net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  */
   7
   8 #include <linux/if.h>
   9 #include <linux/module.h>
  10 #include <linux/err.h>
  11 #include <linux/slab.h>
  12 #include <linux/list.h>
  13 #include <linux/if_ether.h>
  14 #include <linux/ieee80211.h>
  15 #include <linux/nl80211.h>
  16 #include <linux/rtnetlink.h>
  17 #include <linux/netlink.h>
  18 #include <linux/etherdevice.h>
  19 #include <net/net_namespace.h>
  20 #include <net/genetlink.h>
  21 #include <net/cfg80211.h>
  22 #include <net/sock.h>
  23 #include <net/inet_connection_sock.h>
  24 #include "core.h"
  25 #include "nl80211.h"
  26 #include "reg.h"
  27 #include "rdev-ops.h"
  28
  29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  30                                    struct genl_info *info,
  31                                    struct cfg80211_crypto_settings *settings,
  32                                    int cipher_limit);
  33
  34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
  35                             struct genl_info *info);
  36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
  37                               struct genl_info *info);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam = {
  41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
  42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
  43         .hdrsize = 0,                   /* no private header */
  44         .version = 1,                   /* no particular meaning now */
  45         .maxattr = NL80211_ATTR_MAX,
  46         .netnsok = true,
  47         .pre_doit = nl80211_pre_doit,
  48         .post_doit = nl80211_post_doit,
  49 };
  50
  51 /* multicast groups */
  52 enum nl80211_multicast_groups {
  53         NL80211_MCGRP_CONFIG,
  54         NL80211_MCGRP_SCAN,
  55         NL80211_MCGRP_REGULATORY,
  56         NL80211_MCGRP_MLME,
  57         NL80211_MCGRP_VENDOR,
  58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  59 };
  60
  61 static const struct genl_multicast_group nl80211_mcgrps[] = {
  62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
  63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
  64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
  65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
  66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
  67 #ifdef CONFIG_NL80211_TESTMODE
  68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
  69 #endif
  70 };
  71
  72 /* returns ERR_PTR values */
  73 static struct wireless_dev *
  74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  75 {
  76         struct cfg80211_registered_device *rdev;
  77         struct wireless_dev *result = NULL;
  78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  80         u64 wdev_id;
  81         int wiphy_idx = -1;
  82         int ifidx = -1;
  83
  84         ASSERT_RTNL();
  85
  86         if (!have_ifidx && !have_wdev_id)
  87                 return ERR_PTR(-EINVAL);
  88
  89         if (have_ifidx)
  90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  91         if (have_wdev_id) {
  92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  93                 wiphy_idx = wdev_id >> 32;
  94         }
  95
  96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  97                 struct wireless_dev *wdev;
  98
  99                 if (wiphy_net(&rdev->wiphy) != netns)
 100                         continue;
 101
 102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 103                         continue;
 104
 105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
 106                         if (have_ifidx && wdev->netdev &&
 107                             wdev->netdev->ifindex == ifidx) {
 108                                 result = wdev;
 109                                 break;
 110                         }
 111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 112                                 result = wdev;
 113                                 break;
 114                         }
 115                 }
 116
 117                 if (result)
 118                         break;
 119         }
 120
 121         if (result)
 122                 return result;
 123         return ERR_PTR(-ENODEV);
 124 }
 125
 126 static struct cfg80211_registered_device *
 127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 128 {
 129         struct cfg80211_registered_device *rdev = NULL, *tmp;
 130         struct net_device *netdev;
 131
 132         ASSERT_RTNL();
 133
 134         if (!attrs[NL80211_ATTR_WIPHY] &&
 135             !attrs[NL80211_ATTR_IFINDEX] &&
 136             !attrs[NL80211_ATTR_WDEV])
 137                 return ERR_PTR(-EINVAL);
 138
 139         if (attrs[NL80211_ATTR_WIPHY])
 140                 rdev = cfg80211_rdev_by_wiphy_idx(
 141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 142
 143         if (attrs[NL80211_ATTR_WDEV]) {
 144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 145                 struct wireless_dev *wdev;
 146                 bool found = false;
 147
 148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 149                 if (tmp) {
 150                         /* make sure wdev exists */
 151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
 152                                 if (wdev->identifier != (u32)wdev_id)
 153                                         continue;
 154                                 found = true;
 155                                 break;
 156                         }
 157
 158                         if (!found)
 159                                 tmp = NULL;
 160
 161                         if (rdev && tmp != rdev)
 162                                 return ERR_PTR(-EINVAL);
 163                         rdev = tmp;
 164                 }
 165         }
 166
 167         if (attrs[NL80211_ATTR_IFINDEX]) {
 168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 169                 netdev = __dev_get_by_index(netns, ifindex);
 170                 if (netdev) {
 171                         if (netdev->ieee80211_ptr)
 172                                 tmp = wiphy_to_rdev(
 173                                         netdev->ieee80211_ptr->wiphy);
 174                         else
 175                                 tmp = NULL;
 176
 177                         /* not wireless device -- return error */
 178                         if (!tmp)
 179                                 return ERR_PTR(-EINVAL);
 180
 181                         /* mismatch -- return error */
 182                         if (rdev && tmp != rdev)
 183                                 return ERR_PTR(-EINVAL);
 184
 185                         rdev = tmp;
 186                 }
 187         }
 188
 189         if (!rdev)
 190                 return ERR_PTR(-ENODEV);
 191
 192         if (netns != wiphy_net(&rdev->wiphy))
 193                 return ERR_PTR(-ENODEV);
 194
 195         return rdev;
 196 }
 197
 198 /*
 199  * This function returns a pointer to the driver
 200  * that the genl_info item that is passed refers to.
 201  *
 202  * The result of this can be a PTR_ERR and hence must
 203  * be checked with IS_ERR() for errors.
 204  */
 205 static struct cfg80211_registered_device *
 206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 207 {
 208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 209 }
 210
 211 /* policy for the attributes */
 212 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 215                                       .len = 20-1 },
 216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 217
 218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 223
 224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 230
 231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 234
 235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 237
 238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 240                                     .len = WLAN_MAX_KEY_LEN },
 241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 246
 247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 250                                        .len = IEEE80211_MAX_DATA_LEN },
 251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 252                                        .len = IEEE80211_MAX_DATA_LEN },
 253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 257                                                .len = NL80211_MAX_SUPP_RATES },
 258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 264
 265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 267
 268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 272                                            .len = NL80211_MAX_SUPP_RATES },
 273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 274
 275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 277
 278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 279
 280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 282                               .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 285
 286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 287                                 .len = IEEE80211_MAX_SSID_LEN },
 288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 293         [NL80211_ATTR_STA_FLAGS2] = {
 294                 .len = sizeof(struct nl80211_sta_flag_update),
 295         },
 296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
 305                                  .len = WLAN_PMKID_LEN },
 306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 310                                  .len = IEEE80211_MAX_DATA_LEN },
 311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 331                                          .len = IEEE80211_MAX_DATA_LEN },
 332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 333                                          .len = IEEE80211_MAX_DATA_LEN },
 334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 345                                       .len = IEEE80211_MAX_DATA_LEN },
 346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 349                 .len = NL80211_HT_CAPABILITY_LEN
 350         },
 351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
 357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 368                 .len = NL80211_VHT_CAPABILITY_LEN,
 369         },
 370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 372                                   .len = IEEE80211_MAX_DATA_LEN },
 373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 398         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 399 };
 400
 401 /* policy for the key attributes */
 402 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 403         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 404         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 405         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 406         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 407         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 408         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 409         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 410         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 411 };
 412
 413 /* policy for the key default flags */
 414 static const struct nla_policy
 415 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 416         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 417         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 418 };
 419
 420 /* policy for WoWLAN attributes */
 421 static const struct nla_policy
 422 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 423         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 424         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 425         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 426         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 427         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 428         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 429         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 430         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 431         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 432         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 433 };
 434
 435 static const struct nla_policy
 436 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 437         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 438         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 439         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 440         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 441         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 442         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 443         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 444                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 445         },
 446         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 447                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 448         },
 449         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 450         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 451         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 452 };
 453
 454 /* policy for coalesce rule attributes */
 455 static const struct nla_policy
 456 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 457         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 458         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 459         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 460 };
 461
 462 /* policy for GTK rekey offload attributes */
 463 static const struct nla_policy
 464 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 465         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 466         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 467         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 468 };
 469
 470 static const struct nla_policy
 471 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 472         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 473                                                  .len = IEEE80211_MAX_SSID_LEN },
 474         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 475 };
 476
 477 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 478                                      struct netlink_callback *cb,
 479                                      struct cfg80211_registered_device **rdev,
 480                                      struct wireless_dev **wdev)
 481 {
 482         int err;
 483
 484         rtnl_lock();
 485
 486         if (!cb->args[0]) {
 487                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 488                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
 489                                   nl80211_policy);
 490                 if (err)
 491                         goto out_unlock;
 492
 493                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
 494                                                    nl80211_fam.attrbuf);
 495                 if (IS_ERR(*wdev)) {
 496                         err = PTR_ERR(*wdev);
 497                         goto out_unlock;
 498                 }
 499                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 500                 /* 0 is the first index - add 1 to parse only once */
