(msg, j + 1);
 952                         if (!nl_limit)
 953                                 goto nla_put_failure;
 954                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 955                                         c->limits[j].max))
 956                                 goto nla_put_failure;
 957                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 958                                                 c->limits[j].types))
 959                                 goto nla_put_failure;
 960                         nla_nest_end(msg, nl_limit);
 961                 }
 962
 963                 nla_nest_end(msg, nl_limits);
 964
 965                 if (c->beacon_int_infra_match &&
 966                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 967                         goto nla_put_failure;
 968                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 969                                 c->num_different_channels) ||
 970                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 971                                 c->max_interfaces))
 972                         goto nla_put_failure;
 973                 if (large &&
 974                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 975                                 c->radar_detect_widths) ||
 976                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 977                                 c->radar_detect_regions)))
 978                         goto nla_put_failure;
 979
 980                 nla_nest_end(msg, nl_combi);
 981         }
 982
 983         nla_nest_end(msg, nl_combis);
 984
 985         return 0;
 986 nla_put_failure:
 987         return -ENOBUFS;
 988 }
 989
 990 #ifdef CONFIG_PM
 991 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
 992                                         struct sk_buff *msg)
 993 {
 994         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
 995         struct nlattr *nl_tcp;
 996
 997         if (!tcp)
 998                 return 0;
 999
1000         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1001         if (!nl_tcp)
1002                 return -ENOBUFS;
1003
1004         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1005                         tcp->data_payload_max))
1006                 return -ENOBUFS;
1007
1008         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1009                         tcp->data_payload_max))
1010                 return -ENOBUFS;
1011
1012         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1013                 return -ENOBUFS;
1014
1015         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1016                                 sizeof(*tcp->tok), tcp->tok))
1017                 return -ENOBUFS;
1018
1019         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1020                         tcp->data_interval_max))
1021                 return -ENOBUFS;
1022
1023         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1024                         tcp->wake_payload_max))
1025                 return -ENOBUFS;
1026
1027         nla_nest_end(msg, nl_tcp);
1028         return 0;
1029 }
1030
1031 static int nl80211_send_wowlan(struct sk_buff *msg,
1032                                struct cfg80211_registered_device *rdev,
1033                                bool large)
1034 {
1035         struct nlattr *nl_wowlan;
1036
1037         if (!rdev->wiphy.wowlan)
1038                 return 0;
1039
1040         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1041         if (!nl_wowlan)
1042                 return -ENOBUFS;
1043
1044         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1045              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1046             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1047              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1048             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1049              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1050             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1051              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1052             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1053              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1054             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1055              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1056             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1057              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1058             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1059              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1060                 return -ENOBUFS;
1061
1062         if (rdev->wiphy.wowlan->n_patterns) {
1063                 struct nl80211_pattern_support pat = {
1064                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1065                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1066                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1067                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1068                 };
1069
1070                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1071                             sizeof(pat), &pat))
1072                         return -ENOBUFS;
1073         }
1074
1075         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1076                 return -ENOBUFS;
1077
1078         nla_nest_end(msg, nl_wowlan);
1079
1080         return 0;
1081 }
1082 #endif
1083
1084 static int nl80211_send_coalesce(struct sk_buff *msg,
1085                                  struct cfg80211_registered_device *rdev)
1086 {
1087         struct nl80211_coalesce_rule_support rule;
1088
1089         if (!rdev->wiphy.coalesce)
1090                 return 0;
1091
1092         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1093         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1094         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1095         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1096         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1097         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1098
1099         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1100                 return -ENOBUFS;
1101
1102         return 0;
1103 }
1104
1105 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1106                                       struct ieee80211_supported_band *sband)
1107 {
1108         struct nlattr *nl_rates, *nl_rate;
1109         struct ieee80211_rate *rate;
1110         int i;
1111
1112         /* add HT info */
1113         if (sband->ht_cap.ht_supported &&
1114             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1115                      sizeof(sband->ht_cap.mcs),
1116                      &sband->ht_cap.mcs) ||
1117              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1118                          sband->ht_cap.cap) ||
1119              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1120                         sband->ht_cap.ampdu_factor) ||
1121              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1122                         sband->ht_cap.ampdu_density)))
1123                 return -ENOBUFS;
1124
1125         /* add VHT info */
1126         if (sband->vht_cap.vht_supported &&
1127             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1128                      sizeof(sband->vht_cap.vht_mcs),
1129                      &sband->vht_cap.vht_mcs) ||
1130              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1131                          sband->vht_cap.cap)))
1132                 return -ENOBUFS;
1133
1134         /* add bitrates */
1135         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1136         if (!nl_rates)
1137                 return -ENOBUFS;
1138
1139         for (i = 0; i < sband->n_bitrates; i++) {
1140                 nl_rate = nla_nest_start(msg, i);
1141                 if (!nl_rate)
1142                         return -ENOBUFS;
1143
1144                 rate = &sband->bitrates[i];
1145                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1146                                 rate->bitrate))
1147                         return -ENOBUFS;
1148                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1149                     nla_put_flag(msg,
1150                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1151                         return -ENOBUFS;
1152
1153                 nla_nest_end(msg, nl_rate);
1154         }
1155
1156         nla_nest_end(msg, nl_rates);
1157
1158         return 0;
1159 }
1160
1161 static int
1162 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1163                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1164 {
1165         u16 stypes;
1166         struct nlattr *nl_ftypes, *nl_ifs;
1167         enum nl80211_iftype ift;
1168         int i;
1169
1170         if (!mgmt_stypes)
1171                 return 0;
1172
1173         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1174         if (!nl_ifs)
1175                 return -ENOBUFS;
1176
1177         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1178                 nl_ftypes = nla_nest_start(msg, ift);
1179                 if (!nl_ftypes)
1180                         return -ENOBUFS;
1181                 i = 0;
1182                 stypes = mgmt_stypes[ift].tx;
1183                 while (stypes) {
1184                         if ((stypes & 1) &&
1185                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1186                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1187                                 return -ENOBUFS;
1188                         stypes >>= 1;
1189                         i++;
1190                 }
1191                 nla_nest_end(msg, nl_ftypes);
1192         }
1193
1194         nla_nest_end(msg, nl_ifs);
1195
1196         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1197         if (!nl_ifs)
1198                 return -ENOBUFS;
1199
1200         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1201                 nl_ftypes = nla_nest_start(msg, ift);
1202                 if (!nl_ftypes)
1203                         return -ENOBUFS;
1204                 i = 0;
1205                 stypes = mgmt_stypes[ift].rx;
1206                 while (stypes) {
1207                         if ((stypes & 1) &&
1208                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1209                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1210                                 return -ENOBUFS;
1211                         stypes >>= 1;
1212                         i++;
1213                 }
1214                 nla_nest_end(msg, nl_ftypes);
1215         }
1216         nla_nest_end(msg, nl_ifs);
1217
1218         return 0;
1219 }
1220
1221 struct nl80211_dump_wiphy_state {
1222         s64 filter_wiphy;
1223         long start;
1224         long split_start, band_start, chan_start;
1225         bool split;
1226 };
1227
1228 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1229                               struct sk_buff *msg, u32 portid, u32 seq,
1230                               int flags, struct nl80211_dump_wiphy_state *state)
1231 {
1232         void *hdr;
1233         struct nlattr *nl_bands, *nl_band;
1234         struct nlattr *nl_freqs, *nl_freq;
1235         struct nlattr *nl_cmds;
1236         enum ieee80211_band band;
1237         struct ieee80211_channel *chan;
1238         int i;
1239         const struct ieee80211_txrx_stypes *mgmt_stypes =
1240                                 rdev->wiphy.mgmt_stypes;
1241         u32 features;
1242
1243         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_WIPHY);
1244         if (!hdr)
1245                 return -ENOBUFS;
1246
1247         if (WARN_ON(!state))
1248                 return -EINVAL;
1249
1250         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1251             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1252                            wiphy_name(&rdev->wiphy)) ||
1253             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1254                         cfg80211_rdev_list_generation))
1255                 goto nla_put_failure;
1256
1257         switch (state->split_start) {
1258         case 0:
1259                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1260                                rdev->wiphy.retry_short) ||
1261                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1262                                rdev->wiphy.retry_long) ||
1263                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1264                                 rdev->wiphy.frag_threshold) ||
1265                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1266                                 rdev->wiphy.rts_threshold) ||
1267                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1268                                rdev->wiphy.coverage_class) ||
1269                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1270                                rdev->wiphy.max_scan_ssids) ||
1271                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1272                                rdev->wiphy.max_sched_scan_ssids) ||
1273                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1274                                 rdev->wiphy.max_scan_ie_len) ||
1275                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1276                                 rdev->wiphy.max_sched_scan_ie_len) ||
1277                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1278                                rdev->wiphy.max_match_sets))
1279                         goto nla_put_failure;
1280
1281                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1282                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1283                         goto nla_put_failure;
1284                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1285                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1286                         goto nla_put_failure;
1287                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1288                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1289                         goto nla_put_failure;
1290                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1291                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1292                         goto nla_put_failure;
1293                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1294                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1295                         goto nla_put_failure;
1296                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1297                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1298                         goto nla_put_failure;
1299                 state->split_start++;
1300                 if (state->split)
1301                         break;
1302         case 1:
1303                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1304                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1305                             rdev->wiphy.cipher_suites))
1306                         goto nla_put_failure;
1307
1308                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1309                                rdev->wiphy.max_num_pmkids))
1310                         goto nla_put_failure;
1311
1312                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1313                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1314                         goto nla_put_failure;
1315
1316                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1317                                 rdev->wiphy.available_antennas_tx) ||
1318                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1319                                 rdev->wiphy.available_antennas_rx))
1320                         goto nla_put_failure;
1321
1322                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1323                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1324                                 rdev->wiphy.probe_resp_offload))
1325                         goto nla_put_failure;
1326
1327                 if ((rdev->wiphy.available_antennas_tx ||
1328                      rdev->wiphy.available_antennas_rx) &&
1329                     rdev->ops->get_antenna) {
1330                         u32 tx_ant = 0, rx_ant = 0;
1331                         int res;
1332                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1333                         if (!res) {
1334                                 if (nla_put_u32(msg,
1335                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1336                                                 tx_ant) ||
1337                                     nla_put_u32(msg,
1338                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1339                                                 rx_ant))
1340                                         goto nla_put_failure;
1341                         }
1342                 }
1343
1344                 state->split_start++;
1345                 if (state->split)
1346                         break;
1347         case 2:
1348                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1349                                         rdev->wiphy.interface_modes))
1350                                 goto nla_put_failure;
1351                 state->split_start++;
1352                 if (state->split)
1353                         break;
1354         case 3:
1355                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1356                 if (!nl_bands)
1357                         goto nla_put_failure;
1358
1359                 for (band = state->band_start;
1360                      band < IEEE80211_NUM_BANDS; band++) {
1361                         struct ieee80211_supported_band *sband;
1362
1363                         sband = rdev->wiphy.bands[band];
1364
1365                         if (!sband)
1366                                 continue;
1367
1368                         nl_band = nla_nest_start(msg, band);
1369                         if (!nl_band)
1370                                 goto nla_put_failure;
1371
1372                         switch (state->chan_start) {
1373                         case 0:
1374                                 if (nl80211_send_band_rateinfo(msg, sband))
1375                                         goto nla_put_failure;
1376                                 state->chan_start++;
1377                                 if (state->split)
1378                                         break;
1379                         default:
1380                                 /* add frequencies */
1381                                 nl_freqs = nla_nest_start(
1382                                         msg, NL80211_BAND_ATTR_FREQS);
1383                                 if (!nl_freqs)
1384                                         goto nla_put_failure;
1385
1386                                 for (i = state->chan_start - 1;
1387                                      i < sband->n_channels;
1388                                      i++) {
1389                                         nl_freq = nla_nest_start(msg, i);
1390                                         if (!nl_freq)
1391                                                 goto nla_put_failure;
1392
1393                                         chan = &sband->channels[i];
1394
1395                                         if (nl80211_msg_put_channel(
1396                                                         msg, chan,
1397                                                         state->split))
1398                                                 goto nla_put_failure;
1399
1400                                         nla_nest_end(msg, nl_freq);
1401                                         if (state->split)
1402                                                 break;
1403                                 }
1404                                 if (i < sband->n_channels)
1405                                         state->chan_start = i + 2;
1406                                 else
1407                                         state->chan_start = 0;
1408                                 nla_nest_end(msg, nl_freqs);
1409                         }
1410
1411                         nla_nest_end(msg, nl_band);
1412
1413                         if (state->split) {
1414                                 /* start again here */
1415                                 if (state->chan_start)
1416                                         band--;
1417                                 break;
1418                         }
1419                 }
1420                 nla_nest_end(msg, nl_bands);
1421
1422                 if (band < IEEE80211_NUM_BANDS)
1423                         state->band_start = band + 1;
1424                 else
1425                         state->band_start = 0;
1426
1427                 /* if bands & channels are done, continue outside */
1428                 if (state->band_start == 0 && state->chan_start == 0)
1429                         state->split_start++;
1430                 if (state->split)
1431                         break;
1432         case 4:
1433                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1434                 if (!nl_cmds)
1435                         goto nla_put_failure;
1436
1437                 i = 0;
1438 #define CMD(op, n)                                                      \
1439                  do {                                                   \
1440                         if (rdev->ops->op) {                            \
1441                                 i++;                                    \
1442                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1443                                         goto nla_put_failure;           \
1444                         }                                               \
1445                 } while (0)
1446
1447                 CMD(add_virtual_intf, NEW_INTERFACE);
1448                 CMD(change_virtual_intf, SET_INTERFACE);
1449                 CMD(add_key, NEW_KEY);
1450                 CMD(start_ap, START_AP);
1451                 CMD(add_station, NEW_STATION);
1452                 CMD(add_mpath, NEW_MPATH);
1453                 CMD(update_mesh_config, SET_MESH_CONFIG);
1454                 CMD(change_bss, SET_BSS);
1455                 CMD(auth, AUTHENTICATE);
1456                 CMD(assoc, ASSOCIATE);
1457                 CMD(deauth, DEAUTHENTICATE);
1458                 CMD(disassoc, DISASSOCIATE);
1459                 CMD(join_ibss, JOIN_IBSS);
1460                 CMD(join_mesh, JOIN_MESH);
1461                 CMD(set_pmksa, SET_PMKSA);
1462                 CMD(del_pmksa, DEL_PMKSA);
1463                 CMD(flush_pmksa, FLUSH_PMKSA);
1464                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1465                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1466                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1467                 CMD(mgmt_tx, FRAME);
1468                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1469                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1470                         i++;
1471                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1472                                 goto nla_put_failure;
1473                 }
1474                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1475                     rdev->ops->join_mesh) {
1476                         i++;
1477                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1478                                 goto nla_put_failure;
1479                 }
1480                 CMD(set_wds_peer, SET_WDS_PEER);
1481                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1482                         CMD(tdls_mgmt, TDLS_MGMT);
1483                         CMD(tdls_oper, TDLS_OPER);
1484                 }
1485                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1486                         CMD(sched_scan_start, START_SCHED_SCAN);
1487                 CMD(probe_client, PROBE_CLIENT);
1488                 CMD(set_noack_map, SET_NOACK_MAP);
1489                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1490                         i++;
1491                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1492                                 goto nla_put_failure;
1493                 }
1494                 CMD(start_p2p_device, START_P2P_DEVICE);
1495                 CMD(set_mcast_rate, SET_MCAST_RATE);
1496                 if (state->split) {
1497                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1498                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1499                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1500                                 CMD(channel_switch, CHANNEL_SWITCH);
1501                 }
1502                 CMD(set_qos_map, SET_QOS_MAP);
1503
1504 #ifdef CONFIG_NL80211_TESTMODE
1505                 CMD(testmode_cmd, TESTMODE);
1506 #endif
1507
1508 #undef CMD
1509
1510                 if (rdev->ops->connect || rdev->ops->auth) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1513                                 goto nla_put_failure;
1514                 }
1515
1516                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1517                         i++;
1518                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1519                                 goto nla_put_failure;
1520                 }
1521
1522                 nla_nest_end(msg, nl_cmds);
1523                 state->split_start++;
1524                 if (state->split)
1525                         break;
1526         case 5:
1527                 if (rdev->ops->remain_on_channel &&
1528                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1529                     nla_put_u32(msg,
1530                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1531                                 rdev->wiphy.max_remain_on_channel_duration))
1532                         goto nla_put_failure;
1533
1534                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1535                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1536                         goto nla_put_failure;
1537
1538                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1539                         goto nla_put_failure;
1540                 state->split_start++;
1541                 if (state->split)
1542                         break;
1543         case 6:
1544 #ifdef CONFIG_PM
1545                 if (nl80211_send_wowlan(msg, rdev, state->split))
1546                         goto nla_put_failure;
1547                 state->split_start++;
1548                 if (state->split)
1549                         break;
1550 #else
1551                 state->split_start++;
1552 #endif
1553         case 7:
1554                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1555                                         rdev->wiphy.software_iftypes))
1556                         goto nla_put_failure;
1557
1558                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1559                                                    state->split))
1560                         goto nla_put_failure;
1561
1562                 state->split_start++;
1563                 if (state->split)
1564                         break;
1565         case 8:
1566                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1567                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1568                                 rdev->wiphy.ap_sme_capa))
1569                         goto nla_put_failure;
1570
1571                 features = rdev->wiphy.features;
1572                 /*
1573                  * We can only add the per-channel limit information if the
1574                  * dump is split, otherwise it makes it too big. Therefore
1575                  * only advertise it in that case.
1576                  */
1577                 if (state->split)
1578                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1579                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1580                         goto nla_put_failure;
1581
1582                 if (rdev->wiphy.ht_capa_mod_mask &&
1583                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1584                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1585                             rdev->wiphy.ht_capa_mod_mask))
1586                         goto nla_put_failure;
1587
1588                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1589                     rdev->wiphy.max_acl_mac_addrs &&
1590                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1591                                 rdev->wiphy.max_acl_mac_addrs))
1592                         goto nla_put_failure;
1593
1594                 /*
1595                  * Any information below this point is only available to
1596                  * applications that can deal with it being split. This
1597                  * helps ensure that newly added capabilities don't break
1598                  * older tools by overrunning their buffers.
1599                  *
1600                  * We still increment split_start so that in the split
1601                  * case we'll continue with more data in the next round,
1602                  * but break unconditionally so unsplit data stops here.
1603                  */
1604                 state->split_start++;
1605                 break;
1606         case 9:
1607                 if (rdev->wiphy.extended_capabilities &&
1608                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1609                              rdev->wiphy.extended_capabilities_len,
1610                              rdev->wiphy.extended_capabilities) ||
1611                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1612                              rdev->wiphy.extended_capabilities_len,
1613                              rdev->wiphy.extended_capabilities_mask)))
1614                         goto nla_put_failure;
1615
1616                 if (rdev->wiphy.vht_capa_mod_mask &&
1617                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1618                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1619                             rdev->wiphy.vht_capa_mod_mask))
1620                         goto nla_put_failure;
1621
1622                 state->split_start++;
1623                 break;
1624         case 10:
1625                 if (nl80211_send_coalesce(msg, rdev))
1626                         goto nla_put_failure;
1627
1628                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1629                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1630                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1631                         goto nla_put_failure;
1632
1633                 if (rdev->wiphy.max_ap_assoc_sta &&
1634                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1635                                 rdev->wiphy.max_ap_assoc_sta))
1636                         goto nla_put_failure;
1637
1638                 state->split_start++;
1639                 break;
1640         case 11:
1641                 if (rdev->wiphy.n_vendor_commands) {
1642                         const struct nl80211_vendor_cmd_info *info;
1643                         struct nlattr *nested;
1644
1645                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1646                         if (!nested)
1647                                 goto nla_put_failure;
1648
1649                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1650                                 info = &rdev->wiphy.vendor_commands[i].info;
1651                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1652                                         goto nla_put_failure;
1653                         }
1654                         nla_nest_end(msg, nested);
1655                 }
1656
1657                 if (rdev->wiphy.n_vendor_events) {
1658                         const struct nl80211_vendor_cmd_info *info;
1659                         struct nlattr *nested;
1660
1661                         nested = nla_nest_start(msg,
1662                                                 NL80211_ATTR_VENDOR_EVENTS);
1663                         if (!nested)
1664                                 goto nla_put_failure;
1665
1666                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1667                                 info = &rdev->wiphy.vendor_events[i];
1668                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1669                                         goto nla_put_failure;
1670                         }
1671                         nla_nest_end(msg, nested);
1672                 }
1673
1674                 /* done */
1675                 state->split_start = 0;
1676                 break;
1677         }
1678         return genlmsg_end(msg, hdr);
1679
1680  nla_put_failure:
1681         genlmsg_cancel(msg, hdr);
1682         return -EMSGSIZE;
1683 }
1684
1685 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1686                                     struct netlink_callback *cb,
1687                                     struct nl80211_dump_wiphy_state *state)
1688 {
1689         struct nlattr **tb = nl80211_fam.attrbuf;
1690         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1691                               tb, nl80211_fam.maxattr, nl80211_policy);
1692         /* ignore parse errors for backward compatibility */
1693         if (ret)
1694                 return 0;
1695
1696         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1697         if (tb[NL80211_ATTR_WIPHY])
1698                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1699         if (tb[NL80211_ATTR_WDEV])
1700                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1701         if (tb[NL80211_ATTR_IFINDEX]) {
1702                 struct net_device *netdev;
1703                 struct cfg80211_registered_device *rdev;
1704                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1705
1706                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1707                 if (!netdev)
1708                         return -ENODEV;
1709                 if (netdev->ieee80211_ptr) {
1710                         rdev = wiphy_to_rdev(
1711                                 netdev->ieee80211_ptr->wiphy);
1712                         state->filter_wiphy = rdev->wiphy_idx;
1713                 }
1714         }
1715
1716         return 0;
1717 }
1718
1719 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1720 {
1721         int idx = 0, ret;
1722         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1723         struct cfg80211_registered_device *rdev;
1724
1725         rtnl_lock();
1726         if (!state) {
1727                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1728                 if (!state) {
1729                         rtnl_unlock();
1730                         return -ENOMEM;
1731                 }
1732                 state->filter_wiphy = -1;
1733                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1734                 if (ret) {
1735                         kfree(state);
1736                         rtnl_unlock();
1737                         return ret;
1738                 }
1739                 cb->args[0] = (long)state;
1740         }
1741
1742         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1743                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1744                         continue;
1745                 if (++idx <= state->start)
1746                         continue;
1747                 if (state->filter_wiphy != -1 &&
1748                     state->filter_wiphy != rdev->wiphy_idx)
1749                         continue;
1750                 /* attempt to fit multiple wiphy data chunks into the skb */
1751                 do {
1752                         ret = nl80211_send_wiphy(rdev, skb,
1753                                                  NETLINK_CB(cb->skb).portid,
1754                                                  cb->nlh->nlmsg_seq,
1755                                                  NLM_F_MULTI, state);
1756                         if (ret < 0) {
1757                                 /*
1758                                  * If sending the wiphy data didn't fit (ENOBUFS
1759                                  * or EMSGSIZE returned), this SKB is still
1760                                  * empty (so it's not too big because another
1761                                  * wiphy dataset is already in the skb) and
1762                                  * we've not tried to adjust the dump allocation
1763                                  * yet ... then adjust the alloc size to be
1764                                  * bigger, and return 1 but with the empty skb.
1765                                  * This results in an empty message being RX'ed
1766                                  * in userspace, but that is ignored.
1767                                  *
1768                                  * We can then retry with the larger buffer.
1769                                  */
1770                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1771                                     !skb->len && !state->split &&
1772                                     cb->min_dump_alloc < 4096) {
1773                                         cb->min_dump_alloc = 4096;
1774                                         state->split_start = 0;
1775                                         rtnl_unlock();
1776                                         return 1;
1777                                 }
1778                                 idx--;
1779                                 break;
1780                         }
1781                 } while (state->split_start > 0);
1782                 break;
1783         }
1784         rtnl_unlock();
1785
1786         state->start = idx;
1787
1788         return skb->len;
1789 }
1790
1791 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1792 {
1793         kfree((void *)cb->args[0]);
1794         return 0;
1795 }
1796
1797 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1798 {
1799         struct sk_buff *msg;
1800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1801         struct nl80211_dump_wiphy_state state = {};
1802
1803         msg = nlmsg_new(4096, GFP_KERNEL);
1804         if (!msg)
1805                 return -ENOMEM;
1806
1807         if (nl80211_send_wiphy(rdev, msg, info->snd_portid, info->snd_seq, 0,
1808                                &state) < 0) {
1809                 nlmsg_free(msg);
1810                 return -ENOBUFS;
1811         }
1812
1813         return genlmsg_reply(msg, info);
1814 }
1815
1816 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1817         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1818         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1819         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1820         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1821         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1822 };
1823
1824 static int parse_txq_params(struct nlattr *tb[],
1825                             struct ieee80211_txq_params *txq_params)
1826 {
1827         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1828             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1829             !tb[NL80211_TXQ_ATTR_AIFS])
1830                 return -EINVAL;
1831
1832         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1833         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1834         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1835         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1836         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1837
1838         if (txq_params->ac >= NL80211_NUM_ACS)
1839                 return -EINVAL;
1840
1841         return 0;
1842 }
1843
1844 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1845 {
1846         /*
1847          * You can only set the channel explicitly for WDS interfaces,
1848          * all others have their channel managed via their respective
1849          * "establish a connection" command (connect, join, ...)
1850          *
1851          * For AP/GO and mesh mode, the channel can be set with the
1852          * channel userspace API, but is only stored and passed to the
1853          * low-level driver when the AP starts or the mesh is joined.
1854          * This is for backward compatibility, userspace can also give
1855          * the channel in the start-ap or join-mesh commands instead.
1856          *
1857          * Monitors are special as they are normally slaved to
1858          * whatever else is going on, so they have their own special
1859          * operation to set the monitor channel if possible.
1860          */
1861         return !wdev ||
1862                 wdev->iftype == NL80211_IFTYPE_AP ||
1863                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1864                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1865                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1866 }
1867
1868 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1869                                  struct genl_info *info,
1870                                  struct cfg80211_chan_def *chandef)
1871 {
1872         u32 control_freq;
1873
1874         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1875                 return -EINVAL;
1876
1877         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1878
1879         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1880         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1881         chandef->center_freq1 = control_freq;
1882         chandef->center_freq2 = 0;
1883
1884         /* Primary channel not allowed */
1885         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1886                 return -EINVAL;
1887
1888         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1889                 enum nl80211_channel_type chantype;
1890
1891                 chantype = nla_get_u32(
1892                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1893
1894                 switch (chantype) {
1895                 case NL80211_CHAN_NO_HT:
1896                 case NL80211_CHAN_HT20:
1897                 case NL80211_CHAN_HT40PLUS:
1898                 case NL80211_CHAN_HT40MINUS:
1899                         cfg80211_chandef_create(chandef, chandef->chan,
1900                                                 chantype);
1901                         break;
1902                 default:
1903                         return -EINVAL;
1904                 }
1905         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1906                 chandef->width =
1907                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1908                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1909                         chandef->center_freq1 =
1910                                 nla_get_u32(
1911                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1912                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1913                         chandef->center_freq2 =
1914                                 nla_get_u32(
1915                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1916         }
1917
1918         if (!cfg80211_chandef_valid(chandef))
1919                 return -EINVAL;
1920
1921         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1922                                      IEEE80211_CHAN_DISABLED))
1923                 return -EINVAL;
1924
1925         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1926              chandef->width == NL80211_CHAN_WIDTH_10) &&
1927             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1928                 return -EINVAL;
1929
1930         return 0;
1931 }
1932
1933 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1934                                  struct net_device *dev,
1935                                  struct genl_info *info)
1936 {
1937         struct cfg80211_chan_def chandef;
1938         int result;
1939         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1940         struct wireless_dev *wdev = NULL;
1941
1942         if (dev)
1943                 wdev = dev->ieee80211_ptr;
1944         if (!nl80211_can_set_dev_channel(wdev))
1945                 return -EOPNOTSUPP;
1946         if (wdev)
1947                 iftype = wdev->iftype;
1948
1949         result = nl80211_parse_chandef(rdev, info, &chandef);
1950         if (result)
1951                 return result;
1952
1953         switch (iftype) {
1954         case NL80211_IFTYPE_AP:
1955         case NL80211_IFTYPE_P2P_GO:
1956                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1957                         result = -EINVAL;
1958                         break;
1959                 }
1960                 if (wdev->beacon_interval) {
1961                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1962                             !(rdev->wiphy.features &
1963                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1964                                 result = -EBUSY;
1965                                 break;
1966                         }
1967
1968                         /* Only allow dynamic channel width changes */
1969                         if (chandef.chan != wdev->preset_chandef.chan) {
1970                                 result = -EBUSY;
1971                                 break;
1972                         }
1973                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
1974                         if (result)
1975                                 break;
1976                 }
1977                 wdev->preset_chandef = chandef;
1978                 result = 0;
1979                 break;
1980         case NL80211_IFTYPE_MESH_POINT:
1981                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
1982                 break;
1983         case NL80211_IFTYPE_MONITOR:
1984                 result = cfg80211_set_monitor_channel(rdev, &chandef);
1985                 break;
1986         default:
1987                 result = -EINVAL;
1988         }
1989
1990         return result;
1991 }
1992
1993 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
1994 {
1995         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1996         struct net_device *netdev = info->user_ptr[1];
1997
1998         return __nl80211_set_channel(rdev, netdev, info);
1999 }
2000
2001 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2002 {
2003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2004         struct net_device *dev = info->user_ptr[1];
2005         struct wireless_dev *wdev = dev->ieee80211_ptr;
2006         const u8 *bssid;
2007
2008         if (!info->attrs[NL80211_ATTR_MAC])
2009                 return -EINVAL;
2010
2011         if (netif_running(dev))
2012                 return -EBUSY;
2013
2014         if (!rdev->ops->set_wds_peer)
2015                 return -EOPNOTSUPP;
2016
2017         if (wdev->iftype != NL80211_IFTYPE_WDS)
2018                 return -EOPNOTSUPP;
2019
2020         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2021         return rdev_set_wds_peer(rdev, dev, bssid);
2022 }
2023
2024
2025 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2026 {
2027         struct cfg80211_registered_device *rdev;
2028         struct net_device *netdev = NULL;
2029         struct wireless_dev *wdev;
2030         int result = 0, rem_txq_params = 0;
2031         struct nlattr *nl_txq_params;
2032         u32 changed;
2033         u8 retry_short = 0, retry_long = 0;
2034         u32 frag_threshold = 0, rts_threshold = 0;
2035         u8 coverage_class = 0;
2036
2037         ASSERT_RTNL();
2038
2039         /*
2040          * Try to find the wiphy and netdev. Normally this
2041          * function shouldn't need the netdev, but this is
2042          * done for backward compatibility -- previously
2043          * setting the channel was done per wiphy, but now
2044          * it is per netdev. Previous userland like hostapd
2045          * also passed a netdev to set_wiphy, so that it is
2046          * possible to let that go to the right netdev!
2047          */
2048
2049         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2050                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2051
2052                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2053                 if (netdev && netdev->ieee80211_ptr)
2054                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2055                 else
2056                         netdev = NULL;
2057         }
2058
2059         if (!netdev) {
2060                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2061                                                   info->attrs);
2062                 if (IS_ERR(rdev))
2063                         return PTR_ERR(rdev);
2064                 wdev = NULL;
2065                 netdev = NULL;
2066                 result = 0;
2067         } else
2068                 wdev = netdev->ieee80211_ptr;
2069
2070         /*
2071          * end workaround code, by now the rdev is available
2072          * and locked, and wdev may or may not be NULL.
2073          */
2074
2075         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2076                 result = cfg80211_dev_rename(
2077                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2078
2079         if (result)
2080                 return result;
2081
2082         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2083                 struct ieee80211_txq_params txq_params;
2084                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2085
2086                 if (!rdev->ops->set_txq_params)
2087                         return -EOPNOTSUPP;
2088
2089                 if (!netdev)
2090                         return -EINVAL;
2091
2092                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2093                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2094                         return -EINVAL;
2095
2096                 if (!netif_running(netdev))
2097                         return -ENETDOWN;
2098
2099                 nla_for_each_nested(nl_txq_params,
2100                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2101                                     rem_txq_params) {
2102                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2103                                            nla_data(nl_txq_params),
2104                                            nla_len(nl_txq_params),
2105                                            txq_params_policy);
2106                         if (result)
2107                                 return result;
2108                         result = parse_txq_params(tb, &txq_params);
2109                         if (result)
2110                                 return result;
2111
2112                         result = rdev_set_txq_params(rdev, netdev,
2113                                                      &txq_params);
2114                         if (result)
2115                                 return result;
2116                 }
2117         }
2118
2119         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2120                 result = __nl80211_set_channel(
2121                         rdev,
2122                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2123                         info);
2124                 if (result)
2125                         return result;
2126         }
2127
2128         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2129                 struct wireless_dev *txp_wdev = wdev;
2130                 enum nl80211_tx_power_setting type;
2131                 int idx, mbm = 0;
2132
2133                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2134                         txp_wdev = NULL;
2135
2136                 if (!rdev->ops->set_tx_power)
2137                         return -EOPNOTSUPP;
2138
2139                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2140                 type = nla_get_u32(info->attrs[idx]);
2141
2142                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2143                     (type != NL80211_TX_POWER_AUTOMATIC))
2144                         return -EINVAL;
2145
2146                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2147                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2148                         mbm = nla_get_u32(info->attrs[idx]);
2149                 }
2150
2151                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2152                 if (result)
2153                         return result;
2154         }
2155
2156         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2157             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2158                 u32 tx_ant, rx_ant;
2159                 if ((!rdev->wiphy.available_antennas_tx &&
2160                      !rdev->wiphy.available_antennas_rx) ||
2161                     !rdev->ops->set_antenna)
2162                         return -EOPNOTSUPP;
2163
2164                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2165                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2166
2167                 /* reject antenna configurations which don't match the
2168                  * available antenna masks, except for the "all" mask */
2169                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2170                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2171                         return -EINVAL;
2172
2173                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2174                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2175
2176                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2177                 if (result)
2178                         return result;
2179         }
2180
2181         changed = 0;
2182
2183         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2184                 retry_short = nla_get_u8(
2185                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2186                 if (retry_short == 0)
2187                         return -EINVAL;
2188
2189                 changed |= WIPHY_PARAM_RETRY_SHORT;
2190         }
2191
2192         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2193                 retry_long = nla_get_u8(
2194                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2195                 if (retry_long == 0)
2196                         return -EINVAL;
2197
2198                 changed |= WIPHY_PARAM_RETRY_LONG;
2199         }
2200
2201         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2202                 frag_threshold = nla_get_u32(
2203                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2204                 if (frag_threshold < 256)
2205                         return -EINVAL;
2206
2207                 if (frag_threshold != (u32) -1) {
2208                         /*
2209                          * Fragments (apart from the last one) are required to
2210                          * have even length. Make the fragmentation code
2211                          * simpler by stripping LSB should someone try to use
2212                          * odd threshold value.