 501                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 502                 cb->args[1] = (*wdev)->identifier;
 503         } else {
 504                 /* subtract the 1 again here */
 505                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 506                 struct wireless_dev *tmp;
 507
 508                 if (!wiphy) {
 509                         err = -ENODEV;
 510                         goto out_unlock;
 511                 }
 512                 *rdev = wiphy_to_rdev(wiphy);
 513                 *wdev = NULL;
 514
 515                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
 516                         if (tmp->identifier == cb->args[1]) {
 517                                 *wdev = tmp;
 518                                 break;
 519                         }
 520                 }
 521
 522                 if (!*wdev) {
 523                         err = -ENODEV;
 524                         goto out_unlock;
 525                 }
 526         }
 527
 528         return 0;
 529  out_unlock:
 530         rtnl_unlock();
 531         return err;
 532 }
 533
 534 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
 535 {
 536         rtnl_unlock();
 537 }
 538
 539 /* IE validation */
 540 static bool is_valid_ie_attr(const struct nlattr *attr)
 541 {
 542         const u8 *pos;
 543         int len;
 544
 545         if (!attr)
 546                 return true;
 547
 548         pos = nla_data(attr);
 549         len = nla_len(attr);
 550
 551         while (len) {
 552                 u8 elemlen;
 553
 554                 if (len < 2)
 555                         return false;
 556                 len -= 2;
 557
 558                 elemlen = pos[1];
 559                 if (elemlen > len)
 560                         return false;
 561
 562                 len -= elemlen;
 563                 pos += 2 + elemlen;
 564         }
 565
 566         return true;
 567 }
 568
 569 /* message building helper */
 570 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 571                                    int flags, u8 cmd)
 572 {
 573         /* since there is no private header just add the generic one */
 574         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 575 }
 576
 577 static int nl80211_msg_put_channel(struct sk_buff *msg,
 578                                    struct ieee80211_channel *chan,
 579                                    bool large)
 580 {
 581         /* Some channels must be completely excluded from the
 582          * list to protect old user-space tools from breaking
 583          */
 584         if (!large && chan->flags &
 585             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 586                 return 0;
 587
 588         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 589                         chan->center_freq))
 590                 goto nla_put_failure;
 591
 592         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 593             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 594                 goto nla_put_failure;
 595         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 596                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 597                         goto nla_put_failure;
 598                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 599                         goto nla_put_failure;
 600         }
 601         if (chan->flags & IEEE80211_CHAN_RADAR) {
 602                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 603                         goto nla_put_failure;
 604                 if (large) {
 605                         u32 time;
 606
 607                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 608
 609                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 610                                         chan->dfs_state))
 611                                 goto nla_put_failure;
 612                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 613                                         time))
 614                                 goto nla_put_failure;
 615                         if (nla_put_u32(msg,
 616                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 617                                         chan->dfs_cac_ms))
 618                                 goto nla_put_failure;
 619                 }
 620         }
 621
 622         if (large) {
 623                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 624                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 625                         goto nla_put_failure;
 626                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 627                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 628                         goto nla_put_failure;
 629                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 630                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 631                         goto nla_put_failure;
 632                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 633                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 634                         goto nla_put_failure;
 635                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 636                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 637                         goto nla_put_failure;
 638                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
 639                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
 640                         goto nla_put_failure;
 641                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 642                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 643                         goto nla_put_failure;
 644                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 645                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 646                         goto nla_put_failure;
 647         }
 648
 649         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 650                         DBM_TO_MBM(chan->max_power)))
 651                 goto nla_put_failure;
 652
 653         return 0;
 654
 655  nla_put_failure:
 656         return -ENOBUFS;
 657 }
 658
 659 /* netlink command implementations */
 660
 661 struct key_parse {
 662         struct key_params p;
 663         int idx;
 664         int type;
 665         bool def, defmgmt;
 666         bool def_uni, def_multi;
 667 };
 668
 669 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 670 {
 671         struct nlattr *tb[NL80211_KEY_MAX + 1];
 672         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 673                                    nl80211_key_policy);
 674         if (err)
 675                 return err;
 676
 677         k->def = !!tb[NL80211_KEY_DEFAULT];
 678         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 679
 680         if (k->def) {
 681                 k->def_uni = true;
 682                 k->def_multi = true;
 683         }
 684         if (k->defmgmt)
 685                 k->def_multi = true;
 686
 687         if (tb[NL80211_KEY_IDX])
 688                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 689
 690         if (tb[NL80211_KEY_DATA]) {
 691                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 692                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 693         }
 694
 695         if (tb[NL80211_KEY_SEQ]) {
 696                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 697                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 698         }
 699
 700         if (tb[NL80211_KEY_CIPHER])
 701                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 702
 703         if (tb[NL80211_KEY_TYPE]) {
 704                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 705                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 706                         return -EINVAL;
 707         }
 708
 709         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 710                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 711                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 712                                        tb[NL80211_KEY_DEFAULT_TYPES],
 713                                        nl80211_key_default_policy);
 714                 if (err)
 715                         return err;
 716
 717                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 718                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 719         }
 720
 721         return 0;
 722 }
 723
 724 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 725 {
 726         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 727                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 728                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 729         }
 730
 731         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 732                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 733                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 734         }
 735
 736         if (info->attrs[NL80211_ATTR_KEY_IDX])
 737                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 738
 739         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 740                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 741
 742         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 743         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 744
 745         if (k->def) {
 746                 k->def_uni = true;
 747                 k->def_multi = true;
 748         }
 749         if (k->defmgmt)
 750                 k->def_multi = true;
 751
 752         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 753                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 754                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 755                         return -EINVAL;
 756         }
 757
 758         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 759                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 760                 int err = nla_parse_nested(
 761                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 762                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 763                                 nl80211_key_default_policy);
 764                 if (err)
 765                         return err;
 766
 767                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 768                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 769         }
 770
 771         return 0;
 772 }
 773
 774 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 775 {
 776         int err;
 777
 778         memset(k, 0, sizeof(*k));
 779         k->idx = -1;
 780         k->type = -1;
 781
 782         if (info->attrs[NL80211_ATTR_KEY])
 783                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 784         else
 785                 err = nl80211_parse_key_old(info, k);
 786
 787         if (err)
 788                 return err;
 789
 790         if (k->def && k->defmgmt)
 791                 return -EINVAL;
 792
 793         if (k->defmgmt) {
 794                 if (k->def_uni || !k->def_multi)
 795                         return -EINVAL;
 796         }
 797
 798         if (k->idx != -1) {
 799                 if (k->defmgmt) {
 800                         if (k->idx < 4 || k->idx > 5)
 801                                 return -EINVAL;
 802                 } else if (k->def) {
 803                         if (k->idx < 0 || k->idx > 3)
 804                                 return -EINVAL;
 805                 } else {
 806                         if (k->idx < 0 || k->idx > 5)
 807                                 return -EINVAL;
 808                 }
 809         }
 810
 811         return 0;
 812 }
 813
 814 static struct cfg80211_cached_keys *
 815 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 816                        struct nlattr *keys, bool *no_ht)
 817 {
 818         struct key_parse parse;
 819         struct nlattr *key;
 820         struct cfg80211_cached_keys *result;
 821         int rem, err, def = 0;
 822
 823         result = kzalloc(sizeof(*result), GFP_KERNEL);
 824         if (!result)
 825                 return ERR_PTR(-ENOMEM);
 826
 827         result->def = -1;
 828         result->defmgmt = -1;
 829
 830         nla_for_each_nested(key, keys, rem) {
 831                 memset(&parse, 0, sizeof(parse));
 832                 parse.idx = -1;
 833
 834                 err = nl80211_parse_key_new(key, &parse);
 835                 if (err)
 836                         goto error;
 837                 err = -EINVAL;
 838                 if (!parse.p.key)
 839                         goto error;
 840                 if (parse.idx < 0 || parse.idx > 4)
 841                         goto error;
 842                 if (parse.def) {
 843                         if (def)
 844                                 goto error;
 845                         def = 1;
 846                         result->def = parse.idx;
 847                         if (!parse.def_uni || !parse.def_multi)
 848                                 goto error;
 849                 } else if (parse.defmgmt)
 850                         goto error;
 851                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 852                                                      parse.idx, false, NULL);
 853                 if (err)
 854                         goto error;
 855                 result->params[parse.idx].cipher = parse.p.cipher;
 856                 result->params[parse.idx].key_len = parse.p.key_len;
 857                 result->params[parse.idx].key = result->data[parse.idx];
 858                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 859
 860                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
 861                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
 862                         if (no_ht)
 863                                 *no_ht = true;
 864                 }
 865         }
 866
 867         return result;
 868  error:
 869         kfree(result);
 870         return ERR_PTR(err);
 871 }
 872
 873 static int nl80211_key_allowed(struct wireless_dev *wdev)
 874 {
 875         ASSERT_WDEV_LOCK(wdev);
 876
 877         switch (wdev->iftype) {
 878         case NL80211_IFTYPE_AP:
 879         case NL80211_IFTYPE_AP_VLAN:
 880         case NL80211_IFTYPE_P2P_GO:
 881         case NL80211_IFTYPE_MESH_POINT:
 882                 break;
 883         case NL80211_IFTYPE_ADHOC:
 884         case NL80211_IFTYPE_STATION:
 885         case NL80211_IFTYPE_P2P_CLIENT:
 886                 if (!wdev->current_bss)
 887                         return -ENOLINK;
 888                 break;
 889         case NL80211_IFTYPE_UNSPECIFIED:
 890         case NL80211_IFTYPE_OCB:
 891         case NL80211_IFTYPE_MONITOR:
 892         case NL80211_IFTYPE_P2P_DEVICE:
 893         case NL80211_IFTYPE_WDS:
 894         case NUM_NL80211_IFTYPES:
 895                 return -EINVAL;
 896         }
 897
 898         return 0;
 899 }
 900
 901 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 902                                                         struct nlattr *tb)
 903 {
 904         struct ieee80211_channel *chan;
 905
 906         if (tb == NULL)
 907                 return NULL;
 908         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 909         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 910                 return NULL;
 911         return chan;
 912 }
 913
 914 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
 915 {
 916         struct nlattr *nl_modes = nla_nest_start(msg, attr);
 917         int i;
 918
 919         if (!nl_modes)
 920                 goto nla_put_failure;
 921
 922         i = 0;
 923         while (ifmodes) {
 924                 if ((ifmodes & 1) && nla_put_flag(msg, i))
 925                         goto nla_put_failure;
 926                 ifmodes >>= 1;
 927                 i++;
 928         }
 929
 930         nla_nest_end(msg, nl_modes);
 931         return 0;
 932
 933 nla_put_failure:
 934         return -ENOBUFS;
 935 }
 936
 937 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
 938                                           struct sk_buff *msg,
 939                                           bool large)
 940 {
 941         struct nlattr *nl_combis;
 942         int i, j;
 943
 944         nl_combis = nla_nest_start(msg,
 945                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
 946         if (!nl_combis)
 947                 goto nla_put_failure;
 948
 949         for (i = 0; i < wiphy->n_iface_combinations; i++) {
 950                 const struct ieee80211_iface_combination *c;
 951                 struct nlattr *nl_combi, *nl_limits;
 952
 953                 c = &wiphy->iface_combinations[i];
 954
 955                 nl_combi = nla_nest_start(msg, i + 1);
 956                 if (!nl_combi)
 957                         goto nla_put_failure;
 958
 959                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
 960                 if (!nl_limits)
 961                         goto nla_put_failure;
 962
 963                 for (j = 0; j < c->n_limits; j++) {
 964                         struct nlattr *nl_limit;
 965
 966                         nl_limit = nla_nest_start(msg, j + 1);
 967                         if (!nl_limit)
 968                                 goto nla_put_failure;
 969                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
 970                                         c->limits[j].max))
 971                                 goto nla_put_failure;
 972                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
 973                                                 c->limits[j].types))
 974                                 goto nla_put_failure;
 975                         nla_nest_end(msg, nl_limit);
 976                 }
 977
 978                 nla_nest_end(msg, nl_limits);
 979
 980                 if (c->beacon_int_infra_match &&
 981                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
 982                         goto nla_put_failure;
 983                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
 984                                 c->num_different_channels) ||
 985                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
 986                                 c->max_interfaces))
 987                         goto nla_put_failure;
 988                 if (large &&
 989                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
 990                                 c->radar_detect_widths) ||
 991                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
 992                                 c->radar_detect_regions)))
 993                         goto nla_put_failure;
 994
 995                 nla_nest_end(msg, nl_combi);
 996         }
 997
 998         nla_nest_end(msg, nl_combis);
 999
1000         return 0;
1001 nla_put_failure:
1002         return -ENOBUFS;
1003 }
1004
1005 #ifdef CONFIG_PM
1006 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1007                                         struct sk_buff *msg)
1008 {
1009         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1010         struct nlattr *nl_tcp;
1011
1012         if (!tcp)
1013                 return 0;
1014
1015         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1016         if (!nl_tcp)
1017                 return -ENOBUFS;
1018
1019         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1020                         tcp->data_payload_max))
1021                 return -ENOBUFS;
1022
1023         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1024                         tcp->data_payload_max))
1025                 return -ENOBUFS;
1026
1027         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1028                 return -ENOBUFS;
1029
1030         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1031                                 sizeof(*tcp->tok), tcp->tok))
1032                 return -ENOBUFS;
1033
1034         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1035                         tcp->data_interval_max))
1036                 return -ENOBUFS;
1037
1038         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1039                         tcp->wake_payload_max))
1040                 return -ENOBUFS;
1041
1042         nla_nest_end(msg, nl_tcp);
1043         return 0;
1044 }
1045
1046 static int nl80211_send_wowlan(struct sk_buff *msg,
1047                                struct cfg80211_registered_device *rdev,
1048                                bool large)
1049 {
1050         struct nlattr *nl_wowlan;
1051
1052         if (!rdev->wiphy.wowlan)
1053                 return 0;
1054
1055         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1056         if (!nl_wowlan)
1057                 return -ENOBUFS;
1058
1059         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1060              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1061             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1062              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1063             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1064              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1065             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1066              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1067             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1068              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1069             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1070              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1071             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1072              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1073             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1074              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1075                 return -ENOBUFS;
1076
1077         if (rdev->wiphy.wowlan->n_patterns) {
1078                 struct nl80211_pattern_support pat = {
1079                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1080                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1081                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1082                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1083                 };
1084
1085                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1086                             sizeof(pat), &pat))
1087                         return -ENOBUFS;
1088         }
1089
1090         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1091                 return -ENOBUFS;
1092
1093         /* TODO: send wowlan net detect */
1094
1095         nla_nest_end(msg, nl_wowlan);
1096
1097         return 0;
1098 }
1099 #endif
1100
1101 static int nl80211_send_coalesce(struct sk_buff *msg,
1102                                  struct cfg80211_registered_device *rdev)
1103 {
1104         struct nl80211_coalesce_rule_support rule;
1105
1106         if (!rdev->wiphy.coalesce)
1107                 return 0;
1108
1109         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1110         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1111         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1112         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1113         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1114         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1115
1116         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1117                 return -ENOBUFS;
1118
1119         return 0;
1120 }
1121
1122 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1123                                       struct ieee80211_supported_band *sband)
1124 {
1125         struct nlattr *nl_rates, *nl_rate;
1126         struct ieee80211_rate *rate;
1127         int i;
1128
1129         /* add HT info */
1130         if (sband->ht_cap.ht_supported &&
1131             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1132                      sizeof(sband->ht_cap.mcs),
1133                      &sband->ht_cap.mcs) ||
1134              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1135                          sband->ht_cap.cap) ||
1136              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1137                         sband->ht_cap.ampdu_factor) ||
1138              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1139                         sband->ht_cap.ampdu_density)))
1140                 return -ENOBUFS;
1141
1142         /* add VHT info */
1143         if (sband->vht_cap.vht_supported &&
1144             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1145                      sizeof(sband->vht_cap.vht_mcs),
1146                      &sband->vht_cap.vht_mcs) ||
1147              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1148                          sband->vht_cap.cap)))
1149                 return -ENOBUFS;
1150
1151         /* add bitrates */
1152         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1153         if (!nl_rates)
1154                 return -ENOBUFS;
1155
1156         for (i = 0; i < sband->n_bitrates; i++) {
1157                 nl_rate = nla_nest_start(msg, i);
1158                 if (!nl_rate)
1159                         return -ENOBUFS;
1160
1161                 rate = &sband->bitrates[i];
1162                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1163                                 rate->bitrate))
1164                         return -ENOBUFS;
1165                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1166                     nla_put_flag(msg,
1167                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1168                         return -ENOBUFS;
1169
1170                 nla_nest_end(msg, nl_rate);
1171         }
1172
1173         nla_nest_end(msg, nl_rates);
1174
1175         return 0;
1176 }
1177
1178 static int
1179 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1180                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1181 {
1182         u16 stypes;
1183         struct nlattr *nl_ftypes, *nl_ifs;
1184         enum nl80211_iftype ift;
1185         int i;
1186
1187         if (!mgmt_stypes)
1188                 return 0;
1189
1190         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1191         if (!nl_ifs)
1192                 return -ENOBUFS;
1193
1194         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1195                 nl_ftypes = nla_nest_start(msg, ift);
1196                 if (!nl_ftypes)
1197                         return -ENOBUFS;
1198                 i = 0;
1199                 stypes = mgmt_stypes[ift].tx;
1200                 while (stypes) {
1201                         if ((stypes & 1) &&
1202                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1203                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1204                                 return -ENOBUFS;
1205                         stypes >>= 1;
1206                         i++;
1207                 }
1208                 nla_nest_end(msg, nl_ftypes);
1209         }
1210
1211         nla_nest_end(msg, nl_ifs);
1212
1213         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1214         if (!nl_ifs)
1215                 return -ENOBUFS;
1216
1217         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1218                 nl_ftypes = nla_nest_start(msg, ift);
1219                 if (!nl_ftypes)
1220                         return -ENOBUFS;
1221                 i = 0;
1222                 stypes = mgmt_stypes[ift].rx;
1223                 while (stypes) {
1224                         if ((stypes & 1) &&
1225                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1226                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1227                                 return -ENOBUFS;
1228                         stypes >>= 1;
1229                         i++;
1230                 }
1231                 nla_nest_end(msg, nl_ftypes);
1232         }
1233         nla_nest_end(msg, nl_ifs);
1234
1235         return 0;
1236 }
1237
1238 struct nl80211_dump_wiphy_state {
1239         s64 filter_wiphy;
1240         long start;
1241         long split_start, band_start, chan_start;
1242         bool split;
1243 };
1244
1245 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1246                               enum nl80211_commands cmd,
1247                               struct sk_buff *msg, u32 portid, u32 seq,
1248                               int flags, struct nl80211_dump_wiphy_state *state)
1249 {
1250         void *hdr;
1251         struct nlattr *nl_bands, *nl_band;
1252         struct nlattr *nl_freqs, *nl_freq;
1253         struct nlattr *nl_cmds;
1254         enum ieee80211_band band;
1255         struct ieee80211_channel *chan;
1256         int i;
1257         const struct ieee80211_txrx_stypes *mgmt_stypes =
1258                                 rdev->wiphy.mgmt_stypes;
1259         u32 features;
1260
1261         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1262         if (!hdr)
1263                 return -ENOBUFS;
1264
1265         if (WARN_ON(!state))
1266                 return -EINVAL;
1267
1268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1269             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1270                            wiphy_name(&rdev->wiphy)) ||
1271             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1272                         cfg80211_rdev_list_generation))
1273                 goto nla_put_failure;
1274
1275         if (cmd != NL80211_CMD_NEW_WIPHY)
1276                 goto finish;
1277
1278         switch (state->split_start) {
1279         case 0:
1280                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1281                                rdev->wiphy.retry_short) ||
1282                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1283                                rdev->wiphy.retry_long) ||
1284                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1285                                 rdev->wiphy.frag_threshold) ||
1286                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1287                                 rdev->wiphy.rts_threshold) ||
1288                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1289                                rdev->wiphy.coverage_class) ||