2213                          */
2214                         frag_threshold &= ~0x1;
2215                 }
2216                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2217         }
2218
2219         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2220                 rts_threshold = nla_get_u32(
2221                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2222                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2223         }
2224
2225         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2226                 coverage_class = nla_get_u8(
2227                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2228                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2229         }
2230
2231         if (changed) {
2232                 u8 old_retry_short, old_retry_long;
2233                 u32 old_frag_threshold, old_rts_threshold;
2234                 u8 old_coverage_class;
2235
2236                 if (!rdev->ops->set_wiphy_params)
2237                         return -EOPNOTSUPP;
2238
2239                 old_retry_short = rdev->wiphy.retry_short;
2240                 old_retry_long = rdev->wiphy.retry_long;
2241                 old_frag_threshold = rdev->wiphy.frag_threshold;
2242                 old_rts_threshold = rdev->wiphy.rts_threshold;
2243                 old_coverage_class = rdev->wiphy.coverage_class;
2244
2245                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2246                         rdev->wiphy.retry_short = retry_short;
2247                 if (changed & WIPHY_PARAM_RETRY_LONG)
2248                         rdev->wiphy.retry_long = retry_long;
2249                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2250                         rdev->wiphy.frag_threshold = frag_threshold;
2251                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2252                         rdev->wiphy.rts_threshold = rts_threshold;
2253                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2254                         rdev->wiphy.coverage_class = coverage_class;
2255
2256                 result = rdev_set_wiphy_params(rdev, changed);
2257                 if (result) {
2258                         rdev->wiphy.retry_short = old_retry_short;
2259                         rdev->wiphy.retry_long = old_retry_long;
2260                         rdev->wiphy.frag_threshold = old_frag_threshold;
2261                         rdev->wiphy.rts_threshold = old_rts_threshold;
2262                         rdev->wiphy.coverage_class = old_coverage_class;
2263                 }
2264         }
2265         return 0;
2266 }
2267
2268 static inline u64 wdev_id(struct wireless_dev *wdev)
2269 {
2270         return (u64)wdev->identifier |
2271                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2272 }
2273
2274 static int nl80211_send_chandef(struct sk_buff *msg,
2275                                 const struct cfg80211_chan_def *chandef)
2276 {
2277         WARN_ON(!cfg80211_chandef_valid(chandef));
2278
2279         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2280                         chandef->chan->center_freq))
2281                 return -ENOBUFS;
2282         switch (chandef->width) {
2283         case NL80211_CHAN_WIDTH_20_NOHT:
2284         case NL80211_CHAN_WIDTH_20:
2285         case NL80211_CHAN_WIDTH_40:
2286                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2287                                 cfg80211_get_chandef_type(chandef)))
2288                         return -ENOBUFS;
2289                 break;
2290         default:
2291                 break;
2292         }
2293         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2294                 return -ENOBUFS;
2295         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2296                 return -ENOBUFS;
2297         if (chandef->center_freq2 &&
2298             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2299                 return -ENOBUFS;
2300         return 0;
2301 }
2302
2303 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2304                               struct cfg80211_registered_device *rdev,
2305                               struct wireless_dev *wdev)
2306 {
2307         struct net_device *dev = wdev->netdev;
2308         void *hdr;
2309
2310         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_INTERFACE);
2311         if (!hdr)
2312                 return -1;
2313
2314         if (dev &&
2315             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2316              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2317                 goto nla_put_failure;
2318
2319         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2320             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2321             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2322             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2323             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2324                         rdev->devlist_generation ^
2325                         (cfg80211_rdev_list_generation << 2)))
2326                 goto nla_put_failure;
2327
2328         if (rdev->ops->get_channel) {
2329                 int ret;
2330                 struct cfg80211_chan_def chandef;
2331
2332                 ret = rdev_get_channel(rdev, wdev, &chandef);
2333                 if (ret == 0) {
2334                         if (nl80211_send_chandef(msg, &chandef))
2335                                 goto nla_put_failure;
2336                 }
2337         }
2338
2339         if (wdev->ssid_len) {
2340                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2341                         goto nla_put_failure;
2342         }
2343
2344         return genlmsg_end(msg, hdr);
2345
2346  nla_put_failure:
2347         genlmsg_cancel(msg, hdr);
2348         return -EMSGSIZE;
2349 }
2350
2351 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2352 {
2353         int wp_idx = 0;
2354         int if_idx = 0;
2355         int wp_start = cb->args[0];
2356         int if_start = cb->args[1];
2357         struct cfg80211_registered_device *rdev;
2358         struct wireless_dev *wdev;
2359
2360         rtnl_lock();
2361         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2362                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2363                         continue;
2364                 if (wp_idx < wp_start) {
2365                         wp_idx++;
2366                         continue;
2367                 }
2368                 if_idx = 0;
2369
2370                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2371                         if (if_idx < if_start) {
2372                                 if_idx++;
2373                                 continue;
2374                         }
2375                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2376                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2377                                                rdev, wdev) < 0) {
2378                                 goto out;
2379                         }
2380                         if_idx++;
2381                 }
2382
2383                 wp_idx++;
2384         }
2385  out:
2386         rtnl_unlock();
2387
2388         cb->args[0] = wp_idx;
2389         cb->args[1] = if_idx;
2390
2391         return skb->len;
2392 }
2393
2394 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2395 {
2396         struct sk_buff *msg;
2397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2398         struct wireless_dev *wdev = info->user_ptr[1];
2399
2400         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2401         if (!msg)
2402                 return -ENOMEM;
2403
2404         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2405                                rdev, wdev) < 0) {
2406                 nlmsg_free(msg);
2407                 return -ENOBUFS;
2408         }
2409
2410         return genlmsg_reply(msg, info);
2411 }
2412
2413 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2414         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2415         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2416         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2417         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2418         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2419         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2420 };
2421
2422 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2423 {
2424         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2425         int flag;
2426
2427         *mntrflags = 0;
2428
2429         if (!nla)
2430                 return -EINVAL;
2431
2432         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2433                              nla, mntr_flags_policy))
2434                 return -EINVAL;
2435
2436         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2437                 if (flags[flag])
2438                         *mntrflags |= (1<<flag);
2439
2440         return 0;
2441 }
2442
2443 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2444                                struct net_device *netdev, u8 use_4addr,
2445                                enum nl80211_iftype iftype)
2446 {
2447         if (!use_4addr) {
2448                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2449                         return -EBUSY;
2450                 return 0;
2451         }
2452
2453         switch (iftype) {
2454         case NL80211_IFTYPE_AP_VLAN:
2455                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2456                         return 0;
2457                 break;
2458         case NL80211_IFTYPE_STATION:
2459                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2460                         return 0;
2461                 break;
2462         default:
2463                 break;
2464         }
2465
2466         return -EOPNOTSUPP;
2467 }
2468
2469 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2470 {
2471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2472         struct vif_params params;
2473         int err;
2474         enum nl80211_iftype otype, ntype;
2475         struct net_device *dev = info->user_ptr[1];
2476         u32 _flags, *flags = NULL;
2477         bool change = false;
2478
2479         memset(&params, 0, sizeof(params));
2480
2481         otype = ntype = dev->ieee80211_ptr->iftype;
2482
2483         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2484                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2485                 if (otype != ntype)
2486                         change = true;
2487                 if (ntype > NL80211_IFTYPE_MAX)
2488                         return -EINVAL;
2489         }
2490
2491         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2492                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2493
2494                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2495                         return -EINVAL;
2496                 if (netif_running(dev))
2497                         return -EBUSY;
2498
2499                 wdev_lock(wdev);
2500                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2501                              IEEE80211_MAX_MESH_ID_LEN);
2502                 wdev->mesh_id_up_len =
2503                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2504                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2505                        wdev->mesh_id_up_len);
2506                 wdev_unlock(wdev);
2507         }
2508
2509         if (info->attrs[NL80211_ATTR_4ADDR]) {
2510                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2511                 change = true;
2512                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2513                 if (err)
2514                         return err;
2515         } else {
2516                 params.use_4addr = -1;
2517         }
2518
2519         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2520                 if (ntype != NL80211_IFTYPE_MONITOR)
2521                         return -EINVAL;
2522                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2523                                           &_flags);
2524                 if (err)
2525                         return err;
2526
2527                 flags = &_flags;
2528                 change = true;
2529         }
2530
2531         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2532             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2533                 return -EOPNOTSUPP;
2534
2535         if (change)
2536                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2537         else
2538                 err = 0;
2539
2540         if (!err && params.use_4addr != -1)
2541                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2542
2543         return err;
2544 }
2545
2546 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2547 {
2548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2549         struct vif_params params;
2550         struct wireless_dev *wdev;
2551         struct sk_buff *msg;
2552         int err;
2553         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2554         u32 flags;
2555
2556         /* to avoid failing a new interface creation due to pending removal */
2557         cfg80211_destroy_ifaces(rdev);
2558
2559         memset(&params, 0, sizeof(params));
2560
2561         if (!info->attrs[NL80211_ATTR_IFNAME])
2562                 return -EINVAL;
2563
2564         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2565                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2566                 if (type > NL80211_IFTYPE_MAX)
2567                         return -EINVAL;
2568         }
2569
2570         if (!rdev->ops->add_virtual_intf ||
2571             !(rdev->wiphy.interface_modes & (1 << type)))
2572                 return -EOPNOTSUPP;
2573
2574         if (type == NL80211_IFTYPE_P2P_DEVICE && info->attrs[NL80211_ATTR_MAC]) {
2575                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2576                            ETH_ALEN);
2577                 if (!is_valid_ether_addr(params.macaddr))
2578                         return -EADDRNOTAVAIL;
2579         }
2580
2581         if (info->attrs[NL80211_ATTR_4ADDR]) {
2582                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2583                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2584                 if (err)
2585                         return err;
2586         }
2587
2588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2589         if (!msg)
2590                 return -ENOMEM;
2591
2592         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2593                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2594                                   &flags);
2595
2596         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2597             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2598                 return -EOPNOTSUPP;
2599
2600         wdev = rdev_add_virtual_intf(rdev,
2601                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2602                                 type, err ? NULL : &flags, &params);
2603         if (IS_ERR(wdev)) {
2604                 nlmsg_free(msg);
2605                 return PTR_ERR(wdev);
2606         }
2607
2608         if (info->attrs[NL80211_ATTR_IFACE_SOCKET_OWNER])
2609                 wdev->owner_nlportid = info->snd_portid;
2610
2611         switch (type) {
2612         case NL80211_IFTYPE_MESH_POINT:
2613                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2614                         break;
2615                 wdev_lock(wdev);
2616                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2617                              IEEE80211_MAX_MESH_ID_LEN);
2618                 wdev->mesh_id_up_len =
2619                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2620                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2621                        wdev->mesh_id_up_len);
2622                 wdev_unlock(wdev);
2623                 break;
2624         case NL80211_IFTYPE_P2P_DEVICE:
2625                 /*
2626                  * P2P Device doesn't have a netdev, so doesn't go
2627                  * through the netdev notifier and must be added here
2628                  */
2629                 mutex_init(&wdev->mtx);
2630                 INIT_LIST_HEAD(&wdev->event_list);
2631                 spin_lock_init(&wdev->event_lock);
2632                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2633                 spin_lock_init(&wdev->mgmt_registrations_lock);
2634
2635                 wdev->identifier = ++rdev->wdev_id;
2636                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2637                 rdev->devlist_generation++;
2638                 break;
2639         default:
2640                 break;
2641         }
2642
2643         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2644                                rdev, wdev) < 0) {
2645                 nlmsg_free(msg);
2646                 return -ENOBUFS;
2647         }
2648
2649         return genlmsg_reply(msg, info);
2650 }
2651
2652 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2653 {
2654         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2655         struct wireless_dev *wdev = info->user_ptr[1];
2656
2657         if (!rdev->ops->del_virtual_intf)
2658                 return -EOPNOTSUPP;
2659
2660         /*
2661          * If we remove a wireless device without a netdev then clear
2662          * user_ptr[1] so that nl80211_post_doit won't dereference it
2663          * to check if it needs to do dev_put(). Otherwise it crashes
2664          * since the wdev has been freed, unlike with a netdev where
2665          * we need the dev_put() for the netdev to really be freed.
2666          */
2667         if (!wdev->netdev)
2668                 info->user_ptr[1] = NULL;
2669
2670         return rdev_del_virtual_intf(rdev, wdev);
2671 }
2672
2673 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2674 {
2675         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2676         struct net_device *dev = info->user_ptr[1];
2677         u16 noack_map;
2678
2679         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2680                 return -EINVAL;
2681
2682         if (!rdev->ops->set_noack_map)
2683                 return -EOPNOTSUPP;
2684
2685         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2686
2687         return rdev_set_noack_map(rdev, dev, noack_map);
2688 }
2689
2690 struct get_key_cookie {
2691         struct sk_buff *msg;
2692         int error;
2693         int idx;
2694 };
2695
2696 static void get_key_callback(void *c, struct key_params *params)
2697 {
2698         struct nlattr *key;
2699         struct get_key_cookie *cookie = c;
2700
2701         if ((params->key &&
2702              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2703                      params->key_len, params->key)) ||
2704             (params->seq &&
2705              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2706                      params->seq_len, params->seq)) ||
2707             (params->cipher &&
2708              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2709                          params->cipher)))
2710                 goto nla_put_failure;
2711
2712         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2713         if (!key)
2714                 goto nla_put_failure;
2715
2716         if ((params->key &&
2717              nla_put(cookie->msg, NL80211_KEY_DATA,
2718                      params->key_len, params->key)) ||
2719             (params->seq &&
2720              nla_put(cookie->msg, NL80211_KEY_SEQ,
2721                      params->seq_len, params->seq)) ||
2722             (params->cipher &&
2723              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2724                          params->cipher)))
2725                 goto nla_put_failure;
2726
2727         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2728                 goto nla_put_failure;
2729
2730         nla_nest_end(cookie->msg, key);
2731
2732         return;
2733  nla_put_failure:
2734         cookie->error = 1;
2735 }
2736
2737 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2738 {
2739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2740         int err;
2741         struct net_device *dev = info->user_ptr[1];
2742         u8 key_idx = 0;
2743         const u8 *mac_addr = NULL;
2744         bool pairwise;
2745         struct get_key_cookie cookie = {
2746                 .error = 0,
2747         };
2748         void *hdr;
2749         struct sk_buff *msg;
2750
2751         if (info->attrs[NL80211_ATTR_KEY_IDX])
2752                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2753
2754         if (key_idx > 5)
2755                 return -EINVAL;
2756
2757         if (info->attrs[NL80211_ATTR_MAC])
2758                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2759
2760         pairwise = !!mac_addr;
2761         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2762                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2763                 if (kt >= NUM_NL80211_KEYTYPES)
2764                         return -EINVAL;
2765                 if (kt != NL80211_KEYTYPE_GROUP &&
2766                     kt != NL80211_KEYTYPE_PAIRWISE)
2767                         return -EINVAL;
2768                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2769         }
2770
2771         if (!rdev->ops->get_key)
2772                 return -EOPNOTSUPP;
2773
2774         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2775         if (!msg)
2776                 return -ENOMEM;
2777
2778         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2779                              NL80211_CMD_NEW_KEY);
2780         if (!hdr)
2781                 goto nla_put_failure;
2782
2783         cookie.msg = msg;
2784         cookie.idx = key_idx;
2785
2786         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2787             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2788                 goto nla_put_failure;
2789         if (mac_addr &&
2790             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2791                 goto nla_put_failure;
2792
2793         if (pairwise && mac_addr &&
2794             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2795                 return -ENOENT;
2796
2797         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2798                            get_key_callback);
2799
2800         if (err)
2801                 goto free_msg;
2802
2803         if (cookie.error)
2804                 goto nla_put_failure;
2805
2806         genlmsg_end(msg, hdr);
2807         return genlmsg_reply(msg, info);
2808
2809  nla_put_failure:
2810         err = -ENOBUFS;
2811  free_msg:
2812         nlmsg_free(msg);
2813         return err;
2814 }
2815
2816 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2817 {
2818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2819         struct key_parse key;
2820         int err;
2821         struct net_device *dev = info->user_ptr[1];
2822
2823         err = nl80211_parse_key(info, &key);
2824         if (err)
2825                 return err;
2826
2827         if (key.idx < 0)
2828                 return -EINVAL;
2829
2830         /* only support setting default key */
2831         if (!key.def && !key.defmgmt)
2832                 return -EINVAL;
2833
2834         wdev_lock(dev->ieee80211_ptr);
2835
2836         if (key.def) {
2837                 if (!rdev->ops->set_default_key) {
2838                         err = -EOPNOTSUPP;
2839                         goto out;
2840                 }
2841
2842                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2843                 if (err)
2844                         goto out;
2845
2846                 err = rdev_set_default_key(rdev, dev, key.idx,
2847                                                  key.def_uni, key.def_multi);
2848
2849                 if (err)
2850                         goto out;
2851
2852 #ifdef CONFIG_CFG80211_WEXT
2853                 dev->ieee80211_ptr->wext.default_key = key.idx;
2854 #endif
2855         } else {
2856                 if (key.def_uni || !key.def_multi) {
2857                         err = -EINVAL;
2858                         goto out;
2859                 }
2860
2861                 if (!rdev->ops->set_default_mgmt_key) {
2862                         err = -EOPNOTSUPP;
2863                         goto out;
2864                 }
2865
2866                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2867                 if (err)
2868                         goto out;
2869
2870                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2871                 if (err)
2872                         goto out;
2873
2874 #ifdef CONFIG_CFG80211_WEXT
2875                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2876 #endif
2877         }
2878
2879  out:
2880         wdev_unlock(dev->ieee80211_ptr);
2881
2882         return err;
2883 }
2884
2885 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2886 {
2887         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2888         int err;
2889         struct net_device *dev = info->user_ptr[1];
2890         struct key_parse key;
2891         const u8 *mac_addr = NULL;
2892
2893         err = nl80211_parse_key(info, &key);
2894         if (err)
2895                 return err;
2896
2897         if (!key.p.key)
2898                 return -EINVAL;
2899
2900         if (info->attrs[NL80211_ATTR_MAC])
2901                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2902
2903         if (key.type == -1) {
2904                 if (mac_addr)
2905                         key.type = NL80211_KEYTYPE_PAIRWISE;
2906                 else
2907                         key.type = NL80211_KEYTYPE_GROUP;
2908         }
2909
2910         /* for now */
2911         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2912             key.type != NL80211_KEYTYPE_GROUP)
2913                 return -EINVAL;
2914
2915         if (!rdev->ops->add_key)
2916                 return -EOPNOTSUPP;
2917
2918         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
2919                                            key.type == NL80211_KEYTYPE_PAIRWISE,
2920                                            mac_addr))
2921                 return -EINVAL;
2922
2923         wdev_lock(dev->ieee80211_ptr);
2924         err = nl80211_key_allowed(dev->ieee80211_ptr);
2925         if (!err)
2926                 err = rdev_add_key(rdev, dev, key.idx,
2927                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2928                                     mac_addr, &key.p);
2929         wdev_unlock(dev->ieee80211_ptr);
2930
2931         return err;
2932 }
2933
2934 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
2935 {
2936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2937         int err;
2938         struct net_device *dev = info->user_ptr[1];
2939         u8 *mac_addr = NULL;
2940         struct key_parse key;
2941
2942         err = nl80211_parse_key(info, &key);
2943         if (err)
2944                 return err;
2945
2946         if (info->attrs[NL80211_ATTR_MAC])
2947                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2948
2949         if (key.type == -1) {
2950                 if (mac_addr)
2951                         key.type = NL80211_KEYTYPE_PAIRWISE;
2952                 else
2953                         key.type = NL80211_KEYTYPE_GROUP;
2954         }
2955
2956         /* for now */
2957         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2958             key.type != NL80211_KEYTYPE_GROUP)
2959                 return -EINVAL;
2960
2961         if (!rdev->ops->del_key)
2962                 return -EOPNOTSUPP;
2963
2964         wdev_lock(dev->ieee80211_ptr);
2965         err = nl80211_key_allowed(dev->ieee80211_ptr);
2966
2967         if (key.type == NL80211_KEYTYPE_PAIRWISE && mac_addr &&
2968             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2969                 err = -ENOENT;
2970
2971         if (!err)
2972                 err = rdev_del_key(rdev, dev, key.idx,
2973                                    key.type == NL80211_KEYTYPE_PAIRWISE,
2974                                    mac_addr);
2975
2976 #ifdef CONFIG_CFG80211_WEXT
2977         if (!err) {
2978                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
2979                         dev->ieee80211_ptr->wext.default_key = -1;
2980                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
2981                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
2982         }
2983 #endif
2984         wdev_unlock(dev->ieee80211_ptr);
2985
2986         return err;
2987 }
2988
2989 /* This function returns an error or the number of nested attributes */
2990 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
2991 {
2992         struct nlattr *attr;
2993         int n_entries = 0, tmp;
2994
2995         nla_for_each_nested(attr, nl_attr, tmp) {
2996                 if (nla_len(attr) != ETH_ALEN)
2997                         return -EINVAL;
2998
2999                 n_entries++;
3000         }
3001
3002         return n_entries;
3003 }
3004
3005 /*
3006  * This function parses ACL information and allocates memory for ACL data.
3007  * On successful return, the calling function is responsible to free the
3008  * ACL buffer returned by this function.
3009  */
3010 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3011                                                 struct genl_info *info)
3012 {
3013         enum nl80211_acl_policy acl_policy;
3014         struct nlattr *attr;
3015         struct cfg80211_acl_data *acl;
3016         int i = 0, n_entries, tmp;
3017
3018         if (!wiphy->max_acl_mac_addrs)
3019                 return ERR_PTR(-EOPNOTSUPP);
3020
3021         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3022                 return ERR_PTR(-EINVAL);
3023
3024         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3025         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3026             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3027                 return ERR_PTR(-EINVAL);
3028
3029         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3030                 return ERR_PTR(-EINVAL);
3031
3032         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3033         if (n_entries < 0)
3034                 return ERR_PTR(n_entries);
3035
3036         if (n_entries > wiphy->max_acl_mac_addrs)
3037                 return ERR_PTR(-ENOTSUPP);
3038
3039         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3040                       GFP_KERNEL);
3041         if (!acl)
3042                 return ERR_PTR(-ENOMEM);
3043
3044         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3045                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3046                 i++;
3047         }
3048
3049         acl->n_acl_entries = n_entries;
3050         acl->acl_policy = acl_policy;
3051
3052         return acl;
3053 }
3054
3055 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3056 {
3057         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3058         struct net_device *dev = info->user_ptr[1];
3059         struct cfg80211_acl_data *acl;
3060         int err;
3061
3062         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3063             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3064                 return -EOPNOTSUPP;
3065
3066         if (!dev->ieee80211_ptr->beacon_interval)
3067                 return -EINVAL;
3068
3069         acl = parse_acl_data(&rdev->wiphy, info);
3070         if (IS_ERR(acl))
3071                 return PTR_ERR(acl);
3072
3073         err = rdev_set_mac_acl(rdev, dev, acl);
3074
3075         kfree(acl);
3076
3077         return err;
3078 }
3079
3080 static int nl80211_parse_beacon(struct nlattr *attrs[],
3081                                 struct cfg80211_beacon_data *bcn)
3082 {
3083         bool haveinfo = false;
3084
3085         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3086             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3087             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3088             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3089                 return -EINVAL;
3090
3091         memset(bcn, 0, sizeof(*bcn));
3092
3093         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3094                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3095                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3096                 if (!bcn->head_len)
3097                         return -EINVAL;
3098                 haveinfo = true;
3099         }
3100
3101         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3102                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3103                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3104                 haveinfo = true;
3105         }
3106
3107         if (!haveinfo)
3108                 return -EINVAL;
3109
3110         if (attrs[NL80211_ATTR_IE]) {
3111                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3112                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3113         }
3114
3115         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3116                 bcn->proberesp_ies =
3117                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3118                 bcn->proberesp_ies_len =
3119                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3120         }
3121
3122         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3123                 bcn->assocresp_ies =
3124                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3125                 bcn->assocresp_ies_len =
3126                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3127         }
3128
3129         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3130                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3131                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3132         }
3133
3134         return 0;
3135 }
3136
3137 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3138                                    struct cfg80211_ap_settings *params)
3139 {
3140         struct wireless_dev *wdev;
3141         bool ret = false;
3142
3143         list_for_each_entry(wdev, &rdev->wdev_list, list) {
3144                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3145                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3146                         continue;
3147
3148                 if (!wdev->preset_chandef.chan)
3149                         continue;
3150
3151                 params->chandef = wdev->preset_chandef;
3152                 ret = true;
3153                 break;
3154         }
3155
3156         return ret;
3157 }
3158
3159 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3160                                     enum nl80211_auth_type auth_type,
3161                                     enum nl80211_commands cmd)
3162 {
3163         if (auth_type > NL80211_AUTHTYPE_MAX)
3164                 return false;
3165
3166         switch (cmd) {
3167         case NL80211_CMD_AUTHENTICATE:
3168                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3169                     auth_type == NL80211_AUTHTYPE_SAE)
3170                         return false;
3171                 return true;
3172         case NL80211_CMD_CONNECT:
3173         case NL80211_CMD_START_AP:
3174                 /* SAE not supported yet */
3175                 if (auth_type == NL80211_AUTHTYPE_SAE)
3176                         return false;
3177                 return true;
3178         default:
3179                 return false;
3180         }
3181 }
3182
3183 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3184 {
3185         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3186         struct net_device *dev = info->user_ptr[1];
3187         struct wireless_dev *wdev = dev->ieee80211_ptr;
3188         struct cfg80211_ap_settings params;
3189         int err;
3190
3191         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3192             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3193                 return -EOPNOTSUPP;
3194
3195         if (!rdev->ops->start_ap)
3196                 return -EOPNOTSUPP;
3197
3198         if (wdev->beacon_interval)
3199                 return -EALREADY;
3200
3201         memset(&params, 0, sizeof(params));
3202
3203         /* these are required for START_AP */
3204         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3205             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3206             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3207                 return -EINVAL;
3208
3209         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3210         if (err)
3211                 return err;
3212
3213         params.beacon_interval =
3214                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3215         params.dtim_period =
3216                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3217
3218         err = cfg80211_validate_beacon_int(rdev, params.beacon_interval);
3219         if (err)
3220                 return err;
3221
3222         /*
3223          * In theory, some of these attributes should be required here
3224          * but since they were not used when the command was originally
3225          * added, keep them optional for old user space programs to let
3226          * them continue to work with drivers that do not need the
3227          * additional information -- drivers must check!
3228          */
3229         if (info->attrs[NL80211_ATTR_SSID]) {
3230                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3231                 params.ssid_len =
3232                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3233                 if (params.ssid_len == 0 ||
3234                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3235                         return -EINVAL;
3236         }
3237
3238         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3239                 params.hidden_ssid = nla_get_u32(
3240                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3241                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3242                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3243                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3244                         return -EINVAL;
3245         }
3246
3247         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3248
3249         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3250                 params.auth_type = nla_get_u32(
3251                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3252                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3253                                              NL80211_CMD_START_AP))
3254                         return -EINVAL;
3255         } else
3256                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3257
3258         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3259                                       NL80211_MAX_NR_CIPHER_SUITES);
3260         if (err)
3261                 return err;
3262
3263         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3264                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3265                         return -EOPNOTSUPP;
3266                 params.inactivity_timeout = nla_get_u16(
3267                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3268         }
3269
3270         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3271                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3272                         return -EINVAL;
3273                 params.p2p_ctwindow =
3274                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3275                 if (params.p2p_ctwindow > 127)
3276                         return -EINVAL;
3277                 if (params.p2p_ctwindow != 0 &&
3278                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3279                         return -EINVAL;
3280         }
3281
3282         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
3283                 u8 tmp;
3284
3285                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3286                         return -EINVAL;
3287                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
3288                 if (tmp > 1)
3289                         return -EINVAL;
3290                 params.p2p_opp_ps = tmp;
3291                 if (params.p2p_opp_ps != 0 &&
3292                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
3293                         return -EINVAL;
3294         }
3295
3296         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3297                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
3298                 if (err)
3299                         return err;
3300         } else if (wdev->preset_chandef.chan) {
3301                 params.chandef = wdev->preset_chandef;
3302         } else if (!nl80211_get_ap_channel(rdev, &params))
3303                 return -EINVAL;
3304
3305         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
3306                                      wdev->iftype))
3307                 return -EINVAL;
3308
3309         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
3310                 params.acl = parse_acl_data(&rdev->wiphy, info);
3311                 if (IS_ERR(params.acl))
3312                         return PTR_ERR(params.acl);
3313         }
3314
3315         wdev_lock(wdev);
3316         err = rdev_start_ap(rdev, dev, &params);
3317         if (!err) {
3318                 wdev->preset_chandef = params.chandef;
3319                 wdev->beacon_interval = params.beacon_interval;
3320                 wdev->chandef = params.chandef;
3321                 wdev->ssid_len = params.ssid_len;
3322                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
3323         }
3324         wdev_unlock(wdev);
3325
3326         kfree(params.acl);
3327
3328         return err;
3329 }
3330
3331 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
3332 {
3333         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3334         struct net_device *dev = info->user_ptr[1];
3335         struct wireless_dev *wdev = dev->ieee80211_ptr;
3336         struct cfg80211_beacon_data params;
3337         int err;
3338
3339         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3340             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3341                 return -EOPNOTSUPP;
3342
3343         if (!rdev->ops->change_beacon)
3344                 return -EOPNOTSUPP;
3345
3346         if (!wdev->beacon_interval)
3347                 return -EINVAL;
3348
3349         err = nl80211_parse_beacon(info->attrs, &params);
3350         if (err)
3351                 return err;
3352
3353         wdev_lock(wdev);
3354         err = rdev_change_beacon(rdev, dev, &params);
3355         wdev_unlock(wdev);
3356
3357         return err;
3358 }
3359
3360 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
3361 {
3362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3363         struct net_device *dev = info->user_ptr[1];
3364
3365         return cfg80211_stop_ap(rdev, dev, false);
3366 }
3367
3368 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
3369         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
3370         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
3371         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
3372         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
3373         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
3374         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
3375 };
3376
3377 static int parse_station_flags(struct genl_info *info,
3378                                enum nl80211_iftype iftype,
3379                                struct station_parameters *params)
3380 {
3381         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
3382         struct nlattr *nla;
3383         int flag;
3384
3385         /*
3386          * Try parsing the new attribute first so userspace
3387          * can specify both for older kernels.
3388          */
3389         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
3390         if (nla) {
3391                 struct nl80211_sta_flag_update *sta_flags;
3392
3393                 sta_flags = nla_data(nla);
3394                 params->sta_flags_mask = sta_flags->mask;
3395                 params->sta_flags_set = sta_flags->set;
3396                 params->sta_flags_set &= params->sta_flags_mask;
3397                 if ((params->sta_flags_mask |
3398                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
3399                         return -EINVAL;
3400                 return 0;
3401         }
3402
3403         /* if present, parse the old attribute */
3404
3405         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
3406         if (!nla)
3407                 return 0;
3408
3409         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX,
3410                              nla, sta_flags_policy))
3411                 return -EINVAL;
3412
3413         /*
3414          * Only allow certain flags for interface types so that
3415          * other attributes are silently ignored. Remember that
3416          * this is backward compatibility code with old userspace
3417          * and shouldn't be hit in other cases anyway.
3418          */
3419         switch (iftype) {
3420         case NL80211_IFTYPE_AP:
3421         case NL80211_IFTYPE_AP_VLAN:
3422         case NL80211_IFTYPE_P2P_GO:
3423                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3424                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3425                                          BIT(NL80211_STA_FLAG_WME) |
3426                                          BIT(NL80211_STA_FLAG_MFP);
3427                 break;
3428         case NL80211_IFTYPE_P2P_CLIENT:
3429         case NL80211_IFTYPE_STATION:
3430                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
3431                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
3432                 break;
3433         case NL80211_IFTYPE_MESH_POINT:
3434                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3435                                          BIT(NL80211_STA_FLAG_MFP) |
3436                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
3437         default:
3438                 return -EINVAL;
3439         }
3440
3441         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
3442                 if (flags[flag]) {
3443                         params->sta_flags_set |= (1<<flag);
3444
3445                         /* no longer support new API additions in old API */
3446                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
3447                                 return -EINVAL;
3448                 }
3449         }
3450
3451         return 0;
3452 }
3453
3454 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
3455                                  int attr)
3456 {
3457         struct nlattr *rate;
3458         u32 bitrate;
3459         u16 bitrate_compat;
3460
3461         rate = nla_nest_start(msg, attr);
3462         if (!rate)
3463                 return false;
3464
3465         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
3466         bitrate = cfg80211_calculate_bitrate(info);
3467         /* report 16-bit bitrate only if we can */
3468         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
3469         if (bitrate > 0 &&
3470             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
3471                 return false;
3472         if (bitrate_compat > 0 &&
3473             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
3474                 return false;
3475
3476         if (info->flags & RATE_INFO_FLAGS_MCS) {
3477                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
3478                         return false;
3479                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3480                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3481                         return false;
3482                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3483                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3484                         return false;
3485         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
3486                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
3487                         return false;
3488                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
3489                         return false;
3490                 if (info->flags & RATE_INFO_FLAGS_40_MHZ_WIDTH &&
3491                     nla_put_flag(msg, NL80211_RATE_INFO_40_MHZ_WIDTH))
3492                         return false;
3493                 if (info->flags & RATE_INFO_FLAGS_80_MHZ_WIDTH &&
3494                     nla_put_flag(msg, NL80211_RATE_INFO_80_MHZ_WIDTH))
3495                         return false;
3496                 if (info->flags & RATE_INFO_FLAGS_80P80_MHZ_WIDTH &&
3497                     nla_put_flag(msg, NL80211_RATE_INFO_80P80_MHZ_WIDTH))
3498                         return false;
3499                 if (info->flags & RATE_INFO_FLAGS_160_MHZ_WIDTH &&
3500                     nla_put_flag(msg, NL80211_RATE_INFO_160_MHZ_WIDTH))
3501                         return false;
3502                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
3503                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
3504                         return false;
3505         }
3506
3507         nla_nest_end(msg, rate);
3508         return true;
3509 }
3510
3511 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
3512                                int id)
3513 {
3514         void *attr;
3515         int i = 0;
3516
3517         if (!mask)
3518                 return true;
3519
3520         attr = nla_nest_start(msg, id);
3521         if (!attr)
3522                 return false;
3523
3524         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
3525                 if (!(mask & BIT(i)))
3526                         continue;
3527
3528                 if (nla_put_u8(msg, i, signal[i]))
3529                         return false;
3530         }
3531
3532         nla_nest_end(msg, attr);
3533
3534         return true;
3535 }
3536
3537 static int nl80211_send_station(struct sk_buff *msg, u32 portid, u32 seq,
3538                                 int flags,
3539                                 struct cfg80211_registered_device *rdev,
3540                                 struct net_device *dev,
3541                                 const u8 *mac_addr, struct station_info *sinfo)
3542 {
3543         void *hdr;
3544         struct nlattr *sinfoattr, *bss_param;
3545
3546         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
3547         if (!hdr)
3548                 return -1;
3549
3550         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3551             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
3552             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
3553                 goto nla_put_failure;
3554
3555         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
3556         if (!sinfoattr)
3557                 goto nla_put_failure;
3558         if ((sinfo->filled & STATION_INFO_CONNECTED_TIME) &&
3559             nla_put_u32(msg, NL80211_STA_INFO_CONNECTED_TIME,
3560                         sinfo->connected_time))
3561                 goto nla_put_failure;
3562         if ((sinfo->filled & STATION_INFO_INACTIVE_TIME) &&
3563             nla_put_u32(msg, NL80211_STA_INFO_INACTIVE_TIME,
3564                         sinfo->inactive_time))
3565                 goto nla_put_failure;
3566         if ((sinfo->filled & (STATION_INFO_RX_BYTES |
3567                               STATION_INFO_RX_BYTES64)) &&
3568             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
3569                         (u32)sinfo->rx_bytes))
3570                 goto nla_put_failure;
3571         if ((sinfo->filled & (STATION_INFO_TX_BYTES |
3572                               STATION_INFO_TX_BYTES64)) &&
3573             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
3574                         (u32)sinfo->tx_bytes))
3575                 goto nla_put_failure;
3576         if ((sinfo->filled & STATION_INFO_RX_BYTES64) &&
3577             nla_put_u64(msg, NL80211_STA_INFO_RX_BYTES64,
3578                         sinfo->rx_bytes))
3579                 goto nla_put_failure;
3580         if ((sinfo->filled & STATION_INFO_TX_BYTES64) &&
3581             nla_put_u64(msg, NL80211_STA_INFO_TX_BYTES64,
3582                         sinfo->tx_bytes))
3583                 goto nla_put_failure;
3584         if ((sinfo->filled & STATION_INFO_LLID) &&
3585             nla_put_u16(msg, NL80211_STA_INFO_LLID, sinfo->llid))
3586                 goto nla_put_failure;
3587         if ((sinfo->filled & STATION_INFO_PLID) &&
3588             nla_put_u16(msg, NL80211_STA_INFO_PLID, sinfo->plid))
3589                 goto nla_put_failure;
3590         if ((sinfo->filled & STATION_INFO_PLINK_STATE) &&
3591             nla_put_u8(msg, NL80211_STA_INFO_PLINK_STATE,
3592                        sinfo->plink_state))
3593                 goto nla_put_failure;
3594         switch (rdev->wiphy.signal_type) {
3595         case CFG80211_SIGNAL_TYPE_MBM:
3596                 if ((sinfo->filled & STATION_INFO_SIGNAL) &&
3597                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL,
3598                                sinfo->signal))
3599                         goto nla_put_failure;
3600                 if ((sinfo->filled & STATION_INFO_SIGNAL_AVG) &&
3601                     nla_put_u8(msg, NL80211_STA_INFO_SIGNAL_AVG,
3602                                sinfo->signal_avg))
3603                         goto nla_put_failure;
3604                 break;
3605         default:
3606                 break;
3607         }
3608         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL) {
3609                 if (!nl80211_put_signal(msg, sinfo->chains,
3610                                         sinfo->chain_signal,
3611                                         NL80211_STA_INFO_CHAIN_SIGNAL))
3612                         goto nla_put_failure;
3613         }
3614         if (sinfo->filled & STATION_INFO_CHAIN_SIGNAL_AVG) {
3615                 if (!nl80211_put_signal(msg, sinfo->chains,
3616                                         sinfo->chain_signal_avg,
3617                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
3618                         goto nla_put_failure;
3619         }
3620         if (sinfo->filled & STATION_INFO_TX_BITRATE) {
3621                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
3622                                           NL80211_STA_INFO_TX_BITRATE))
3623                         goto nla_put_failure;
3624         }
3625         if (sinfo->filled & STATION_INFO_RX_BITRATE) {
3626                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
3627                                           NL80211_STA_INFO_RX_BITRATE))
3628                         goto nla_put_failure;
3629         }
3630         if ((sinfo->filled & STATION_INFO_RX_PACKETS) &&
3631             nla_put_u32(msg, NL80211_STA_INFO_RX_PACKETS,
3632                         sinfo->rx_packets))
3633                 goto nla_put_failure;
3634         if ((sinfo->filled & STATION_INFO_TX_PACKETS) &&
3635             nla_put_u32(msg, NL80211_STA_INFO_TX_PACKETS,
3636                         sinfo->tx_packets))
3637                 goto nla_put_failure;
3638         if ((sinfo->filled & STATION_INFO_TX_RETRIES) &&
3639             nla_put_u32(msg, NL80211_STA_INFO_TX_RETRIES,
3640                         sinfo->tx_retries))
3641                 goto nla_put_failure;
3642         if ((sinfo->filled & STATION_INFO_TX_FAILED) &&
3643             nla_put_u32(msg, NL80211_STA_INFO_TX_FAILED,
3644                         sinfo->tx_failed))
3645                 goto nla_put_failure;
3646         if ((sinfo->filled & STATION_INFO_BEACON_LOSS_COUNT) &&
3647             nla_put_u32(msg, NL80211_STA_INFO_BEACON_LOSS,
3648                         sinfo->beacon_loss_count))
3649                 goto nla_put_failure;
3650         if ((sinfo->filled & STATION_INFO_LOCAL_PM) &&
3651             nla_put_u32(msg, NL80211_STA_INFO_LOCAL_PM,
3652                         sinfo->local_pm))
3653                 goto nla_put_failure;
3654         if ((sinfo->filled & STATION_INFO_PEER_PM) &&
3655             nla_put_u32(msg, NL80211_STA_INFO_PEER_PM,
3656                         sinfo->peer_pm))
3657                 goto nla_put_failure;
3658         if ((sinfo->filled & STATION_INFO_NONPEER_PM) &&
3659             nla_put_u32(msg, NL80211_STA_INFO_NONPEER_PM,
3660                         sinfo->nonpeer_pm))
3661                 goto nla_put_failure;
3662         if (sinfo->filled & STATION_INFO_BSS_PARAM) {
3663                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
3664                 if (!bss_param)
3665                         goto nla_put_failure;
3666
3667                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
3668                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
3669                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
3670                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
3671                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
3672                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
3673                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
3674                                sinfo->bss_param.dtim_period) ||
3675                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
3676                                 sinfo->bss_param.beacon_interval))
3677                         goto nla_put_failure;
3678
3679                 nla_nest_end(msg, bss_param);
3680         }
3681         if ((sinfo->filled & STATION_INFO_STA_FLAGS) &&
3682             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
3683                     sizeof(struct nl80211_sta_flag_update),
3684                     &sinfo->sta_flags))
3685                 goto nla_put_failure;
3686         if ((sinfo->filled & STATION_INFO_T_OFFSET) &&
3687                 nla_put_u64(msg, NL80211_STA_INFO_T_OFFSET,
3688                             sinfo->t_offset))
3689                 goto nla_put_failure;
3690         nla_nest_end(msg, sinfoattr);
3691
3692         if ((sinfo->filled & STATION_INFO_ASSOC_REQ_IES) &&
3693             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
3694                     sinfo->assoc_req_ies))
3695                 goto nla_put_failure;
3696
3697         return genlmsg_end(msg, hdr);
3698
3699  nla_put_failure:
3700         genlmsg_cancel(msg, hdr);
3701         return -EMSGSIZE;
3702 }
3703
3704 static int nl80211_dump_station(struct sk_buff *skb,
3705                                 struct netlink_callback *cb)
3706 {
3707         struct station_info sinfo;
3708         struct cfg80211_registered_device *rdev;
3709         struct wireless_dev *wdev;
3710         u8 mac_addr[ETH_ALEN];
3711         int sta_idx = cb->args[2];
3712         int err;
3713
3714         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
3715         if (err)
3716                 return err;
3717
3718         if (!wdev->netdev) {
3719                 err = -EINVAL;
3720                 goto out_err;
3721         }
3722
3723         if (!rdev->ops->dump_station) {
3724                 err = -EOPNOTSUPP;
3725                 goto out_err;
3726         }
3727
3728         while (1) {
3729                 memset(&sinfo, 0, sizeof(sinfo));
3730                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
3731                                         mac_addr, &sinfo);
3732                 if (err == -ENOENT)
3733                         break;
3734                 if (err)
3735                         goto out_err;
3736
3737                 if (nl80211_send_station(skb,
3738                                 NETLINK_CB(cb->skb).portid,
3739                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
3740                                 rdev, wdev->netdev, mac_addr,
3741                                 &sinfo) < 0)
3742                         goto out;
3743
3744                 sta_idx++;
3745         }
3746
3747
3748  out:
3749         cb->args[2] = sta_idx;
3750         err = skb->len;
3751  out_err:
3752         nl80211_finish_wdev_dump(rdev);
3753
3754         return err;
3755 }
3756
3757 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
3758 {
3759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3760         struct net_device *dev = info->user_ptr[1];
3761         struct station_info sinfo;
3762         struct sk_buff *msg;
3763         u8 *mac_addr = NULL;
3764         int err;
3765
3766         memset(&sinfo, 0, sizeof(sinfo));
3767
3768         if (!info->attrs[NL80211_ATTR_MAC])
3769                 return -EINVAL;
3770
3771         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3772
3773         if (!rdev->ops->get_station)
3774                 return -EOPNOTSUPP;
3775
3776         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
3777         if (err)
3778                 return err;
3779
3780         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3781         if (!msg)
3782                 return -ENOMEM;
3783
3784         if (nl80211_send_station(msg, info->snd_portid, info->snd_seq, 0,
3785                                  rdev, dev, mac_addr, &sinfo) < 0) {
3786                 nlmsg_free(msg);
3787                 return -ENOBUFS;
3788         }
3789
3790         return genlmsg_reply(msg, info);
3791 }
3792
3793 int cfg80211_check_station_change(struct wiphy *wiphy,
3794                                   struct station_parameters *params,
3795                                   enum cfg80211_station_type statype)
3796 {
3797         if (params->listen_interval != -1)
3798                 return -EINVAL;
3799         if (params->aid)
3800                 return -EINVAL;
3801
3802         /* When you run into this, adjust the code below for the new flag */
3803         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
3804
3805         switch (statype) {
3806         case CFG80211_STA_MESH_PEER_KERNEL:
3807         case CFG80211_STA_MESH_PEER_USER:
3808                 /*
3809                  * No ignoring the TDLS flag here -- the userspace mesh
3810                  * code doesn't have the bug of including TDLS in the
3811                  * mask everywhere.