1290                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1291                                rdev->wiphy.max_scan_ssids) ||
1292                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1293                                rdev->wiphy.max_sched_scan_ssids) ||
1294                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1295                                 rdev->wiphy.max_scan_ie_len) ||
1296                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1297                                 rdev->wiphy.max_sched_scan_ie_len) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1299                                rdev->wiphy.max_match_sets))
1300                         goto nla_put_failure;
1301
1302                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1303                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1304                         goto nla_put_failure;
1305                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1306                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1307                         goto nla_put_failure;
1308                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1309                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1310                         goto nla_put_failure;
1311                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1312                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1313                         goto nla_put_failure;
1314                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1315                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1316                         goto nla_put_failure;
1317                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1318                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1319                         goto nla_put_failure;
1320                 state->split_start++;
1321                 if (state->split)
1322                         break;
1323         case 1:
1324                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1325                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1326                             rdev->wiphy.cipher_suites))
1327                         goto nla_put_failure;
1328
1329                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1330                                rdev->wiphy.max_num_pmkids))
1331                         goto nla_put_failure;
1332
1333                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1334                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1335                         goto nla_put_failure;
1336
1337                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1338                                 rdev->wiphy.available_antennas_tx) ||
1339                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1340                                 rdev->wiphy.available_antennas_rx))
1341                         goto nla_put_failure;
1342
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1344                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1345                                 rdev->wiphy.probe_resp_offload))
1346                         goto nla_put_failure;
1347
1348                 if ((rdev->wiphy.available_antennas_tx ||
1349                      rdev->wiphy.available_antennas_rx) &&
1350                     rdev->ops->get_antenna) {
1351                         u32 tx_ant = 0, rx_ant = 0;
1352                         int res;
1353                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1354                         if (!res) {
1355                                 if (nla_put_u32(msg,
1356                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1357                                                 tx_ant) ||
1358                                     nla_put_u32(msg,
1359                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1360                                                 rx_ant))
1361                                         goto nla_put_failure;
1362                         }
1363                 }
1364
1365                 state->split_start++;
1366                 if (state->split)
1367                         break;
1368         case 2:
1369                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1370                                         rdev->wiphy.interface_modes))
1371                                 goto nla_put_failure;
1372                 state->split_start++;
1373                 if (state->split)
1374                         break;
1375         case 3:
1376                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1377                 if (!nl_bands)
1378                         goto nla_put_failure;
1379
1380                 for (band = state->band_start;
1381                      band < IEEE80211_NUM_BANDS; band++) {
1382                         struct ieee80211_supported_band *sband;
1383
1384                         sband = rdev->wiphy.bands[band];
1385
1386                         if (!sband)
1387                                 continue;
1388
1389                         nl_band = nla_nest_start(msg, band);
1390                         if (!nl_band)
1391                                 goto nla_put_failure;
1392
1393                         switch (state->chan_start) {
1394                         case 0:
1395                                 if (nl80211_send_band_rateinfo(msg, sband))
1396                                         goto nla_put_failure;
1397                                 state->chan_start++;
1398                                 if (state->split)
1399                                         break;
1400                         default:
1401                                 /* add frequencies */
1402                                 nl_freqs = nla_nest_start(
1403                                         msg, NL80211_BAND_ATTR_FREQS);
1404                                 if (!nl_freqs)
1405                                         goto nla_put_failure;
1406
1407                                 for (i = state->chan_start - 1;
1408                                      i < sband->n_channels;
1409                                      i++) {
1410                                         nl_freq = nla_nest_start(msg, i);
1411                                         if (!nl_freq)
1412                                                 goto nla_put_failure;
1413
1414                                         chan = &sband->channels[i];
1415
1416                                         if (nl80211_msg_put_channel(
1417                                                         msg, chan,
1418                                                         state->split))
1419                                                 goto nla_put_failure;
1420
1421                                         nla_nest_end(msg, nl_freq);
1422                                         if (state->split)
1423                                                 break;
1424                                 }
1425                                 if (i < sband->n_channels)
1426                                         state->chan_start = i + 2;
1427                                 else
1428                                         state->chan_start = 0;
1429                                 nla_nest_end(msg, nl_freqs);
1430                         }
1431
1432                         nla_nest_end(msg, nl_band);
1433
1434                         if (state->split) {
1435                                 /* start again here */
1436                                 if (state->chan_start)
1437                                         band--;
1438                                 break;
1439                         }
1440                 }
1441                 nla_nest_end(msg, nl_bands);
1442
1443                 if (band < IEEE80211_NUM_BANDS)
1444                         state->band_start = band + 1;
1445                 else
1446                         state->band_start = 0;
1447
1448                 /* if bands & channels are done, continue outside */
1449                 if (state->band_start == 0 && state->chan_start == 0)
1450                         state->split_start++;
1451                 if (state->split)
1452                         break;
1453         case 4:
1454                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1455                 if (!nl_cmds)
1456                         goto nla_put_failure;
1457
1458                 i = 0;
1459 #define CMD(op, n)                                                      \
1460                  do {                                                   \
1461                         if (rdev->ops->op) {                            \
1462                                 i++;                                    \
1463                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1464                                         goto nla_put_failure;           \
1465                         }                                               \
1466                 } while (0)
1467
1468                 CMD(add_virtual_intf, NEW_INTERFACE);
1469                 CMD(change_virtual_intf, SET_INTERFACE);
1470                 CMD(add_key, NEW_KEY);
1471                 CMD(start_ap, START_AP);
1472                 CMD(add_station, NEW_STATION);
1473                 CMD(add_mpath, NEW_MPATH);
1474                 CMD(update_mesh_config, SET_MESH_CONFIG);
1475                 CMD(change_bss, SET_BSS);
1476                 CMD(auth, AUTHENTICATE);
1477                 CMD(assoc, ASSOCIATE);
1478                 CMD(deauth, DEAUTHENTICATE);
1479                 CMD(disassoc, DISASSOCIATE);
1480                 CMD(join_ibss, JOIN_IBSS);
1481                 CMD(join_mesh, JOIN_MESH);
1482                 CMD(set_pmksa, SET_PMKSA);
1483                 CMD(del_pmksa, DEL_PMKSA);
1484                 CMD(flush_pmksa, FLUSH_PMKSA);
1485                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1486                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1487                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1488                 CMD(mgmt_tx, FRAME);
1489                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1490                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1491                         i++;
1492                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1493                                 goto nla_put_failure;
1494                 }
1495                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1496                     rdev->ops->join_mesh) {
1497                         i++;
1498                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1499                                 goto nla_put_failure;
1500                 }
1501                 CMD(set_wds_peer, SET_WDS_PEER);
1502                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1503                         CMD(tdls_mgmt, TDLS_MGMT);
1504                         CMD(tdls_oper, TDLS_OPER);
1505                 }
1506                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1507                         CMD(sched_scan_start, START_SCHED_SCAN);
1508                 CMD(probe_client, PROBE_CLIENT);
1509                 CMD(set_noack_map, SET_NOACK_MAP);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1513                                 goto nla_put_failure;
1514                 }
1515                 CMD(start_p2p_device, START_P2P_DEVICE);
1516                 CMD(set_mcast_rate, SET_MCAST_RATE);
1517 #ifdef CONFIG_NL80211_TESTMODE
1518                 CMD(testmode_cmd, TESTMODE);
1519 #endif
1520                 if (state->split) {
1521                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1522                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1523                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1524                                 CMD(channel_switch, CHANNEL_SWITCH);
1525                         CMD(set_qos_map, SET_QOS_MAP);
1526                         if (rdev->wiphy.features &
1527                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1528                                 CMD(add_tx_ts, ADD_TX_TS);
1529                 }
1530                 /* add into the if now */
1531 #undef CMD
1532
1533                 if (rdev->ops->connect || rdev->ops->auth) {
1534                         i++;
1535                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1536                                 goto nla_put_failure;
1537                 }
1538
1539                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1540                         i++;
1541                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1542                                 goto nla_put_failure;
1543                 }
1544
1545                 nla_nest_end(msg, nl_cmds);
1546                 state->split_start++;
1547                 if (state->split)
1548                         break;
1549         case 5:
1550                 if (rdev->ops->remain_on_channel &&
1551                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1552                     nla_put_u32(msg,
1553                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1554                                 rdev->wiphy.max_remain_on_channel_duration))
1555                         goto nla_put_failure;
1556
1557                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1558                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1559                         goto nla_put_failure;
1560
1561                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1562                         goto nla_put_failure;
1563                 state->split_start++;
1564                 if (state->split)
1565                         break;
1566         case 6:
1567 #ifdef CONFIG_PM
1568                 if (nl80211_send_wowlan(msg, rdev, state->split))
1569                         goto nla_put_failure;
1570                 state->split_start++;
1571                 if (state->split)
1572                         break;
1573 #else
1574                 state->split_start++;
1575 #endif
1576         case 7:
1577                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1578                                         rdev->wiphy.software_iftypes))
1579                         goto nla_put_failure;
1580
1581                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1582                                                    state->split))
1583                         goto nla_put_failure;
1584
1585                 state->split_start++;
1586                 if (state->split)
1587                         break;
1588         case 8:
1589                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1590                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1591                                 rdev->wiphy.ap_sme_capa))
1592                         goto nla_put_failure;
1593
1594                 features = rdev->wiphy.features;
1595                 /*
1596                  * We can only add the per-channel limit information if the
1597                  * dump is split, otherwise it makes it too big. Therefore
1598                  * only advertise it in that case.
1599                  */
1600                 if (state->split)
1601                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1602                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1603                         goto nla_put_failure;
1604
1605                 if (rdev->wiphy.ht_capa_mod_mask &&
1606                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1607                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1608                             rdev->wiphy.ht_capa_mod_mask))
1609                         goto nla_put_failure;
1610
1611                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1612                     rdev->wiphy.max_acl_mac_addrs &&
1613                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1614                                 rdev->wiphy.max_acl_mac_addrs))
1615                         goto nla_put_failure;
1616
1617                 /*
1618                  * Any information below this point is only available to
1619                  * applications that can deal with it being split. This
1620                  * helps ensure that newly added capabilities don't break
1621                  * older tools by overrunning their buffers.
1622                  *
1623                  * We still increment split_start so that in the split
1624                  * case we'll continue with more data in the next round,
1625                  * but break unconditionally so unsplit data stops here.
1626                  */
1627                 state->split_start++;
1628                 break;
1629         case 9:
1630                 if (rdev->wiphy.extended_capabilities &&
1631                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1632                              rdev->wiphy.extended_capabilities_len,
1633                              rdev->wiphy.extended_capabilities) ||
1634                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1635                              rdev->wiphy.extended_capabilities_len,
1636                              rdev->wiphy.extended_capabilities_mask)))
1637                         goto nla_put_failure;
1638
1639                 if (rdev->wiphy.vht_capa_mod_mask &&
1640                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1641                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1642                             rdev->wiphy.vht_capa_mod_mask))
1643                         goto nla_put_failure;
1644
1645                 state->split_start++;
1646                 break;
1647         case 10:
1648                 if (nl80211_send_coalesce(msg, rdev))
1649                         goto nla_put_failure;
1650
1651                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1652                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1653                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1654                         goto nla_put_failure;
1655
1656                 if (rdev->wiphy.max_ap_assoc_sta &&
1657                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1658                                 rdev->wiphy.max_ap_assoc_sta))
1659                         goto nla_put_failure;
1660
1661                 state->split_start++;
1662                 break;
1663         case 11:
1664                 if (rdev->wiphy.n_vendor_commands) {
1665                         const struct nl80211_vendor_cmd_info *info;
1666                         struct nlattr *nested;
1667
1668                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1669                         if (!nested)
1670                                 goto nla_put_failure;
1671
1672                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1673                                 info = &rdev->wiphy.vendor_commands[i].info;
1674                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1675                                         goto nla_put_failure;
1676                         }
1677                         nla_nest_end(msg, nested);
1678                 }
1679
1680                 if (rdev->wiphy.n_vendor_events) {
1681                         const struct nl80211_vendor_cmd_info *info;
1682                         struct nlattr *nested;
1683
1684                         nested = nla_nest_start(msg,
1685                                                 NL80211_ATTR_VENDOR_EVENTS);
1686                         if (!nested)
1687                                 goto nla_put_failure;
1688
1689                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1690                                 info = &rdev->wiphy.vendor_events[i];
1691                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1692                                         goto nla_put_failure;
1693                         }
1694                         nla_nest_end(msg, nested);
1695                 }
1696                 state->split_start++;
1697                 break;
1698         case 12:
1699                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1700                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1701                                rdev->wiphy.max_num_csa_counters))
1702                         goto nla_put_failure;
1703
1704                 /* done */
1705                 state->split_start = 0;
1706                 break;
1707         }
1708  finish:
1709         return genlmsg_end(msg, hdr);
1710
1711  nla_put_failure:
1712         genlmsg_cancel(msg, hdr);
1713         return -EMSGSIZE;
1714 }
1715
1716 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1717                                     struct netlink_callback *cb,
1718                                     struct nl80211_dump_wiphy_state *state)
1719 {
1720         struct nlattr **tb = nl80211_fam.attrbuf;
1721         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1722                               tb, nl80211_fam.maxattr, nl80211_policy);
1723         /* ignore parse errors for backward compatibility */
1724         if (ret)
1725                 return 0;
1726
1727         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1728         if (tb[NL80211_ATTR_WIPHY])
1729                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1730         if (tb[NL80211_ATTR_WDEV])
1731                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1732         if (tb[NL80211_ATTR_IFINDEX]) {
1733                 struct net_device *netdev;
1734                 struct cfg80211_registered_device *rdev;
1735                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1736
1737                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1738                 if (!netdev)
1739                         return -ENODEV;
1740                 if (netdev->ieee80211_ptr) {
1741                         rdev = wiphy_to_rdev(
1742                                 netdev->ieee80211_ptr->wiphy);
1743                         state->filter_wiphy = rdev->wiphy_idx;
1744                 }
1745         }
1746
1747         return 0;
1748 }
1749
1750 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1751 {
1752         int idx = 0, ret;
1753         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1754         struct cfg80211_registered_device *rdev;
1755
1756         rtnl_lock();
1757         if (!state) {
1758                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1759                 if (!state) {
1760                         rtnl_unlock();
1761                         return -ENOMEM;
1762                 }
1763                 state->filter_wiphy = -1;
1764                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1765                 if (ret) {
1766                         kfree(state);
1767                         rtnl_unlock();
1768                         return ret;
1769                 }
1770                 cb->args[0] = (long)state;
1771         }
1772
1773         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1774                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1775                         continue;
1776                 if (++idx <= state->start)
1777                         continue;
1778                 if (state->filter_wiphy != -1 &&
1779                     state->filter_wiphy != rdev->wiphy_idx)
1780                         continue;
1781                 /* attempt to fit multiple wiphy data chunks into the skb */
1782                 do {
1783                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1784                                                  skb,
1785                                                  NETLINK_CB(cb->skb).portid,
1786                                                  cb->nlh->nlmsg_seq,
1787                                                  NLM_F_MULTI, state);
1788                         if (ret < 0) {
1789                                 /*
1790                                  * If sending the wiphy data didn't fit (ENOBUFS
1791                                  * or EMSGSIZE returned), this SKB is still
1792                                  * empty (so it's not too big because another
1793                                  * wiphy dataset is already in the skb) and
1794                                  * we've not tried to adjust the dump allocation
1795                                  * yet ... then adjust the alloc size to be
1796                                  * bigger, and return 1 but with the empty skb.
1797                                  * This results in an empty message being RX'ed
1798                                  * in userspace, but that is ignored.
1799                                  *
1800                                  * We can then retry with the larger buffer.
1801                                  */
1802                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1803                                     !skb->len && !state->split &&
1804                                     cb->min_dump_alloc < 4096) {
1805                                         cb->min_dump_alloc = 4096;
1806                                         state->split_start = 0;
1807                                         rtnl_unlock();
1808                                         return 1;
1809                                 }
1810                                 idx--;
1811                                 break;
1812                         }
1813                 } while (state->split_start > 0);
1814                 break;
1815         }
1816         rtnl_unlock();
1817
1818         state->start = idx;
1819
1820         return skb->len;
1821 }
1822
1823 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1824 {
1825         kfree((void *)cb->args[0]);
1826         return 0;
1827 }
1828
1829 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1830 {
1831         struct sk_buff *msg;
1832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1833         struct nl80211_dump_wiphy_state state = {};
1834
1835         msg = nlmsg_new(4096, GFP_KERNEL);
1836         if (!msg)
1837                 return -ENOMEM;
1838
1839         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1840                                info->snd_portid, info->snd_seq, 0,
1841                                &state) < 0) {
1842                 nlmsg_free(msg);
1843                 return -ENOBUFS;
1844         }
1845
1846         return genlmsg_reply(msg, info);
1847 }
1848
1849 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1850         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1851         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1852         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1853         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1854         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1855 };
1856
1857 static int parse_txq_params(struct nlattr *tb[],
1858                             struct ieee80211_txq_params *txq_params)
1859 {
1860         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1861             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1862             !tb[NL80211_TXQ_ATTR_AIFS])
1863                 return -EINVAL;
1864
1865         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1866         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1867         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1868         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1869         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1870
1871         if (txq_params->ac >= NL80211_NUM_ACS)
1872                 return -EINVAL;
1873
1874         return 0;
1875 }
1876
1877 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1878 {
1879         /*
1880          * You can only set the channel explicitly for WDS interfaces,
1881          * all others have their channel managed via their respective
1882          * "establish a connection" command (connect, join, ...)
1883          *
1884          * For AP/GO and mesh mode, the channel can be set with the
1885          * channel userspace API, but is only stored and passed to the
1886          * low-level driver when the AP starts or the mesh is joined.
1887          * This is for backward compatibility, userspace can also give
1888          * the channel in the start-ap or join-mesh commands instead.
1889          *
1890          * Monitors are special as they are normally slaved to
1891          * whatever else is going on, so they have their own special
1892          * operation to set the monitor channel if possible.