3812                  */
3813                 if (params->sta_flags_mask &
3814                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3815                                   BIT(NL80211_STA_FLAG_MFP) |
3816                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
3817                         return -EINVAL;
3818                 break;
3819         case CFG80211_STA_TDLS_PEER_SETUP:
3820         case CFG80211_STA_TDLS_PEER_ACTIVE:
3821                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
3822                         return -EINVAL;
3823                 /* ignore since it can't change */
3824                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3825                 break;
3826         default:
3827                 /* disallow mesh-specific things */
3828                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3829                         return -EINVAL;
3830                 if (params->local_pm)
3831                         return -EINVAL;
3832                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3833                         return -EINVAL;
3834         }
3835
3836         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
3837             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
3838                 /* TDLS can't be set, ... */
3839                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
3840                         return -EINVAL;
3841                 /*
3842                  * ... but don't bother the driver with it. This works around
3843                  * a hostapd/wpa_supplicant issue -- it always includes the
3844                  * TLDS_PEER flag in the mask even for AP mode.
3845                  */
3846                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
3847         }
3848
3849         if (statype != CFG80211_STA_TDLS_PEER_SETUP) {
3850                 /* reject other things that can't change */
3851                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
3852                         return -EINVAL;
3853                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
3854                         return -EINVAL;
3855                 if (params->supported_rates)
3856                         return -EINVAL;
3857                 if (params->ext_capab || params->ht_capa || params->vht_capa)
3858                         return -EINVAL;
3859         }
3860
3861         if (statype != CFG80211_STA_AP_CLIENT) {
3862                 if (params->vlan)
3863                         return -EINVAL;
3864         }
3865
3866         switch (statype) {
3867         case CFG80211_STA_AP_MLME_CLIENT:
3868                 /* Use this only for authorizing/unauthorizing a station */
3869                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
3870                         return -EOPNOTSUPP;
3871                 break;
3872         case CFG80211_STA_AP_CLIENT:
3873                 /* accept only the listed bits */
3874                 if (params->sta_flags_mask &
3875                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3876                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3877                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
3878                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
3879                                   BIT(NL80211_STA_FLAG_WME) |
3880                                   BIT(NL80211_STA_FLAG_MFP)))
3881                         return -EINVAL;
3882
3883                 /* but authenticated/associated only if driver handles it */
3884                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
3885                     params->sta_flags_mask &
3886                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
3887                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
3888                         return -EINVAL;
3889                 break;
3890         case CFG80211_STA_IBSS:
3891         case CFG80211_STA_AP_STA:
3892                 /* reject any changes other than AUTHORIZED */
3893                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
3894                         return -EINVAL;
3895                 break;
3896         case CFG80211_STA_TDLS_PEER_SETUP:
3897                 /* reject any changes other than AUTHORIZED or WME */
3898                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
3899                                                BIT(NL80211_STA_FLAG_WME)))
3900                         return -EINVAL;
3901                 /* force (at least) rates when authorizing */
3902                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
3903                     !params->supported_rates)
3904                         return -EINVAL;
3905                 break;
3906         case CFG80211_STA_TDLS_PEER_ACTIVE:
3907                 /* reject any changes */
3908                 return -EINVAL;
3909         case CFG80211_STA_MESH_PEER_KERNEL:
3910                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
3911                         return -EINVAL;
3912                 break;
3913         case CFG80211_STA_MESH_PEER_USER:
3914                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
3915                         return -EINVAL;
3916                 break;
3917         }
3918
3919         return 0;
3920 }
3921 EXPORT_SYMBOL(cfg80211_check_station_change);
3922
3923 /*
3924  * Get vlan interface making sure it is running and on the right wiphy.
3925  */
3926 static struct net_device *get_vlan(struct genl_info *info,
3927                                    struct cfg80211_registered_device *rdev)
3928 {
3929         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
3930         struct net_device *v;
3931         int ret;
3932
3933         if (!vlanattr)
3934                 return NULL;
3935
3936         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
3937         if (!v)
3938                 return ERR_PTR(-ENODEV);
3939
3940         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
3941                 ret = -EINVAL;
3942                 goto error;
3943         }
3944
3945         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
3946             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3947             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3948                 ret = -EINVAL;
3949                 goto error;
3950         }
3951
3952         if (!netif_running(v)) {
3953                 ret = -ENETDOWN;
3954                 goto error;
3955         }
3956
3957         return v;
3958  error:
3959         dev_put(v);
3960         return ERR_PTR(ret);
3961 }
3962
3963 static const struct nla_policy
3964 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
3965         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
3966         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
3967 };
3968
3969 static int nl80211_parse_sta_wme(struct genl_info *info,
3970                                  struct station_parameters *params)
3971 {
3972         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
3973         struct nlattr *nla;
3974         int err;
3975
3976         /* parse WME attributes if present */
3977         if (!info->attrs[NL80211_ATTR_STA_WME])
3978                 return 0;
3979
3980         nla = info->attrs[NL80211_ATTR_STA_WME];
3981         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
3982                                nl80211_sta_wme_policy);
3983         if (err)
3984                 return err;
3985
3986         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
3987                 params->uapsd_queues = nla_get_u8(
3988                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
3989         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
3990                 return -EINVAL;
3991
3992         if (tb[NL80211_STA_WME_MAX_SP])
3993                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
3994
3995         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
3996                 return -EINVAL;
3997
3998         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
3999
4000         return 0;
4001 }
4002
4003 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4004                                       struct station_parameters *params)
4005 {
4006         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4007                 params->supported_channels =
4008                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4009                 params->supported_channels_len =
4010                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4011                 /*
4012                  * Need to include at least one (first channel, number of
4013                  * channels) tuple for each subband, and must have proper
4014                  * tuples for the rest of the data as well.
4015                  */
4016                 if (params->supported_channels_len < 2)
4017                         return -EINVAL;
4018                 if (params->supported_channels_len % 2)
4019                         return -EINVAL;
4020         }
4021
4022         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4023                 params->supported_oper_classes =
4024                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4025                 params->supported_oper_classes_len =
4026                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4027                 /*
4028                  * The value of the Length field of the Supported Operating
4029                  * Classes element is between 2 and 253.
4030                  */
4031                 if (params->supported_oper_classes_len < 2 ||
4032                     params->supported_oper_classes_len > 253)
4033                         return -EINVAL;
4034         }
4035         return 0;
4036 }
4037
4038 static int nl80211_set_station_tdls(struct genl_info *info,
4039                                     struct station_parameters *params)
4040 {
4041         int err;
4042         /* Dummy STA entry gets updated once the peer capabilities are known */
4043         if (info->attrs[NL80211_ATTR_PEER_AID])
4044                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4045         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4046                 params->ht_capa =
4047                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4048         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4049                 params->vht_capa =
4050                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4051
4052         err = nl80211_parse_sta_channel_info(info, params);
4053         if (err)
4054                 return err;
4055
4056         return nl80211_parse_sta_wme(info, params);
4057 }
4058
4059 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4060 {
4061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4062         struct net_device *dev = info->user_ptr[1];
4063         struct station_parameters params;
4064         u8 *mac_addr;
4065         int err;
4066
4067         memset(&params, 0, sizeof(params));
4068
4069         params.listen_interval = -1;
4070
4071         if (!rdev->ops->change_station)
4072                 return -EOPNOTSUPP;
4073
4074         if (info->attrs[NL80211_ATTR_STA_AID])
4075                 return -EINVAL;
4076
4077         if (!info->attrs[NL80211_ATTR_MAC])
4078                 return -EINVAL;
4079
4080         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4081
4082         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4083                 params.supported_rates =
4084                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4085                 params.supported_rates_len =
4086                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4087         }
4088
4089         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4090                 params.capability =
4091                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4092                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4093         }
4094
4095         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4096                 params.ext_capab =
4097                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4098                 params.ext_capab_len =
4099                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4100         }
4101
4102         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4103                 return -EINVAL;
4104
4105         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4106                 return -EINVAL;
4107
4108         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4109                 params.plink_action =
4110                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4111                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4112                         return -EINVAL;
4113         }
4114
4115         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4116                 params.plink_state =
4117                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4118                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4119                         return -EINVAL;
4120                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4121         }
4122
4123         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4124                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4125                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4126
4127                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4128                     pm > NL80211_MESH_POWER_MAX)
4129                         return -EINVAL;
4130
4131                 params.local_pm = pm;
4132         }
4133
4134         /* Include parameters for TDLS peer (will check later) */
4135         err = nl80211_set_station_tdls(info, &params);
4136         if (err)
4137                 return err;
4138
4139         params.vlan = get_vlan(info, rdev);
4140         if (IS_ERR(params.vlan))
4141                 return PTR_ERR(params.vlan);
4142
4143         switch (dev->ieee80211_ptr->iftype) {
4144         case NL80211_IFTYPE_AP:
4145         case NL80211_IFTYPE_AP_VLAN:
4146         case NL80211_IFTYPE_P2P_GO:
4147         case NL80211_IFTYPE_P2P_CLIENT:
4148         case NL80211_IFTYPE_STATION:
4149         case NL80211_IFTYPE_ADHOC:
4150         case NL80211_IFTYPE_MESH_POINT:
4151                 break;
4152         default:
4153                 err = -EOPNOTSUPP;
4154                 goto out_put_vlan;
4155         }
4156
4157         /* driver will call cfg80211_check_station_change() */
4158         err = rdev_change_station(rdev, dev, mac_addr, &params);
4159
4160  out_put_vlan:
4161         if (params.vlan)
4162                 dev_put(params.vlan);
4163
4164         return err;
4165 }
4166
4167 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
4168 {
4169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4170         int err;
4171         struct net_device *dev = info->user_ptr[1];
4172         struct station_parameters params;
4173         u8 *mac_addr = NULL;
4174
4175         memset(&params, 0, sizeof(params));
4176
4177         if (!rdev->ops->add_station)
4178                 return -EOPNOTSUPP;
4179
4180         if (!info->attrs[NL80211_ATTR_MAC])
4181                 return -EINVAL;
4182
4183         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4184                 return -EINVAL;
4185
4186         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
4187                 return -EINVAL;
4188
4189         if (!info->attrs[NL80211_ATTR_STA_AID] &&
4190             !info->attrs[NL80211_ATTR_PEER_AID])
4191                 return -EINVAL;
4192
4193         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4194         params.supported_rates =
4195                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4196         params.supported_rates_len =
4197                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4198         params.listen_interval =
4199                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4200
4201         if (info->attrs[NL80211_ATTR_PEER_AID])
4202                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4203         else
4204                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4205         if (!params.aid || params.aid > IEEE80211_MAX_AID)
4206                 return -EINVAL;
4207
4208         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4209                 params.capability =
4210                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4211                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4212         }
4213
4214         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4215                 params.ext_capab =
4216                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4217                 params.ext_capab_len =
4218                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4219         }
4220
4221         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4222                 params.ht_capa =
4223                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4224
4225         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4226                 params.vht_capa =
4227                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4228
4229         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4230                 params.opmode_notif_used = true;
4231                 params.opmode_notif =
4232                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4233         }
4234
4235         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4236                 params.plink_action =
4237                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4238                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4239                         return -EINVAL;
4240         }
4241
4242         err = nl80211_parse_sta_channel_info(info, &params);
4243         if (err)
4244                 return err;
4245
4246         err = nl80211_parse_sta_wme(info, &params);
4247         if (err)
4248                 return err;
4249
4250         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4251                 return -EINVAL;
4252
4253         /* When you run into this, adjust the code below for the new flag */
4254         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4255
4256         switch (dev->ieee80211_ptr->iftype) {
4257         case NL80211_IFTYPE_AP:
4258         case NL80211_IFTYPE_AP_VLAN:
4259         case NL80211_IFTYPE_P2P_GO:
4260                 /* ignore WME attributes if iface/sta is not capable */
4261                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
4262                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
4263                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4264
4265                 /* TDLS peers cannot be added */
4266                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4267                     info->attrs[NL80211_ATTR_PEER_AID])
4268                         return -EINVAL;
4269                 /* but don't bother the driver with it */
4270                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4271
4272                 /* allow authenticated/associated only if driver handles it */
4273                 if (!(rdev->wiphy.features &
4274                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4275                     params.sta_flags_mask &
4276                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4277                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4278                         return -EINVAL;
4279
4280                 /* must be last in here for error handling */
4281                 params.vlan = get_vlan(info, rdev);
4282                 if (IS_ERR(params.vlan))
4283                         return PTR_ERR(params.vlan);
4284                 break;
4285         case NL80211_IFTYPE_MESH_POINT:
4286                 /* ignore uAPSD data */
4287                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4288
4289                 /* associated is disallowed */
4290                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
4291                         return -EINVAL;
4292                 /* TDLS peers cannot be added */
4293                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
4294                     info->attrs[NL80211_ATTR_PEER_AID])
4295                         return -EINVAL;
4296                 break;
4297         case NL80211_IFTYPE_STATION:
4298         case NL80211_IFTYPE_P2P_CLIENT:
4299                 /* ignore uAPSD data */
4300                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
4301
4302                 /* these are disallowed */
4303                 if (params.sta_flags_mask &
4304                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
4305                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
4306                         return -EINVAL;
4307                 /* Only TDLS peers can be added */
4308                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4309                         return -EINVAL;
4310                 /* Can only add if TDLS ... */
4311                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
4312                         return -EOPNOTSUPP;
4313                 /* ... with external setup is supported */
4314                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
4315                         return -EOPNOTSUPP;
4316                 /*
4317                  * Older wpa_supplicant versions always mark the TDLS peer
4318                  * as authorized, but it shouldn't yet be.
4319                  */
4320                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
4321                 break;
4322         default:
4323                 return -EOPNOTSUPP;
4324         }
4325
4326         /* be aware of params.vlan when changing code here */
4327
4328         err = rdev_add_station(rdev, dev, mac_addr, &params);
4329
4330         if (params.vlan)
4331                 dev_put(params.vlan);
4332         return err;
4333 }
4334
4335 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
4336 {
4337         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4338         struct net_device *dev = info->user_ptr[1];
4339         u8 *mac_addr = NULL;
4340
4341         if (info->attrs[NL80211_ATTR_MAC])
4342                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4343
4344         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4345             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4346             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
4347             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4348                 return -EINVAL;
4349
4350         if (!rdev->ops->del_station)
4351                 return -EOPNOTSUPP;
4352
4353         return rdev_del_station(rdev, dev, mac_addr);
4354 }
4355
4356 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
4357                                 int flags, struct net_device *dev,
4358                                 u8 *dst, u8 *next_hop,
4359                                 struct mpath_info *pinfo)
4360 {
4361         void *hdr;
4362         struct nlattr *pinfoattr;
4363
4364         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_STATION);
4365         if (!hdr)
4366                 return -1;
4367
4368         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4369             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
4370             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
4371             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
4372                 goto nla_put_failure;
4373
4374         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
4375         if (!pinfoattr)
4376                 goto nla_put_failure;
4377         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
4378             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
4379                         pinfo->frame_qlen))
4380                 goto nla_put_failure;
4381         if (((pinfo->filled & MPATH_INFO_SN) &&
4382              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
4383             ((pinfo->filled & MPATH_INFO_METRIC) &&
4384              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
4385                          pinfo->metric)) ||
4386             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
4387              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
4388                          pinfo->exptime)) ||
4389             ((pinfo->filled & MPATH_INFO_FLAGS) &&
4390              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
4391                         pinfo->flags)) ||
4392             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
4393              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
4394                          pinfo->discovery_timeout)) ||
4395             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
4396              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
4397                         pinfo->discovery_retries)))
4398                 goto nla_put_failure;
4399
4400         nla_nest_end(msg, pinfoattr);
4401
4402         return genlmsg_end(msg, hdr);
4403
4404  nla_put_failure:
4405         genlmsg_cancel(msg, hdr);
4406         return -EMSGSIZE;
4407 }
4408
4409 static int nl80211_dump_mpath(struct sk_buff *skb,
4410                               struct netlink_callback *cb)
4411 {
4412         struct mpath_info pinfo;
4413         struct cfg80211_registered_device *rdev;
4414         struct wireless_dev *wdev;
4415         u8 dst[ETH_ALEN];
4416         u8 next_hop[ETH_ALEN];
4417         int path_idx = cb->args[2];
4418         int err;
4419
4420         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4421         if (err)
4422                 return err;
4423
4424         if (!rdev->ops->dump_mpath) {
4425                 err = -EOPNOTSUPP;
4426                 goto out_err;
4427         }
4428
4429         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
4430                 err = -EOPNOTSUPP;
4431                 goto out_err;
4432         }
4433
4434         while (1) {
4435                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
4436                                       next_hop, &pinfo);
4437                 if (err == -ENOENT)
4438                         break;
4439                 if (err)
4440                         goto out_err;
4441
4442                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
4443                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
4444                                        wdev->netdev, dst, next_hop,
4445                                        &pinfo) < 0)
4446                         goto out;
4447
4448                 path_idx++;
4449         }
4450
4451
4452  out:
4453         cb->args[2] = path_idx;
4454         err = skb->len;
4455  out_err:
4456         nl80211_finish_wdev_dump(rdev);
4457         return err;
4458 }
4459
4460 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
4461 {
4462         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4463         int err;
4464         struct net_device *dev = info->user_ptr[1];
4465         struct mpath_info pinfo;
4466         struct sk_buff *msg;
4467         u8 *dst = NULL;
4468         u8 next_hop[ETH_ALEN];
4469
4470         memset(&pinfo, 0, sizeof(pinfo));
4471
4472         if (!info->attrs[NL80211_ATTR_MAC])
4473                 return -EINVAL;
4474
4475         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4476
4477         if (!rdev->ops->get_mpath)
4478                 return -EOPNOTSUPP;
4479
4480         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4481                 return -EOPNOTSUPP;
4482
4483         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
4484         if (err)
4485                 return err;
4486
4487         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4488         if (!msg)
4489                 return -ENOMEM;
4490
4491         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
4492                                  dev, dst, next_hop, &pinfo) < 0) {
4493                 nlmsg_free(msg);
4494                 return -ENOBUFS;
4495         }
4496
4497         return genlmsg_reply(msg, info);
4498 }
4499
4500 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
4501 {
4502         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4503         struct net_device *dev = info->user_ptr[1];
4504         u8 *dst = NULL;
4505         u8 *next_hop = NULL;
4506
4507         if (!info->attrs[NL80211_ATTR_MAC])
4508                 return -EINVAL;
4509
4510         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4511                 return -EINVAL;
4512
4513         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4514         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4515
4516         if (!rdev->ops->change_mpath)
4517                 return -EOPNOTSUPP;
4518
4519         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4520                 return -EOPNOTSUPP;
4521
4522         return rdev_change_mpath(rdev, dev, dst, next_hop);
4523 }
4524
4525 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
4526 {
4527         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4528         struct net_device *dev = info->user_ptr[1];
4529         u8 *dst = NULL;
4530         u8 *next_hop = NULL;
4531
4532         if (!info->attrs[NL80211_ATTR_MAC])
4533                 return -EINVAL;
4534
4535         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
4536                 return -EINVAL;
4537
4538         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4539         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
4540
4541         if (!rdev->ops->add_mpath)
4542                 return -EOPNOTSUPP;
4543
4544         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
4545                 return -EOPNOTSUPP;
4546
4547         return rdev_add_mpath(rdev, dev, dst, next_hop);
4548 }
4549
4550 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
4551 {
4552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4553         struct net_device *dev = info->user_ptr[1];
4554         u8 *dst = NULL;
4555
4556         if (info->attrs[NL80211_ATTR_MAC])
4557                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
4558
4559         if (!rdev->ops->del_mpath)
4560                 return -EOPNOTSUPP;
4561
4562         return rdev_del_mpath(rdev, dev, dst);
4563 }
4564
4565 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
4566 {
4567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4568         struct net_device *dev = info->user_ptr[1];
4569         struct wireless_dev *wdev = dev->ieee80211_ptr;
4570         struct bss_parameters params;
4571         int err;
4572
4573         memset(&params, 0, sizeof(params));
4574         /* default to not changing parameters */
4575         params.use_cts_prot = -1;
4576         params.use_short_preamble = -1;
4577         params.use_short_slot_time = -1;
4578         params.ap_isolate = -1;
4579         params.ht_opmode = -1;
4580         params.p2p_ctwindow = -1;
4581         params.p2p_opp_ps = -1;
4582
4583         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
4584                 params.use_cts_prot =
4585                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
4586         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
4587                 params.use_short_preamble =
4588                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
4589         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
4590                 params.use_short_slot_time =
4591                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
4592         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
4593                 params.basic_rates =
4594                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4595                 params.basic_rates_len =
4596                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
4597         }
4598         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
4599                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
4600         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
4601                 params.ht_opmode =
4602                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
4603
4604         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4605                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4606                         return -EINVAL;
4607                 params.p2p_ctwindow =
4608                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4609                 if (params.p2p_ctwindow < 0)
4610                         return -EINVAL;
4611                 if (params.p2p_ctwindow != 0 &&
4612                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4613                         return -EINVAL;
4614         }
4615
4616         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4617                 u8 tmp;
4618
4619                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4620                         return -EINVAL;
4621                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4622                 if (tmp > 1)
4623                         return -EINVAL;
4624                 params.p2p_opp_ps = tmp;
4625                 if (params.p2p_opp_ps &&
4626                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4627                         return -EINVAL;
4628         }
4629
4630         if (!rdev->ops->change_bss)
4631                 return -EOPNOTSUPP;
4632
4633         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4634             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4635                 return -EOPNOTSUPP;
4636
4637         wdev_lock(wdev);
4638         err = rdev_change_bss(rdev, dev, &params);
4639         wdev_unlock(wdev);
4640
4641         return err;
4642 }
4643
4644 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
4645         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
4646         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
4647         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
4648         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
4649         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
4650         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
4651         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
4652 };
4653
4654 static int parse_reg_rule(struct nlattr *tb[],
4655         struct ieee80211_reg_rule *reg_rule)
4656 {
4657         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
4658         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
4659
4660         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
4661                 return -EINVAL;
4662         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
4663                 return -EINVAL;
4664         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
4665                 return -EINVAL;
4666         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
4667                 return -EINVAL;
4668         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
4669                 return -EINVAL;
4670
4671         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
4672
4673         freq_range->start_freq_khz =
4674                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
4675         freq_range->end_freq_khz =
4676                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
4677         freq_range->max_bandwidth_khz =
4678                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
4679
4680         power_rule->max_eirp =
4681                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
4682
4683         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
4684                 power_rule->max_antenna_gain =
4685                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
4686
4687         if (tb[NL80211_ATTR_DFS_CAC_TIME])
4688                 reg_rule->dfs_cac_ms =
4689                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
4690
4691         return 0;
4692 }
4693
4694 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
4695 {
4696         char *data = NULL;
4697         enum nl80211_user_reg_hint_type user_reg_hint_type;
4698
4699         /*
4700          * You should only get this when cfg80211 hasn't yet initialized
4701          * completely when built-in to the kernel right between the time
4702          * window between nl80211_init() and regulatory_init(), if that is
4703          * even possible.
4704          */
4705         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
4706                 return -EINPROGRESS;
4707
4708         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
4709                 user_reg_hint_type =
4710                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
4711         else
4712                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
4713
4714         switch (user_reg_hint_type) {
4715         case NL80211_USER_REG_HINT_USER:
4716         case NL80211_USER_REG_HINT_CELL_BASE:
4717                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
4718                         return -EINVAL;
4719
4720                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
4721                 return regulatory_hint_user(data, user_reg_hint_type);
4722         case NL80211_USER_REG_HINT_INDOOR:
4723                 return regulatory_hint_indoor_user();
4724         default:
4725                 return -EINVAL;
4726         }
4727 }
4728
4729 static int nl80211_get_mesh_config(struct sk_buff *skb,
4730                                    struct genl_info *info)
4731 {
4732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4733         struct net_device *dev = info->user_ptr[1];
4734         struct wireless_dev *wdev = dev->ieee80211_ptr;
4735         struct mesh_config cur_params;
4736         int err = 0;
4737         void *hdr;
4738         struct nlattr *pinfoattr;
4739         struct sk_buff *msg;
4740
4741         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
4742                 return -EOPNOTSUPP;
4743
4744         if (!rdev->ops->get_mesh_config)
4745                 return -EOPNOTSUPP;
4746
4747         wdev_lock(wdev);
4748         /* If not connected, get default parameters */
4749         if (!wdev->mesh_id_len)
4750                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
4751         else
4752                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
4753         wdev_unlock(wdev);
4754
4755         if (err)
4756                 return err;
4757
4758         /* Draw up a netlink message to send back */
4759         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4760         if (!msg)
4761                 return -ENOMEM;
4762         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4763                              NL80211_CMD_GET_MESH_CONFIG);
4764         if (!hdr)
4765                 goto out;
4766         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
4767         if (!pinfoattr)
4768                 goto nla_put_failure;
4769         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4770             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
4771                         cur_params.dot11MeshRetryTimeout) ||
4772             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4773                         cur_params.dot11MeshConfirmTimeout) ||
4774             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
4775                         cur_params.dot11MeshHoldingTimeout) ||
4776             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
4777                         cur_params.dot11MeshMaxPeerLinks) ||
4778             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
4779                        cur_params.dot11MeshMaxRetries) ||
4780             nla_put_u8(msg, NL80211_MESHCONF_TTL,
4781                        cur_params.dot11MeshTTL) ||
4782             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
4783                        cur_params.element_ttl) ||
4784             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4785                        cur_params.auto_open_plinks) ||
4786             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4787                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
4788             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4789                        cur_params.dot11MeshHWMPmaxPREQretries) ||
4790             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
4791                         cur_params.path_refresh_time) ||
4792             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4793                         cur_params.min_discovery_timeout) ||
4794             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4795                         cur_params.dot11MeshHWMPactivePathTimeout) ||
4796             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4797                         cur_params.dot11MeshHWMPpreqMinInterval) ||
4798             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4799                         cur_params.dot11MeshHWMPperrMinInterval) ||
4800             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4801                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
4802             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
4803                        cur_params.dot11MeshHWMPRootMode) ||
4804             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4805                         cur_params.dot11MeshHWMPRannInterval) ||
4806             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4807                        cur_params.dot11MeshGateAnnouncementProtocol) ||
4808             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
4809                        cur_params.dot11MeshForwarding) ||
4810             nla_put_u32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
4811                         cur_params.rssi_threshold) ||
4812             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
4813                         cur_params.ht_opmode) ||
4814             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4815                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
4816             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4817                         cur_params.dot11MeshHWMProotInterval) ||
4818             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4819                         cur_params.dot11MeshHWMPconfirmationInterval) ||
4820             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
4821                         cur_params.power_mode) ||
4822             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
4823                         cur_params.dot11MeshAwakeWindowDuration) ||
4824             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
4825                         cur_params.plink_timeout))
4826                 goto nla_put_failure;
4827         nla_nest_end(msg, pinfoattr);
4828         genlmsg_end(msg, hdr);
4829         return genlmsg_reply(msg, info);
4830
4831  nla_put_failure:
4832         genlmsg_cancel(msg, hdr);
4833  out:
4834         nlmsg_free(msg);
4835         return -ENOBUFS;
4836 }
4837
4838 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
4839         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
4840         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
4841         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
4842         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
4843         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
4844         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
4845         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
4846         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
4847         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
4848         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
4849         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
4850         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
4851         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
4852         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
4853         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
4854         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
4855         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
4856         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
4857         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
4858         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
4859         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
4860         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
4861         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
4862         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
4863         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
4864         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
4865         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
4866         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
4867 };
4868
4869 static const struct nla_policy
4870         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
4871         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
4872         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
4873         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
4874         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
4875         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
4876         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
4877         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
4878                                     .len = IEEE80211_MAX_DATA_LEN },
4879         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
4880 };
4881
4882 static int nl80211_parse_mesh_config(struct genl_info *info,
4883                                      struct mesh_config *cfg,
4884                                      u32 *mask_out)
4885 {
4886         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
4887         u32 mask = 0;
4888
4889 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
4890 do {                                                                        \
4891         if (tb[attr]) {                                                     \
4892                 if (fn(tb[attr]) < min || fn(tb[attr]) > max)               \
4893                         return -EINVAL;                                     \
4894                 cfg->param = fn(tb[attr]);                                  \
4895                 mask |= (1 << (attr - 1));                                  \
4896         }                                                                   \
4897 } while (0)
4898
4899
4900         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
4901                 return -EINVAL;
4902         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
4903                              info->attrs[NL80211_ATTR_MESH_CONFIG],
4904                              nl80211_meshconf_params_policy))
4905                 return -EINVAL;
4906
4907         /* This makes sure that there aren't more than 32 mesh config
4908          * parameters (otherwise our bitfield scheme would not work.) */
4909         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
4910
4911         /* Fill in the params struct */
4912         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
4913                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
4914                                   nla_get_u16);
4915         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
4916                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
4917                                   nla_get_u16);
4918         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
4919                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
4920                                   nla_get_u16);
4921         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
4922                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
4923                                   nla_get_u16);
4924         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
4925                                   mask, NL80211_MESHCONF_MAX_RETRIES,
4926                                   nla_get_u8);
4927         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
4928                                   mask, NL80211_MESHCONF_TTL, nla_get_u8);
4929         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
4930                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
4931                                   nla_get_u8);
4932         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
4933                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
4934                                   nla_get_u8);
4935         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
4936                                   1, 255, mask,
4937                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
4938                                   nla_get_u32);
4939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
4940                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
4941                                   nla_get_u8);
4942         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
4943                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
4944                                   nla_get_u32);
4945         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
4946                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
4947                                   nla_get_u16);
4948         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
4949                                   1, 65535, mask,
4950                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
4951                                   nla_get_u32);
4952         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
4953                                   1, 65535, mask,
4954                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
4955                                   nla_get_u16);
4956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
4957                                   1, 65535, mask,
4958                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
4959                                   nla_get_u16);
4960         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4961                                   dot11MeshHWMPnetDiameterTraversalTime,
4962                                   1, 65535, mask,
4963                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
4964                                   nla_get_u16);
4965         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
4966                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
4967                                   nla_get_u8);
4968         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
4969                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
4970                                   nla_get_u16);
4971         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4972                                   dot11MeshGateAnnouncementProtocol, 0, 1,
4973                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
4974                                   nla_get_u8);
4975         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
4976                                   mask, NL80211_MESHCONF_FORWARDING,
4977                                   nla_get_u8);
4978         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
4979                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
4980                                   nla_get_s32);
4981         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, ht_opmode, 0, 16,
4982                                   mask, NL80211_MESHCONF_HT_OPMODE,
4983                                   nla_get_u16);
4984         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
4985                                   1, 65535, mask,
4986                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
4987                                   nla_get_u32);
4988         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
4989                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
4990                                   nla_get_u16);
4991         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
4992                                   dot11MeshHWMPconfirmationInterval,
4993                                   1, 65535, mask,
4994                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
4995                                   nla_get_u16);
4996         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
4997                                   NL80211_MESH_POWER_ACTIVE,
4998                                   NL80211_MESH_POWER_MAX,
4999                                   mask, NL80211_MESHCONF_POWER_MODE,
5000                                   nla_get_u32);
5001         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
5002                                   0, 65535, mask,
5003                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
5004         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 1, 0xffffffff,
5005                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
5006                                   nla_get_u32);
5007         if (mask_out)
5008                 *mask_out = mask;
5009
5010         return 0;
5011
5012 #undef FILL_IN_MESH_PARAM_IF_SET
5013 }
5014
5015 static int nl80211_parse_mesh_setup(struct genl_info *info,
5016                                      struct mesh_setup *setup)
5017 {
5018         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5019         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
5020
5021         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
5022                 return -EINVAL;
5023         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
5024                              info->attrs[NL80211_ATTR_MESH_SETUP],
5025                              nl80211_mesh_setup_params_policy))
5026                 return -EINVAL;
5027
5028         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
5029                 setup->sync_method =
5030                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
5031                  IEEE80211_SYNC_METHOD_VENDOR :
5032                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
5033
5034         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
5035                 setup->path_sel_proto =
5036                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
5037                  IEEE80211_PATH_PROTOCOL_VENDOR :
5038                  IEEE80211_PATH_PROTOCOL_HWMP;
5039
5040         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
5041                 setup->path_metric =
5042                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
5043                  IEEE80211_PATH_METRIC_VENDOR :
5044                  IEEE80211_PATH_METRIC_AIRTIME;
5045
5046
5047         if (tb[NL80211_MESH_SETUP_IE]) {
5048                 struct nlattr *ieattr =
5049                         tb[NL80211_MESH_SETUP_IE];
5050                 if (!is_valid_ie_attr(ieattr))
5051                         return -EINVAL;
5052                 setup->ie = nla_data(ieattr);
5053                 setup->ie_len = nla_len(ieattr);
5054         }
5055         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
5056             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
5057                 return -EINVAL;
5058         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
5059         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
5060         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
5061         if (setup->is_secure)
5062                 setup->user_mpm = true;
5063
5064         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
5065                 if (!setup->user_mpm)
5066                         return -EINVAL;
5067                 setup->auth_id =
5068                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
5069         }
5070
5071         return 0;
5072 }
5073
5074 static int nl80211_update_mesh_config(struct sk_buff *skb,
5075                                       struct genl_info *info)
5076 {
5077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5078         struct net_device *dev = info->user_ptr[1];
5079         struct wireless_dev *wdev = dev->ieee80211_ptr;
5080         struct mesh_config cfg;
5081         u32 mask;
5082         int err;
5083
5084         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5085                 return -EOPNOTSUPP;
5086
5087         if (!rdev->ops->update_mesh_config)
5088                 return -EOPNOTSUPP;
5089
5090         err = nl80211_parse_mesh_config(info, &cfg, &mask);
5091         if (err)
5092                 return err;
5093
5094         wdev_lock(wdev);
5095         if (!wdev->mesh_id_len)
5096                 err = -ENOLINK;
5097
5098         if (!err)
5099                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
5100
5101         wdev_unlock(wdev);
5102
5103         return err;
5104 }
5105
5106 static int nl80211_get_reg(struct sk_buff *skb, struct genl_info *info)
5107 {
5108         const struct ieee80211_regdomain *regdom;
5109         struct sk_buff *msg;
5110         void *hdr = NULL;
5111         struct nlattr *nl_reg_rules;
5112         unsigned int i;
5113
5114         if (!cfg80211_regdomain)
5115                 return -EINVAL;
5116
5117         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5118         if (!msg)
5119                 return -ENOBUFS;
5120
5121         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5122                              NL80211_CMD_GET_REG);
5123         if (!hdr)
5124                 goto put_failure;
5125
5126         if (reg_last_request_cell_base() &&
5127             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
5128                         NL80211_USER_REG_HINT_CELL_BASE))
5129                 goto nla_put_failure;
5130
5131         rcu_read_lock();
5132         regdom = rcu_dereference(cfg80211_regdomain);
5133
5134         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
5135             (regdom->dfs_region &&
5136              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
5137                 goto nla_put_failure_rcu;
5138
5139         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
5140         if (!nl_reg_rules)
5141                 goto nla_put_failure_rcu;
5142
5143         for (i = 0; i < regdom->n_reg_rules; i++) {
5144                 struct nlattr *nl_reg_rule;
5145                 const struct ieee80211_reg_rule *reg_rule;
5146                 const struct ieee80211_freq_range *freq_range;
5147                 const struct ieee80211_power_rule *power_rule;
5148                 unsigned int max_bandwidth_khz;
5149
5150                 reg_rule = &regdom->reg_rules[i];
5151                 freq_range = &reg_rule->freq_range;
5152                 power_rule = &reg_rule->power_rule;
5153
5154                 nl_reg_rule = nla_nest_start(msg, i);
5155                 if (!nl_reg_rule)
5156                         goto nla_put_failure_rcu;
5157
5158                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
5159                 if (!max_bandwidth_khz)
5160                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
5161                                                                   reg_rule);
5162
5163                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
5164                                 reg_rule->flags) ||
5165                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
5166                                 freq_range->start_freq_khz) ||
5167                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
5168                                 freq_range->end_freq_khz) ||
5169                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
5170                                 max_bandwidth_khz) ||
5171                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
5172                                 power_rule->max_antenna_gain) ||
5173                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
5174                                 power_rule->max_eirp) ||
5175                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
5176                                 reg_rule->dfs_cac_ms))
5177                         goto nla_put_failure_rcu;
5178
5179                 nla_nest_end(msg, nl_reg_rule);
5180         }
5181         rcu_read_unlock();
5182
5183         nla_nest_end(msg, nl_reg_rules);
5184
5185         genlmsg_end(msg, hdr);
5186         return genlmsg_reply(msg, info);
5187
5188 nla_put_failure_rcu:
5189         rcu_read_unlock();
5190 nla_put_failure:
5191         genlmsg_cancel(msg, hdr);
5192 put_failure:
5193         nlmsg_free(msg);
5194         return -EMSGSIZE;
5195 }
5196
5197 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
5198 {
5199         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
5200         struct nlattr *nl_reg_rule;
5201         char *alpha2 = NULL;
5202         int rem_reg_rules = 0, r = 0;
5203         u32 num_rules = 0, rule_idx = 0, size_of_regd;
5204         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
5205         struct ieee80211_regdomain *rd = NULL;
5206
5207         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5208                 return -EINVAL;
5209
5210         if (!info->attrs[NL80211_ATTR_REG_RULES])
5211                 return -EINVAL;
5212
5213         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5214
5215         if (info->attrs[NL80211_ATTR_DFS_REGION])
5216                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
5217
5218         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5219                             rem_reg_rules) {
5220                 num_rules++;
5221                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
5222                         return -EINVAL;
5223         }
5224
5225         if (!reg_is_valid_request(alpha2))
5226                 return -EINVAL;
5227
5228         size_of_regd = sizeof(struct ieee80211_regdomain) +
5229                        num_rules * sizeof(struct ieee80211_reg_rule);
5230
5231         rd = kzalloc(size_of_regd, GFP_KERNEL);
5232         if (!rd)
5233                 return -ENOMEM;
5234
5235         rd->n_reg_rules = num_rules;
5236         rd->alpha2[0] = alpha2[0];
5237         rd->alpha2[1] = alpha2[1];
5238
5239         /*
5240          * Disable DFS master mode if the DFS region was
5241          * not supported or known on this kernel.