1893          */
1894         return !wdev ||
1895                 wdev->iftype == NL80211_IFTYPE_AP ||
1896                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1897                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1898                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1899 }
1900
1901 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1902                                  struct genl_info *info,
1903                                  struct cfg80211_chan_def *chandef)
1904 {
1905         u32 control_freq;
1906
1907         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1908                 return -EINVAL;
1909
1910         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1911
1912         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1913         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1914         chandef->center_freq1 = control_freq;
1915         chandef->center_freq2 = 0;
1916
1917         /* Primary channel not allowed */
1918         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1919                 return -EINVAL;
1920
1921         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1922                 enum nl80211_channel_type chantype;
1923
1924                 chantype = nla_get_u32(
1925                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1926
1927                 switch (chantype) {
1928                 case NL80211_CHAN_NO_HT:
1929                 case NL80211_CHAN_HT20:
1930                 case NL80211_CHAN_HT40PLUS:
1931                 case NL80211_CHAN_HT40MINUS:
1932                         cfg80211_chandef_create(chandef, chandef->chan,
1933                                                 chantype);
1934                         break;
1935                 default:
1936                         return -EINVAL;
1937                 }
1938         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1939                 chandef->width =
1940                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1941                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1942                         chandef->center_freq1 =
1943                                 nla_get_u32(
1944                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1945                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1946                         chandef->center_freq2 =
1947                                 nla_get_u32(
1948                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1949         }
1950
1951         if (!cfg80211_chandef_valid(chandef))
1952                 return -EINVAL;
1953
1954         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1955                                      IEEE80211_CHAN_DISABLED))
1956                 return -EINVAL;
1957
1958         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1959              chandef->width == NL80211_CHAN_WIDTH_10) &&
1960             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1961                 return -EINVAL;
1962
1963         return 0;
1964 }
1965
1966 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1967                                  struct net_device *dev,
1968                                  struct genl_info *info)
1969 {
1970         struct cfg80211_chan_def chandef;
1971         int result;
1972         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1973         struct wireless_dev *wdev = NULL;
1974
1975         if (dev)
1976                 wdev = dev->ieee80211_ptr;
1977         if (!nl80211_can_set_dev_channel(wdev))
1978                 return -EOPNOTSUPP;
1979         if (wdev)
1980                 iftype = wdev->iftype;
1981
1982         result = nl80211_parse_chandef(rdev, info, &chandef);
1983         if (result)
1984                 return result;
1985
1986         switch (iftype) {
1987         case NL80211_IFTYPE_AP:
1988         case NL80211_IFTYPE_P2P_GO:
1989                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1990                         result = -EINVAL;
1991                         break;
1992                 }
1993                 if (wdev->beacon_interval) {
1994                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1995                             !(rdev->wiphy.features &
1996                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1997                                 result = -EBUSY;
1998                                 break;
1999                         }
2000
2001                         /* Only allow dynamic channel width changes */
2002                         if (chandef.chan != wdev->preset_chandef.chan) {
2003                                 result = -EBUSY;
2004                                 break;
2005                         }
2006                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2007                         if (result)
2008                                 break;
2009                 }
2010                 wdev->preset_chandef = chandef;
2011                 result = 0;
2012                 break;
2013         case NL80211_IFTYPE_MESH_POINT:
2014                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2015                 break;
2016         case NL80211_IFTYPE_MONITOR:
2017                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2018                 break;
2019         default:
2020                 result = -EINVAL;
2021         }
2022
2023         return result;
2024 }
2025
2026 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2027 {
2028         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2029         struct net_device *netdev = info->user_ptr[1];
2030
2031         return __nl80211_set_channel(rdev, netdev, info);
2032 }
2033
2034 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2035 {
2036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2037         struct net_device *dev = info->user_ptr[1];
2038         struct wireless_dev *wdev = dev->ieee80211_ptr;
2039         const u8 *bssid;
2040
2041         if (!info->attrs[NL80211_ATTR_MAC])
2042                 return -EINVAL;
2043
2044         if (netif_running(dev))
2045                 return -EBUSY;
2046
2047         if (!rdev->ops->set_wds_peer)
2048                 return -EOPNOTSUPP;
2049
2050         if (wdev->iftype != NL80211_IFTYPE_WDS)
2051                 return -EOPNOTSUPP;
2052
2053         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2054         return rdev_set_wds_peer(rdev, dev, bssid);
2055 }
2056
2057
2058 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2059 {
2060         struct cfg80211_registered_device *rdev;
2061         struct net_device *netdev = NULL;
2062         struct wireless_dev *wdev;
2063         int result = 0, rem_txq_params = 0;
2064         struct nlattr *nl_txq_params;
2065         u32 changed;
2066         u8 retry_short = 0, retry_long = 0;
2067         u32 frag_threshold = 0, rts_threshold = 0;
2068         u8 coverage_class = 0;
2069
2070         ASSERT_RTNL();
2071
2072         /*
2073          * Try to find the wiphy and netdev. Normally this
2074          * function shouldn't need the netdev, but this is
2075          * done for backward compatibility -- previously
2076          * setting the channel was done per wiphy, but now
2077          * it is per netdev. Previous userland like hostapd
2078          * also passed a netdev to set_wiphy, so that it is
2079          * possible to let that go to the right netdev!
2080          */
2081
2082         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2083                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2084
2085                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2086                 if (netdev && netdev->ieee80211_ptr)
2087                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2088                 else
2089                         netdev = NULL;
2090         }
2091
2092         if (!netdev) {
2093                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2094                                                   info->attrs);
2095                 if (IS_ERR(rdev))
2096                         return PTR_ERR(rdev);
2097                 wdev = NULL;
2098                 netdev = NULL;
2099                 result = 0;
2100         } else
2101                 wdev = netdev->ieee80211_ptr;
2102
2103         /*
2104          * end workaround code, by now the rdev is available
2105          * and locked, and wdev may or may not be NULL.
2106          */
2107
2108         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2109                 result = cfg80211_dev_rename(
2110                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2111
2112         if (result)
2113                 return result;
2114
2115         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2116                 struct ieee80211_txq_params txq_params;
2117                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2118
2119                 if (!rdev->ops->set_txq_params)
2120                         return -EOPNOTSUPP;
2121
2122                 if (!netdev)
2123                         return -EINVAL;
2124
2125                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2126                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2127                         return -EINVAL;
2128
2129                 if (!netif_running(netdev))
2130                         return -ENETDOWN;
2131
2132                 nla_for_each_nested(nl_txq_params,
2133                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2134                                     rem_txq_params) {
2135                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2136                                            nla_data(nl_txq_params),
2137                                            nla_len(nl_txq_params),
2138                                            txq_params_policy);
2139                         if (result)
2140                                 return result;
2141                         result = parse_txq_params(tb, &txq_params);
2142                         if (result)
2143                                 return result;
2144
2145                         result = rdev_set_txq_params(rdev, netdev,
2146                                                      &txq_params);
2147                         if (result)
2148                                 return result;
2149                 }
2150         }
2151
2152         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2153                 result = __nl80211_set_channel(
2154                         rdev,
2155                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2156                         info);
2157                 if (result)
2158                         return result;
2159         }
2160
2161         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2162                 struct wireless_dev *txp_wdev = wdev;
2163                 enum nl80211_tx_power_setting type;
2164                 int idx, mbm = 0;
2165
2166                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2167                         txp_wdev = NULL;
2168
2169                 if (!rdev->ops->set_tx_power)
2170                         return -EOPNOTSUPP;
2171
2172                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2173                 type = nla_get_u32(info->attrs[idx]);
2174
2175                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2176                     (type != NL80211_TX_POWER_AUTOMATIC))
2177                         return -EINVAL;
2178
2179                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2180                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2181                         mbm = nla_get_u32(info->attrs[idx]);
2182                 }
2183
2184                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2185                 if (result)
2186                         return result;
2187         }
2188
2189         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2190             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2191                 u32 tx_ant, rx_ant;
2192                 if ((!rdev->wiphy.available_antennas_tx &&
2193                      !rdev->wiphy.available_antennas_rx) ||
2194                     !rdev->ops->set_antenna)
2195                         return -EOPNOTSUPP;
2196
2197                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2198                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2199
2200                 /* reject antenna configurations which don't match the
2201                  * available antenna masks, except for the "all" mask */
2202                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2203                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2204                         return -EINVAL;
2205
2206                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2207                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2208
2209                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2210                 if (result)
2211                         return result;
2212         }
2213
2214         changed = 0;
2215
2216         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2217                 retry_short = nla_get_u8(
2218                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2219                 if (retry_short == 0)
2220                         return -EINVAL;
2221
2222                 changed |= WIPHY_PARAM_RETRY_SHORT;
2223         }
2224
2225         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2226                 retry_long = nla_get_u8(
2227                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2228                 if (retry_long == 0)
2229                         return -EINVAL;
2230
2231                 changed |= WIPHY_PARAM_RETRY_LONG;
2232         }
2233
2234         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2235                 frag_threshold = nla_get_u32(
2236                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2237                 if (frag_threshold < 256)
2238                         return -EINVAL;
2239
2240                 if (frag_threshold != (u32) -1) {
2241                         /*
2242                          * Fragments (apart from the last one) are required to
2243                          * have even length. Make the fragmentation code
2244                          * simpler by stripping LSB should someone try to use
2245                          * odd threshold value.