5242          */
5243         if (reg_supported_dfs_region(dfs_region))
5244                 rd->dfs_region = dfs_region;
5245
5246         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
5247                             rem_reg_rules) {
5248                 r = nla_parse(tb, NL80211_REG_RULE_ATTR_MAX,
5249                               nla_data(nl_reg_rule), nla_len(nl_reg_rule),
5250                               reg_rule_policy);
5251                 if (r)
5252                         goto bad_reg;
5253                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
5254                 if (r)
5255                         goto bad_reg;
5256
5257                 rule_idx++;
5258
5259                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
5260                         r = -EINVAL;
5261                         goto bad_reg;
5262                 }
5263         }
5264
5265         r = set_regdom(rd);
5266         /* set_regdom took ownership */
5267         rd = NULL;
5268
5269  bad_reg:
5270         kfree(rd);
5271         return r;
5272 }
5273
5274 static int validate_scan_freqs(struct nlattr *freqs)
5275 {
5276         struct nlattr *attr1, *attr2;
5277         int n_channels = 0, tmp1, tmp2;
5278
5279         nla_for_each_nested(attr1, freqs, tmp1) {
5280                 n_channels++;
5281                 /*
5282                  * Some hardware has a limited channel list for
5283                  * scanning, and it is pretty much nonsensical
5284                  * to scan for a channel twice, so disallow that
5285                  * and don't require drivers to check that the
5286                  * channel list they get isn't longer than what
5287                  * they can scan, as long as they can scan all
5288                  * the channels they registered at once.
5289                  */
5290                 nla_for_each_nested(attr2, freqs, tmp2)
5291                         if (attr1 != attr2 &&
5292                             nla_get_u32(attr1) == nla_get_u32(attr2))
5293                                 return 0;
5294         }
5295
5296         return n_channels;
5297 }
5298
5299 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
5300 {
5301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5302         struct wireless_dev *wdev = info->user_ptr[1];
5303         struct cfg80211_scan_request *request;
5304         struct nlattr *attr;
5305         struct wiphy *wiphy;
5306         int err, tmp, n_ssids = 0, n_channels, i;
5307         size_t ie_len;
5308
5309         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5310                 return -EINVAL;
5311
5312         wiphy = &rdev->wiphy;
5313
5314         if (!rdev->ops->scan)
5315                 return -EOPNOTSUPP;
5316
5317         if (rdev->scan_req || rdev->scan_msg) {
5318                 err = -EBUSY;
5319                 goto unlock;
5320         }
5321
5322         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5323                 n_channels = validate_scan_freqs(
5324                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5325                 if (!n_channels) {
5326                         err = -EINVAL;
5327                         goto unlock;
5328                 }
5329         } else {
5330                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5331         }
5332
5333         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5334                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
5335                         n_ssids++;
5336
5337         if (n_ssids > wiphy->max_scan_ssids) {
5338                 err = -EINVAL;
5339                 goto unlock;
5340         }
5341
5342         if (info->attrs[NL80211_ATTR_IE])
5343                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5344         else
5345                 ie_len = 0;
5346
5347         if (ie_len > wiphy->max_scan_ie_len) {
5348                 err = -EINVAL;
5349                 goto unlock;
5350         }
5351
5352         request = kzalloc(sizeof(*request)
5353                         + sizeof(*request->ssids) * n_ssids
5354                         + sizeof(*request->channels) * n_channels
5355                         + ie_len, GFP_KERNEL);
5356         if (!request) {
5357                 err = -ENOMEM;
5358                 goto unlock;
5359         }
5360
5361         if (n_ssids)
5362                 request->ssids = (void *)&request->channels[n_channels];
5363         request->n_ssids = n_ssids;
5364         if (ie_len) {
5365                 if (request->ssids)
5366                         request->ie = (void *)(request->ssids + n_ssids);
5367                 else
5368                         request->ie = (void *)(request->channels + n_channels);
5369         }
5370
5371         i = 0;
5372         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5373                 /* user specified, bail out if channel not found */
5374                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
5375                         struct ieee80211_channel *chan;
5376
5377                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5378
5379                         if (!chan) {
5380                                 err = -EINVAL;
5381                                 goto out_free;
5382                         }
5383
5384                         /* ignore disabled channels */
5385                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5386                                 continue;
5387
5388                         request->channels[i] = chan;
5389                         i++;
5390                 }
5391         } else {
5392                 enum ieee80211_band band;
5393
5394                 /* all channels */
5395                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5396                         int j;
5397                         if (!wiphy->bands[band])
5398                                 continue;
5399                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5400                                 struct ieee80211_channel *chan;
5401
5402                                 chan = &wiphy->bands[band]->channels[j];
5403
5404                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5405                                         continue;
5406
5407                                 request->channels[i] = chan;
5408                                 i++;
5409                         }
5410                 }
5411         }
5412
5413         if (!i) {
5414                 err = -EINVAL;
5415                 goto out_free;
5416         }
5417
5418         request->n_channels = i;
5419
5420         i = 0;
5421         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5422                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
5423                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5424                                 err = -EINVAL;
5425                                 goto out_free;
5426                         }
5427                         request->ssids[i].ssid_len = nla_len(attr);
5428                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
5429                         i++;
5430                 }
5431         }
5432
5433         if (info->attrs[NL80211_ATTR_IE]) {
5434                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5435                 memcpy((void *)request->ie,
5436                        nla_data(info->attrs[NL80211_ATTR_IE]),
5437                        request->ie_len);
5438         }
5439
5440         for (i = 0; i < IEEE80211_NUM_BANDS; i++)
5441                 if (wiphy->bands[i])
5442                         request->rates[i] =
5443                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
5444
5445         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
5446                 nla_for_each_nested(attr,
5447                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
5448                                     tmp) {
5449                         enum ieee80211_band band = nla_type(attr);
5450
5451                         if (band < 0 || band >= IEEE80211_NUM_BANDS) {
5452                                 err = -EINVAL;
5453                                 goto out_free;
5454                         }
5455
5456                         if (!wiphy->bands[band])
5457                                 continue;
5458
5459                         err = ieee80211_get_ratemask(wiphy->bands[band],
5460                                                      nla_data(attr),
5461                                                      nla_len(attr),
5462                                                      &request->rates[band]);
5463                         if (err)
5464                                 goto out_free;
5465                 }
5466         }
5467
5468         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5469                 request->flags = nla_get_u32(
5470                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5471                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5472                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5473                         err = -EOPNOTSUPP;
5474                         goto out_free;
5475                 }
5476         }
5477
5478         request->no_cck =
5479                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
5480
5481         request->wdev = wdev;
5482         request->wiphy = &rdev->wiphy;
5483         request->scan_start = jiffies;
5484
5485         rdev->scan_req = request;
5486         err = rdev_scan(rdev, request);
5487
5488         if (!err) {
5489                 nl80211_send_scan_start(rdev, wdev);
5490                 if (wdev->netdev)
5491                         dev_hold(wdev->netdev);
5492         } else {
5493  out_free:
5494                 rdev->scan_req = NULL;
5495                 kfree(request);
5496         }
5497
5498  unlock:
5499         return err;
5500 }
5501
5502 static int nl80211_start_sched_scan(struct sk_buff *skb,
5503                                     struct genl_info *info)
5504 {
5505         struct cfg80211_sched_scan_request *request;
5506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5507         struct net_device *dev = info->user_ptr[1];
5508         struct nlattr *attr;
5509         struct wiphy *wiphy;
5510         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i;
5511         u32 interval;
5512         enum ieee80211_band band;
5513         size_t ie_len;
5514         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
5515         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
5516
5517         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5518             !rdev->ops->sched_scan_start)
5519                 return -EOPNOTSUPP;
5520
5521         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
5522                 return -EINVAL;
5523
5524         if (!info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
5525                 return -EINVAL;
5526
5527         interval = nla_get_u32(info->attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
5528         if (interval == 0)
5529                 return -EINVAL;
5530
5531         wiphy = &rdev->wiphy;
5532
5533         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5534                 n_channels = validate_scan_freqs(
5535                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
5536                 if (!n_channels)
5537                         return -EINVAL;
5538         } else {
5539                 n_channels = ieee80211_get_num_supported_channels(wiphy);
5540         }
5541
5542         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
5543                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5544                                     tmp)
5545                         n_ssids++;
5546
5547         if (n_ssids > wiphy->max_sched_scan_ssids)
5548                 return -EINVAL;
5549
5550         /*
5551          * First, count the number of 'real' matchsets. Due to an issue with
5552          * the old implementation, matchsets containing only the RSSI attribute
5553          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
5554          * RSSI for all matchsets, rather than their own matchset for reporting
5555          * all APs with a strong RSSI. This is needed to be compatible with
5556          * older userspace that treated a matchset with only the RSSI as the
5557          * global RSSI for all other matchsets - if there are other matchsets.
5558          */
5559         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5560                 nla_for_each_nested(attr,
5561                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5562                                     tmp) {
5563                         struct nlattr *rssi;
5564
5565                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5566                                         nla_data(attr), nla_len(attr),
5567                                         nl80211_match_policy);
5568                         if (err)
5569                                 return err;
5570                         /* add other standalone attributes here */
5571                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID]) {
5572                                 n_match_sets++;
5573                                 continue;
5574                         }
5575                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5576                         if (rssi)
5577                                 default_match_rssi = nla_get_s32(rssi);
5578                 }
5579         }
5580
5581         /* However, if there's no other matchset, add the RSSI one */
5582         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
5583                 n_match_sets = 1;
5584
5585         if (n_match_sets > wiphy->max_match_sets)
5586                 return -EINVAL;
5587
5588         if (info->attrs[NL80211_ATTR_IE])
5589                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
5590         else
5591                 ie_len = 0;
5592
5593         if (ie_len > wiphy->max_sched_scan_ie_len)
5594                 return -EINVAL;
5595
5596         if (rdev->sched_scan_req) {
5597                 err = -EINPROGRESS;
5598                 goto out;
5599         }
5600
5601         request = kzalloc(sizeof(*request)
5602                         + sizeof(*request->ssids) * n_ssids
5603                         + sizeof(*request->match_sets) * n_match_sets
5604                         + sizeof(*request->channels) * n_channels
5605                         + ie_len, GFP_KERNEL);
5606         if (!request) {
5607                 err = -ENOMEM;
5608                 goto out;
5609         }
5610
5611         if (n_ssids)
5612                 request->ssids = (void *)&request->channels[n_channels];
5613         request->n_ssids = n_ssids;
5614         if (ie_len) {
5615                 if (request->ssids)
5616                         request->ie = (void *)(request->ssids + n_ssids);
5617                 else
5618                         request->ie = (void *)(request->channels + n_channels);
5619         }
5620
5621         if (n_match_sets) {
5622                 if (request->ie)
5623                         request->match_sets = (void *)(request->ie + ie_len);
5624                 else if (request->ssids)
5625                         request->match_sets =
5626                                 (void *)(request->ssids + n_ssids);
5627                 else
5628                         request->match_sets =
5629                                 (void *)(request->channels + n_channels);
5630         }
5631         request->n_match_sets = n_match_sets;
5632
5633         i = 0;
5634         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
5635                 /* user specified, bail out if channel not found */
5636                 nla_for_each_nested(attr,
5637                                     info->attrs[NL80211_ATTR_SCAN_FREQUENCIES],
5638                                     tmp) {
5639                         struct ieee80211_channel *chan;
5640
5641                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
5642
5643                         if (!chan) {
5644                                 err = -EINVAL;
5645                                 goto out_free;
5646                         }
5647
5648                         /* ignore disabled channels */
5649                         if (chan->flags & IEEE80211_CHAN_DISABLED)
5650                                 continue;
5651
5652                         request->channels[i] = chan;
5653                         i++;
5654                 }
5655         } else {
5656                 /* all channels */
5657                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
5658                         int j;
5659                         if (!wiphy->bands[band])
5660                                 continue;
5661                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
5662                                 struct ieee80211_channel *chan;
5663
5664                                 chan = &wiphy->bands[band]->channels[j];
5665
5666                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
5667                                         continue;
5668
5669                                 request->channels[i] = chan;
5670                                 i++;
5671                         }
5672                 }
5673         }
5674
5675         if (!i) {
5676                 err = -EINVAL;
5677                 goto out_free;
5678         }
5679
5680         request->n_channels = i;
5681
5682         i = 0;
5683         if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) {
5684                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS],
5685                                     tmp) {
5686                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
5687                                 err = -EINVAL;
5688                                 goto out_free;
5689                         }
5690                         request->ssids[i].ssid_len = nla_len(attr);
5691                         memcpy(request->ssids[i].ssid, nla_data(attr),
5692                                nla_len(attr));
5693                         i++;
5694                 }
5695         }
5696
5697         i = 0;
5698         if (info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
5699                 nla_for_each_nested(attr,
5700                                     info->attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
5701                                     tmp) {
5702                         struct nlattr *ssid, *rssi;
5703
5704                         err = nla_parse(tb, NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
5705                                         nla_data(attr), nla_len(attr),
5706                                         nl80211_match_policy);
5707                         if (err)
5708                                 goto out_free;
5709                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
5710                         if (ssid) {
5711                                 if (WARN_ON(i >= n_match_sets)) {
5712                                         /* this indicates a programming error,
5713                                          * the loop above should have verified
5714                                          * things properly
5715                                          */
5716                                         err = -EINVAL;
5717                                         goto out_free;
5718                                 }
5719
5720                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
5721                                         err = -EINVAL;
5722                                         goto out_free;
5723                                 }
5724                                 memcpy(request->match_sets[i].ssid.ssid,
5725                                        nla_data(ssid), nla_len(ssid));
5726                                 request->match_sets[i].ssid.ssid_len =
5727                                         nla_len(ssid);
5728                                 /* special attribute - old implemenation w/a */
5729                                 request->match_sets[i].rssi_thold =
5730                                         default_match_rssi;
5731                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
5732                                 if (rssi)
5733                                         request->match_sets[i].rssi_thold =
5734                                                 nla_get_s32(rssi);
5735                         }
5736                         i++;
5737                 }
5738
5739                 /* there was no other matchset, so the RSSI one is alone */
5740                 if (i == 0)
5741                         request->match_sets[0].rssi_thold = default_match_rssi;
5742
5743                 request->min_rssi_thold = INT_MAX;
5744                 for (i = 0; i < n_match_sets; i++)
5745                         request->min_rssi_thold =
5746                                 min(request->match_sets[i].rssi_thold,
5747                                     request->min_rssi_thold);
5748         } else {
5749                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
5750         }
5751
5752         if (ie_len) {
5753                 request->ie_len = ie_len;
5754                 memcpy((void *)request->ie,
5755                        nla_data(info->attrs[NL80211_ATTR_IE]),
5756                        request->ie_len);
5757         }
5758
5759         if (info->attrs[NL80211_ATTR_SCAN_FLAGS]) {
5760                 request->flags = nla_get_u32(
5761                         info->attrs[NL80211_ATTR_SCAN_FLAGS]);
5762                 if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
5763                     !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) {
5764                         err = -EOPNOTSUPP;
5765                         goto out_free;
5766                 }
5767         }
5768
5769         request->dev = dev;
5770         request->wiphy = &rdev->wiphy;
5771         request->interval = interval;
5772         request->scan_start = jiffies;
5773
5774         err = rdev_sched_scan_start(rdev, dev, request);
5775         if (!err) {
5776                 rdev->sched_scan_req = request;
5777                 nl80211_send_sched_scan(rdev, dev,
5778                                         NL80211_CMD_START_SCHED_SCAN);
5779                 goto out;
5780         }
5781
5782 out_free:
5783         kfree(request);
5784 out:
5785         return err;
5786 }
5787
5788 static int nl80211_stop_sched_scan(struct sk_buff *skb,
5789                                    struct genl_info *info)
5790 {
5791         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5792
5793         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN) ||
5794             !rdev->ops->sched_scan_stop)
5795                 return -EOPNOTSUPP;
5796
5797         return __cfg80211_stop_sched_scan(rdev, false);
5798 }
5799
5800 static int nl80211_start_radar_detection(struct sk_buff *skb,
5801                                          struct genl_info *info)
5802 {
5803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5804         struct net_device *dev = info->user_ptr[1];
5805         struct wireless_dev *wdev = dev->ieee80211_ptr;
5806         struct cfg80211_chan_def chandef;
5807         enum nl80211_dfs_regions dfs_region;
5808         unsigned int cac_time_ms;
5809         int err;
5810
5811         dfs_region = reg_get_dfs_region(wdev->wiphy);
5812         if (dfs_region == NL80211_DFS_UNSET)
5813                 return -EINVAL;
5814
5815         err = nl80211_parse_chandef(rdev, info, &chandef);
5816         if (err)
5817                 return err;
5818
5819         if (netif_carrier_ok(dev))
5820                 return -EBUSY;
5821
5822         if (wdev->cac_started)
5823                 return -EBUSY;
5824
5825         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
5826                                             wdev->iftype);
5827         if (err < 0)
5828                 return err;
5829
5830         if (err == 0)
5831                 return -EINVAL;
5832
5833         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
5834                 return -EINVAL;
5835
5836         if (!rdev->ops->start_radar_detection)
5837                 return -EOPNOTSUPP;
5838
5839         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
5840         if (WARN_ON(!cac_time_ms))
5841                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
5842
5843         err = rdev->ops->start_radar_detection(&rdev->wiphy, dev, &chandef,
5844                                                cac_time_ms);
5845         if (!err) {
5846                 wdev->chandef = chandef;
5847                 wdev->cac_started = true;
5848                 wdev->cac_start_time = jiffies;
5849                 wdev->cac_time_ms = cac_time_ms;
5850         }
5851         return err;
5852 }
5853
5854 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
5855 {
5856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5857         struct net_device *dev = info->user_ptr[1];
5858         struct wireless_dev *wdev = dev->ieee80211_ptr;
5859         struct cfg80211_csa_settings params;
5860         /* csa_attrs is defined static to avoid waste of stack size - this
5861          * function is called under RTNL lock, so this should not be a problem.
5862          */
5863         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
5864         u8 radar_detect_width = 0;
5865         int err;
5866         bool need_new_beacon = false;
5867
5868         if (!rdev->ops->channel_switch ||
5869             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
5870                 return -EOPNOTSUPP;
5871
5872         switch (dev->ieee80211_ptr->iftype) {
5873         case NL80211_IFTYPE_AP:
5874         case NL80211_IFTYPE_P2P_GO:
5875                 need_new_beacon = true;
5876
5877                 /* useless if AP is not running */
5878                 if (!wdev->beacon_interval)
5879                         return -ENOTCONN;
5880                 break;
5881         case NL80211_IFTYPE_ADHOC:
5882                 if (!wdev->ssid_len)
5883                         return -ENOTCONN;
5884                 break;
5885         case NL80211_IFTYPE_MESH_POINT:
5886                 if (!wdev->mesh_id_len)
5887                         return -ENOTCONN;
5888                 break;
5889         default:
5890                 return -EOPNOTSUPP;
5891         }
5892
5893         memset(&params, 0, sizeof(params));
5894
5895         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
5896             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
5897                 return -EINVAL;
5898
5899         /* only important for AP, IBSS and mesh create IEs internally */
5900         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
5901                 return -EINVAL;
5902
5903         params.count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
5904
5905         if (!need_new_beacon)
5906                 goto skip_beacons;
5907
5908         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
5909         if (err)
5910                 return err;
5911
5912         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
5913                                info->attrs[NL80211_ATTR_CSA_IES],
5914                                nl80211_policy);
5915         if (err)
5916                 return err;
5917
5918         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
5919         if (err)
5920                 return err;
5921
5922         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
5923                 return -EINVAL;
5924
5925         params.counter_offset_beacon =
5926                 nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
5927         if (params.counter_offset_beacon >= params.beacon_csa.tail_len)
5928                 return -EINVAL;
5929
5930         /* sanity check - counters should be the same */
5931         if (params.beacon_csa.tail[params.counter_offset_beacon] !=
5932             params.count)
5933                 return -EINVAL;
5934
5935         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
5936                 params.counter_offset_presp =
5937                         nla_get_u16(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
5938                 if (params.counter_offset_presp >=
5939                     params.beacon_csa.probe_resp_len)
5940                         return -EINVAL;
5941
5942                 if (params.beacon_csa.probe_resp[params.counter_offset_presp] !=
5943                     params.count)
5944                         return -EINVAL;
5945         }
5946
5947 skip_beacons:
5948         err = nl80211_parse_chandef(rdev, info, &params.chandef);
5949         if (err)
5950                 return err;
5951
5952         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &params.chandef,
5953                                      wdev->iftype))
5954                 return -EINVAL;
5955
5956         err = cfg80211_chandef_dfs_required(wdev->wiphy,
5957                                             &params.chandef,
5958                                             wdev->iftype);
5959         if (err < 0)
5960                 return err;
5961
5962         if (err > 0) {
5963                 radar_detect_width = BIT(params.chandef.width);
5964                 params.radar_required = true;
5965         }
5966
5967         /* TODO: I left this here for now.  With channel switch, the
5968          * verification is a bit more complicated, because we only do
5969          * it later when the channel switch really happens.
5970          */
5971         err = cfg80211_can_use_iftype_chan(rdev, wdev, wdev->iftype,
5972                                            params.chandef.chan,
5973                                            CHAN_MODE_SHARED,
5974                                            radar_detect_width);
5975         if (err)
5976                 return err;
5977
5978         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
5979                 params.block_tx = true;
5980
5981         wdev_lock(wdev);
5982         err = rdev_channel_switch(rdev, dev, &params);
5983         wdev_unlock(wdev);
5984
5985         return err;
5986 }
5987
5988 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
5989                             u32 seq, int flags,
5990                             struct cfg80211_registered_device *rdev,
5991                             struct wireless_dev *wdev,
5992                             struct cfg80211_internal_bss *intbss)
5993 {
5994         struct cfg80211_bss *res = &intbss->pub;
5995         const struct cfg80211_bss_ies *ies;
5996         void *hdr;
5997         struct nlattr *bss;
5998         bool tsf = false;
5999
6000         ASSERT_WDEV_LOCK(wdev);
6001
6002         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6003                              NL80211_CMD_NEW_SCAN_RESULTS);
6004         if (!hdr)
6005                 return -1;
6006
6007         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6008
6009         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
6010                 goto nla_put_failure;
6011         if (wdev->netdev &&
6012             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
6013                 goto nla_put_failure;
6014         if (nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
6015                 goto nla_put_failure;
6016
6017         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
6018         if (!bss)
6019                 goto nla_put_failure;
6020         if ((!is_zero_ether_addr(res->bssid) &&
6021              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
6022                 goto nla_put_failure;
6023
6024         rcu_read_lock();
6025         ies = rcu_dereference(res->ies);
6026         if (ies) {
6027                 if (nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6028                         goto fail_unlock_rcu;
6029                 tsf = true;
6030                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
6031                                         ies->len, ies->data))
6032                         goto fail_unlock_rcu;
6033         }
6034         ies = rcu_dereference(res->beacon_ies);
6035         if (ies) {
6036                 if (!tsf && nla_put_u64(msg, NL80211_BSS_TSF, ies->tsf))
6037                         goto fail_unlock_rcu;
6038                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
6039                                         ies->len, ies->data))
6040                         goto fail_unlock_rcu;
6041         }
6042         rcu_read_unlock();
6043
6044         if (res->beacon_interval &&
6045             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
6046                 goto nla_put_failure;
6047         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
6048             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
6049             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
6050             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
6051                         jiffies_to_msecs(jiffies - intbss->ts)))
6052                 goto nla_put_failure;
6053
6054         switch (rdev->wiphy.signal_type) {
6055         case CFG80211_SIGNAL_TYPE_MBM:
6056                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
6057                         goto nla_put_failure;
6058                 break;
6059         case CFG80211_SIGNAL_TYPE_UNSPEC:
6060                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
6061                         goto nla_put_failure;
6062                 break;
6063         default:
6064                 break;
6065         }
6066
6067         switch (wdev->iftype) {
6068         case NL80211_IFTYPE_P2P_CLIENT:
6069         case NL80211_IFTYPE_STATION:
6070                 if (intbss == wdev->current_bss &&
6071                     nla_put_u32(msg, NL80211_BSS_STATUS,
6072                                 NL80211_BSS_STATUS_ASSOCIATED))
6073                         goto nla_put_failure;
6074                 break;
6075         case NL80211_IFTYPE_ADHOC:
6076                 if (intbss == wdev->current_bss &&
6077                     nla_put_u32(msg, NL80211_BSS_STATUS,
6078                                 NL80211_BSS_STATUS_IBSS_JOINED))
6079                         goto nla_put_failure;
6080                 break;
6081         default:
6082                 break;
6083         }
6084
6085         nla_nest_end(msg, bss);
6086
6087         return genlmsg_end(msg, hdr);
6088
6089  fail_unlock_rcu:
6090         rcu_read_unlock();
6091  nla_put_failure:
6092         genlmsg_cancel(msg, hdr);
6093         return -EMSGSIZE;
6094 }
6095
6096 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
6097 {
6098         struct cfg80211_registered_device *rdev;
6099         struct cfg80211_internal_bss *scan;
6100         struct wireless_dev *wdev;
6101         int start = cb->args[2], idx = 0;
6102         int err;
6103
6104         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6105         if (err)
6106                 return err;
6107
6108         wdev_lock(wdev);
6109         spin_lock_bh(&rdev->bss_lock);
6110         cfg80211_bss_expire(rdev);
6111
6112         cb->seq = rdev->bss_generation;
6113
6114         list_for_each_entry(scan, &rdev->bss_list, list) {
6115                 if (++idx <= start)
6116                         continue;
6117                 if (nl80211_send_bss(skb, cb,
6118                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6119                                 rdev, wdev, scan) < 0) {
6120                         idx--;
6121                         break;
6122                 }
6123         }
6124
6125         spin_unlock_bh(&rdev->bss_lock);
6126         wdev_unlock(wdev);
6127
6128         cb->args[2] = idx;
6129         nl80211_finish_wdev_dump(rdev);
6130
6131         return skb->len;
6132 }
6133
6134 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
6135                                 int flags, struct net_device *dev,
6136                                 struct survey_info *survey)
6137 {
6138         void *hdr;
6139         struct nlattr *infoattr;
6140
6141         hdr = nl80211hdr_put(msg, portid, seq, flags,
6142                              NL80211_CMD_NEW_SURVEY_RESULTS);
6143         if (!hdr)
6144                 return -ENOMEM;
6145
6146         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
6147                 goto nla_put_failure;
6148
6149         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
6150         if (!infoattr)
6151                 goto nla_put_failure;
6152
6153         if (nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
6154                         survey->channel->center_freq))
6155                 goto nla_put_failure;
6156
6157         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
6158             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
6159                 goto nla_put_failure;
6160         if ((survey->filled & SURVEY_INFO_IN_USE) &&
6161             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
6162                 goto nla_put_failure;
6163         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME) &&
6164             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME,
6165                         survey->channel_time))
6166                 goto nla_put_failure;
6167         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_BUSY) &&
6168             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_BUSY,
6169                         survey->channel_time_busy))
6170                 goto nla_put_failure;
6171         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_EXT_BUSY) &&
6172             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_EXT_BUSY,
6173                         survey->channel_time_ext_busy))
6174                 goto nla_put_failure;
6175         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_RX) &&
6176             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_RX,
6177                         survey->channel_time_rx))
6178                 goto nla_put_failure;
6179         if ((survey->filled & SURVEY_INFO_CHANNEL_TIME_TX) &&
6180             nla_put_u64(msg, NL80211_SURVEY_INFO_CHANNEL_TIME_TX,
6181                         survey->channel_time_tx))
6182                 goto nla_put_failure;
6183
6184         nla_nest_end(msg, infoattr);
6185
6186         return genlmsg_end(msg, hdr);
6187
6188  nla_put_failure:
6189         genlmsg_cancel(msg, hdr);
6190         return -EMSGSIZE;
6191 }
6192
6193 static int nl80211_dump_survey(struct sk_buff *skb,
6194                         struct netlink_callback *cb)
6195 {
6196         struct survey_info survey;
6197         struct cfg80211_registered_device *rdev;
6198         struct wireless_dev *wdev;
6199         int survey_idx = cb->args[2];
6200         int res;
6201
6202         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
6203         if (res)
6204                 return res;
6205
6206         if (!wdev->netdev) {
6207                 res = -EINVAL;
6208                 goto out_err;
6209         }
6210
6211         if (!rdev->ops->dump_survey) {
6212                 res = -EOPNOTSUPP;
6213                 goto out_err;
6214         }
6215
6216         while (1) {
6217                 struct ieee80211_channel *chan;
6218
6219                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
6220                 if (res == -ENOENT)
6221                         break;
6222                 if (res)
6223                         goto out_err;
6224
6225                 /* Survey without a channel doesn't make sense */
6226                 if (!survey.channel) {
6227                         res = -EINVAL;
6228                         goto out;
6229                 }
6230
6231                 chan = ieee80211_get_channel(&rdev->wiphy,
6232                                              survey.channel->center_freq);
6233                 if (!chan || chan->flags & IEEE80211_CHAN_DISABLED) {
6234                         survey_idx++;
6235                         continue;
6236                 }
6237
6238                 if (nl80211_send_survey(skb,
6239                                 NETLINK_CB(cb->skb).portid,
6240                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6241                                 wdev->netdev, &survey) < 0)
6242                         goto out;
6243                 survey_idx++;
6244         }
6245
6246  out:
6247         cb->args[2] = survey_idx;
6248         res = skb->len;
6249  out_err:
6250         nl80211_finish_wdev_dump(rdev);
6251         return res;
6252 }
6253
6254 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
6255 {
6256         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
6257                                   NL80211_WPA_VERSION_2));
6258 }
6259
6260 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
6261 {
6262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6263         struct net_device *dev = info->user_ptr[1];
6264         struct ieee80211_channel *chan;
6265         const u8 *bssid, *ssid, *ie = NULL, *sae_data = NULL;
6266         int err, ssid_len, ie_len = 0, sae_data_len = 0;
6267         enum nl80211_auth_type auth_type;
6268         struct key_parse key;
6269         bool local_state_change;
6270
6271         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6272                 return -EINVAL;
6273
6274         if (!info->attrs[NL80211_ATTR_MAC])
6275                 return -EINVAL;
6276
6277         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
6278                 return -EINVAL;
6279
6280         if (!info->attrs[NL80211_ATTR_SSID])
6281                 return -EINVAL;
6282
6283         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
6284                 return -EINVAL;
6285
6286         err = nl80211_parse_key(info, &key);
6287         if (err)
6288                 return err;
6289
6290         if (key.idx >= 0) {
6291                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
6292                         return -EINVAL;
6293                 if (!key.p.key || !key.p.key_len)
6294                         return -EINVAL;
6295                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
6296                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
6297                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
6298                      key.p.key_len != WLAN_KEY_LEN_WEP104))
6299                         return -EINVAL;
6300                 if (key.idx > 4)
6301                         return -EINVAL;
6302         } else {
6303                 key.p.key_len = 0;
6304                 key.p.key = NULL;
6305         }
6306
6307         if (key.idx >= 0) {
6308                 int i;
6309                 bool ok = false;
6310                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
6311                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
6312                                 ok = true;
6313                                 break;
6314                         }
6315                 }
6316                 if (!ok)
6317                         return -EINVAL;
6318         }
6319
6320         if (!rdev->ops->auth)
6321                 return -EOPNOTSUPP;
6322
6323         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6324             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6325                 return -EOPNOTSUPP;
6326
6327         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6328         chan = nl80211_get_valid_chan(&rdev->wiphy,
6329                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6330         if (!chan)
6331                 return -EINVAL;
6332
6333         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6334         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6335
6336         if (info->attrs[NL80211_ATTR_IE]) {
6337                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6338                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6339         }
6340
6341         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
6342         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
6343                 return -EINVAL;
6344
6345         if (auth_type == NL80211_AUTHTYPE_SAE &&
6346             !info->attrs[NL80211_ATTR_SAE_DATA])
6347                 return -EINVAL;
6348
6349         if (info->attrs[NL80211_ATTR_SAE_DATA]) {
6350                 if (auth_type != NL80211_AUTHTYPE_SAE)
6351                         return -EINVAL;
6352                 sae_data = nla_data(info->attrs[NL80211_ATTR_SAE_DATA]);
6353                 sae_data_len = nla_len(info->attrs[NL80211_ATTR_SAE_DATA]);
6354                 /* need to include at least Auth Transaction and Status Code */
6355                 if (sae_data_len < 4)
6356                         return -EINVAL;
6357         }
6358
6359         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6360
6361         /*
6362          * Since we no longer track auth state, ignore
6363          * requests to only change local state.
6364          */
6365         if (local_state_change)
6366                 return 0;
6367
6368         wdev_lock(dev->ieee80211_ptr);
6369         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
6370                                  ssid, ssid_len, ie, ie_len,
6371                                  key.p.key, key.p.key_len, key.idx,
6372                                  sae_data, sae_data_len);
6373         wdev_unlock(dev->ieee80211_ptr);
6374         return err;
6375 }
6376
6377 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
6378                                    struct genl_info *info,
6379                                    struct cfg80211_crypto_settings *settings,
6380                                    int cipher_limit)
6381 {
6382         memset(settings, 0, sizeof(*settings));
6383
6384         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
6385
6386         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
6387                 u16 proto;
6388                 proto = nla_get_u16(
6389                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
6390                 settings->control_port_ethertype = cpu_to_be16(proto);
6391                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
6392                     proto != ETH_P_PAE)
6393                         return -EINVAL;
6394                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
6395                         settings->control_port_no_encrypt = true;
6396         } else
6397                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
6398
6399         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
6400                 void *data;
6401                 int len, i;
6402
6403                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6404                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
6405                 settings->n_ciphers_pairwise = len / sizeof(u32);
6406
6407                 if (len % sizeof(u32))
6408                         return -EINVAL;
6409
6410                 if (settings->n_ciphers_pairwise > cipher_limit)
6411                         return -EINVAL;
6412
6413                 memcpy(settings->ciphers_pairwise, data, len);
6414
6415                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
6416                         if (!cfg80211_supported_cipher_suite(
6417                                         &rdev->wiphy,
6418                                         settings->ciphers_pairwise[i]))
6419                                 return -EINVAL;
6420         }
6421
6422         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
6423                 settings->cipher_group =
6424                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
6425                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
6426                                                      settings->cipher_group))
6427                         return -EINVAL;
6428         }
6429
6430         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
6431                 settings->wpa_versions =
6432                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
6433                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
6434                         return -EINVAL;
6435         }
6436
6437         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
6438                 void *data;
6439                 int len;
6440
6441                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
6442                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
6443                 settings->n_akm_suites = len / sizeof(u32);
6444
6445                 if (len % sizeof(u32))
6446                         return -EINVAL;
6447
6448                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
6449                         return -EINVAL;
6450
6451                 memcpy(settings->akm_suites, data, len);
6452         }
6453
6454         return 0;
6455 }
6456
6457 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
6458 {
6459         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6460         struct net_device *dev = info->user_ptr[1];
6461         struct ieee80211_channel *chan;
6462         struct cfg80211_assoc_request req = {};
6463         const u8 *bssid, *ssid;
6464         int err, ssid_len = 0;
6465
6466         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6467                 return -EINVAL;
6468
6469         if (!info->attrs[NL80211_ATTR_MAC] ||
6470             !info->attrs[NL80211_ATTR_SSID] ||
6471             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
6472                 return -EINVAL;
6473
6474         if (!rdev->ops->assoc)
6475                 return -EOPNOTSUPP;
6476
6477         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6478             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6479                 return -EOPNOTSUPP;
6480
6481         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6482
6483         chan = nl80211_get_valid_chan(&rdev->wiphy,
6484                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
6485         if (!chan)
6486                 return -EINVAL;
6487
6488         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6489         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6490
6491         if (info->attrs[NL80211_ATTR_IE]) {
6492                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6493                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6494         }
6495
6496         if (info->attrs[NL80211_ATTR_USE_MFP]) {
6497                 enum nl80211_mfp mfp =
6498                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
6499                 if (mfp == NL80211_MFP_REQUIRED)
6500                         req.use_mfp = true;
6501                 else if (mfp != NL80211_MFP_NO)
6502                         return -EINVAL;
6503         }
6504
6505         if (info->attrs[NL80211_ATTR_PREV_BSSID])
6506                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
6507
6508         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
6509                 req.flags |= ASSOC_REQ_DISABLE_HT;
6510
6511         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6512                 memcpy(&req.ht_capa_mask,
6513                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6514                        sizeof(req.ht_capa_mask));
6515
6516         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6517                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6518                         return -EINVAL;
6519                 memcpy(&req.ht_capa,
6520                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6521                        sizeof(req.ht_capa));
6522         }
6523
6524         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
6525                 req.flags |= ASSOC_REQ_DISABLE_VHT;
6526
6527         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6528                 memcpy(&req.vht_capa_mask,
6529                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
6530                        sizeof(req.vht_capa_mask));
6531
6532         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
6533                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
6534                         return -EINVAL;
6535                 memcpy(&req.vht_capa,
6536                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
6537                        sizeof(req.vht_capa));
6538         }
6539
6540         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
6541         if (!err) {
6542                 wdev_lock(dev->ieee80211_ptr);
6543                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
6544                                           ssid, ssid_len, &req);
6545                 wdev_unlock(dev->ieee80211_ptr);
6546         }
6547
6548         return err;
6549 }
6550
6551 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
6552 {
6553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6554         struct net_device *dev = info->user_ptr[1];
6555         const u8 *ie = NULL, *bssid;
6556         int ie_len = 0, err;
6557         u16 reason_code;
6558         bool local_state_change;
6559
6560         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6561                 return -EINVAL;
6562
6563         if (!info->attrs[NL80211_ATTR_MAC])
6564                 return -EINVAL;
6565
6566         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6567                 return -EINVAL;
6568
6569         if (!rdev->ops->deauth)
6570                 return -EOPNOTSUPP;
6571
6572         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6573             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6574                 return -EOPNOTSUPP;
6575
6576         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6577
6578         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6579         if (reason_code == 0) {
6580                 /* Reason Code 0 is reserved */
6581                 return -EINVAL;
6582         }
6583
6584         if (info->attrs[NL80211_ATTR_IE]) {
6585                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6586                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6587         }
6588
6589         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6590
6591         wdev_lock(dev->ieee80211_ptr);
6592         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
6593                                    local_state_change);
6594         wdev_unlock(dev->ieee80211_ptr);
6595         return err;
6596 }
6597
6598 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
6599 {
6600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6601         struct net_device *dev = info->user_ptr[1];
6602         const u8 *ie = NULL, *bssid;
6603         int ie_len = 0, err;
6604         u16 reason_code;
6605         bool local_state_change;
6606
6607         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6608                 return -EINVAL;
6609
6610         if (!info->attrs[NL80211_ATTR_MAC])
6611                 return -EINVAL;
6612
6613         if (!info->attrs[NL80211_ATTR_REASON_CODE])
6614                 return -EINVAL;
6615
6616         if (!rdev->ops->disassoc)
6617                 return -EOPNOTSUPP;
6618
6619         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
6620             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
6621                 return -EOPNOTSUPP;
6622
6623         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6624
6625         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6626         if (reason_code == 0) {
6627                 /* Reason Code 0 is reserved */
6628                 return -EINVAL;
6629         }
6630
6631         if (info->attrs[NL80211_ATTR_IE]) {
6632                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6633                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6634         }
6635
6636         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
6637
6638         wdev_lock(dev->ieee80211_ptr);
6639         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
6640                                      local_state_change);
6641         wdev_unlock(dev->ieee80211_ptr);
6642         return err;
6643 }
6644
6645 static bool
6646 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
6647                          int mcast_rate[IEEE80211_NUM_BANDS],
6648                          int rateval)
6649 {
6650         struct wiphy *wiphy = &rdev->wiphy;
6651         bool found = false;
6652         int band, i;
6653
6654         for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
6655                 struct ieee80211_supported_band *sband;
6656
6657                 sband = wiphy->bands[band];
6658                 if (!sband)
6659                         continue;
6660
6661                 for (i = 0; i < sband->n_bitrates; i++) {
6662                         if (sband->bitrates[i].bitrate == rateval) {
6663                                 mcast_rate[band] = i + 1;
6664                                 found = true;
6665                                 break;
6666                         }
6667                 }
6668         }
6669
6670         return found;
6671 }
6672
6673 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
6674 {
6675         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6676         struct net_device *dev = info->user_ptr[1];
6677         struct cfg80211_ibss_params ibss;
6678         struct wiphy *wiphy;
6679         struct cfg80211_cached_keys *connkeys = NULL;
6680         int err;
6681
6682         memset(&ibss, 0, sizeof(ibss));
6683
6684         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6685                 return -EINVAL;
6686
6687         if (!info->attrs[NL80211_ATTR_SSID] ||
6688             !nla_len(info->attrs[NL80211_ATTR_SSID]))
6689                 return -EINVAL;
6690
6691         ibss.beacon_interval = 100;
6692
6693         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
6694                 ibss.beacon_interval =
6695                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
6696                 if (ibss.beacon_interval < 1 || ibss.beacon_interval > 10000)
6697                         return -EINVAL;
6698         }
6699
6700         if (!rdev->ops->join_ibss)
6701                 return -EOPNOTSUPP;
6702
6703         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6704                 return -EOPNOTSUPP;
6705
6706         wiphy = &rdev->wiphy;
6707
6708         if (info->attrs[NL80211_ATTR_MAC]) {
6709                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
6710
6711                 if (!is_valid_ether_addr(ibss.bssid))
6712                         return -EINVAL;
6713         }
6714         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
6715         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
6716
6717         if (info->attrs[NL80211_ATTR_IE]) {
6718                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
6719                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6720         }
6721
6722         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
6723         if (err)
6724                 return err;
6725
6726         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
6727                                      NL80211_IFTYPE_ADHOC))
6728                 return -EINVAL;
6729
6730         switch (ibss.chandef.width) {
6731         case NL80211_CHAN_WIDTH_5:
6732         case NL80211_CHAN_WIDTH_10:
6733         case NL80211_CHAN_WIDTH_20_NOHT:
6734                 break;
6735         case NL80211_CHAN_WIDTH_20:
6736         case NL80211_CHAN_WIDTH_40:
6737                 if (rdev->wiphy.features & NL80211_FEATURE_HT_IBSS)
6738                         break;
6739         default:
6740                 return -EINVAL;
6741         }
6742
6743         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
6744         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
6745
6746         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6747                 u8 *rates =
6748                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6749                 int n_rates =
6750                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6751                 struct ieee80211_supported_band *sband =
6752                         wiphy->bands[ibss.chandef.chan->band];
6753
6754                 err = ieee80211_get_ratemask(sband, rates, n_rates,
6755                                              &ibss.basic_rates);
6756                 if (err)
6757                         return err;
6758         }
6759
6760         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6761                 memcpy(&ibss.ht_capa_mask,
6762                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
6763                        sizeof(ibss.ht_capa_mask));
6764
6765         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
6766                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
6767                         return -EINVAL;
6768                 memcpy(&ibss.ht_capa,
6769                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
6770                        sizeof(ibss.ht_capa));
6771         }
6772
6773         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
6774             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
6775                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
6776                 return -EINVAL;
6777
6778         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
6779                 bool no_ht = false;
6780
6781                 connkeys = nl80211_parse_connkeys(rdev,
6782                                           info->attrs[NL80211_ATTR_KEYS],
6783                                           &no_ht);
6784                 if (IS_ERR(connkeys))
6785                         return PTR_ERR(connkeys);
6786
6787                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
6788                     no_ht) {
6789                         kfree(connkeys);
6790                         return -EINVAL;
6791                 }
6792         }
6793
6794         ibss.control_port =
6795                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
6796
6797         ibss.userspace_handles_dfs =
6798                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
6799
6800         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
6801         if (err)
6802                 kfree(connkeys);
6803         return err;
6804 }
6805
6806 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
6807 {
6808         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6809         struct net_device *dev = info->user_ptr[1];
6810
6811         if (!rdev->ops->leave_ibss)
6812                 return -EOPNOTSUPP;
6813
6814         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
6815                 return -EOPNOTSUPP;
6816
6817         return cfg80211_leave_ibss(rdev, dev, false);
6818 }
6819
6820 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
6821 {
6822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6823         struct net_device *dev = info->user_ptr[1];
6824         int mcast_rate[IEEE80211_NUM_BANDS];
6825         u32 nla_rate;
6826         int err;
6827
6828         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
6829             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6830                 return -EOPNOTSUPP;
6831
6832         if (!rdev->ops->set_mcast_rate)
6833                 return -EOPNOTSUPP;
6834
6835         memset(mcast_rate, 0, sizeof(mcast_rate));
6836
6837         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
6838                 return -EINVAL;
6839
6840         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
6841         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
6842                 return -EINVAL;
6843
6844         err = rdev->ops->set_mcast_rate(&rdev->wiphy, dev, mcast_rate);
6845
6846         return err;
6847 }
6848
6849 static struct sk_buff *
6850 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
6851                             int approxlen, u32 portid, u32 seq,
6852                             enum nl80211_commands cmd,
6853                             enum nl80211_attrs attr,
6854                             const struct nl80211_vendor_cmd_info *info,
6855                             gfp_t gfp)
6856 {
6857         struct sk_buff *skb;
6858         void *hdr;
6859         struct nlattr *data;
6860
6861         skb = nlmsg_new(approxlen + 100, gfp);
6862         if (!skb)
6863                 return NULL;
6864
6865         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
6866         if (!hdr) {
6867                 kfree_skb(skb);
6868                 return NULL;
6869         }
6870
6871         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
6872                 goto nla_put_failure;
6873
6874         if (info) {
6875                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
6876                                 info->vendor_id))
6877                         goto nla_put_failure;
6878                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
6879                                 info->subcmd))
6880                         goto nla_put_failure;
6881         }
6882
6883         data = nla_nest_start(skb, attr);
6884
6885         ((void **)skb->cb)[0] = rdev;
6886         ((void **)skb->cb)[1] = hdr;
6887         ((void **)skb->cb)[2] = data;
6888
6889         return skb;
6890
6891  nla_put_failure:
6892         kfree_skb(skb);
6893         return NULL;
6894 }
6895
6896 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
6897                                            enum nl80211_commands cmd,
6898                                            enum nl80211_attrs attr,
6899                                            int vendor_event_idx,
6900                                            int approxlen, gfp_t gfp)
6901 {
6902         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
6903         const struct nl80211_vendor_cmd_info *info;
6904
6905         switch (cmd) {
6906         case NL80211_CMD_TESTMODE:
6907                 if (WARN_ON(vendor_event_idx != -1))
6908                         return NULL;
6909                 info = NULL;
6910                 break;
6911         case NL80211_CMD_VENDOR:
6912                 if (WARN_ON(vendor_event_idx < 0 ||
6913                             vendor_event_idx >= wiphy->n_vendor_events))
6914                         return NULL;
6915                 info = &wiphy->vendor_events[vendor_event_idx];
6916                 break;
6917         default:
6918                 WARN_ON(1);
6919                 return NULL;
6920         }
6921
6922         return __cfg80211_alloc_vendor_skb(rdev, approxlen, 0, 0,
6923                                            cmd, attr, info, gfp);
6924 }
6925 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
6926
6927 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
6928 {
6929         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
6930         void *hdr = ((void **)skb->cb)[1];
6931         struct nlattr *data = ((void **)skb->cb)[2];
6932         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
6933
6934         nla_nest_end(skb, data);
6935         genlmsg_end(skb, hdr);
6936
6937         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
6938                 mcgrp = NL80211_MCGRP_VENDOR;
6939
6940         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
6941                                 mcgrp, gfp);
6942 }
6943 EXPORT_SYMBOL(__cfg80211_send_event_skb);
6944
6945 #ifdef CONFIG_NL80211_TESTMODE
6946 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
6947 {
6948         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6949         struct wireless_dev *wdev =
6950                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
6951         int err;
6952
6953         if (!rdev->ops->testmode_cmd)
6954                 return -EOPNOTSUPP;
6955
6956         if (IS_ERR(wdev)) {
6957                 err = PTR_ERR(wdev);
6958                 if (err != -EINVAL)
6959                         return err;
6960                 wdev = NULL;
6961         } else if (wdev->wiphy != &rdev->wiphy) {
6962                 return -EINVAL;
6963         }
6964
6965         if (!info->attrs[NL80211_ATTR_TESTDATA])
6966                 return -EINVAL;
6967
6968         rdev->cur_cmd_info = info;
6969         err = rdev_testmode_cmd(rdev, wdev,
6970                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
6971                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
6972         rdev->cur_cmd_info = NULL;
6973
6974         return err;
6975 }
6976
6977 static int nl80211_testmode_dump(struct sk_buff *skb,
6978                                  struct netlink_callback *cb)
6979 {
6980         struct cfg80211_registered_device *rdev;
6981         int err;
6982         long phy_idx;
6983         void *data = NULL;
6984         int data_len = 0;
6985
6986         rtnl_lock();
6987
6988         if (cb->args[0]) {
6989                 /*
6990                  * 0 is a valid index, but not valid for args[0],
6991                  * so we need to offset by 1.
6992                  */
6993                 phy_idx = cb->args[0] - 1;
6994         } else {
6995                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
6996                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
6997                                   nl80211_policy);
6998                 if (err)
6999                         goto out_err;
7000
7001                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk),
7002                                                   nl80211_fam.attrbuf);
7003                 if (IS_ERR(rdev)) {
7004                         err = PTR_ERR(rdev);
7005                         goto out_err;
7006                 }
7007                 phy_idx = rdev->wiphy_idx;
7008                 rdev = NULL;
7009
7010                 if (nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA])
7011                         cb->args[1] =
7012                                 (long)nl80211_fam.attrbuf[NL80211_ATTR_TESTDATA];
7013         }
7014
7015         if (cb->args[1]) {
7016                 data = nla_data((void *)cb->args[1]);
7017                 data_len = nla_len((void *)cb->args[1]);
7018         }
7019
7020         rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
7021         if (!rdev) {
7022                 err = -ENOENT;
7023                 goto out_err;
7024         }
7025
7026         if (!rdev->ops->testmode_dump) {
7027                 err = -EOPNOTSUPP;
7028                 goto out_err;
7029         }
7030
7031         while (1) {
7032                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
7033                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
7034                                            NL80211_CMD_TESTMODE);
7035                 struct nlattr *tmdata;
7036
7037                 if (!hdr)
7038                         break;
7039
7040                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
7041                         genlmsg_cancel(skb, hdr);
7042                         break;
7043                 }
7044
7045                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
7046                 if (!tmdata) {
7047                         genlmsg_cancel(skb, hdr);
7048                         break;
7049                 }
7050                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
7051                 nla_nest_end(skb, tmdata);
7052
7053                 if (err == -ENOBUFS || err == -ENOENT) {
7054                         genlmsg_cancel(skb, hdr);
7055                         break;
7056                 } else if (err) {
7057                         genlmsg_cancel(skb, hdr);
7058                         goto out_err;
7059                 }
7060
7061                 genlmsg_end(skb, hdr);
7062         }
7063
7064         err = skb->len;
7065         /* see above */
7066         cb->args[0] = phy_idx + 1;
7067  out_err:
7068         rtnl_unlock();
7069         return err;
7070 }
7071 #endif
7072
7073 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
7074 {
7075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7076         struct net_device *dev = info->user_ptr[1];
7077         struct cfg80211_connect_params connect;
7078         struct wiphy *wiphy;
7079         struct cfg80211_cached_keys *connkeys = NULL;
7080         int err;
7081
7082         memset(&connect, 0, sizeof(connect));
7083
7084         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7085                 return -EINVAL;
7086
7087         if (!info->attrs[NL80211_ATTR_SSID] ||
7088             !nla_len(info->attrs[NL80211_ATTR_SSID]))
7089                 return -EINVAL;
7090
7091         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
7092                 connect.auth_type =
7093                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
7094                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
7095                                              NL80211_CMD_CONNECT))
7096                         return -EINVAL;
7097         } else
7098                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
7099
7100         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
7101
7102         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
7103                                       NL80211_MAX_NR_CIPHER_SUITES);
7104         if (err)
7105                 return err;
7106
7107         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7108             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7109                 return -EOPNOTSUPP;
7110
7111         wiphy = &rdev->wiphy;
7112
7113         connect.bg_scan_period = -1;
7114         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
7115                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
7116                 connect.bg_scan_period =
7117                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
7118         }
7119
7120         if (info->attrs[NL80211_ATTR_MAC])
7121                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7122         else if (info->attrs[NL80211_ATTR_MAC_HINT])
7123                 connect.bssid_hint =
7124                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
7125         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
7126         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
7127
7128         if (info->attrs[NL80211_ATTR_IE]) {
7129                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
7130                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7131         }
7132
7133         if (info->attrs[NL80211_ATTR_USE_MFP]) {
7134                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
7135                 if (connect.mfp != NL80211_MFP_REQUIRED &&
7136                     connect.mfp != NL80211_MFP_NO)
7137                         return -EINVAL;
7138         } else {
7139                 connect.mfp = NL80211_MFP_NO;
7140         }
7141
7142         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7143                 connect.channel = nl80211_get_valid_chan(
7144                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
7145                 if (!connect.channel)
7146                         return -EINVAL;
7147         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
7148                 connect.channel_hint = nl80211_get_valid_chan(
7149                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
7150                 if (!connect.channel_hint)
7151                         return -EINVAL;
7152         }
7153
7154         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
7155                 connkeys = nl80211_parse_connkeys(rdev,
7156                                           info->attrs[NL80211_ATTR_KEYS], NULL);
7157                 if (IS_ERR(connkeys))
7158                         return PTR_ERR(connkeys);
7159         }
7160
7161         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
7162                 connect.flags |= ASSOC_REQ_DISABLE_HT;
7163
7164         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
7165                 memcpy(&connect.ht_capa_mask,
7166                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
7167                        sizeof(connect.ht_capa_mask));
7168
7169         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
7170                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
7171                         kfree(connkeys);
7172                         return -EINVAL;
7173                 }
7174                 memcpy(&connect.ht_capa,
7175                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
7176                        sizeof(connect.ht_capa));
7177         }
7178
7179         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
7180                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
7181
7182         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
7183                 memcpy(&connect.vht_capa_mask,
7184                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
7185                        sizeof(connect.vht_capa_mask));
7186
7187         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
7188                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
7189                         kfree(connkeys);
7190                         return -EINVAL;
7191                 }
7192                 memcpy(&connect.vht_capa,
7193                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
7194                        sizeof(connect.vht_capa));
7195         }
7196
7197         wdev_lock(dev->ieee80211_ptr);
7198         err = cfg80211_connect(rdev, dev, &connect, connkeys, NULL);
7199         wdev_unlock(dev->ieee80211_ptr);
7200         if (err)
7201                 kfree(connkeys);
7202         return err;
7203 }
7204
7205 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
7206 {
7207         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7208         struct net_device *dev = info->user_ptr[1];
7209         u16 reason;
7210         int ret;
7211
7212         if (!info->attrs[NL80211_ATTR_REASON_CODE])
7213                 reason = WLAN_REASON_DEAUTH_LEAVING;
7214         else
7215                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7216
7217         if (reason == 0)
7218                 return -EINVAL;
7219
7220         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7221             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7222                 return -EOPNOTSUPP;
7223
7224         wdev_lock(dev->ieee80211_ptr);
7225         ret = cfg80211_disconnect(rdev, dev, reason, true);
7226         wdev_unlock(dev->ieee80211_ptr);
7227         return ret;
7228 }
7229
7230 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
7231 {
7232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7233         struct net *net;
7234         int err;
7235         u32 pid;
7236
7237         if (!info->attrs[NL80211_ATTR_PID])
7238                 return -EINVAL;
7239
7240         pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
7241
7242         net = get_net_ns_by_pid(pid);
7243         if (IS_ERR(net))
7244                 return PTR_ERR(net);
7245
7246         err = 0;
7247
7248         /* check if anything to do */
7249         if (!net_eq(wiphy_net(&rdev->wiphy), net))
7250                 err = cfg80211_switch_netns(rdev, net);
7251
7252         put_net(net);
7253         return err;
7254 }
7255
7256 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
7257 {
7258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7259         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
7260                         struct cfg80211_pmksa *pmksa) = NULL;
7261         struct net_device *dev = info->user_ptr[1];
7262         struct cfg80211_pmksa pmksa;
7263
7264         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
7265
7266         if (!info->attrs[NL80211_ATTR_MAC])
7267                 return -EINVAL;
7268
7269         if (!info->attrs[NL80211_ATTR_PMKID])
7270                 return -EINVAL;
7271
7272         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
7273         pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
7274
7275         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7276             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7277                 return -EOPNOTSUPP;
7278
7279         switch (info->genlhdr->cmd) {
7280         case NL80211_CMD_SET_PMKSA:
7281                 rdev_ops = rdev->ops->set_pmksa;
7282                 break;
7283         case NL80211_CMD_DEL_PMKSA:
7284                 rdev_ops = rdev->ops->del_pmksa;
7285                 break;
7286         default:
7287                 WARN_ON(1);
7288                 break;
7289         }
7290
7291         if (!rdev_ops)
7292                 return -EOPNOTSUPP;
7293
7294         return rdev_ops(&rdev->wiphy, dev, &pmksa);
7295 }
7296
7297 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
7298 {
7299         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7300         struct net_device *dev = info->user_ptr[1];
7301
7302         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
7303             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
7304                 return -EOPNOTSUPP;
7305
7306         if (!rdev->ops->flush_pmksa)
7307                 return -EOPNOTSUPP;
7308
7309         return rdev_flush_pmksa(rdev, dev);
7310 }
7311
7312 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
7313 {
7314         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7315         struct net_device *dev = info->user_ptr[1];
7316         u8 action_code, dialog_token;
7317         u32 peer_capability = 0;
7318         u16 status_code;
7319         u8 *peer;
7320
7321         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7322             !rdev->ops->tdls_mgmt)
7323                 return -EOPNOTSUPP;
7324
7325         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
7326             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
7327             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
7328             !info->attrs[NL80211_ATTR_IE] ||
7329             !info->attrs[NL80211_ATTR_MAC])
7330                 return -EINVAL;
7331
7332         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7333         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
7334         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
7335         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
7336         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
7337                 peer_capability =
7338                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
7339
7340         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
7341                               dialog_token, status_code, peer_capability,
7342                               nla_data(info->attrs[NL80211_ATTR_IE]),
7343                               nla_len(info->attrs[NL80211_ATTR_IE]));
7344 }
7345
7346 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
7347 {
7348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7349         struct net_device *dev = info->user_ptr[1];
7350         enum nl80211_tdls_operation operation;
7351         u8 *peer;
7352
7353         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
7354             !rdev->ops->tdls_oper)
7355                 return -EOPNOTSUPP;
7356
7357         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
7358             !info->attrs[NL80211_ATTR_MAC])
7359                 return -EINVAL;
7360
7361         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
7362         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
7363
7364         return rdev_tdls_oper(rdev, dev, peer, operation);
7365 }
7366
7367 static int nl80211_remain_on_channel(struct sk_buff *skb,
7368                                      struct genl_info *info)
7369 {
7370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7371         struct wireless_dev *wdev = info->user_ptr[1];
7372         struct cfg80211_chan_def chandef;
7373         struct sk_buff *msg;
7374         void *hdr;
7375         u64 cookie;
7376         u32 duration;
7377         int err;
7378
7379         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7380             !info->attrs[NL80211_ATTR_DURATION])
7381                 return -EINVAL;
7382
7383         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7384
7385         if (!rdev->ops->remain_on_channel ||
7386             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
7387                 return -EOPNOTSUPP;
7388
7389         /*
7390          * We should be on that channel for at least a minimum amount of
7391          * time (10ms) but no longer than the driver supports.
7392          */
7393         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7394             duration > rdev->wiphy.max_remain_on_channel_duration)
7395                 return -EINVAL;
7396
7397         err = nl80211_parse_chandef(rdev, info, &chandef);
7398         if (err)
7399                 return err;
7400
7401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7402         if (!msg)
7403                 return -ENOMEM;
7404
7405         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7406                              NL80211_CMD_REMAIN_ON_CHANNEL);
7407         if (!hdr) {
7408                 err = -ENOBUFS;
7409                 goto free_msg;
7410         }
7411
7412         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
7413                                      duration, &cookie);
7414
7415         if (err)
7416                 goto free_msg;
7417
7418         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7419                 goto nla_put_failure;
7420
7421         genlmsg_end(msg, hdr);
7422
7423         return genlmsg_reply(msg, info);
7424
7425  nla_put_failure:
7426         err = -ENOBUFS;
7427  free_msg:
7428         nlmsg_free(msg);
7429         return err;
7430 }
7431
7432 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
7433                                             struct genl_info *info)
7434 {
7435         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7436         struct wireless_dev *wdev = info->user_ptr[1];
7437         u64 cookie;
7438
7439         if (!info->attrs[NL80211_ATTR_COOKIE])
7440                 return -EINVAL;
7441
7442         if (!rdev->ops->cancel_remain_on_channel)
7443                 return -EOPNOTSUPP;
7444
7445         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7446
7447         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
7448 }
7449
7450 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
7451                            u8 *rates, u8 rates_len)
7452 {
7453         u8 i;
7454         u32 mask = 0;
7455
7456         for (i = 0; i < rates_len; i++) {
7457                 int rate = (rates[i] & 0x7f) * 5;
7458                 int ridx;
7459                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
7460                         struct ieee80211_rate *srate =
7461                                 &sband->bitrates[ridx];
7462                         if (rate == srate->bitrate) {
7463                                 mask |= 1 << ridx;
7464                                 break;
7465                         }
7466                 }
7467                 if (ridx == sband->n_bitrates)
7468                         return 0; /* rate not found */
7469         }
7470
7471         return mask;
7472 }
7473
7474 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
7475                                u8 *rates, u8 rates_len,
7476                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
7477 {
7478         u8 i;
7479
7480         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
7481
7482         for (i = 0; i < rates_len; i++) {
7483                 int ridx, rbit;
7484
7485                 ridx = rates[i] / 8;
7486                 rbit = BIT(rates[i] % 8);
7487
7488                 /* check validity */
7489                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
7490                         return false;
7491
7492                 /* check availability */
7493                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
7494                         mcs[ridx] |= rbit;
7495                 else
7496                         return false;
7497         }
7498
7499         return true;
7500 }
7501
7502 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
7503 {
7504         u16 mcs_mask = 0;
7505
7506         switch (vht_mcs_map) {
7507         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
7508                 break;
7509         case IEEE80211_VHT_MCS_SUPPORT_0_7:
7510                 mcs_mask = 0x00FF;
7511                 break;
7512         case IEEE80211_VHT_MCS_SUPPORT_0_8:
7513                 mcs_mask = 0x01FF;
7514                 break;
7515         case IEEE80211_VHT_MCS_SUPPORT_0_9:
7516                 mcs_mask = 0x03FF;
7517                 break;
7518         default:
7519                 break;
7520         }
7521
7522         return mcs_mask;
7523 }
7524
7525 static void vht_build_mcs_mask(u16 vht_mcs_map,
7526                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
7527 {
7528         u8 nss;
7529
7530         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
7531                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
7532                 vht_mcs_map >>= 2;
7533         }
7534 }
7535
7536 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
7537                              struct nl80211_txrate_vht *txrate,
7538                              u16 mcs[NL80211_VHT_NSS_MAX])
7539 {
7540         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7541         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
7542         u8 i;
7543
7544         if (!sband->vht_cap.vht_supported)
7545                 return false;
7546
7547         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
7548
7549         /* Build vht_mcs_mask from VHT capabilities */
7550         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
7551
7552         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
7553                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
7554                         mcs[i] = txrate->mcs[i];
7555                 else
7556                         return false;
7557         }
7558
7559         return true;
7560 }
7561
7562 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
7563         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
7564                                     .len = NL80211_MAX_SUPP_RATES },
7565         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
7566                                 .len = NL80211_MAX_SUPP_HT_RATES },
7567         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
7568         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
7569 };
7570
7571 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
7572                                        struct genl_info *info)
7573 {
7574         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
7575         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7576         struct cfg80211_bitrate_mask mask;
7577         int rem, i;
7578         struct net_device *dev = info->user_ptr[1];
7579         struct nlattr *tx_rates;
7580         struct ieee80211_supported_band *sband;
7581         u16 vht_tx_mcs_map;
7582
7583         if (!rdev->ops->set_bitrate_mask)
7584                 return -EOPNOTSUPP;
7585
7586         memset(&mask, 0, sizeof(mask));
7587         /* Default to all rates enabled */
7588         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
7589                 sband = rdev->wiphy.bands[i];
7590
7591                 if (!sband)
7592                         continue;
7593
7594                 mask.control[i].legacy = (1 << sband->n_bitrates) - 1;
7595                 memcpy(mask.control[i].ht_mcs,
7596                        sband->ht_cap.mcs.rx_mask,
7597                        sizeof(mask.control[i].ht_mcs));
7598
7599                 if (!sband->vht_cap.vht_supported)
7600                         continue;
7601
7602                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
7603                 vht_build_mcs_mask(vht_tx_mcs_map, mask.control[i].vht_mcs);
7604         }
7605
7606         /* if no rates are given set it back to the defaults */
7607         if (!info->attrs[NL80211_ATTR_TX_RATES])
7608                 goto out;
7609
7610         /*
7611          * The nested attribute uses enum nl80211_band as the index. This maps
7612          * directly to the enum ieee80211_band values used in cfg80211.
7613          */
7614         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
7615         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
7616                 enum ieee80211_band band = nla_type(tx_rates);
7617                 int err;
7618
7619                 if (band < 0 || band >= IEEE80211_NUM_BANDS)
7620                         return -EINVAL;
7621                 sband = rdev->wiphy.bands[band];
7622                 if (sband == NULL)
7623                         return -EINVAL;
7624                 err = nla_parse(tb, NL80211_TXRATE_MAX, nla_data(tx_rates),
7625                                 nla_len(tx_rates), nl80211_txattr_policy);
7626                 if (err)
7627                         return err;
7628                 if (tb[NL80211_TXRATE_LEGACY]) {
7629                         mask.control[band].legacy = rateset_to_mask(
7630                                 sband,
7631                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
7632                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
7633                         if ((mask.control[band].legacy == 0) &&
7634                             nla_len(tb[NL80211_TXRATE_LEGACY]))
7635                                 return -EINVAL;
7636                 }
7637                 if (tb[NL80211_TXRATE_HT]) {
7638                         if (!ht_rateset_to_mask(
7639                                         sband,
7640                                         nla_data(tb[NL80211_TXRATE_HT]),
7641                                         nla_len(tb[NL80211_TXRATE_HT]),
7642                                         mask.control[band].ht_mcs))
7643                                 return -EINVAL;
7644                 }
7645                 if (tb[NL80211_TXRATE_VHT]) {
7646                         if (!vht_set_mcs_mask(
7647                                         sband,
7648                                         nla_data(tb[NL80211_TXRATE_VHT]),
7649                                         mask.control[band].vht_mcs))
7650                                 return -EINVAL;
7651                 }
7652                 if (tb[NL80211_TXRATE_GI]) {
7653                         mask.control[band].gi =
7654                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
7655                         if (mask.control[band].gi > NL80211_TXRATE_FORCE_LGI)
7656                                 return -EINVAL;
7657                 }
7658
7659                 if (mask.control[band].legacy == 0) {
7660                         /* don't allow empty legacy rates if HT or VHT
7661                          * are not even supported.
7662                          */
7663                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
7664                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
7665                                 return -EINVAL;
7666
7667                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
7668                                 if (mask.control[band].ht_mcs[i])
7669                                         goto out;
7670
7671                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
7672                                 if (mask.control[band].vht_mcs[i])
7673                                         goto out;
7674
7675                         /* legacy and mcs rates may not be both empty */
7676                         return -EINVAL;
7677                 }
7678         }
7679
7680 out:
7681         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
7682 }
7683
7684 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
7685 {
7686         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7687         struct wireless_dev *wdev = info->user_ptr[1];
7688         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
7689
7690         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
7691                 return -EINVAL;
7692
7693         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
7694                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
7695
7696         switch (wdev->iftype) {
7697         case NL80211_IFTYPE_STATION:
7698         case NL80211_IFTYPE_ADHOC:
7699         case NL80211_IFTYPE_P2P_CLIENT:
7700         case NL80211_IFTYPE_AP:
7701         case NL80211_IFTYPE_AP_VLAN:
7702         case NL80211_IFTYPE_MESH_POINT:
7703         case NL80211_IFTYPE_P2P_GO:
7704         case NL80211_IFTYPE_P2P_DEVICE:
7705                 break;
7706         default:
7707                 return -EOPNOTSUPP;
7708         }
7709
7710         /* not much point in registering if we can't reply */
7711         if (!rdev->ops->mgmt_tx)
7712                 return -EOPNOTSUPP;
7713
7714         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
7715                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
7716                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
7717 }
7718
7719 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
7720 {
7721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7722         struct wireless_dev *wdev = info->user_ptr[1];
7723         struct cfg80211_chan_def chandef;
7724         int err;
7725         void *hdr = NULL;
7726         u64 cookie;
7727         struct sk_buff *msg = NULL;
7728         struct cfg80211_mgmt_tx_params params = {
7729                 .dont_wait_for_ack =
7730                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
7731         };
7732
7733         if (!info->attrs[NL80211_ATTR_FRAME])
7734                 return -EINVAL;
7735
7736         if (!rdev->ops->mgmt_tx)
7737                 return -EOPNOTSUPP;
7738
7739         switch (wdev->iftype) {
7740         case NL80211_IFTYPE_P2P_DEVICE:
7741                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
7742                         return -EINVAL;
7743         case NL80211_IFTYPE_STATION:
7744         case NL80211_IFTYPE_ADHOC:
7745         case NL80211_IFTYPE_P2P_CLIENT:
7746         case NL80211_IFTYPE_AP:
7747         case NL80211_IFTYPE_AP_VLAN:
7748         case NL80211_IFTYPE_MESH_POINT:
7749         case NL80211_IFTYPE_P2P_GO:
7750                 break;
7751         default:
7752                 return -EOPNOTSUPP;
7753         }
7754
7755         if (info->attrs[NL80211_ATTR_DURATION]) {
7756                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7757                         return -EINVAL;
7758                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
7759
7760                 /*
7761                  * We should wait on the channel for at least a minimum amount
7762                  * of time (10ms) but no longer than the driver supports.