2246                          */
2247                         frag_threshold &= ~0x1;
2248                 }
2249                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2250         }
2251
2252         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2253                 rts_threshold = nla_get_u32(
2254                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2255                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2256         }
2257
2258         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2259                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2260                         return -EINVAL;
2261
2262                 coverage_class = nla_get_u8(
2263                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2264                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2265         }
2266
2267         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2268                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2269                         return -EOPNOTSUPP;
2270
2271                 changed |= WIPHY_PARAM_DYN_ACK;
2272         }
2273
2274         if (changed) {
2275                 u8 old_retry_short, old_retry_long;
2276                 u32 old_frag_threshold, old_rts_threshold;
2277                 u8 old_coverage_class;
2278
2279                 if (!rdev->ops->set_wiphy_params)
2280                         return -EOPNOTSUPP;
2281
2282                 old_retry_short = rdev->wiphy.retry_short;
2283                 old_retry_long = rdev->wiphy.retry_long;
2284                 old_frag_threshold = rdev->wiphy.frag_threshold;
2285                 old_rts_threshold = rdev->wiphy.rts_threshold;
2286                 old_coverage_class = rdev->wiphy.coverage_class;
2287
2288                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2289                         rdev->wiphy.retry_short = retry_short;
2290                 if (changed & WIPHY_PARAM_RETRY_LONG)
2291                         rdev->wiphy.retry_long = retry_long;
2292                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2293                         rdev->wiphy.frag_threshold = frag_threshold;
2294                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2295                         rdev->wiphy.rts_threshold = rts_threshold;
2296                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2297                         rdev->wiphy.coverage_class = coverage_class;
2298
2299                 result = rdev_set_wiphy_params(rdev, changed);
2300                 if (result) {
2301                         rdev->wiphy.retry_short = old_retry_short;
2302                         rdev->wiphy.retry_long = old_retry_long;
2303                         rdev->wiphy.frag_threshold = old_frag_threshold;
2304                         rdev->wiphy.rts_threshold = old_rts_threshold;
2305                         rdev->wiphy.coverage_class = old_coverage_class;
2306                 }
2307         }
2308         return 0;
2309 }
2310
2311 static inline u64 wdev_id(struct wireless_dev *wdev)
2312 {
2313         return (u64)wdev->identifier |
2314                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2315 }
2316
2317 static int nl80211_send_chandef(struct sk_buff *msg,
2318                                 const struct cfg80211_chan_def *chandef)
2319 {
2320         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2321                 return -EINVAL;
2322
2323         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2324                         chandef->chan->center_freq))
2325                 return -ENOBUFS;
2326         switch (chandef->width) {
2327         case NL80211_CHAN_WIDTH_20_NOHT:
2328         case NL80211_CHAN_WIDTH_20:
2329         case NL80211_CHAN_WIDTH_40:
2330                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2331                                 cfg80211_get_chandef_type(chandef)))
2332                         return -ENOBUFS;
2333                 break;
2334         default:
2335                 break;
2336         }
2337         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2338                 return -ENOBUFS;
2339         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2340                 return -ENOBUFS;
2341         if (chandef->center_freq2 &&
2342             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2343                 return -ENOBUFS;
2344         return 0;
2345 }
2346
2347 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2348                               struct cfg80211_registered_device *rdev,
2349                               struct wireless_dev *wdev, bool removal)
2350 {
2351         struct net_device *dev = wdev->netdev;
2352         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2353         void *hdr;
2354
2355         if (removal)
2356                 cmd = NL80211_CMD_DEL_INTERFACE;
2357
2358         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2359         if (!hdr)
2360                 return -1;
2361
2362         if (dev &&
2363             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2364              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2365                 goto nla_put_failure;
2366
2367         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2368             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2369             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2370             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2371             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2372                         rdev->devlist_generation ^
2373                         (cfg80211_rdev_list_generation << 2)))
2374                 goto nla_put_failure;
2375
2376         if (rdev->ops->get_channel) {
2377                 int ret;
2378                 struct cfg80211_chan_def chandef;
2379
2380                 ret = rdev_get_channel(rdev, wdev, &chandef);
2381                 if (ret == 0) {
2382                         if (nl80211_send_chandef(msg, &chandef))
2383                                 goto nla_put_failure;
2384                 }
2385         }
2386
2387         if (wdev->ssid_len) {
2388                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2389                         goto nla_put_failure;
2390         }
2391
2392         return genlmsg_end(msg, hdr);
2393
2394  nla_put_failure:
2395         genlmsg_cancel(msg, hdr);
2396         return -EMSGSIZE;
2397 }
2398
2399 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2400 {
2401         int wp_idx = 0;
2402         int if_idx = 0;
2403         int wp_start = cb->args[0];
2404         int if_start = cb->args[1];
2405         struct cfg80211_registered_device *rdev;
2406         struct wireless_dev *wdev;
2407
2408         rtnl_lock();
2409         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2410                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2411                         continue;
2412                 if (wp_idx < wp_start) {
2413                         wp_idx++;
2414                         continue;
2415                 }
2416                 if_idx = 0;
2417
2418                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2419                         if (if_idx < if_start) {
2420                                 if_idx++;
2421                                 continue;
2422                         }
2423                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2424                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2425                                                rdev, wdev, false) < 0) {
2426                                 goto out;
2427                         }
2428                         if_idx++;
2429                 }
2430
2431                 wp_idx++;
2432         }
2433  out:
2434         rtnl_unlock();
2435
2436         cb->args[0] = wp_idx;
2437         cb->args[1] = if_idx;
2438
2439         return skb->len;
2440 }
2441
2442 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2443 {
2444         struct sk_buff *msg;
2445         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2446         struct wireless_dev *wdev = info->user_ptr[1];
2447
2448         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2449         if (!msg)
2450                 return -ENOMEM;
2451
2452         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2453                                rdev, wdev, false) < 0) {
2454                 nlmsg_free(msg);
2455                 return -ENOBUFS;
2456         }
2457
2458         return genlmsg_reply(msg, info);
2459 }
2460
2461 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2462         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2463         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2464         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2465         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2466         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2467         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2468 };
2469
2470 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2471 {
2472         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2473         int flag;
2474
2475         *mntrflags = 0;
2476
2477         if (!nla)
2478                 return -EINVAL;
2479
2480         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2481                              nla, mntr_flags_policy))
2482                 return -EINVAL;
2483
2484         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2485                 if (flags[flag])
2486                         *mntrflags |= (1<<flag);
2487
2488         return 0;
2489 }
2490
2491 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2492                                struct net_device *netdev, u8 use_4addr,
2493                                enum nl80211_iftype iftype)
2494 {
2495         if (!use_4addr) {
2496                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2497                         return -EBUSY;
2498                 return 0;
2499         }
2500
2501         switch (iftype) {
2502         case NL80211_IFTYPE_AP_VLAN:
2503                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2504                         return 0;
2505                 break;
2506         case NL80211_IFTYPE_STATION:
2507                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2508                         return 0;
2509                 break;
2510         default:
2511                 break;
2512         }
2513
2514         return -EOPNOTSUPP;
2515 }
2516
2517 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2518 {
2519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2520         struct vif_params params;
2521         int err;
2522         enum nl80211_iftype otype, ntype;
2523         struct net_device *dev = info->user_ptr[1];
2524         u32 _flags, *flags = NULL;
2525         bool change = false;
2526
2527         memset(&params, 0, sizeof(params));
2528
2529         otype = ntype = dev->ieee80211_ptr->iftype;
2530
2531         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2532                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2533                 if (otype != ntype)
2534                         change = true;
2535                 if (ntype > NL80211_IFTYPE_MAX)
2536                         return -EINVAL;
2537         }
2538
2539         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2540                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2541
2542                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2543                         return -EINVAL;
2544                 if (netif_running(dev))
2545                         return -EBUSY;
2546
2547                 wdev_lock(wdev);
2548                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2549                              IEEE80211_MAX_MESH_ID_LEN);
2550                 wdev->mesh_id_up_len =
2551                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2552                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2553                        wdev->mesh_id_up_len);
2554                 wdev_unlock(wdev);
2555         }
2556
2557         if (info->attrs[NL80211_ATTR_4ADDR]) {
2558                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2559                 change = true;
2560                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2561                 if (err)
2562                         return err;
2563         } else {
2564                 params.use_4addr = -1;
2565         }
2566
2567         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2568                 if (ntype != NL80211_IFTYPE_MONITOR)
2569                         return -EINVAL;
2570                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2571                                           &_flags);
2572                 if (err)
2573                         return err;
2574
2575                 flags = &_flags;
2576                 change = true;
2577         }
2578
2579         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2580             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2581                 return -EOPNOTSUPP;
2582
2583         if (change)
2584                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2585         else
2586                 err = 0;
2587
2588         if (!err && params.use_4addr != -1)
2589                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2590
2591         return err;
2592 }
2593
2594 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2595 {
2596         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2597         struct vif_params params;
2598         struct wireless_dev *wdev;
2599         struct sk_buff *msg, *event;
2600         int err;
2601         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2602         u32 flags;
2603
2604         /* to avoid failing a new interface creation due to pending removal */
2605         cfg80211_destroy_ifaces(rdev);
2606
2607         memset(&params, 0, sizeof(params));
2608
2609         if (!info->attrs[NL80211_ATTR_IFNAME])
2610                 return -EINVAL;
2611
2612         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2613                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2614                 if (type > NL80211_IFTYPE_MAX)
2615                         return -EINVAL;
2616         }
2617
2618         if (!rdev->ops->add_virtual_intf ||
2619             !(rdev->wiphy.interface_modes & (1 << type)))
2620                 return -EOPNOTSUPP;
2621
2622         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2623              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2624             info->attrs[NL80211_ATTR_MAC]) {
2625                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2626                            ETH_ALEN);
2627                 if (!is_valid_ether_addr(params.macaddr))
2628                         return -EADDRNOTAVAIL;
2629         }
2630
2631         if (info->attrs[NL80211_ATTR_4ADDR]) {
2632                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2633                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2634                 if (err)
2635                         return err;
2636         }
2637
2638         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2639         if (!msg)
2640                 return -ENOMEM;
2641
2642         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2643                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2644                                   &flags);
2645
2646         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2647             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2648                 return -EOPNOTSUPP;
2649
2650         wdev = rdev_add_virtual_intf(rdev,
2651                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2652                                 type, err ? NULL : &flags, &params);
2653         if (WARN_ON(!wdev)) {
2654                 nlmsg_free(msg);
2655                 return -EPROTO;
2656         } else if (IS_ERR(wdev)) {
2657                 nlmsg_free(msg);
2658                 return PTR_ERR(wdev);
2659         }
2660
2661         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2662                 wdev->owner_nlportid = info->snd_portid;
2663
2664         switch (type) {
2665         case NL80211_IFTYPE_MESH_POINT:
2666                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2667                         break;
2668                 wdev_lock(wdev);
2669                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2670                              IEEE80211_MAX_MESH_ID_LEN);
2671                 wdev->mesh_id_up_len =
2672                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2673                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2674                        wdev->mesh_id_up_len);
2675                 wdev_unlock(wdev);
2676                 break;
2677         case NL80211_IFTYPE_P2P_DEVICE:
2678                 /*
2679                  * P2P Device doesn't have a netdev, so doesn't go
2680                  * through the netdev notifier and must be added here
2681                  */
2682                 mutex_init(&wdev->mtx);
2683                 INIT_LIST_HEAD(&wdev->event_list);
2684                 spin_lock_init(&wdev->event_lock);
2685                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2686                 spin_lock_init(&wdev->mgmt_registrations_lock);
2687
2688                 wdev->identifier = ++rdev->wdev_id;
2689                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2690                 rdev->devlist_generation++;
2691                 break;
2692         default:
2693                 break;
2694         }
2695
2696         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2697                                rdev, wdev, false) < 0) {
2698                 nlmsg_free(msg);
2699                 return -ENOBUFS;
2700         }
2701
2702         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2703         if (event) {
2704                 if (nl80211_send_iface(event, 0, 0, 0,
2705                                        rdev, wdev, false) < 0) {
2706                         nlmsg_free(event);
2707                         goto out;
2708                 }
2709
2710                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2711                                         event, 0, NL80211_MCGRP_CONFIG,
2712                                         GFP_KERNEL);
2713         }
2714
2715 out:
2716         return genlmsg_reply(msg, info);
2717 }
2718
2719 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2720 {
2721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2722         struct wireless_dev *wdev = info->user_ptr[1];
2723         struct sk_buff *msg;
2724         int status;
2725
2726         if (!rdev->ops->del_virtual_intf)
2727                 return -EOPNOTSUPP;
2728
2729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2730         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2731                 nlmsg_free(msg);
2732                 msg = NULL;
2733         }
2734
2735         /*
2736          * If we remove a wireless device without a netdev then clear
2737          * user_ptr[1] so that nl80211_post_doit won't dereference it
2738          * to check if it needs to do dev_put(). Otherwise it crashes
2739          * since the wdev has been freed, unlike with a netdev where
2740          * we need the dev_put() for the netdev to really be freed.