7763                  */
7764                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
7765                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
7766                         return -EINVAL;
7767
7768         }
7769
7770         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
7771
7772         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
7773                 return -EINVAL;
7774
7775         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7776
7777         /* get the channel if any has been specified, otherwise pass NULL to
7778          * the driver. The latter will use the current one
7779          */
7780         chandef.chan = NULL;
7781         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
7782                 err = nl80211_parse_chandef(rdev, info, &chandef);
7783                 if (err)
7784                         return err;
7785         }
7786
7787         if (!chandef.chan && params.offchan)
7788                 return -EINVAL;
7789
7790         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
7791         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
7792
7793         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
7794                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7795                 int i;
7796
7797                 if (len % sizeof(u16))
7798                         return -EINVAL;
7799
7800                 params.n_csa_offsets = len / sizeof(u16);
7801                 params.csa_offsets =
7802                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
7803
7804                 /* check that all the offsets fit the frame */
7805                 for (i = 0; i < params.n_csa_offsets; i++) {
7806                         if (params.csa_offsets[i] >= params.len)
7807                                 return -EINVAL;
7808                 }
7809         }
7810
7811         if (!params.dont_wait_for_ack) {
7812                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7813                 if (!msg)
7814                         return -ENOMEM;
7815
7816                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7817                                      NL80211_CMD_FRAME);
7818                 if (!hdr) {
7819                         err = -ENOBUFS;
7820                         goto free_msg;
7821                 }
7822         }
7823
7824         params.chan = chandef.chan;
7825         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
7826         if (err)
7827                 goto free_msg;
7828
7829         if (msg) {
7830                 if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
7831                         goto nla_put_failure;
7832
7833                 genlmsg_end(msg, hdr);
7834                 return genlmsg_reply(msg, info);
7835         }
7836
7837         return 0;
7838
7839  nla_put_failure:
7840         err = -ENOBUFS;
7841  free_msg:
7842         nlmsg_free(msg);
7843         return err;
7844 }
7845
7846 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
7847 {
7848         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7849         struct wireless_dev *wdev = info->user_ptr[1];
7850         u64 cookie;
7851
7852         if (!info->attrs[NL80211_ATTR_COOKIE])
7853                 return -EINVAL;
7854
7855         if (!rdev->ops->mgmt_tx_cancel_wait)
7856                 return -EOPNOTSUPP;
7857
7858         switch (wdev->iftype) {
7859         case NL80211_IFTYPE_STATION:
7860         case NL80211_IFTYPE_ADHOC:
7861         case NL80211_IFTYPE_P2P_CLIENT:
7862         case NL80211_IFTYPE_AP:
7863         case NL80211_IFTYPE_AP_VLAN:
7864         case NL80211_IFTYPE_P2P_GO:
7865         case NL80211_IFTYPE_P2P_DEVICE:
7866                 break;
7867         default:
7868                 return -EOPNOTSUPP;
7869         }
7870
7871         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7872
7873         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
7874 }
7875
7876 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
7877 {
7878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7879         struct wireless_dev *wdev;
7880         struct net_device *dev = info->user_ptr[1];
7881         u8 ps_state;
7882         bool state;
7883         int err;
7884
7885         if (!info->attrs[NL80211_ATTR_PS_STATE])
7886                 return -EINVAL;
7887
7888         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
7889
7890         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
7891                 return -EINVAL;
7892
7893         wdev = dev->ieee80211_ptr;
7894
7895         if (!rdev->ops->set_power_mgmt)
7896                 return -EOPNOTSUPP;
7897
7898         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
7899
7900         if (state == wdev->ps)
7901                 return 0;
7902
7903         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
7904         if (!err)
7905                 wdev->ps = state;
7906         return err;
7907 }
7908
7909 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
7910 {
7911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7912         enum nl80211_ps_state ps_state;
7913         struct wireless_dev *wdev;
7914         struct net_device *dev = info->user_ptr[1];
7915         struct sk_buff *msg;
7916         void *hdr;
7917         int err;
7918
7919         wdev = dev->ieee80211_ptr;
7920
7921         if (!rdev->ops->set_power_mgmt)
7922                 return -EOPNOTSUPP;
7923
7924         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7925         if (!msg)
7926                 return -ENOMEM;
7927
7928         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7929                              NL80211_CMD_GET_POWER_SAVE);
7930         if (!hdr) {
7931                 err = -ENOBUFS;
7932                 goto free_msg;
7933         }
7934
7935         if (wdev->ps)
7936                 ps_state = NL80211_PS_ENABLED;
7937         else
7938                 ps_state = NL80211_PS_DISABLED;
7939
7940         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
7941                 goto nla_put_failure;
7942
7943         genlmsg_end(msg, hdr);
7944         return genlmsg_reply(msg, info);
7945
7946  nla_put_failure:
7947         err = -ENOBUFS;
7948  free_msg:
7949         nlmsg_free(msg);
7950         return err;
7951 }
7952
7953 static const struct nla_policy
7954 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
7955         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
7956         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
7957         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
7958         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
7959         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
7960         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
7961 };
7962
7963 static int nl80211_set_cqm_txe(struct genl_info *info,
7964                                u32 rate, u32 pkts, u32 intvl)
7965 {
7966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7967         struct net_device *dev = info->user_ptr[1];
7968         struct wireless_dev *wdev = dev->ieee80211_ptr;
7969
7970         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
7971                 return -EINVAL;
7972
7973         if (!rdev->ops->set_cqm_txe_config)
7974                 return -EOPNOTSUPP;
7975
7976         if (wdev->iftype != NL80211_IFTYPE_STATION &&
7977             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
7978                 return -EOPNOTSUPP;
7979
7980         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
7981 }
7982
7983 static int nl80211_set_cqm_rssi(struct genl_info *info,
7984                                 s32 threshold, u32 hysteresis)
7985 {
7986         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7987         struct net_device *dev = info->user_ptr[1];
7988         struct wireless_dev *wdev = dev->ieee80211_ptr;
7989
7990         if (threshold > 0)
7991                 return -EINVAL;
7992
7993         /* disabling - hysteresis should also be zero then */
7994         if (threshold == 0)
7995                 hysteresis = 0;
7996
7997         if (!rdev->ops->set_cqm_rssi_config)
7998                 return -EOPNOTSUPP;
7999
8000         if (wdev->iftype != NL80211_IFTYPE_STATION &&
8001             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
8002                 return -EOPNOTSUPP;
8003
8004         return rdev_set_cqm_rssi_config(rdev, dev, threshold, hysteresis);
8005 }
8006
8007 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
8008 {
8009         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
8010         struct nlattr *cqm;
8011         int err;
8012
8013         cqm = info->attrs[NL80211_ATTR_CQM];
8014         if (!cqm)
8015                 return -EINVAL;
8016
8017         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
8018                                nl80211_attr_cqm_policy);
8019         if (err)
8020                 return err;
8021
8022         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
8023             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
8024                 s32 threshold = nla_get_s32(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
8025                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
8026
8027                 return nl80211_set_cqm_rssi(info, threshold, hysteresis);
8028         }
8029
8030         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
8031             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
8032             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
8033                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
8034                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
8035                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
8036
8037                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
8038         }
8039
8040         return -EINVAL;
8041 }
8042
8043 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
8044 {
8045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8046         struct net_device *dev = info->user_ptr[1];
8047         struct mesh_config cfg;
8048         struct mesh_setup setup;
8049         int err;
8050
8051         /* start with default */
8052         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
8053         memcpy(&setup, &default_mesh_setup, sizeof(setup));
8054
8055         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
8056                 /* and parse parameters if given */
8057                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
8058                 if (err)
8059                         return err;
8060         }
8061
8062         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
8063             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
8064                 return -EINVAL;
8065
8066         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
8067         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
8068
8069         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8070             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
8071                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8072                         return -EINVAL;
8073
8074         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
8075                 setup.beacon_interval =
8076                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8077                 if (setup.beacon_interval < 10 ||
8078                     setup.beacon_interval > 10000)
8079                         return -EINVAL;
8080         }
8081
8082         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
8083                 setup.dtim_period =
8084                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
8085                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
8086                         return -EINVAL;
8087         }
8088
8089         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
8090                 /* parse additional setup parameters if given */
8091                 err = nl80211_parse_mesh_setup(info, &setup);
8092                 if (err)
8093                         return err;
8094         }
8095
8096         if (setup.user_mpm)
8097                 cfg.auto_open_plinks = false;
8098
8099         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8100                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
8101                 if (err)
8102                         return err;
8103         } else {
8104                 /* cfg80211_join_mesh() will sort it out */
8105                 setup.chandef.chan = NULL;
8106         }
8107
8108         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8109                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8110                 int n_rates =
8111                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8112                 struct ieee80211_supported_band *sband;
8113
8114                 if (!setup.chandef.chan)
8115                         return -EINVAL;
8116
8117                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
8118
8119                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8120                                              &setup.basic_rates);
8121                 if (err)
8122                         return err;
8123         }
8124
8125         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
8126 }
8127
8128 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
8129 {
8130         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8131         struct net_device *dev = info->user_ptr[1];
8132
8133         return cfg80211_leave_mesh(rdev, dev);
8134 }
8135
8136 #ifdef CONFIG_PM
8137 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
8138                                         struct cfg80211_registered_device *rdev)
8139 {
8140         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
8141         struct nlattr *nl_pats, *nl_pat;
8142         int i, pat_len;
8143
8144         if (!wowlan->n_patterns)
8145                 return 0;
8146
8147         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
8148         if (!nl_pats)
8149                 return -ENOBUFS;
8150
8151         for (i = 0; i < wowlan->n_patterns; i++) {
8152                 nl_pat = nla_nest_start(msg, i + 1);
8153                 if (!nl_pat)
8154                         return -ENOBUFS;
8155                 pat_len = wowlan->patterns[i].pattern_len;
8156                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
8157                             wowlan->patterns[i].mask) ||
8158                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8159                             wowlan->patterns[i].pattern) ||
8160                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8161                                 wowlan->patterns[i].pkt_offset))
8162                         return -ENOBUFS;
8163                 nla_nest_end(msg, nl_pat);
8164         }
8165         nla_nest_end(msg, nl_pats);
8166
8167         return 0;
8168 }
8169
8170 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
8171                                    struct cfg80211_wowlan_tcp *tcp)
8172 {
8173         struct nlattr *nl_tcp;
8174
8175         if (!tcp)
8176                 return 0;
8177
8178         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
8179         if (!nl_tcp)
8180                 return -ENOBUFS;
8181
8182         if (nla_put_be32(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
8183             nla_put_be32(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
8184             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
8185             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
8186             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
8187             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
8188                     tcp->payload_len, tcp->payload) ||
8189             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
8190                         tcp->data_interval) ||
8191             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
8192                     tcp->wake_len, tcp->wake_data) ||
8193             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
8194                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
8195                 return -ENOBUFS;
8196
8197         if (tcp->payload_seq.len &&
8198             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
8199                     sizeof(tcp->payload_seq), &tcp->payload_seq))
8200                 return -ENOBUFS;
8201
8202         if (tcp->payload_tok.len &&
8203             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
8204                     sizeof(tcp->payload_tok) + tcp->tokens_size,
8205                     &tcp->payload_tok))
8206                 return -ENOBUFS;
8207
8208         nla_nest_end(msg, nl_tcp);
8209
8210         return 0;
8211 }
8212
8213 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
8214 {
8215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8216         struct sk_buff *msg;
8217         void *hdr;
8218         u32 size = NLMSG_DEFAULT_SIZE;
8219
8220         if (!rdev->wiphy.wowlan)
8221                 return -EOPNOTSUPP;
8222
8223         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
8224                 /* adjust size to have room for all the data */
8225                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
8226                         rdev->wiphy.wowlan_config->tcp->payload_len +
8227                         rdev->wiphy.wowlan_config->tcp->wake_len +
8228                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
8229         }
8230
8231         msg = nlmsg_new(size, GFP_KERNEL);
8232         if (!msg)
8233                 return -ENOMEM;
8234
8235         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8236                              NL80211_CMD_GET_WOWLAN);
8237         if (!hdr)
8238                 goto nla_put_failure;
8239
8240         if (rdev->wiphy.wowlan_config) {
8241                 struct nlattr *nl_wowlan;
8242
8243                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
8244                 if (!nl_wowlan)
8245                         goto nla_put_failure;
8246
8247                 if ((rdev->wiphy.wowlan_config->any &&
8248                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
8249                     (rdev->wiphy.wowlan_config->disconnect &&
8250                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
8251                     (rdev->wiphy.wowlan_config->magic_pkt &&
8252                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
8253                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
8254                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
8255                     (rdev->wiphy.wowlan_config->eap_identity_req &&
8256                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
8257                     (rdev->wiphy.wowlan_config->four_way_handshake &&
8258                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
8259                     (rdev->wiphy.wowlan_config->rfkill_release &&
8260                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
8261                         goto nla_put_failure;
8262
8263                 if (nl80211_send_wowlan_patterns(msg, rdev))
8264                         goto nla_put_failure;
8265
8266                 if (nl80211_send_wowlan_tcp(msg,
8267                                             rdev->wiphy.wowlan_config->tcp))
8268                         goto nla_put_failure;
8269
8270                 nla_nest_end(msg, nl_wowlan);
8271         }
8272
8273         genlmsg_end(msg, hdr);
8274         return genlmsg_reply(msg, info);
8275
8276 nla_put_failure:
8277         nlmsg_free(msg);
8278         return -ENOBUFS;
8279 }
8280
8281 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
8282                                     struct nlattr *attr,
8283                                     struct cfg80211_wowlan *trig)
8284 {
8285         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
8286         struct cfg80211_wowlan_tcp *cfg;
8287         struct nl80211_wowlan_tcp_data_token *tok = NULL;
8288         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
8289         u32 size;
8290         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
8291         int err, port;
8292
8293         if (!rdev->wiphy.wowlan->tcp)
8294                 return -EINVAL;
8295
8296         err = nla_parse(tb, MAX_NL80211_WOWLAN_TCP,
8297                         nla_data(attr), nla_len(attr),
8298                         nl80211_wowlan_tcp_policy);
8299         if (err)
8300                 return err;
8301
8302         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
8303             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
8304             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
8305             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
8306             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
8307             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
8308             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
8309             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
8310                 return -EINVAL;
8311
8312         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
8313         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
8314                 return -EINVAL;
8315
8316         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
8317                         rdev->wiphy.wowlan->tcp->data_interval_max ||
8318             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
8319                 return -EINVAL;
8320
8321         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
8322         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
8323                 return -EINVAL;
8324
8325         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
8326         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
8327                 return -EINVAL;
8328
8329         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
8330                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8331
8332                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
8333                 tokens_size = tokln - sizeof(*tok);
8334
8335                 if (!tok->len || tokens_size % tok->len)
8336                         return -EINVAL;
8337                 if (!rdev->wiphy.wowlan->tcp->tok)
8338                         return -EINVAL;
8339                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
8340                         return -EINVAL;
8341                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
8342                         return -EINVAL;
8343                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
8344                         return -EINVAL;
8345                 if (tok->offset + tok->len > data_size)
8346                         return -EINVAL;
8347         }
8348
8349         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
8350                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
8351                 if (!rdev->wiphy.wowlan->tcp->seq)
8352                         return -EINVAL;
8353                 if (seq->len == 0 || seq->len > 4)
8354                         return -EINVAL;
8355                 if (seq->len + seq->offset > data_size)
8356                         return -EINVAL;
8357         }
8358
8359         size = sizeof(*cfg);
8360         size += data_size;
8361         size += wake_size + wake_mask_size;
8362         size += tokens_size;
8363
8364         cfg = kzalloc(size, GFP_KERNEL);
8365         if (!cfg)
8366                 return -ENOMEM;
8367         cfg->src = nla_get_be32(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
8368         cfg->dst = nla_get_be32(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
8369         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
8370                ETH_ALEN);
8371         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
8372                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
8373         else
8374                 port = 0;
8375 #ifdef CONFIG_INET
8376         /* allocate a socket and port for it and use it */
8377         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
8378                             IPPROTO_TCP, &cfg->sock, 1);
8379         if (err) {
8380                 kfree(cfg);
8381                 return err;
8382         }
8383         if (inet_csk_get_port(cfg->sock->sk, port)) {
8384                 sock_release(cfg->sock);
8385                 kfree(cfg);
8386                 return -EADDRINUSE;
8387         }
8388         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
8389 #else
8390         if (!port) {
8391                 kfree(cfg);
8392                 return -EINVAL;
8393         }
8394         cfg->src_port = port;
8395 #endif
8396
8397         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
8398         cfg->payload_len = data_size;
8399         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
8400         memcpy((void *)cfg->payload,
8401                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
8402                data_size);
8403         if (seq)
8404                 cfg->payload_seq = *seq;
8405         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
8406         cfg->wake_len = wake_size;
8407         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
8408         memcpy((void *)cfg->wake_data,
8409                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
8410                wake_size);
8411         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
8412                          data_size + wake_size;
8413         memcpy((void *)cfg->wake_mask,
8414                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
8415                wake_mask_size);
8416         if (tok) {
8417                 cfg->tokens_size = tokens_size;
8418                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
8419         }
8420
8421         trig->tcp = cfg;
8422
8423         return 0;
8424 }
8425
8426 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
8427 {
8428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8429         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
8430         struct cfg80211_wowlan new_triggers = {};
8431         struct cfg80211_wowlan *ntrig;
8432         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
8433         int err, i;
8434         bool prev_enabled = rdev->wiphy.wowlan_config;
8435
8436         if (!wowlan)
8437                 return -EOPNOTSUPP;
8438
8439         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
8440                 cfg80211_rdev_free_wowlan(rdev);
8441                 rdev->wiphy.wowlan_config = NULL;
8442                 goto set_wakeup;
8443         }
8444
8445         err = nla_parse(tb, MAX_NL80211_WOWLAN_TRIG,
8446                         nla_data(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8447                         nla_len(info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]),
8448                         nl80211_wowlan_policy);
8449         if (err)
8450                 return err;
8451
8452         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
8453                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
8454                         return -EINVAL;
8455                 new_triggers.any = true;
8456         }
8457
8458         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
8459                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
8460                         return -EINVAL;
8461                 new_triggers.disconnect = true;
8462         }
8463
8464         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
8465                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
8466                         return -EINVAL;
8467                 new_triggers.magic_pkt = true;
8468         }
8469
8470         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
8471                 return -EINVAL;
8472
8473         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
8474                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
8475                         return -EINVAL;
8476                 new_triggers.gtk_rekey_failure = true;
8477         }
8478
8479         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
8480                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
8481                         return -EINVAL;
8482                 new_triggers.eap_identity_req = true;
8483         }
8484
8485         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
8486                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
8487                         return -EINVAL;
8488                 new_triggers.four_way_handshake = true;
8489         }
8490
8491         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
8492                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
8493                         return -EINVAL;
8494                 new_triggers.rfkill_release = true;
8495         }
8496
8497         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
8498                 struct nlattr *pat;
8499                 int n_patterns = 0;
8500                 int rem, pat_len, mask_len, pkt_offset;
8501                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8502
8503                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8504                                     rem)
8505                         n_patterns++;
8506                 if (n_patterns > wowlan->n_patterns)
8507                         return -EINVAL;
8508
8509                 new_triggers.patterns = kcalloc(n_patterns,
8510                                                 sizeof(new_triggers.patterns[0]),
8511                                                 GFP_KERNEL);
8512                 if (!new_triggers.patterns)
8513                         return -ENOMEM;
8514
8515                 new_triggers.n_patterns = n_patterns;
8516                 i = 0;
8517
8518                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
8519                                     rem) {
8520                         nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8521                                   nla_len(pat), NULL);
8522                         err = -EINVAL;
8523                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
8524                             !pat_tb[NL80211_PKTPAT_PATTERN])
8525                                 goto error;
8526                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8527                         mask_len = DIV_ROUND_UP(pat_len, 8);
8528                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8529                                 goto error;
8530                         if (pat_len > wowlan->pattern_max_len ||
8531                             pat_len < wowlan->pattern_min_len)
8532                                 goto error;
8533
8534                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
8535                                 pkt_offset = 0;
8536                         else
8537                                 pkt_offset = nla_get_u32(
8538                                         pat_tb[NL80211_PKTPAT_OFFSET]);
8539                         if (pkt_offset > wowlan->max_pkt_offset)
8540                                 goto error;
8541                         new_triggers.patterns[i].pkt_offset = pkt_offset;
8542
8543                         new_triggers.patterns[i].mask =
8544                                 kmalloc(mask_len + pat_len, GFP_KERNEL);
8545                         if (!new_triggers.patterns[i].mask) {
8546                                 err = -ENOMEM;
8547                                 goto error;
8548                         }
8549                         new_triggers.patterns[i].pattern =
8550                                 new_triggers.patterns[i].mask + mask_len;
8551                         memcpy(new_triggers.patterns[i].mask,
8552                                nla_data(pat_tb[NL80211_PKTPAT_MASK]),
8553                                mask_len);
8554                         new_triggers.patterns[i].pattern_len = pat_len;
8555                         memcpy(new_triggers.patterns[i].pattern,
8556                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
8557                                pat_len);
8558                         i++;
8559                 }
8560         }
8561
8562         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
8563                 err = nl80211_parse_wowlan_tcp(
8564                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
8565                         &new_triggers);
8566                 if (err)
8567                         goto error;
8568         }
8569
8570         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
8571         if (!ntrig) {
8572                 err = -ENOMEM;
8573                 goto error;
8574         }
8575         cfg80211_rdev_free_wowlan(rdev);
8576         rdev->wiphy.wowlan_config = ntrig;
8577
8578  set_wakeup:
8579         if (rdev->ops->set_wakeup &&
8580             prev_enabled != !!rdev->wiphy.wowlan_config)
8581                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
8582
8583         return 0;
8584  error:
8585         for (i = 0; i < new_triggers.n_patterns; i++)
8586                 kfree(new_triggers.patterns[i].mask);
8587         kfree(new_triggers.patterns);
8588         if (new_triggers.tcp && new_triggers.tcp->sock)
8589                 sock_release(new_triggers.tcp->sock);
8590         kfree(new_triggers.tcp);
8591         return err;
8592 }
8593 #endif
8594
8595 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
8596                                        struct cfg80211_registered_device *rdev)
8597 {
8598         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
8599         int i, j, pat_len;
8600         struct cfg80211_coalesce_rules *rule;
8601
8602         if (!rdev->coalesce->n_rules)
8603                 return 0;
8604
8605         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
8606         if (!nl_rules)
8607                 return -ENOBUFS;
8608
8609         for (i = 0; i < rdev->coalesce->n_rules; i++) {
8610                 nl_rule = nla_nest_start(msg, i + 1);
8611                 if (!nl_rule)
8612                         return -ENOBUFS;
8613
8614                 rule = &rdev->coalesce->rules[i];
8615                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
8616                                 rule->delay))
8617                         return -ENOBUFS;
8618
8619                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
8620                                 rule->condition))
8621                         return -ENOBUFS;
8622
8623                 nl_pats = nla_nest_start(msg,
8624                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
8625                 if (!nl_pats)
8626                         return -ENOBUFS;
8627
8628                 for (j = 0; j < rule->n_patterns; j++) {
8629                         nl_pat = nla_nest_start(msg, j + 1);
8630                         if (!nl_pat)
8631                                 return -ENOBUFS;
8632                         pat_len = rule->patterns[j].pattern_len;
8633                         if (nla_put(msg, NL80211_PKTPAT_MASK,
8634                                     DIV_ROUND_UP(pat_len, 8),
8635                                     rule->patterns[j].mask) ||
8636                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
8637                                     rule->patterns[j].pattern) ||
8638                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
8639                                         rule->patterns[j].pkt_offset))
8640                                 return -ENOBUFS;
8641                         nla_nest_end(msg, nl_pat);
8642                 }
8643                 nla_nest_end(msg, nl_pats);
8644                 nla_nest_end(msg, nl_rule);
8645         }
8646         nla_nest_end(msg, nl_rules);
8647
8648         return 0;
8649 }
8650
8651 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
8652 {
8653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8654         struct sk_buff *msg;
8655         void *hdr;
8656
8657         if (!rdev->wiphy.coalesce)
8658                 return -EOPNOTSUPP;
8659
8660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8661         if (!msg)
8662                 return -ENOMEM;
8663
8664         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8665                              NL80211_CMD_GET_COALESCE);
8666         if (!hdr)
8667                 goto nla_put_failure;
8668
8669         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
8670                 goto nla_put_failure;
8671
8672         genlmsg_end(msg, hdr);
8673         return genlmsg_reply(msg, info);
8674
8675 nla_put_failure:
8676         nlmsg_free(msg);
8677         return -ENOBUFS;
8678 }
8679
8680 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
8681 {
8682         struct cfg80211_coalesce *coalesce = rdev->coalesce;
8683         int i, j;
8684         struct cfg80211_coalesce_rules *rule;
8685
8686         if (!coalesce)
8687                 return;
8688
8689         for (i = 0; i < coalesce->n_rules; i++) {
8690                 rule = &coalesce->rules[i];
8691                 for (j = 0; j < rule->n_patterns; j++)
8692                         kfree(rule->patterns[j].mask);
8693                 kfree(rule->patterns);
8694         }
8695         kfree(coalesce->rules);
8696         kfree(coalesce);
8697         rdev->coalesce = NULL;
8698 }
8699
8700 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
8701                                        struct nlattr *rule,
8702                                        struct cfg80211_coalesce_rules *new_rule)
8703 {
8704         int err, i;
8705         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8706         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
8707         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
8708         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
8709
8710         err = nla_parse(tb, NL80211_ATTR_COALESCE_RULE_MAX, nla_data(rule),
8711                         nla_len(rule), nl80211_coalesce_policy);
8712         if (err)
8713                 return err;
8714
8715         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
8716                 new_rule->delay =
8717                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
8718         if (new_rule->delay > coalesce->max_delay)
8719                 return -EINVAL;
8720
8721         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
8722                 new_rule->condition =
8723                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
8724         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
8725             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
8726                 return -EINVAL;
8727
8728         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
8729                 return -EINVAL;
8730
8731         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8732                             rem)
8733                 n_patterns++;
8734         if (n_patterns > coalesce->n_patterns)
8735                 return -EINVAL;
8736
8737         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
8738                                      GFP_KERNEL);
8739         if (!new_rule->patterns)
8740                 return -ENOMEM;
8741
8742         new_rule->n_patterns = n_patterns;
8743         i = 0;
8744
8745         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
8746                             rem) {
8747                 nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat),
8748                           nla_len(pat), NULL);
8749                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
8750                     !pat_tb[NL80211_PKTPAT_PATTERN])
8751                         return -EINVAL;
8752                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
8753                 mask_len = DIV_ROUND_UP(pat_len, 8);
8754                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
8755                         return -EINVAL;
8756                 if (pat_len > coalesce->pattern_max_len ||
8757                     pat_len < coalesce->pattern_min_len)
8758                         return -EINVAL;
8759
8760                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
8761                         pkt_offset = 0;
8762                 else
8763                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
8764                 if (pkt_offset > coalesce->max_pkt_offset)
8765                         return -EINVAL;
8766                 new_rule->patterns[i].pkt_offset = pkt_offset;
8767
8768                 new_rule->patterns[i].mask =
8769                         kmalloc(mask_len + pat_len, GFP_KERNEL);
8770                 if (!new_rule->patterns[i].mask)
8771                         return -ENOMEM;
8772                 new_rule->patterns[i].pattern =
8773                         new_rule->patterns[i].mask + mask_len;
8774                 memcpy(new_rule->patterns[i].mask,
8775                        nla_data(pat_tb[NL80211_PKTPAT_MASK]), mask_len);
8776                 new_rule->patterns[i].pattern_len = pat_len;
8777                 memcpy(new_rule->patterns[i].pattern,
8778                        nla_data(pat_tb[NL80211_PKTPAT_PATTERN]), pat_len);
8779                 i++;
8780         }
8781
8782         return 0;
8783 }
8784
8785 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
8786 {
8787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8788         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
8789         struct cfg80211_coalesce new_coalesce = {};
8790         struct cfg80211_coalesce *n_coalesce;
8791         int err, rem_rule, n_rules = 0, i, j;
8792         struct nlattr *rule;
8793         struct cfg80211_coalesce_rules *tmp_rule;
8794
8795         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
8796                 return -EOPNOTSUPP;
8797
8798         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
8799                 cfg80211_rdev_free_coalesce(rdev);
8800                 rdev->ops->set_coalesce(&rdev->wiphy, NULL);
8801                 return 0;
8802         }
8803
8804         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8805                             rem_rule)
8806                 n_rules++;
8807         if (n_rules > coalesce->n_rules)
8808                 return -EINVAL;
8809
8810         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
8811                                      GFP_KERNEL);
8812         if (!new_coalesce.rules)
8813                 return -ENOMEM;
8814
8815         new_coalesce.n_rules = n_rules;
8816         i = 0;
8817
8818         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
8819                             rem_rule) {
8820                 err = nl80211_parse_coalesce_rule(rdev, rule,
8821                                                   &new_coalesce.rules[i]);
8822                 if (err)
8823                         goto error;
8824
8825                 i++;
8826         }
8827
8828         err = rdev->ops->set_coalesce(&rdev->wiphy, &new_coalesce);
8829         if (err)
8830                 goto error;
8831
8832         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
8833         if (!n_coalesce) {
8834                 err = -ENOMEM;
8835                 goto error;
8836         }
8837         cfg80211_rdev_free_coalesce(rdev);
8838         rdev->coalesce = n_coalesce;
8839
8840         return 0;
8841 error:
8842         for (i = 0; i < new_coalesce.n_rules; i++) {
8843                 tmp_rule = &new_coalesce.rules[i];
8844                 for (j = 0; j < tmp_rule->n_patterns; j++)
8845                         kfree(tmp_rule->patterns[j].mask);
8846                 kfree(tmp_rule->patterns);
8847         }
8848         kfree(new_coalesce.rules);
8849
8850         return err;
8851 }
8852
8853 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
8854 {
8855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8856         struct net_device *dev = info->user_ptr[1];
8857         struct wireless_dev *wdev = dev->ieee80211_ptr;
8858         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
8859         struct cfg80211_gtk_rekey_data rekey_data;
8860         int err;
8861
8862         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
8863                 return -EINVAL;
8864
8865         err = nla_parse(tb, MAX_NL80211_REKEY_DATA,
8866                         nla_data(info->attrs[NL80211_ATTR_REKEY_DATA]),
8867                         nla_len(info->attrs[NL80211_ATTR_REKEY_DATA]),
8868                         nl80211_rekey_policy);
8869         if (err)
8870                 return err;
8871
8872         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
8873                 return -ERANGE;
8874         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
8875                 return -ERANGE;
8876         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
8877                 return -ERANGE;
8878
8879         memcpy(rekey_data.kek, nla_data(tb[NL80211_REKEY_DATA_KEK]),
8880                NL80211_KEK_LEN);
8881         memcpy(rekey_data.kck, nla_data(tb[NL80211_REKEY_DATA_KCK]),
8882                NL80211_KCK_LEN);
8883         memcpy(rekey_data.replay_ctr,
8884                nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]),
8885                NL80211_REPLAY_CTR_LEN);
8886
8887         wdev_lock(wdev);
8888         if (!wdev->current_bss) {
8889                 err = -ENOTCONN;
8890                 goto out;
8891         }
8892
8893         if (!rdev->ops->set_rekey_data) {
8894                 err = -EOPNOTSUPP;
8895                 goto out;
8896         }
8897
8898         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
8899  out:
8900         wdev_unlock(wdev);
8901         return err;
8902 }
8903
8904 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
8905                                              struct genl_info *info)
8906 {
8907         struct net_device *dev = info->user_ptr[1];
8908         struct wireless_dev *wdev = dev->ieee80211_ptr;
8909
8910         if (wdev->iftype != NL80211_IFTYPE_AP &&
8911             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8912                 return -EINVAL;
8913
8914         if (wdev->ap_unexpected_nlportid)
8915                 return -EBUSY;
8916
8917         wdev->ap_unexpected_nlportid = info->snd_portid;
8918         return 0;
8919 }
8920
8921 static int nl80211_probe_client(struct sk_buff *skb,
8922                                 struct genl_info *info)
8923 {
8924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8925         struct net_device *dev = info->user_ptr[1];
8926         struct wireless_dev *wdev = dev->ieee80211_ptr;
8927         struct sk_buff *msg;
8928         void *hdr;
8929         const u8 *addr;
8930         u64 cookie;
8931         int err;
8932
8933         if (wdev->iftype != NL80211_IFTYPE_AP &&
8934             wdev->iftype != NL80211_IFTYPE_P2P_GO)
8935                 return -EOPNOTSUPP;
8936
8937         if (!info->attrs[NL80211_ATTR_MAC])
8938                 return -EINVAL;
8939
8940         if (!rdev->ops->probe_client)
8941                 return -EOPNOTSUPP;
8942
8943         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8944         if (!msg)
8945                 return -ENOMEM;
8946
8947         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8948                              NL80211_CMD_PROBE_CLIENT);
8949         if (!hdr) {
8950                 err = -ENOBUFS;
8951                 goto free_msg;
8952         }
8953
8954         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
8955
8956         err = rdev_probe_client(rdev, dev, addr, &cookie);
8957         if (err)
8958                 goto free_msg;
8959
8960         if (nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
8961                 goto nla_put_failure;
8962
8963         genlmsg_end(msg, hdr);
8964
8965         return genlmsg_reply(msg, info);
8966
8967  nla_put_failure:
8968         err = -ENOBUFS;
8969  free_msg:
8970         nlmsg_free(msg);
8971         return err;
8972 }
8973
8974 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
8975 {
8976         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8977         struct cfg80211_beacon_registration *reg, *nreg;
8978         int rv;
8979
8980         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
8981                 return -EOPNOTSUPP;
8982
8983         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
8984         if (!nreg)
8985                 return -ENOMEM;
8986
8987         /* First, check if already registered. */
8988         spin_lock_bh(&rdev->beacon_registrations_lock);
8989         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
8990                 if (reg->nlportid == info->snd_portid) {
8991                         rv = -EALREADY;
8992                         goto out_err;
8993                 }
8994         }
8995         /* Add it to the list */
8996         nreg->nlportid = info->snd_portid;
8997         list_add(&nreg->list, &rdev->beacon_registrations);
8998
8999         spin_unlock_bh(&rdev->beacon_registrations_lock);
9000
9001         return 0;
9002 out_err:
9003         spin_unlock_bh(&rdev->beacon_registrations_lock);
9004         kfree(nreg);
9005         return rv;
9006 }
9007
9008 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
9009 {
9010         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9011         struct wireless_dev *wdev = info->user_ptr[1];
9012         int err;
9013
9014         if (!rdev->ops->start_p2p_device)
9015                 return -EOPNOTSUPP;
9016
9017         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9018                 return -EOPNOTSUPP;
9019
9020         if (wdev->p2p_started)
9021                 return 0;
9022
9023         if (rfkill_blocked(rdev->rfkill))
9024                 return -ERFKILL;
9025
9026         err = rdev_start_p2p_device(rdev, wdev);
9027         if (err)
9028                 return err;
9029
9030         wdev->p2p_started = true;
9031         rdev->opencount++;
9032
9033         return 0;
9034 }
9035
9036 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
9037 {
9038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9039         struct wireless_dev *wdev = info->user_ptr[1];
9040
9041         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
9042                 return -EOPNOTSUPP;
9043
9044         if (!rdev->ops->stop_p2p_device)
9045                 return -EOPNOTSUPP;
9046
9047         cfg80211_stop_p2p_device(rdev, wdev);
9048
9049         return 0;
9050 }
9051
9052 static int nl80211_get_protocol_features(struct sk_buff *skb,
9053                                          struct genl_info *info)
9054 {
9055         void *hdr;
9056         struct sk_buff *msg;
9057
9058         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9059         if (!msg)
9060                 return -ENOMEM;
9061
9062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9063                              NL80211_CMD_GET_PROTOCOL_FEATURES);
9064         if (!hdr)
9065                 goto nla_put_failure;
9066
9067         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
9068                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
9069                 goto nla_put_failure;
9070
9071         genlmsg_end(msg, hdr);
9072         return genlmsg_reply(msg, info);
9073
9074  nla_put_failure:
9075         kfree_skb(msg);
9076         return -ENOBUFS;
9077 }
9078
9079 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
9080 {
9081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9082         struct cfg80211_update_ft_ies_params ft_params;
9083         struct net_device *dev = info->user_ptr[1];
9084
9085         if (!rdev->ops->update_ft_ies)
9086                 return -EOPNOTSUPP;
9087
9088         if (!info->attrs[NL80211_ATTR_MDID] ||
9089             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9090                 return -EINVAL;
9091
9092         memset(&ft_params, 0, sizeof(ft_params));
9093         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
9094         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9095         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9096
9097         return rdev_update_ft_ies(rdev, dev, &ft_params);
9098 }
9099
9100 static int nl80211_crit_protocol_start(struct sk_buff *skb,
9101                                        struct genl_info *info)
9102 {
9103         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9104         struct wireless_dev *wdev = info->user_ptr[1];
9105         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
9106         u16 duration;
9107         int ret;
9108
9109         if (!rdev->ops->crit_proto_start)
9110                 return -EOPNOTSUPP;
9111
9112         if (WARN_ON(!rdev->ops->crit_proto_stop))
9113                 return -EINVAL;
9114
9115         if (rdev->crit_proto_nlportid)
9116                 return -EBUSY;
9117
9118         /* determine protocol if provided */
9119         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
9120                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
9121
9122         if (proto >= NUM_NL80211_CRIT_PROTO)
9123                 return -EINVAL;
9124
9125         /* timeout must be provided */
9126         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
9127                 return -EINVAL;
9128
9129         duration =
9130                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
9131
9132         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
9133                 return -ERANGE;
9134
9135         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
9136         if (!ret)
9137                 rdev->crit_proto_nlportid = info->snd_portid;
9138
9139         return ret;
9140 }
9141
9142 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
9143                                       struct genl_info *info)
9144 {
9145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9146         struct wireless_dev *wdev = info->user_ptr[1];
9147
9148         if (!rdev->ops->crit_proto_stop)
9149                 return -EOPNOTSUPP;
9150
9151         if (rdev->crit_proto_nlportid) {
9152                 rdev->crit_proto_nlportid = 0;
9153                 rdev_crit_proto_stop(rdev, wdev);
9154         }
9155         return 0;
9156 }
9157
9158 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
9159 {
9160         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9161         struct wireless_dev *wdev =
9162                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9163         int i, err;
9164         u32 vid, subcmd;
9165
9166         if (!rdev->wiphy.vendor_commands)
9167                 return -EOPNOTSUPP;
9168
9169         if (IS_ERR(wdev)) {
9170                 err = PTR_ERR(wdev);
9171                 if (err != -EINVAL)
9172                         return err;
9173                 wdev = NULL;
9174         } else if (wdev->wiphy != &rdev->wiphy) {
9175                 return -EINVAL;
9176         }
9177
9178         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
9179             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
9180                 return -EINVAL;
9181
9182         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
9183         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
9184         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
9185                 const struct wiphy_vendor_command *vcmd;
9186                 void *data = NULL;
9187                 int len = 0;
9188
9189                 vcmd = &rdev->wiphy.vendor_commands[i];
9190
9191                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
9192                         continue;
9193
9194                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
9195                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
9196                         if (!wdev)
9197                                 return -EINVAL;
9198                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
9199                             !wdev->netdev)
9200                                 return -EINVAL;
9201
9202                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
9203                                 if (wdev->netdev &&
9204                                     !netif_running(wdev->netdev))
9205                                         return -ENETDOWN;
9206                                 if (!wdev->netdev && !wdev->p2p_started)
9207                                         return -ENETDOWN;
9208                         }
9209                 } else {
9210                         wdev = NULL;
9211                 }
9212
9213                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
9214                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9215                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
9216                 }
9217
9218                 rdev->cur_cmd_info = info;
9219                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
9220                                                           data, len);
9221                 rdev->cur_cmd_info = NULL;
9222                 return err;
9223         }
9224
9225         return -EOPNOTSUPP;
9226 }
9227
9228 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
9229                                            enum nl80211_commands cmd,
9230                                            enum nl80211_attrs attr,
9231                                            int approxlen)
9232 {
9233         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9234
9235         if (WARN_ON(!rdev->cur_cmd_info))
9236                 return NULL;
9237
9238         return __cfg80211_alloc_vendor_skb(rdev, approxlen,
9239                                            rdev->cur_cmd_info->snd_portid,
9240                                            rdev->cur_cmd_info->snd_seq,
9241                                            cmd, attr, NULL, GFP_KERNEL);
9242 }
9243 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
9244
9245 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
9246 {
9247         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9248         void *hdr = ((void **)skb->cb)[1];
9249         struct nlattr *data = ((void **)skb->cb)[2];
9250
9251         if (WARN_ON(!rdev->cur_cmd_info)) {
9252                 kfree_skb(skb);
9253                 return -EINVAL;
9254         }
9255
9256         nla_nest_end(skb, data);
9257         genlmsg_end(skb, hdr);
9258         return genlmsg_reply(skb, rdev->cur_cmd_info);
9259 }
9260 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
9261
9262
9263 static int nl80211_set_qos_map(struct sk_buff *skb,
9264                                struct genl_info *info)
9265 {
9266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9267         struct cfg80211_qos_map *qos_map = NULL;
9268         struct net_device *dev = info->user_ptr[1];
9269         u8 *pos, len, num_des, des_len, des;
9270         int ret;
9271
9272         if (!rdev->ops->set_qos_map)
9273                 return -EOPNOTSUPP;
9274
9275         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
9276                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
9277                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
9278
9279                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
9280                     len > IEEE80211_QOS_MAP_LEN_MAX)
9281                         return -EINVAL;
9282
9283                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
9284                 if (!qos_map)
9285                         return -ENOMEM;
9286
9287                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
9288                 if (num_des) {
9289                         des_len = num_des *
9290                                 sizeof(struct cfg80211_dscp_exception);
9291                         memcpy(qos_map->dscp_exception, pos, des_len);
9292                         qos_map->num_des = num_des;
9293                         for (des = 0; des < num_des; des++) {
9294                                 if (qos_map->dscp_exception[des].up > 7) {
9295                                         kfree(qos_map);
9296                                         return -EINVAL;
9297                                 }
9298                         }
9299                         pos += des_len;
9300                 }
9301                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
9302         }
9303
9304         wdev_lock(dev->ieee80211_ptr);
9305         ret = nl80211_key_allowed(dev->ieee80211_ptr);
9306         if (!ret)
9307                 ret = rdev_set_qos_map(rdev, dev, qos_map);
9308         wdev_unlock(dev->ieee80211_ptr);
9309
9310         kfree(qos_map);
9311         return ret;
9312 }
9313
9314 #define NL80211_FLAG_NEED_WIPHY         0x01
9315 #define NL80211_FLAG_NEED_NETDEV        0x02
9316 #define NL80211_FLAG_NEED_RTNL          0x04
9317 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
9318 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
9319                                          NL80211_FLAG_CHECK_NETDEV_UP)
9320 #define NL80211_FLAG_NEED_WDEV          0x10
9321 /* If a netdev is associated, it must be UP, P2P must be started */
9322 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
9323                                          NL80211_FLAG_CHECK_NETDEV_UP)
9324
9325 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
9326                             struct genl_info *info)
9327 {
9328         struct cfg80211_registered_device *rdev;
9329         struct wireless_dev *wdev;
9330         struct net_device *dev;
9331         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
9332
9333         if (rtnl)
9334                 rtnl_lock();
9335
9336         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
9337                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
9338                 if (IS_ERR(rdev)) {
9339                         if (rtnl)
9340                                 rtnl_unlock();
9341                         return PTR_ERR(rdev);
9342                 }
9343                 info->user_ptr[0] = rdev;
9344         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
9345                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9346                 ASSERT_RTNL();
9347
9348                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
9349                                                   info->attrs);
9350                 if (IS_ERR(wdev)) {
9351                         if (rtnl)
9352                                 rtnl_unlock();
9353                         return PTR_ERR(wdev);
9354                 }
9355
9356                 dev = wdev->netdev;
9357                 rdev = wiphy_to_rdev(wdev->wiphy);
9358
9359                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
9360                         if (!dev) {
9361                                 if (rtnl)
9362                                         rtnl_unlock();
9363                                 return -EINVAL;
9364                         }
9365
9366                         info->user_ptr[1] = dev;
9367                 } else {
9368                         info->user_ptr[1] = wdev;
9369                 }
9370
9371                 if (dev) {
9372                         if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
9373                             !netif_running(dev)) {
9374                                 if (rtnl)
9375                                         rtnl_unlock();
9376                                 return -ENETDOWN;
9377                         }
9378
9379                         dev_hold(dev);
9380                 } else if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP) {
9381                         if (!wdev->p2p_started) {
9382                                 if (rtnl)
9383                                         rtnl_unlock();
9384                                 return -ENETDOWN;
9385                         }
9386                 }
9387
9388                 info->user_ptr[0] = rdev;
9389         }
9390
9391         return 0;
9392 }
9393
9394 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
9395                               struct genl_info *info)
9396 {
9397         if (info->user_ptr[1]) {
9398                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
9399                         struct wireless_dev *wdev = info->user_ptr[1];
9400
9401                         if (wdev->netdev)
9402                                 dev_put(wdev->netdev);
9403                 } else {
9404                         dev_put(info->user_ptr[1]);
9405                 }
9406         }
9407         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
9408                 rtnl_unlock();
9409 }
9410
9411 static const struct genl_ops nl80211_ops[] = {
9412         {
9413                 .cmd = NL80211_CMD_GET_WIPHY,
9414                 .doit = nl80211_get_wiphy,
9415                 .dumpit = nl80211_dump_wiphy,
9416                 .done = nl80211_dump_wiphy_done,
9417                 .policy = nl80211_policy,
9418                 /* can be retrieved by unprivileged users */
9419                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9420                                   NL80211_FLAG_NEED_RTNL,
9421         },
9422         {
9423                 .cmd = NL80211_CMD_SET_WIPHY,
9424                 .doit = nl80211_set_wiphy,
9425                 .policy = nl80211_policy,
9426                 .flags = GENL_ADMIN_PERM,
9427                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9428         },
9429         {
9430                 .cmd = NL80211_CMD_GET_INTERFACE,
9431                 .doit = nl80211_get_interface,
9432                 .dumpit = nl80211_dump_interface,
9433                 .policy = nl80211_policy,
9434                 /* can be retrieved by unprivileged users */
9435                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9436                                   NL80211_FLAG_NEED_RTNL,
9437         },
9438         {
9439                 .cmd = NL80211_CMD_SET_INTERFACE,
9440                 .doit = nl80211_set_interface,
9441                 .policy = nl80211_policy,
9442                 .flags = GENL_ADMIN_PERM,
9443                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9444                                   NL80211_FLAG_NEED_RTNL,
9445         },
9446         {
9447                 .cmd = NL80211_CMD_NEW_INTERFACE,
9448                 .doit = nl80211_new_interface,
9449                 .policy = nl80211_policy,
9450                 .flags = GENL_ADMIN_PERM,
9451                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9452                                   NL80211_FLAG_NEED_RTNL,
9453         },
9454         {
9455                 .cmd = NL80211_CMD_DEL_INTERFACE,
9456                 .doit = nl80211_del_interface,
9457                 .policy = nl80211_policy,
9458                 .flags = GENL_ADMIN_PERM,
9459                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9460                                   NL80211_FLAG_NEED_RTNL,
9461         },
9462         {
9463                 .cmd = NL80211_CMD_GET_KEY,
9464                 .doit = nl80211_get_key,
9465                 .policy = nl80211_policy,
9466                 .flags = GENL_ADMIN_PERM,
9467                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9468                                   NL80211_FLAG_NEED_RTNL,
9469         },
9470         {
9471                 .cmd = NL80211_CMD_SET_KEY,
9472                 .doit = nl80211_set_key,
9473                 .policy = nl80211_policy,
9474                 .flags = GENL_ADMIN_PERM,
9475                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9476                                   NL80211_FLAG_NEED_RTNL,
9477         },
9478         {
9479                 .cmd = NL80211_CMD_NEW_KEY,
9480                 .doit = nl80211_new_key,
9481                 .policy = nl80211_policy,
9482                 .flags = GENL_ADMIN_PERM,
9483                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9484                                   NL80211_FLAG_NEED_RTNL,
9485         },
9486         {
9487                 .cmd = NL80211_CMD_DEL_KEY,
9488                 .doit = nl80211_del_key,
9489                 .policy = nl80211_policy,
9490                 .flags = GENL_ADMIN_PERM,
9491                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9492                                   NL80211_FLAG_NEED_RTNL,
9493         },
9494         {
9495                 .cmd = NL80211_CMD_SET_BEACON,
9496                 .policy = nl80211_policy,
9497                 .flags = GENL_ADMIN_PERM,
9498                 .doit = nl80211_set_beacon,
9499                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9500                                   NL80211_FLAG_NEED_RTNL,
9501         },
9502         {
9503                 .cmd = NL80211_CMD_START_AP,
9504                 .policy = nl80211_policy,
9505                 .flags = GENL_ADMIN_PERM,
9506                 .doit = nl80211_start_ap,
9507                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9508                                   NL80211_FLAG_NEED_RTNL,
9509         },
9510         {
9511                 .cmd = NL80211_CMD_STOP_AP,
9512                 .policy = nl80211_policy,
9513                 .flags = GENL_ADMIN_PERM,
9514                 .doit = nl80211_stop_ap,
9515                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9516                                   NL80211_FLAG_NEED_RTNL,
9517         },
9518         {
9519                 .cmd = NL80211_CMD_GET_STATION,
9520                 .doit = nl80211_get_station,
9521                 .dumpit = nl80211_dump_station,
9522                 .policy = nl80211_policy,
9523                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9524                                   NL80211_FLAG_NEED_RTNL,
9525         },
9526         {
9527                 .cmd = NL80211_CMD_SET_STATION,
9528                 .doit = nl80211_set_station,
9529                 .policy = nl80211_policy,
9530                 .flags = GENL_ADMIN_PERM,
9531                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9532                                   NL80211_FLAG_NEED_RTNL,
9533         },
9534         {
9535                 .cmd = NL80211_CMD_NEW_STATION,
9536                 .doit = nl80211_new_station,
9537                 .policy = nl80211_policy,
9538                 .flags = GENL_ADMIN_PERM,
9539                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9540                                   NL80211_FLAG_NEED_RTNL,
9541         },
9542         {
9543                 .cmd = NL80211_CMD_DEL_STATION,
9544                 .doit = nl80211_del_station,
9545                 .policy = nl80211_policy,
9546                 .flags = GENL_ADMIN_PERM,
9547                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9548                                   NL80211_FLAG_NEED_RTNL,
9549         },
9550         {
9551                 .cmd = NL80211_CMD_GET_MPATH,
9552                 .doit = nl80211_get_mpath,
9553                 .dumpit = nl80211_dump_mpath,
9554                 .policy = nl80211_policy,
9555                 .flags = GENL_ADMIN_PERM,
9556                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9557                                   NL80211_FLAG_NEED_RTNL,
9558         },
9559         {
9560                 .cmd = NL80211_CMD_SET_MPATH,
9561                 .doit = nl80211_set_mpath,
9562                 .policy = nl80211_policy,
9563                 .flags = GENL_ADMIN_PERM,
9564                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9565                                   NL80211_FLAG_NEED_RTNL,
9566         },
9567         {
9568                 .cmd = NL80211_CMD_NEW_MPATH,
9569                 .doit = nl80211_new_mpath,
9570                 .policy = nl80211_policy,
9571                 .flags = GENL_ADMIN_PERM,
9572                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9573                                   NL80211_FLAG_NEED_RTNL,
9574         },
9575         {
9576                 .cmd = NL80211_CMD_DEL_MPATH,
9577                 .doit = nl80211_del_mpath,
9578                 .policy = nl80211_policy,
9579                 .flags = GENL_ADMIN_PERM,
9580                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9581                                   NL80211_FLAG_NEED_RTNL,
9582         },
9583         {
9584                 .cmd = NL80211_CMD_SET_BSS,
9585                 .doit = nl80211_set_bss,
9586                 .policy = nl80211_policy,
9587                 .flags = GENL_ADMIN_PERM,
9588                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9589                                   NL80211_FLAG_NEED_RTNL,
9590         },
9591         {
9592                 .cmd = NL80211_CMD_GET_REG,
9593                 .doit = nl80211_get_reg,
9594                 .policy = nl80211_policy,
9595                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9596                 /* can be retrieved by unprivileged users */
9597         },
9598         {
9599                 .cmd = NL80211_CMD_SET_REG,
9600                 .doit = nl80211_set_reg,
9601                 .policy = nl80211_policy,
9602                 .flags = GENL_ADMIN_PERM,
9603                 .internal_flags = NL80211_FLAG_NEED_RTNL,
9604         },
9605         {
9606                 .cmd = NL80211_CMD_REQ_SET_REG,
9607                 .doit = nl80211_req_set_reg,
9608                 .policy = nl80211_policy,
9609                 .flags = GENL_ADMIN_PERM,
9610         },
9611         {
9612                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
9613                 .doit = nl80211_get_mesh_config,
9614                 .policy = nl80211_policy,
9615                 /* can be retrieved by unprivileged users */
9616                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9617                                   NL80211_FLAG_NEED_RTNL,
9618         },
9619         {
9620                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
9621                 .doit = nl80211_update_mesh_config,
9622                 .policy = nl80211_policy,
9623                 .flags = GENL_ADMIN_PERM,
9624                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9625                                   NL80211_FLAG_NEED_RTNL,
9626         },
9627         {
9628                 .cmd = NL80211_CMD_TRIGGER_SCAN,
9629                 .doit = nl80211_trigger_scan,
9630                 .policy = nl80211_policy,
9631                 .flags = GENL_ADMIN_PERM,
9632                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9633                                   NL80211_FLAG_NEED_RTNL,
9634         },
9635         {
9636                 .cmd = NL80211_CMD_GET_SCAN,
9637                 .policy = nl80211_policy,
9638                 .dumpit = nl80211_dump_scan,
9639         },
9640         {
9641                 .cmd = NL80211_CMD_START_SCHED_SCAN,
9642                 .doit = nl80211_start_sched_scan,
9643                 .policy = nl80211_policy,
9644                 .flags = GENL_ADMIN_PERM,
9645                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9646                                   NL80211_FLAG_NEED_RTNL,
9647         },
9648         {
9649                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
9650                 .doit = nl80211_stop_sched_scan,
9651                 .policy = nl80211_policy,
9652                 .flags = GENL_ADMIN_PERM,
9653                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9654                                   NL80211_FLAG_NEED_RTNL,
9655         },
9656         {
9657                 .cmd = NL80211_CMD_AUTHENTICATE,
9658                 .doit = nl80211_authenticate,
9659                 .policy = nl80211_policy,
9660                 .flags = GENL_ADMIN_PERM,
9661                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9662                                   NL80211_FLAG_NEED_RTNL,
9663         },
9664         {
9665                 .cmd = NL80211_CMD_ASSOCIATE,
9666                 .doit = nl80211_associate,
9667                 .policy = nl80211_policy,
9668                 .flags = GENL_ADMIN_PERM,
9669                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9670                                   NL80211_FLAG_NEED_RTNL,
9671         },
9672         {
9673                 .cmd = NL80211_CMD_DEAUTHENTICATE,
9674                 .doit = nl80211_deauthenticate,
9675                 .policy = nl80211_policy,
9676                 .flags = GENL_ADMIN_PERM,
9677                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9678                                   NL80211_FLAG_NEED_RTNL,
9679         },
9680         {
9681                 .cmd = NL80211_CMD_DISASSOCIATE,
9682                 .doit = nl80211_disassociate,
9683                 .policy = nl80211_policy,
9684                 .flags = GENL_ADMIN_PERM,
9685                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9686                                   NL80211_FLAG_NEED_RTNL,
9687         },
9688         {
9689                 .cmd = NL80211_CMD_JOIN_IBSS,
9690                 .doit = nl80211_join_ibss,
9691                 .policy = nl80211_policy,
9692                 .flags = GENL_ADMIN_PERM,
9693                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9694                                   NL80211_FLAG_NEED_RTNL,
9695         },
9696         {
9697                 .cmd = NL80211_CMD_LEAVE_IBSS,
9698                 .doit = nl80211_leave_ibss,
9699                 .policy = nl80211_policy,
9700                 .flags = GENL_ADMIN_PERM,
9701                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9702                                   NL80211_FLAG_NEED_RTNL,
9703         },
9704 #ifdef CONFIG_NL80211_TESTMODE
9705         {
9706                 .cmd = NL80211_CMD_TESTMODE,
9707                 .doit = nl80211_testmode_do,
9708                 .dumpit = nl80211_testmode_dump,
9709                 .policy = nl80211_policy,
9710                 .flags = GENL_ADMIN_PERM,
9711                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9712                                   NL80211_FLAG_NEED_RTNL,
9713         },
9714 #endif
9715         {
9716                 .cmd = NL80211_CMD_CONNECT,
9717                 .doit = nl80211_connect,
9718                 .policy = nl80211_policy,
9719                 .flags = GENL_ADMIN_PERM,
9720                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9721                                   NL80211_FLAG_NEED_RTNL,
9722         },
9723         {
9724                 .cmd = NL80211_CMD_DISCONNECT,
9725                 .doit = nl80211_disconnect,
9726                 .policy = nl80211_policy,
9727                 .flags = GENL_ADMIN_PERM,
9728                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9729                                   NL80211_FLAG_NEED_RTNL,
9730         },
9731         {
9732                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
9733                 .doit = nl80211_wiphy_netns,
9734                 .policy = nl80211_policy,
9735                 .flags = GENL_ADMIN_PERM,
9736                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9737                                   NL80211_FLAG_NEED_RTNL,
9738         },
9739         {
9740                 .cmd = NL80211_CMD_GET_SURVEY,
9741                 .policy = nl80211_policy,
9742                 .dumpit = nl80211_dump_survey,
9743         },
9744         {
9745                 .cmd = NL80211_CMD_SET_PMKSA,
9746                 .doit = nl80211_setdel_pmksa,
9747                 .policy = nl80211_policy,
9748                 .flags = GENL_ADMIN_PERM,
9749                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9750                                   NL80211_FLAG_NEED_RTNL,
9751         },
9752         {
9753                 .cmd = NL80211_CMD_DEL_PMKSA,
9754                 .doit = nl80211_setdel_pmksa,
9755                 .policy = nl80211_policy,
9756                 .flags = GENL_ADMIN_PERM,
9757                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9758                                   NL80211_FLAG_NEED_RTNL,
9759         },
9760         {
9761                 .cmd = NL80211_CMD_FLUSH_PMKSA,
9762                 .doit = nl80211_flush_pmksa,
9763                 .policy = nl80211_policy,
9764                 .flags = GENL_ADMIN_PERM,
9765                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9766                                   NL80211_FLAG_NEED_RTNL,
9767         },
9768         {
9769                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
9770                 .doit = nl80211_remain_on_channel,
9771                 .policy = nl80211_policy,
9772                 .flags = GENL_ADMIN_PERM,
9773                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9774                                   NL80211_FLAG_NEED_RTNL,
9775         },
9776         {
9777                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
9778                 .doit = nl80211_cancel_remain_on_channel,
9779                 .policy = nl80211_policy,
9780                 .flags = GENL_ADMIN_PERM,
9781                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9782                                   NL80211_FLAG_NEED_RTNL,
9783         },
9784         {
9785                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
9786                 .doit = nl80211_set_tx_bitrate_mask,
9787                 .policy = nl80211_policy,
9788                 .flags = GENL_ADMIN_PERM,
9789                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9790                                   NL80211_FLAG_NEED_RTNL,
9791         },
9792         {
9793                 .cmd = NL80211_CMD_REGISTER_FRAME,
9794                 .doit = nl80211_register_mgmt,
9795                 .policy = nl80211_policy,
9796                 .flags = GENL_ADMIN_PERM,
9797                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9798                                   NL80211_FLAG_NEED_RTNL,
9799         },
9800         {
9801                 .cmd = NL80211_CMD_FRAME,
9802                 .doit = nl80211_tx_mgmt,
9803                 .policy = nl80211_policy,
9804                 .flags = GENL_ADMIN_PERM,
9805                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9806                                   NL80211_FLAG_NEED_RTNL,
9807         },
9808         {
9809                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
9810                 .doit = nl80211_tx_mgmt_cancel_wait,
9811                 .policy = nl80211_policy,
9812                 .flags = GENL_ADMIN_PERM,
9813                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9814                                   NL80211_FLAG_NEED_RTNL,
9815         },
9816         {
9817                 .cmd = NL80211_CMD_SET_POWER_SAVE,
9818                 .doit = nl80211_set_power_save,
9819                 .policy = nl80211_policy,
9820                 .flags = GENL_ADMIN_PERM,
9821                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9822                                   NL80211_FLAG_NEED_RTNL,
9823         },
9824         {
9825                 .cmd = NL80211_CMD_GET_POWER_SAVE,
9826                 .doit = nl80211_get_power_save,
9827                 .policy = nl80211_policy,
9828                 /* can be retrieved by unprivileged users */
9829                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9830                                   NL80211_FLAG_NEED_RTNL,
9831         },
9832         {
9833                 .cmd = NL80211_CMD_SET_CQM,
9834                 .doit = nl80211_set_cqm,
9835                 .policy = nl80211_policy,
9836                 .flags = GENL_ADMIN_PERM,
9837                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9838                                   NL80211_FLAG_NEED_RTNL,
9839         },
9840         {
9841                 .cmd = NL80211_CMD_SET_CHANNEL,
9842                 .doit = nl80211_set_channel,
9843                 .policy = nl80211_policy,
9844                 .flags = GENL_ADMIN_PERM,
9845                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9846                                   NL80211_FLAG_NEED_RTNL,
9847         },
9848         {
9849                 .cmd = NL80211_CMD_SET_WDS_PEER,
9850                 .doit = nl80211_set_wds_peer,
9851                 .policy = nl80211_policy,
9852                 .flags = GENL_ADMIN_PERM,
9853                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9854                                   NL80211_FLAG_NEED_RTNL,
9855         },
9856         {
9857                 .cmd = NL80211_CMD_JOIN_MESH,
9858                 .doit = nl80211_join_mesh,
9859                 .policy = nl80211_policy,
9860                 .flags = GENL_ADMIN_PERM,
9861                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9862                                   NL80211_FLAG_NEED_RTNL,
9863         },
9864         {
9865                 .cmd = NL80211_CMD_LEAVE_MESH,
9866                 .doit = nl80211_leave_mesh,
9867                 .policy = nl80211_policy,
9868                 .flags = GENL_ADMIN_PERM,
9869                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9870                                   NL80211_FLAG_NEED_RTNL,
9871         },
9872 #ifdef CONFIG_PM
9873         {
9874                 .cmd = NL80211_CMD_GET_WOWLAN,
9875                 .doit = nl80211_get_wowlan,
9876                 .policy = nl80211_policy,
9877                 /* can be retrieved by unprivileged users */
9878                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9879                                   NL80211_FLAG_NEED_RTNL,
9880         },
9881         {
9882                 .cmd = NL80211_CMD_SET_WOWLAN,
9883                 .doit = nl80211_set_wowlan,
9884                 .policy = nl80211_policy,
9885                 .flags = GENL_ADMIN_PERM,
9886                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9887                                   NL80211_FLAG_NEED_RTNL,
9888         },
9889 #endif
9890         {
9891                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
9892                 .doit = nl80211_set_rekey_data,
9893                 .policy = nl80211_policy,
9894                 .flags = GENL_ADMIN_PERM,
9895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9896                                   NL80211_FLAG_NEED_RTNL,
9897         },
9898         {
9899                 .cmd = NL80211_CMD_TDLS_MGMT,
9900                 .doit = nl80211_tdls_mgmt,
9901                 .policy = nl80211_policy,
9902                 .flags = GENL_ADMIN_PERM,
9903                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9904                                   NL80211_FLAG_NEED_RTNL,
9905         },
9906         {
9907                 .cmd = NL80211_CMD_TDLS_OPER,
9908                 .doit = nl80211_tdls_oper,
9909                 .policy = nl80211_policy,
9910                 .flags = GENL_ADMIN_PERM,
9911                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9912                                   NL80211_FLAG_NEED_RTNL,
9913         },
9914         {
9915                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
9916                 .doit = nl80211_register_unexpected_frame,
9917                 .policy = nl80211_policy,
9918                 .flags = GENL_ADMIN_PERM,
9919                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9920                                   NL80211_FLAG_NEED_RTNL,
9921         },
9922         {
9923                 .cmd = NL80211_CMD_PROBE_CLIENT,
9924                 .doit = nl80211_probe_client,
9925                 .policy = nl80211_policy,
9926                 .flags = GENL_ADMIN_PERM,
9927                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9928                                   NL80211_FLAG_NEED_RTNL,
9929         },
9930         {
9931                 .cmd = NL80211_CMD_REGISTER_BEACONS,
9932                 .doit = nl80211_register_beacons,
9933                 .policy = nl80211_policy,
9934                 .flags = GENL_ADMIN_PERM,
9935                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
9936                                   NL80211_FLAG_NEED_RTNL,
9937         },
9938         {
9939                 .cmd = NL80211_CMD_SET_NOACK_MAP,
9940                 .doit = nl80211_set_noack_map,
9941                 .policy = nl80211_policy,
9942                 .flags = GENL_ADMIN_PERM,
9943                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9944                                   NL80211_FLAG_NEED_RTNL,
9945         },
9946         {
9947                 .cmd = NL80211_CMD_START_P2P_DEVICE,
9948                 .doit = nl80211_start_p2p_device,
9949                 .policy = nl80211_policy,
9950                 .flags = GENL_ADMIN_PERM,
9951                 .internal_flags = NL80211_FLAG_NEED_WDEV |
9952                                   NL80211_FLAG_NEED_RTNL,
9953         },
9954         {
9955                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
9956                 .doit = nl80211_stop_p2p_device,
9957                 .policy = nl80211_policy,
9958                 .flags = GENL_ADMIN_PERM,
9959                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
9960                                   NL80211_FLAG_NEED_RTNL,
9961         },
9962         {
9963                 .cmd = NL80211_CMD_SET_MCAST_RATE,
9964                 .doit = nl80211_set_mcast_rate,
9965                 .policy = nl80211_policy,
9966                 .flags = GENL_ADMIN_PERM,
9967                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9968                                   NL80211_FLAG_NEED_RTNL,
9969         },
9970         {
9971                 .cmd = NL80211_CMD_SET_MAC_ACL,
9972                 .doit = nl80211_set_mac_acl,
9973                 .policy = nl80211_policy,
9974                 .flags = GENL_ADMIN_PERM,
9975                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
9976                                   NL80211_FLAG_NEED_RTNL,
9977         },
9978         {
9979                 .cmd = NL80211_CMD_RADAR_DETECT,
9980                 .doit = nl80211_start_radar_detection,
9981                 .policy = nl80211_policy,
9982                 .flags = GENL_ADMIN_PERM,
9983                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9984                                   NL80211_FLAG_NEED_RTNL,
9985         },
9986         {
9987                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
9988                 .doit = nl80211_get_protocol_features,
9989                 .policy = nl80211_policy,
9990         },
9991         {
9992                 .cmd = NL80211_CMD_UPDATE_FT_IES,
9993                 .doit = nl80211_update_ft_ies,
9994                 .policy = nl80211_policy,
9995                 .flags = GENL_ADMIN_PERM,
9996                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
9997                                   NL80211_FLAG_NEED_RTNL,
9998         },
9999         {
10000                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
10001                 .doit = nl80211_crit_protocol_start,
10002                 .policy = nl80211_policy,
10003                 .flags = GENL_ADMIN_PERM,
10004                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10005                                   NL80211_FLAG_NEED_RTNL,
10006         },
10007         {
10008                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
10009                 .doit = nl80211_crit_protocol_stop,
10010                 .policy = nl80211_policy,
10011                 .flags = GENL_ADMIN_PERM,
10012                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
10013                                   NL80211_FLAG_NEED_RTNL,
10014         },
10015         {
10016                 .cmd = NL80211_CMD_GET_COALESCE,
10017                 .doit = nl80211_get_coalesce,
10018                 .policy = nl80211_policy,
10019                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10020                                   NL80211_FLAG_NEED_RTNL,
10021         },
10022         {
10023                 .cmd = NL80211_CMD_SET_COALESCE,
10024                 .doit = nl80211_set_coalesce,
10025                 .policy = nl80211_policy,
10026                 .flags = GENL_ADMIN_PERM,
10027                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10028                                   NL80211_FLAG_NEED_RTNL,
10029         },
10030         {
10031                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
10032                 .doit = nl80211_channel_switch,
10033                 .policy = nl80211_policy,
10034                 .flags = GENL_ADMIN_PERM,
10035                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10036                                   NL80211_FLAG_NEED_RTNL,
10037         },
10038         {
10039                 .cmd = NL80211_CMD_VENDOR,
10040                 .doit = nl80211_vendor_cmd,
10041                 .policy = nl80211_policy,
10042                 .flags = GENL_ADMIN_PERM,
10043                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
10044                                   NL80211_FLAG_NEED_RTNL,
10045         },
10046         {
10047                 .cmd = NL80211_CMD_SET_QOS_MAP,
10048                 .doit = nl80211_set_qos_map,
10049                 .policy = nl80211_policy,
10050                 .flags = GENL_ADMIN_PERM,
10051                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
10052                                   NL80211_FLAG_NEED_RTNL,
10053         },
10054 };
10055
10056 /* notification functions */
10057
10058 void nl80211_notify_dev_rename(struct cfg80211_registered_device *rdev)
10059 {
10060         struct sk_buff *msg;
10061         struct nl80211_dump_wiphy_state state = {};
10062
10063         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10064         if (!msg)
10065                 return;
10066
10067         if (nl80211_send_wiphy(rdev, msg, 0, 0, 0, &state) < 0) {
10068                 nlmsg_free(msg);
10069                 return;
10070         }
10071
10072         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10073                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
10074 }
10075
10076 static int nl80211_add_scan_req(struct sk_buff *msg,
10077                                 struct cfg80211_registered_device *rdev)
10078 {
10079         struct cfg80211_scan_request *req = rdev->scan_req;
10080         struct nlattr *nest;
10081         int i;
10082
10083         if (WARN_ON(!req))
10084                 return 0;
10085
10086         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
10087         if (!nest)
10088                 goto nla_put_failure;
10089         for (i = 0; i < req->n_ssids; i++) {
10090                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
10091                         goto nla_put_failure;
10092         }
10093         nla_nest_end(msg, nest);
10094
10095         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10096         if (!nest)
10097                 goto nla_put_failure;
10098         for (i = 0; i < req->n_channels; i++) {
10099                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10100                         goto nla_put_failure;
10101         }
10102         nla_nest_end(msg, nest);
10103
10104         if (req->ie &&
10105             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
10106                 goto nla_put_failure;
10107
10108         if (req->flags &&
10109             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
10110                 goto nla_put_failure;
10111
10112         return 0;
10113  nla_put_failure:
10114         return -ENOBUFS;
10115 }
10116
10117 static int nl80211_send_scan_msg(struct sk_buff *msg,
10118                                  struct cfg80211_registered_device *rdev,
10119                                  struct wireless_dev *wdev,
10120                                  u32 portid, u32 seq, int flags,
10121                                  u32 cmd)
10122 {
10123         void *hdr;
10124
10125         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10126         if (!hdr)
10127                 return -1;
10128
10129         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10130             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10131                                          wdev->netdev->ifindex)) ||
10132             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
10133                 goto nla_put_failure;
10134
10135         /* ignore errors and send incomplete event anyway */
10136         nl80211_add_scan_req(msg, rdev);
10137
10138         return genlmsg_end(msg, hdr);
10139
10140  nla_put_failure:
10141         genlmsg_cancel(msg, hdr);
10142         return -EMSGSIZE;
10143 }
10144
10145 static int
10146 nl80211_send_sched_scan_msg(struct sk_buff *msg,
10147                             struct cfg80211_registered_device *rdev,
10148                             struct net_device *netdev,
10149                             u32 portid, u32 seq, int flags, u32 cmd)
10150 {
10151         void *hdr;
10152
10153         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
10154         if (!hdr)
10155                 return -1;
10156
10157         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10158             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
10159                 goto nla_put_failure;
10160
10161         return genlmsg_end(msg, hdr);
10162
10163  nla_put_failure:
10164         genlmsg_cancel(msg, hdr);
10165         return -EMSGSIZE;
10166 }
10167
10168 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
10169                              struct wireless_dev *wdev)
10170 {
10171         struct sk_buff *msg;
10172
10173         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10174         if (!msg)
10175                 return;
10176
10177         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10178                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
10179                 nlmsg_free(msg);
10180                 return;
10181         }
10182
10183         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10184                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10185 }
10186
10187 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
10188                                        struct wireless_dev *wdev, bool aborted)
10189 {
10190         struct sk_buff *msg;
10191
10192         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10193         if (!msg)
10194                 return NULL;
10195
10196         if (nl80211_send_scan_msg(msg, rdev, wdev, 0, 0, 0,
10197                                   aborted ? NL80211_CMD_SCAN_ABORTED :
10198                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
10199                 nlmsg_free(msg);
10200                 return NULL;
10201         }
10202
10203         return msg;
10204 }
10205
10206 void nl80211_send_scan_result(struct cfg80211_registered_device *rdev,
10207                               struct sk_buff *msg)
10208 {
10209         if (!msg)
10210                 return;
10211
10212         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10213                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10214 }
10215
10216 void nl80211_send_sched_scan_results(struct cfg80211_registered_device *rdev,
10217                                      struct net_device *netdev)
10218 {
10219         struct sk_buff *msg;
10220
10221         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10222         if (!msg)
10223                 return;
10224
10225         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0,
10226                                         NL80211_CMD_SCHED_SCAN_RESULTS) < 0) {
10227                 nlmsg_free(msg);
10228                 return;
10229         }
10230
10231         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10232                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10233 }
10234
10235 void nl80211_send_sched_scan(struct cfg80211_registered_device *rdev,
10236                              struct net_device *netdev, u32 cmd)
10237 {
10238         struct sk_buff *msg;
10239
10240         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10241         if (!msg)
10242                 return;
10243
10244         if (nl80211_send_sched_scan_msg(msg, rdev, netdev, 0, 0, 0, cmd) < 0) {
10245                 nlmsg_free(msg);
10246                 return;
10247         }
10248
10249         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10250                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
10251 }
10252
10253 /*
10254  * This can happen on global regulatory changes or device specific settings
10255  * based on custom world regulatory domains.