2741          */
2742         if (!wdev->netdev)
2743                 info->user_ptr[1] = NULL;
2744
2745         status = rdev_del_virtual_intf(rdev, wdev);
2746         if (status >= 0 && msg)
2747                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2748                                         msg, 0, NL80211_MCGRP_CONFIG,
2749                                         GFP_KERNEL);
2750         else
2751                 nlmsg_free(msg);
2752
2753         return status;
2754 }
2755
2756 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2757 {
2758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2759         struct net_device *dev = info->user_ptr[1];
2760         u16 noack_map;
2761
2762         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2763                 return -EINVAL;
2764
2765         if (!rdev->ops->set_noack_map)
2766                 return -EOPNOTSUPP;
2767
2768         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2769
2770         return rdev_set_noack_map(rdev, dev, noack_map);
2771 }
2772
2773 struct get_key_cookie {
2774         struct sk_buff *msg;
2775         int error;
2776         int idx;
2777 };
2778
2779 static void get_key_callback(void *c, struct key_params *params)
2780 {
2781         struct nlattr *key;
2782         struct get_key_cookie *cookie = c;
2783
2784         if ((params->key &&
2785              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2786                      params->key_len, params->key)) ||
2787             (params->seq &&
2788              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2789                      params->seq_len, params->seq)) ||
2790             (params->cipher &&
2791              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2792                          params->cipher)))
2793                 goto nla_put_failure;
2794
2795         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2796         if (!key)
2797                 goto nla_put_failure;
2798
2799         if ((params->key &&
2800              nla_put(cookie->msg, NL80211_KEY_DATA,
2801                      params->key_len, params->key)) ||
2802             (params->seq &&
2803              nla_put(cookie->msg, NL80211_KEY_SEQ,
2804                      params->seq_len, params->seq)) ||
2805             (params->cipher &&
2806              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2807                          params->cipher)))
2808                 goto nla_put_failure;
2809
2810         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2811                 goto nla_put_failure;
2812
2813         nla_nest_end(cookie->msg, key);
2814
2815         return;
2816  nla_put_failure:
2817         cookie->error = 1;
2818 }
2819
2820 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2821 {
2822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2823         int err;
2824         struct net_device *dev = info->user_ptr[1];
2825         u8 key_idx = 0;
2826         const u8 *mac_addr = NULL;
2827         bool pairwise;
2828         struct get_key_cookie cookie = {
2829                 .error = 0,
2830         };
2831         void *hdr;
2832         struct sk_buff *msg;
2833
2834         if (info->attrs[NL80211_ATTR_KEY_IDX])
2835                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2836
2837         if (key_idx > 5)
2838                 return -EINVAL;
2839
2840         if (info->attrs[NL80211_ATTR_MAC])
2841                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2842
2843         pairwise = !!mac_addr;
2844         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2845                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2846                 if (kt >= NUM_NL80211_KEYTYPES)
2847                         return -EINVAL;
2848                 if (kt != NL80211_KEYTYPE_GROUP &&
2849                     kt != NL80211_KEYTYPE_PAIRWISE)
2850                         return -EINVAL;
2851                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2852         }
2853
2854         if (!rdev->ops->get_key)
2855                 return -EOPNOTSUPP;
2856
2857         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2858                 return -ENOENT;
2859
2860         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2861         if (!msg)
2862                 return -ENOMEM;
2863
2864         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2865                              NL80211_CMD_NEW_KEY);
2866         if (!hdr)
2867                 goto nla_put_failure;
2868
2869         cookie.msg = msg;
2870         cookie.idx = key_idx;
2871
2872         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2873             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2874                 goto nla_put_failure;
2875         if (mac_addr &&
2876             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2877                 goto nla_put_failure;
2878
2879         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2880                            get_key_callback);
2881
2882         if (err)
2883                 goto free_msg;
2884
2885         if (cookie.error)
2886                 goto nla_put_failure;
2887
2888         genlmsg_end(msg, hdr);
2889         return genlmsg_reply(msg, info);
2890
2891  nla_put_failure:
2892         err = -ENOBUFS;
2893  free_msg:
2894         nlmsg_free(msg);
2895         return err;
2896 }
2897
2898 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2899 {
2900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2901         struct key_parse key;
2902         int err;
2903         struct net_device *dev = info->user_ptr[1];
2904
2905         err = nl80211_parse_key(info, &key);
2906         if (err)
2907                 return err;
2908
2909         if (key.idx < 0)
2910                 return -EINVAL;
2911
2912         /* only support setting default key */
2913         if (!key.def && !key.defmgmt)
2914                 return -EINVAL;
2915
2916         wdev_lock(dev->ieee80211_ptr);
2917
2918         if (key.def) {
2919                 if (!rdev->ops->set_default_key) {
2920                         err = -EOPNOTSUPP;
2921                         goto out;
2922                 }
2923
2924                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2925                 if (err)
2926                         goto out;
2927
2928                 err = rdev_set_default_key(rdev, dev, key.idx,
2929                                                  key.def_uni, key.def_multi);
2930
2931                 if (err)
2932                         goto out;
2933
2934 #ifdef CONFIG_CFG80211_WEXT
2935                 dev->ieee80211_ptr->wext.default_key = key.idx;
2936 #endif
2937         } else {
2938                 if (key.def_uni || !key.def_multi) {
2939                         err = -EINVAL;
2940                         goto out;
2941                 }
2942
2943                 if (!rdev->ops->set_default_mgmt_key) {
2944                         err = -EOPNOTSUPP;
2945                         goto out;
2946                 }
2947
2948                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2949                 if (err)
2950                         goto out;
2951
2952                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2953                 if (err)
2954                         goto out;
2955
2956 #ifdef CONFIG_CFG80211_WEXT
2957                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2958 #endif
2959         }
2960
2961  out:
2962         wdev_unlock(dev->ieee80211_ptr);
2963
2964         return err;
2965 }
2966
2967 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2968 {
2969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2970         int err;
2971         struct net_device *dev = info->user_ptr[1];
2972         struct key_parse key;
2973         const u8 *mac_addr = NULL;
2974
2975         err = nl80211_parse_key(info, &key);
2976         if (err)
2977                 return err;
2978
2979         if (!key.p.key)
2980                 return -EINVAL;
2981
2982         if (info->attrs[NL80211_ATTR_MAC])
2983                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2984
2985         if (key.type == -1) {
2986                 if (mac_addr)
2987                         key.type = NL80211_KEYTYPE_PAIRWISE;
2988                 else
2989                         key.type = NL80211_KEYTYPE_GROUP;
2990         }
2991
2992         /* for now */
2993         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2994             key.type != NL80211_KEYTYPE_GROUP)
2995                 return -EINVAL;
2996
2997         if (!rdev->ops->add_key)
2998                 return -EOPNOTSUPP;
2999
3000         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3001                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3002                                            mac_addr))
3003                 return -EINVAL;
3004
3005         wdev_lock(dev->ieee80211_ptr);
3006         err = nl80211_key_allowed(dev->ieee80211_ptr);
3007         if (!err)
3008                 err = rdev_add_key(rdev, dev, key.idx,
3009                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3010                                     mac_addr, &key.p);
3011         wdev_unlock(dev->ieee80211_ptr);
3012