10256  */
10257 void nl80211_send_reg_change_event(struct regulatory_request *request)
10258 {
10259         struct sk_buff *msg;
10260         void *hdr;
10261
10262         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10263         if (!msg)
10264                 return;
10265
10266         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_CHANGE);
10267         if (!hdr) {
10268                 nlmsg_free(msg);
10269                 return;
10270         }
10271
10272         /* Userspace can always count this one always being set */
10273         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
10274                 goto nla_put_failure;
10275
10276         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
10277                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10278                                NL80211_REGDOM_TYPE_WORLD))
10279                         goto nla_put_failure;
10280         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
10281                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10282                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
10283                         goto nla_put_failure;
10284         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
10285                    request->intersect) {
10286                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10287                                NL80211_REGDOM_TYPE_INTERSECTION))
10288                         goto nla_put_failure;
10289         } else {
10290                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
10291                                NL80211_REGDOM_TYPE_COUNTRY) ||
10292                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
10293                                    request->alpha2))
10294                         goto nla_put_failure;
10295         }
10296
10297         if (request->wiphy_idx != WIPHY_IDX_INVALID &&
10298             nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
10299                 goto nla_put_failure;
10300
10301         genlmsg_end(msg, hdr);
10302
10303         rcu_read_lock();
10304         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10305                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10306         rcu_read_unlock();
10307
10308         return;
10309
10310 nla_put_failure:
10311         genlmsg_cancel(msg, hdr);
10312         nlmsg_free(msg);
10313 }
10314
10315 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
10316                                     struct net_device *netdev,
10317                                     const u8 *buf, size_t len,
10318                                     enum nl80211_commands cmd, gfp_t gfp)
10319 {
10320         struct sk_buff *msg;
10321         void *hdr;
10322
10323         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10324         if (!msg)
10325                 return;
10326
10327         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10328         if (!hdr) {
10329                 nlmsg_free(msg);
10330                 return;
10331         }
10332
10333         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10334             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10335             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
10336                 goto nla_put_failure;
10337
10338         genlmsg_end(msg, hdr);
10339
10340         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10341                                 NL80211_MCGRP_MLME, gfp);
10342         return;
10343
10344  nla_put_failure:
10345         genlmsg_cancel(msg, hdr);
10346         nlmsg_free(msg);
10347 }
10348
10349 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
10350                           struct net_device *netdev, const u8 *buf,
10351                           size_t len, gfp_t gfp)
10352 {
10353         nl80211_send_mlme_event(rdev, netdev, buf, len,
10354                                 NL80211_CMD_AUTHENTICATE, gfp);
10355 }
10356
10357 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
10358                            struct net_device *netdev, const u8 *buf,
10359                            size_t len, gfp_t gfp)
10360 {
10361         nl80211_send_mlme_event(rdev, netdev, buf, len,
10362                                 NL80211_CMD_ASSOCIATE, gfp);
10363 }
10364
10365 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
10366                          struct net_device *netdev, const u8 *buf,
10367                          size_t len, gfp_t gfp)
10368 {
10369         nl80211_send_mlme_event(rdev, netdev, buf, len,
10370                                 NL80211_CMD_DEAUTHENTICATE, gfp);
10371 }
10372
10373 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
10374                            struct net_device *netdev, const u8 *buf,
10375                            size_t len, gfp_t gfp)
10376 {
10377         nl80211_send_mlme_event(rdev, netdev, buf, len,
10378                                 NL80211_CMD_DISASSOCIATE, gfp);
10379 }
10380
10381 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
10382                                   size_t len)
10383 {
10384         struct wireless_dev *wdev = dev->ieee80211_ptr;
10385         struct wiphy *wiphy = wdev->wiphy;
10386         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10387         const struct ieee80211_mgmt *mgmt = (void *)buf;
10388         u32 cmd;
10389
10390         if (WARN_ON(len < 2))
10391                 return;
10392
10393         if (ieee80211_is_deauth(mgmt->frame_control))
10394                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
10395         else
10396                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
10397
10398         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
10399         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC);
10400 }
10401 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
10402
10403 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
10404                                       struct net_device *netdev, int cmd,
10405                                       const u8 *addr, gfp_t gfp)
10406 {
10407         struct sk_buff *msg;
10408         void *hdr;
10409
10410         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10411         if (!msg)
10412                 return;
10413
10414         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10415         if (!hdr) {
10416                 nlmsg_free(msg);
10417                 return;
10418         }
10419
10420         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10421             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10422             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
10423             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10424                 goto nla_put_failure;
10425
10426         genlmsg_end(msg, hdr);
10427
10428         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10429                                 NL80211_MCGRP_MLME, gfp);
10430         return;
10431
10432  nla_put_failure:
10433         genlmsg_cancel(msg, hdr);
10434         nlmsg_free(msg);
10435 }
10436
10437 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
10438                                struct net_device *netdev, const u8 *addr,
10439                                gfp_t gfp)
10440 {
10441         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
10442                                   addr, gfp);
10443 }
10444
10445 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
10446                                 struct net_device *netdev, const u8 *addr,
10447                                 gfp_t gfp)
10448 {
10449         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
10450                                   addr, gfp);
10451 }
10452
10453 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
10454                                  struct net_device *netdev, const u8 *bssid,
10455                                  const u8 *req_ie, size_t req_ie_len,
10456                                  const u8 *resp_ie, size_t resp_ie_len,
10457                                  u16 status, gfp_t gfp)
10458 {
10459         struct sk_buff *msg;
10460         void *hdr;
10461
10462         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10463         if (!msg)
10464                 return;
10465
10466         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
10467         if (!hdr) {
10468                 nlmsg_free(msg);
10469                 return;
10470         }
10471
10472         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10473             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10474             (bssid && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid)) ||
10475             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE, status) ||
10476             (req_ie &&
10477              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10478             (resp_ie &&
10479              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10480                 goto nla_put_failure;
10481
10482         genlmsg_end(msg, hdr);
10483
10484         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10485                                 NL80211_MCGRP_MLME, gfp);
10486         return;
10487
10488  nla_put_failure:
10489         genlmsg_cancel(msg, hdr);
10490         nlmsg_free(msg);
10491
10492 }
10493
10494 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
10495                          struct net_device *netdev, const u8 *bssid,
10496                          const u8 *req_ie, size_t req_ie_len,
10497                          const u8 *resp_ie, size_t resp_ie_len, gfp_t gfp)
10498 {
10499         struct sk_buff *msg;
10500         void *hdr;
10501
10502         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10503         if (!msg)
10504                 return;
10505
10506         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
10507         if (!hdr) {
10508                 nlmsg_free(msg);
10509                 return;
10510         }
10511
10512         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10513             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10514             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
10515             (req_ie &&
10516              nla_put(msg, NL80211_ATTR_REQ_IE, req_ie_len, req_ie)) ||
10517             (resp_ie &&
10518              nla_put(msg, NL80211_ATTR_RESP_IE, resp_ie_len, resp_ie)))
10519                 goto nla_put_failure;
10520
10521         genlmsg_end(msg, hdr);
10522
10523         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10524                                 NL80211_MCGRP_MLME, gfp);
10525         return;
10526
10527  nla_put_failure:
10528         genlmsg_cancel(msg, hdr);
10529         nlmsg_free(msg);
10530
10531 }
10532
10533 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
10534                                struct net_device *netdev, u16 reason,
10535                                const u8 *ie, size_t ie_len, bool from_ap)
10536 {
10537         struct sk_buff *msg;
10538         void *hdr;
10539
10540         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10541         if (!msg)
10542                 return;
10543
10544         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
10545         if (!hdr) {
10546                 nlmsg_free(msg);
10547                 return;
10548         }
10549
10550         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10551             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10552             (from_ap && reason &&
10553              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
10554             (from_ap &&
10555              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
10556             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
10557                 goto nla_put_failure;
10558
10559         genlmsg_end(msg, hdr);
10560
10561         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10562                                 NL80211_MCGRP_MLME, GFP_KERNEL);
10563         return;
10564
10565  nla_put_failure:
10566         genlmsg_cancel(msg, hdr);
10567         nlmsg_free(msg);
10568
10569 }
10570
10571 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
10572                              struct net_device *netdev, const u8 *bssid,
10573                              gfp_t gfp)
10574 {
10575         struct sk_buff *msg;
10576         void *hdr;
10577
10578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10579         if (!msg)
10580                 return;
10581
10582         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
10583         if (!hdr) {
10584                 nlmsg_free(msg);
10585                 return;
10586         }
10587
10588         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10589             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10590             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
10591                 goto nla_put_failure;
10592
10593         genlmsg_end(msg, hdr);
10594
10595         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10596                                 NL80211_MCGRP_MLME, gfp);
10597         return;
10598
10599  nla_put_failure:
10600         genlmsg_cancel(msg, hdr);
10601         nlmsg_free(msg);
10602 }
10603
10604 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
10605                                         const u8* ie, u8 ie_len, gfp_t gfp)
10606 {
10607         struct wireless_dev *wdev = dev->ieee80211_ptr;
10608         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10609         struct sk_buff *msg;
10610         void *hdr;
10611
10612         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
10613                 return;
10614
10615         trace_cfg80211_notify_new_peer_candidate(dev, addr);
10616
10617         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10618         if (!msg)
10619                 return;
10620
10621         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
10622         if (!hdr) {
10623                 nlmsg_free(msg);
10624                 return;
10625         }
10626
10627         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10628             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10629             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
10630             (ie_len && ie &&
10631              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
10632                 goto nla_put_failure;
10633
10634         genlmsg_end(msg, hdr);
10635
10636         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10637                                 NL80211_MCGRP_MLME, gfp);
10638         return;
10639
10640  nla_put_failure:
10641         genlmsg_cancel(msg, hdr);
10642         nlmsg_free(msg);
10643 }
10644 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
10645
10646 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
10647                                  struct net_device *netdev, const u8 *addr,
10648                                  enum nl80211_key_type key_type, int key_id,
10649                                  const u8 *tsc, gfp_t gfp)
10650 {
10651         struct sk_buff *msg;
10652         void *hdr;
10653
10654         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10655         if (!msg)
10656                 return;
10657
10658         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
10659         if (!hdr) {
10660                 nlmsg_free(msg);
10661                 return;
10662         }
10663
10664         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10665             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
10666             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
10667             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
10668             (key_id != -1 &&
10669              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
10670             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
10671                 goto nla_put_failure;
10672
10673         genlmsg_end(msg, hdr);
10674
10675         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10676                                 NL80211_MCGRP_MLME, gfp);
10677         return;
10678
10679  nla_put_failure:
10680         genlmsg_cancel(msg, hdr);
10681         nlmsg_free(msg);
10682 }
10683
10684 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
10685                                     struct ieee80211_channel *channel_before,
10686                                     struct ieee80211_channel *channel_after)
10687 {
10688         struct sk_buff *msg;
10689         void *hdr;
10690         struct nlattr *nl_freq;
10691
10692         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
10693         if (!msg)
10694                 return;
10695
10696         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
10697         if (!hdr) {
10698                 nlmsg_free(msg);
10699                 return;
10700         }
10701
10702         /*
10703          * Since we are applying the beacon hint to a wiphy we know its
10704          * wiphy_idx is valid
10705          */
10706         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
10707                 goto nla_put_failure;
10708
10709         /* Before */
10710         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
10711         if (!nl_freq)
10712                 goto nla_put_failure;
10713         if (nl80211_msg_put_channel(msg, channel_before, false))
10714                 goto nla_put_failure;
10715         nla_nest_end(msg, nl_freq);
10716
10717         /* After */
10718         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
10719         if (!nl_freq)
10720                 goto nla_put_failure;
10721         if (nl80211_msg_put_channel(msg, channel_after, false))
10722                 goto nla_put_failure;
10723         nla_nest_end(msg, nl_freq);
10724
10725         genlmsg_end(msg, hdr);
10726
10727         rcu_read_lock();
10728         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
10729                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
10730         rcu_read_unlock();
10731
10732         return;
10733
10734 nla_put_failure:
10735         genlmsg_cancel(msg, hdr);
10736         nlmsg_free(msg);
10737 }
10738
10739 static void nl80211_send_remain_on_chan_event(
10740         int cmd, struct cfg80211_registered_device *rdev,
10741         struct wireless_dev *wdev, u64 cookie,
10742         struct ieee80211_channel *chan,
10743         unsigned int duration, gfp_t gfp)
10744 {
10745         struct sk_buff *msg;
10746         void *hdr;
10747
10748         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10749         if (!msg)
10750                 return;
10751
10752         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10753         if (!hdr) {
10754                 nlmsg_free(msg);
10755                 return;
10756         }
10757
10758         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10759             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
10760                                          wdev->netdev->ifindex)) ||
10761             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
10762             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
10763             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
10764                         NL80211_CHAN_NO_HT) ||
10765             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie))
10766                 goto nla_put_failure;
10767
10768         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
10769             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
10770                 goto nla_put_failure;
10771
10772         genlmsg_end(msg, hdr);
10773
10774         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10775                                 NL80211_MCGRP_MLME, gfp);
10776         return;
10777
10778  nla_put_failure:
10779         genlmsg_cancel(msg, hdr);
10780         nlmsg_free(msg);
10781 }
10782
10783 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
10784                                struct ieee80211_channel *chan,
10785                                unsigned int duration, gfp_t gfp)
10786 {
10787         struct wiphy *wiphy = wdev->wiphy;
10788         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10789
10790         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
10791         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
10792                                           rdev, wdev, cookie, chan,
10793                                           duration, gfp);
10794 }
10795 EXPORT_SYMBOL(cfg80211_ready_on_channel);
10796
10797 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
10798                                         struct ieee80211_channel *chan,
10799                                         gfp_t gfp)
10800 {
10801         struct wiphy *wiphy = wdev->wiphy;
10802         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10803
10804         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
10805         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
10806                                           rdev, wdev, cookie, chan, 0, gfp);
10807 }
10808 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
10809
10810 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
10811                       struct station_info *sinfo, gfp_t gfp)
10812 {
10813         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10814         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10815         struct sk_buff *msg;
10816
10817         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
10818
10819         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10820         if (!msg)
10821                 return;
10822
10823         if (nl80211_send_station(msg, 0, 0, 0,
10824                                  rdev, dev, mac_addr, sinfo) < 0) {
10825                 nlmsg_free(msg);
10826                 return;
10827         }
10828
10829         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10830                                 NL80211_MCGRP_MLME, gfp);
10831 }
10832 EXPORT_SYMBOL(cfg80211_new_sta);
10833
10834 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
10835 {
10836         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10837         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10838         struct sk_buff *msg;
10839         void *hdr;
10840
10841         trace_cfg80211_del_sta(dev, mac_addr);
10842
10843         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10844         if (!msg)
10845                 return;
10846
10847         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_STATION);
10848         if (!hdr) {
10849                 nlmsg_free(msg);
10850                 return;
10851         }
10852
10853         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10854             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
10855                 goto nla_put_failure;
10856
10857         genlmsg_end(msg, hdr);
10858
10859         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10860                                 NL80211_MCGRP_MLME, gfp);
10861         return;
10862
10863  nla_put_failure:
10864         genlmsg_cancel(msg, hdr);
10865         nlmsg_free(msg);
10866 }
10867 EXPORT_SYMBOL(cfg80211_del_sta);
10868
10869 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
10870                           enum nl80211_connect_failed_reason reason,
10871                           gfp_t gfp)
10872 {
10873         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
10874         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10875         struct sk_buff *msg;
10876         void *hdr;
10877
10878         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
10879         if (!msg)
10880                 return;
10881
10882         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
10883         if (!hdr) {
10884                 nlmsg_free(msg);
10885                 return;
10886         }
10887
10888         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10889             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
10890             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
10891                 goto nla_put_failure;
10892
10893         genlmsg_end(msg, hdr);
10894
10895         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
10896                                 NL80211_MCGRP_MLME, gfp);
10897         return;
10898
10899  nla_put_failure:
10900         genlmsg_cancel(msg, hdr);
10901         nlmsg_free(msg);
10902 }
10903 EXPORT_SYMBOL(cfg80211_conn_failed);
10904
10905 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
10906                                        const u8 *addr, gfp_t gfp)
10907 {
10908         struct wireless_dev *wdev = dev->ieee80211_ptr;
10909         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
10910         struct sk_buff *msg;
10911         void *hdr;
10912         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
10913
10914         if (!nlportid)
10915                 return false;
10916
10917         msg = nlmsg_new(100, gfp);
10918         if (!msg)
10919                 return true;
10920
10921         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
10922         if (!hdr) {
10923                 nlmsg_free(msg);
10924                 return true;
10925         }
10926
10927         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
10928             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
10929             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
10930                 goto nla_put_failure;
10931
10932         genlmsg_end(msg, hdr);
10933         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
10934         return true;
10935
10936  nla_put_failure:
10937         genlmsg_cancel(msg, hdr);
10938         nlmsg_free(msg);
10939         return true;
10940 }
10941
10942 bool cfg80211_rx_spurious_frame(struct net_device *dev,
10943                                 const u8 *addr, gfp_t gfp)
10944 {
10945         struct wireless_dev *wdev = dev->ieee80211_ptr;
10946         bool ret;
10947
10948         trace_cfg80211_rx_spurious_frame(dev, addr);
10949
10950         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10951                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
10952                 trace_cfg80211_return_bool(false);
10953                 return false;
10954         }
10955         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
10956                                          addr, gfp);
10957         trace_cfg80211_return_bool(ret);
10958         return ret;
10959 }
10960 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
10961
10962 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
10963                                         const u8 *addr, gfp_t gfp)
10964 {
10965         struct wireless_dev *wdev = dev->ieee80211_ptr;
10966         bool ret;
10967
10968         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
10969
10970         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
10971                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
10972                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
10973                 trace_cfg80211_return_bool(false);
10974                 return false;
10975         }
10976         ret = __nl80211_unexpected_frame(dev,
10977                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
10978                                          addr, gfp);
10979         trace_cfg80211_return_bool(ret);
10980         return ret;
10981 }
10982 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
10983
10984 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
10985                       struct wireless_dev *wdev, u32 nlportid,
10986                       int freq, int sig_dbm,
10987                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
10988 {
10989         struct net_device *netdev = wdev->netdev;
10990         struct sk_buff *msg;
10991         void *hdr;
10992
10993         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
10994         if (!msg)
10995                 return -ENOMEM;
10996
10997         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
10998         if (!hdr) {
10999                 nlmsg_free(msg);
11000                 return -ENOMEM;
11001         }
11002
11003         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11004             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11005                                         netdev->ifindex)) ||
11006             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11007             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
11008             (sig_dbm &&
11009              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11010             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11011             (flags &&
11012              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
11013                 goto nla_put_failure;
11014
11015         genlmsg_end(msg, hdr);
11016
11017         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11018
11019  nla_put_failure:
11020         genlmsg_cancel(msg, hdr);
11021         nlmsg_free(msg);
11022         return -ENOBUFS;
11023 }
11024
11025 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
11026                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
11027 {
11028         struct wiphy *wiphy = wdev->wiphy;
11029         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11030         struct net_device *netdev = wdev->netdev;
11031         struct sk_buff *msg;
11032         void *hdr;
11033
11034         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
11035
11036         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11037         if (!msg)
11038                 return;
11039
11040         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
11041         if (!hdr) {
11042                 nlmsg_free(msg);
11043                 return;
11044         }
11045
11046         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11047             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11048                                    netdev->ifindex)) ||
11049             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
11050             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
11051             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11052             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
11053                 goto nla_put_failure;
11054
11055         genlmsg_end(msg, hdr);
11056
11057         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11058                                 NL80211_MCGRP_MLME, gfp);
11059         return;
11060
11061  nla_put_failure:
11062         genlmsg_cancel(msg, hdr);
11063         nlmsg_free(msg);
11064 }
11065 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
11066
11067 void cfg80211_cqm_rssi_notify(struct net_device *dev,
11068                               enum nl80211_cqm_rssi_threshold_event rssi_event,
11069                               gfp_t gfp)
11070 {
11071         struct wireless_dev *wdev = dev->ieee80211_ptr;
11072         struct wiphy *wiphy = wdev->wiphy;
11073         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11074         struct sk_buff *msg;
11075         struct nlattr *pinfoattr;
11076         void *hdr;
11077
11078         trace_cfg80211_cqm_rssi_notify(dev, rssi_event);
11079
11080         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11081         if (!msg)
11082                 return;
11083
11084         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11085         if (!hdr) {
11086                 nlmsg_free(msg);
11087                 return;
11088         }
11089
11090         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11091             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
11092                 goto nla_put_failure;
11093
11094         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11095         if (!pinfoattr)
11096                 goto nla_put_failure;
11097
11098         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
11099                         rssi_event))
11100                 goto nla_put_failure;
11101
11102         nla_nest_end(msg, pinfoattr);
11103
11104         genlmsg_end(msg, hdr);
11105
11106         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11107                                 NL80211_MCGRP_MLME, gfp);
11108         return;
11109
11110  nla_put_failure:
11111         genlmsg_cancel(msg, hdr);
11112         nlmsg_free(msg);
11113 }
11114 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
11115
11116 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
11117                                      struct net_device *netdev, const u8 *bssid,
11118                                      const u8 *replay_ctr, gfp_t gfp)
11119 {
11120         struct sk_buff *msg;
11121         struct nlattr *rekey_attr;
11122         void *hdr;
11123
11124         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11125         if (!msg)
11126                 return;
11127
11128         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
11129         if (!hdr) {
11130                 nlmsg_free(msg);
11131                 return;
11132         }
11133
11134         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11135             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11136             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
11137                 goto nla_put_failure;
11138
11139         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
11140         if (!rekey_attr)
11141                 goto nla_put_failure;
11142
11143         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
11144                     NL80211_REPLAY_CTR_LEN, replay_ctr))
11145                 goto nla_put_failure;
11146
11147         nla_nest_end(msg, rekey_attr);
11148
11149         genlmsg_end(msg, hdr);
11150
11151         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11152                                 NL80211_MCGRP_MLME, gfp);
11153         return;
11154
11155  nla_put_failure:
11156         genlmsg_cancel(msg, hdr);
11157         nlmsg_free(msg);
11158 }
11159
11160 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
11161                                const u8 *replay_ctr, gfp_t gfp)
11162 {
11163         struct wireless_dev *wdev = dev->ieee80211_ptr;
11164         struct wiphy *wiphy = wdev->wiphy;
11165         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11166
11167         trace_cfg80211_gtk_rekey_notify(dev, bssid);
11168         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
11169 }
11170 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
11171
11172 static void
11173 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
11174                                struct net_device *netdev, int index,
11175                                const u8 *bssid, bool preauth, gfp_t gfp)
11176 {
11177         struct sk_buff *msg;
11178         struct nlattr *attr;
11179         void *hdr;
11180
11181         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11182         if (!msg)
11183                 return;
11184
11185         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
11186         if (!hdr) {
11187                 nlmsg_free(msg);
11188                 return;
11189         }
11190
11191         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11192             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11193                 goto nla_put_failure;
11194
11195         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
11196         if (!attr)
11197                 goto nla_put_failure;
11198
11199         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
11200             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
11201             (preauth &&
11202              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
11203                 goto nla_put_failure;
11204
11205         nla_nest_end(msg, attr);
11206
11207         genlmsg_end(msg, hdr);
11208
11209         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11210                                 NL80211_MCGRP_MLME, gfp);
11211         return;
11212
11213  nla_put_failure:
11214         genlmsg_cancel(msg, hdr);
11215         nlmsg_free(msg);
11216 }
11217
11218 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
11219                                      const u8 *bssid, bool preauth, gfp_t gfp)
11220 {
11221         struct wireless_dev *wdev = dev->ieee80211_ptr;
11222         struct wiphy *wiphy = wdev->wiphy;
11223         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11224
11225         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
11226         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
11227 }
11228 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
11229
11230 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
11231                                      struct net_device *netdev,
11232                                      struct cfg80211_chan_def *chandef,
11233                                      gfp_t gfp)
11234 {
11235         struct sk_buff *msg;
11236         void *hdr;
11237
11238         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11239         if (!msg)
11240                 return;
11241
11242         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CH_SWITCH_NOTIFY);
11243         if (!hdr) {
11244                 nlmsg_free(msg);
11245                 return;
11246         }
11247
11248         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
11249                 goto nla_put_failure;
11250
11251         if (nl80211_send_chandef(msg, chandef))
11252                 goto nla_put_failure;
11253
11254         genlmsg_end(msg, hdr);
11255
11256         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11257                                 NL80211_MCGRP_MLME, gfp);
11258         return;
11259
11260  nla_put_failure:
11261         genlmsg_cancel(msg, hdr);
11262         nlmsg_free(msg);
11263 }
11264
11265 void cfg80211_ch_switch_notify(struct net_device *dev,
11266                                struct cfg80211_chan_def *chandef)
11267 {
11268         struct wireless_dev *wdev = dev->ieee80211_ptr;
11269         struct wiphy *wiphy = wdev->wiphy;
11270         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11271
11272         ASSERT_WDEV_LOCK(wdev);
11273
11274         trace_cfg80211_ch_switch_notify(dev, chandef);
11275
11276         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
11277                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
11278                     wdev->iftype != NL80211_IFTYPE_ADHOC &&
11279                     wdev->iftype != NL80211_IFTYPE_MESH_POINT))
11280                 return;
11281
11282         wdev->chandef = *chandef;
11283         wdev->preset_chandef = *chandef;
11284         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL);
11285 }
11286 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
11287
11288 void cfg80211_cqm_txe_notify(struct net_device *dev,
11289                              const u8 *peer, u32 num_packets,
11290                              u32 rate, u32 intvl, gfp_t gfp)
11291 {
11292         struct wireless_dev *wdev = dev->ieee80211_ptr;
11293         struct wiphy *wiphy = wdev->wiphy;
11294         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11295         struct sk_buff *msg;
11296         struct nlattr *pinfoattr;
11297         void *hdr;
11298
11299         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
11300         if (!msg)
11301                 return;
11302
11303         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11304         if (!hdr) {
11305                 nlmsg_free(msg);
11306                 return;
11307         }
11308
11309         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11310             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11311             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11312                 goto nla_put_failure;
11313
11314         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11315         if (!pinfoattr)
11316                 goto nla_put_failure;
11317
11318         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
11319                 goto nla_put_failure;
11320
11321         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
11322                 goto nla_put_failure;
11323
11324         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
11325                 goto nla_put_failure;
11326
11327         nla_nest_end(msg, pinfoattr);
11328
11329         genlmsg_end(msg, hdr);
11330
11331         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11332                                 NL80211_MCGRP_MLME, gfp);
11333         return;
11334
11335  nla_put_failure:
11336         genlmsg_cancel(msg, hdr);
11337         nlmsg_free(msg);
11338 }
11339 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
11340
11341 void
11342 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
11343                      const struct cfg80211_chan_def *chandef,
11344                      enum nl80211_radar_event event,
11345                      struct net_device *netdev, gfp_t gfp)
11346 {
11347         struct sk_buff *msg;
11348         void *hdr;
11349
11350         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11351         if (!msg)
11352                 return;
11353
11354         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
11355         if (!hdr) {
11356                 nlmsg_free(msg);
11357                 return;
11358         }
11359
11360         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11361                 goto nla_put_failure;
11362
11363         /* NOP and radar events don't need a netdev parameter */
11364         if (netdev) {
11365                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
11366
11367                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11368                     nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11369                         goto nla_put_failure;
11370         }
11371
11372         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
11373                 goto nla_put_failure;
11374
11375         if (nl80211_send_chandef(msg, chandef))
11376                 goto nla_put_failure;
11377
11378         genlmsg_end(msg, hdr);
11379
11380         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11381                                 NL80211_MCGRP_MLME, gfp);
11382         return;
11383
11384  nla_put_failure:
11385         genlmsg_cancel(msg, hdr);
11386         nlmsg_free(msg);
11387 }
11388
11389 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
11390                                  const u8 *peer, u32 num_packets, gfp_t gfp)
11391 {
11392         struct wireless_dev *wdev = dev->ieee80211_ptr;
11393         struct wiphy *wiphy = wdev->wiphy;
11394         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11395         struct sk_buff *msg;
11396         struct nlattr *pinfoattr;
11397         void *hdr;
11398
11399         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
11400
11401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11402         if (!msg)
11403                 return;
11404
11405         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
11406         if (!hdr) {
11407                 nlmsg_free(msg);
11408                 return;
11409         }
11410
11411         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11412             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11413             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer))
11414                 goto nla_put_failure;
11415
11416         pinfoattr = nla_nest_start(msg, NL80211_ATTR_CQM);
11417         if (!pinfoattr)
11418                 goto nla_put_failure;
11419
11420         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
11421                 goto nla_put_failure;
11422
11423         nla_nest_end(msg, pinfoattr);
11424
11425         genlmsg_end(msg, hdr);
11426
11427         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11428                                 NL80211_MCGRP_MLME, gfp);
11429         return;
11430
11431  nla_put_failure:
11432         genlmsg_cancel(msg, hdr);
11433         nlmsg_free(msg);
11434 }
11435 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
11436
11437 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
11438                            u64 cookie, bool acked, gfp_t gfp)
11439 {
11440         struct wireless_dev *wdev = dev->ieee80211_ptr;
11441         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11442         struct sk_buff *msg;
11443         void *hdr;
11444
11445         trace_cfg80211_probe_status(dev, addr, cookie, acked);
11446
11447         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11448
11449         if (!msg)
11450                 return;
11451
11452         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
11453         if (!hdr) {
11454                 nlmsg_free(msg);
11455                 return;
11456         }
11457
11458         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11459             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11460             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
11461             nla_put_u64(msg, NL80211_ATTR_COOKIE, cookie) ||
11462             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
11463                 goto nla_put_failure;
11464
11465         genlmsg_end(msg, hdr);
11466
11467         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11468                                 NL80211_MCGRP_MLME, gfp);
11469         return;
11470
11471  nla_put_failure:
11472         genlmsg_cancel(msg, hdr);
11473         nlmsg_free(msg);
11474 }
11475 EXPORT_SYMBOL(cfg80211_probe_status);
11476
11477 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
11478                                  const u8 *frame, size_t len,
11479                                  int freq, int sig_dbm)
11480 {
11481         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11482         struct sk_buff *msg;
11483         void *hdr;
11484         struct cfg80211_beacon_registration *reg;
11485
11486         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
11487
11488         spin_lock_bh(&rdev->beacon_registrations_lock);
11489         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11490                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
11491                 if (!msg) {
11492                         spin_unlock_bh(&rdev->beacon_registrations_lock);
11493                         return;
11494                 }
11495
11496                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
11497                 if (!hdr)
11498                         goto nla_put_failure;
11499
11500                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11501                     (freq &&
11502                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
11503                     (sig_dbm &&
11504                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
11505                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
11506                         goto nla_put_failure;
11507
11508                 genlmsg_end(msg, hdr);
11509
11510                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
11511         }
11512         spin_unlock_bh(&rdev->beacon_registrations_lock);
11513         return;
11514
11515  nla_put_failure:
11516         spin_unlock_bh(&rdev->beacon_registrations_lock);
11517         if (hdr)
11518                 genlmsg_cancel(msg, hdr);
11519         nlmsg_free(msg);
11520 }
11521 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
11522
11523 #ifdef CONFIG_PM
11524 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
11525                                    struct cfg80211_wowlan_wakeup *wakeup,
11526                                    gfp_t gfp)
11527 {
11528         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11529         struct sk_buff *msg;
11530         void *hdr;
11531         int size = 200;
11532
11533         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
11534
11535         if (wakeup)
11536                 size += wakeup->packet_present_len;
11537
11538         msg = nlmsg_new(size, gfp);
11539         if (!msg)
11540                 return;
11541
11542         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
11543         if (!hdr)
11544                 goto free_msg;
11545
11546         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11547             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11548                 goto free_msg;
11549
11550         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11551                                         wdev->netdev->ifindex))
11552                 goto free_msg;
11553
11554         if (wakeup) {
11555                 struct nlattr *reasons;
11556
11557                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11558                 if (!reasons)
11559                         goto free_msg;
11560
11561                 if (wakeup->disconnect &&
11562                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
11563                         goto free_msg;
11564                 if (wakeup->magic_pkt &&
11565                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
11566                         goto free_msg;
11567                 if (wakeup->gtk_rekey_failure &&
11568                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
11569                         goto free_msg;
11570                 if (wakeup->eap_identity_req &&
11571                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
11572                         goto free_msg;
11573                 if (wakeup->four_way_handshake &&
11574                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
11575                         goto free_msg;
11576                 if (wakeup->rfkill_release &&
11577                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
11578                         goto free_msg;
11579
11580                 if (wakeup->pattern_idx >= 0 &&
11581                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
11582                                 wakeup->pattern_idx))
11583                         goto free_msg;
11584
11585                 if (wakeup->tcp_match &&
11586                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
11587                         goto free_msg;
11588
11589                 if (wakeup->tcp_connlost &&
11590                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
11591                         goto free_msg;
11592
11593                 if (wakeup->tcp_nomoretokens &&
11594                     nla_put_flag(msg,
11595                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
11596                         goto free_msg;
11597
11598                 if (wakeup->packet) {
11599                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
11600                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
11601
11602                         if (!wakeup->packet_80211) {
11603                                 pkt_attr =
11604                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
11605                                 len_attr =
11606                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
11607                         }
11608
11609                         if (wakeup->packet_len &&
11610                             nla_put_u32(msg, len_attr, wakeup->packet_len))
11611                                 goto free_msg;
11612
11613                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
11614                                     wakeup->packet))
11615                                 goto free_msg;
11616                 }
11617
11618                 nla_nest_end(msg, reasons);
11619         }
11620
11621         genlmsg_end(msg, hdr);
11622
11623         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11624                                 NL80211_MCGRP_MLME, gfp);
11625         return;
11626
11627  free_msg:
11628         nlmsg_free(msg);
11629 }
11630 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
11631 #endif
11632
11633 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
11634                                 enum nl80211_tdls_operation oper,
11635                                 u16 reason_code, gfp_t gfp)
11636 {
11637         struct wireless_dev *wdev = dev->ieee80211_ptr;
11638         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
11639         struct sk_buff *msg;
11640         void *hdr;
11641
11642         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
11643                                          reason_code);
11644
11645         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11646         if (!msg)
11647                 return;
11648
11649         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
11650         if (!hdr) {
11651                 nlmsg_free(msg);
11652                 return;
11653         }
11654
11655         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11656             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
11657             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
11658             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
11659             (reason_code > 0 &&
11660              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
11661                 goto nla_put_failure;
11662
11663         genlmsg_end(msg, hdr);
11664
11665         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11666                                 NL80211_MCGRP_MLME, gfp);
11667         return;
11668
11669  nla_put_failure:
11670         genlmsg_cancel(msg, hdr);
11671         nlmsg_free(msg);
11672 }
11673 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
11674
11675 static int nl80211_netlink_notify(struct notifier_block * nb,
11676                                   unsigned long state,
11677                                   void *_notify)
11678 {
11679         struct netlink_notify *notify = _notify;
11680         struct cfg80211_registered_device *rdev;
11681         struct wireless_dev *wdev;
11682         struct cfg80211_beacon_registration *reg, *tmp;
11683
11684         if (state != NETLINK_URELEASE)
11685                 return NOTIFY_DONE;
11686
11687         rcu_read_lock();
11688
11689         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
11690                 bool schedule_destroy_work = false;
11691
11692                 list_for_each_entry_rcu(wdev, &rdev->wdev_list, list) {
11693                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
11694
11695                         if (wdev->owner_nlportid == notify->portid)
11696                                 schedule_destroy_work = true;
11697                 }
11698
11699                 spin_lock_bh(&rdev->beacon_registrations_lock);
11700                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
11701                                          list) {
11702                         if (reg->nlportid == notify->portid) {
11703                                 list_del(&reg->list);
11704                                 kfree(reg);
11705                                 break;
11706                         }
11707                 }
11708                 spin_unlock_bh(&rdev->beacon_registrations_lock);
11709
11710                 if (schedule_destroy_work) {
11711                         struct cfg80211_iface_destroy *destroy;
11712
11713                         destroy = kzalloc(sizeof(*destroy), GFP_ATOMIC);
11714                         if (destroy) {
11715                                 destroy->nlportid = notify->portid;
11716                                 spin_lock(&rdev->destroy_list_lock);
11717                                 list_add(&destroy->list, &rdev->destroy_list);
11718                                 spin_unlock(&rdev->destroy_list_lock);
11719                                 schedule_work(&rdev->destroy_work);
11720                         }
11721                 }
11722         }
11723
11724         rcu_read_unlock();
11725
11726         return NOTIFY_OK;
11727 }
11728
11729 static struct notifier_block nl80211_netlink_notifier = {
11730         .notifier_call = nl80211_netlink_notify,
11731 };
11732
11733 void cfg80211_ft_event(struct net_device *netdev,
11734                        struct cfg80211_ft_event_params *ft_event)
11735 {
11736         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
11737         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11738         struct sk_buff *msg;
11739         void *hdr;
11740
11741         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
11742
11743         if (!ft_event->target_ap)
11744                 return;
11745
11746         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11747         if (!msg)
11748                 return;
11749
11750         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
11751         if (!hdr)
11752                 goto out;
11753
11754         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11755             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
11756             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
11757                 goto out;
11758
11759         if (ft_event->ies &&
11760             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
11761                 goto out;
11762         if (ft_event->ric_ies &&
11763             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
11764                     ft_event->ric_ies))
11765                 goto out;
11766
11767         genlmsg_end(msg, hdr);
11768
11769         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
11770                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11771         return;
11772  out:
11773         nlmsg_free(msg);
11774 }
11775 EXPORT_SYMBOL(cfg80211_ft_event);
11776
11777 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
11778 {
11779         struct cfg80211_registered_device *rdev;
11780         struct sk_buff *msg;
11781         void *hdr;
11782         u32 nlportid;
11783
11784         rdev = wiphy_to_rdev(wdev->wiphy);
11785         if (!rdev->crit_proto_nlportid)
11786                 return;
11787
11788         nlportid = rdev->crit_proto_nlportid;
11789         rdev->crit_proto_nlportid = 0;
11790
11791         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11792         if (!msg)
11793                 return;
11794
11795         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
11796         if (!hdr)
11797                 goto nla_put_failure;
11798
11799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11800             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11801                 goto nla_put_failure;
11802
11803         genlmsg_end(msg, hdr);
11804
11805         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
11806         return;
11807
11808  nla_put_failure:
11809         if (hdr)
11810                 genlmsg_cancel(msg, hdr);
11811         nlmsg_free(msg);
11812
11813 }
11814 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
11815
11816 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
11817 {
11818         struct wiphy *wiphy = wdev->wiphy;
11819         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11820         struct sk_buff *msg;
11821         void *hdr;
11822
11823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11824         if (!msg)
11825                 return;
11826
11827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
11828         if (!hdr)
11829                 goto out;
11830
11831         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11832             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
11833             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)))
11834                 goto out;
11835
11836         genlmsg_end(msg, hdr);
11837
11838         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
11839                                 NL80211_MCGRP_MLME, GFP_KERNEL);
11840         return;
11841  out:
11842         nlmsg_free(msg);
11843 }
11844
11845 /* initialisation/exit functions */
11846
11847 int nl80211_init(void)
11848 {
11849         int err;
11850
11851         err = genl_register_family_with_ops_groups(&nl80211_fam, nl80211_ops,
11852                                                    nl80211_mcgrps);
11853         if (err)
11854                 return err;
11855
11856         err = netlink_register_notifier(&nl80211_netlink_notifier);
11857         if (err)
11858                 goto err_out;
11859
11860         return 0;
11861  err_out:
11862         genl_unregister_family(&nl80211_fam);
11863         return err;
11864 }
11865
11866 void nl80211_exit(void)
11867 {
11868         netlink_unregister_notifier(&nl80211_netlink_notifier);
11869         genl_unregister_family(&nl80211_fam);
11870 }