nl80211: fix per-station group key get/del and memory leak
[pandora-kernel.git] / net / wireless / nl80211.c
1 /*
2  * This is the new netlink-based wireless configuration interface.
3  *
4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
5  * Copyright 2013-2014  Intel Mobile Communications GmbH
6  */
7
8 #include <linux/if.h>
9 #include <linux/module.h>
10 #include <linux/err.h>
11 #include <linux/slab.h>
12 #include <linux/list.h>
13 #include <linux/if_ether.h>
14 #include <linux/ieee80211.h>
15 #include <linux/nl80211.h>
16 #include <linux/rtnetlink.h>
17 #include <linux/netlink.h>
18 #include <linux/etherdevice.h>
19 #include <net/net_namespace.h>
20 #include <net/genetlink.h>
21 #include <net/cfg80211.h>
22 #include <net/sock.h>
23 #include <net/inet_connection_sock.h>
24 #include "core.h"
25 #include "nl80211.h"
26 #include "reg.h"
27 #include "rdev-ops.h"
28
29 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
30                                    struct genl_info *info,
31                                    struct cfg80211_crypto_settings *settings,
32                                    int cipher_limit);
33
34 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
35                             struct genl_info *info);
36 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
37                               struct genl_info *info);
38
39 /* the netlink family */
40 static struct genl_family nl80211_fam = {
41         .id = GENL_ID_GENERATE,         /* don't bother with a hardcoded ID */
42         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
43         .hdrsize = 0,                   /* no private header */
44         .version = 1,                   /* no particular meaning now */
45         .maxattr = NL80211_ATTR_MAX,
46         .netnsok = true,
47         .pre_doit = nl80211_pre_doit,
48         .post_doit = nl80211_post_doit,
49 };
50
51 /* multicast groups */
52 enum nl80211_multicast_groups {
53         NL80211_MCGRP_CONFIG,
54         NL80211_MCGRP_SCAN,
55         NL80211_MCGRP_REGULATORY,
56         NL80211_MCGRP_MLME,
57         NL80211_MCGRP_VENDOR,
58         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
59 };
60
61 static const struct genl_multicast_group nl80211_mcgrps[] = {
62         [NL80211_MCGRP_CONFIG] = { .name = "config", },
63         [NL80211_MCGRP_SCAN] = { .name = "scan", },
64         [NL80211_MCGRP_REGULATORY] = { .name = "regulatory", },
65         [NL80211_MCGRP_MLME] = { .name = "mlme", },
66         [NL80211_MCGRP_VENDOR] = { .name = "vendor", },
67 #ifdef CONFIG_NL80211_TESTMODE
68         [NL80211_MCGRP_TESTMODE] = { .name = "testmode", }
69 #endif
70 };
71
72 /* returns ERR_PTR values */
73 static struct wireless_dev *
74 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
75 {
76         struct cfg80211_registered_device *rdev;
77         struct wireless_dev *result = NULL;
78         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
79         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
80         u64 wdev_id;
81         int wiphy_idx = -1;
82         int ifidx = -1;
83
84         ASSERT_RTNL();
85
86         if (!have_ifidx && !have_wdev_id)
87                 return ERR_PTR(-EINVAL);
88
89         if (have_ifidx)
90                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
91         if (have_wdev_id) {
92                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
93                 wiphy_idx = wdev_id >> 32;
94         }
95
96         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
97                 struct wireless_dev *wdev;
98
99                 if (wiphy_net(&rdev->wiphy) != netns)
100                         continue;
101
102                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
103                         continue;
104
105                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
106                         if (have_ifidx && wdev->netdev &&
107                             wdev->netdev->ifindex == ifidx) {
108                                 result = wdev;
109                                 break;
110                         }
111                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
112                                 result = wdev;
113                                 break;
114                         }
115                 }
116
117                 if (result)
118                         break;
119         }
120
121         if (result)
122                 return result;
123         return ERR_PTR(-ENODEV);
124 }
125
126 static struct cfg80211_registered_device *
127 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
128 {
129         struct cfg80211_registered_device *rdev = NULL, *tmp;
130         struct net_device *netdev;
131
132         ASSERT_RTNL();
133
134         if (!attrs[NL80211_ATTR_WIPHY] &&
135             !attrs[NL80211_ATTR_IFINDEX] &&
136             !attrs[NL80211_ATTR_WDEV])
137                 return ERR_PTR(-EINVAL);
138
139         if (attrs[NL80211_ATTR_WIPHY])
140                 rdev = cfg80211_rdev_by_wiphy_idx(
141                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
142
143         if (attrs[NL80211_ATTR_WDEV]) {
144                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
145                 struct wireless_dev *wdev;
146                 bool found = false;
147
148                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
149                 if (tmp) {
150                         /* make sure wdev exists */
151                         list_for_each_entry(wdev, &tmp->wdev_list, list) {
152                                 if (wdev->identifier != (u32)wdev_id)
153                                         continue;
154                                 found = true;
155                                 break;
156                         }
157
158                         if (!found)
159                                 tmp = NULL;
160
161                         if (rdev && tmp != rdev)
162                                 return ERR_PTR(-EINVAL);
163                         rdev = tmp;
164                 }
165         }
166
167         if (attrs[NL80211_ATTR_IFINDEX]) {
168                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
169                 netdev = __dev_get_by_index(netns, ifindex);
170                 if (netdev) {
171                         if (netdev->ieee80211_ptr)
172                                 tmp = wiphy_to_rdev(
173                                         netdev->ieee80211_ptr->wiphy);
174                         else
175                                 tmp = NULL;
176
177                         /* not wireless device -- return error */
178                         if (!tmp)
179                                 return ERR_PTR(-EINVAL);
180
181                         /* mismatch -- return error */
182                         if (rdev && tmp != rdev)
183                                 return ERR_PTR(-EINVAL);
184
185                         rdev = tmp;
186                 }
187         }
188
189         if (!rdev)
190                 return ERR_PTR(-ENODEV);
191
192         if (netns != wiphy_net(&rdev->wiphy))
193                 return ERR_PTR(-ENODEV);
194
195         return rdev;
196 }
197
198 /*
199  * This function returns a pointer to the driver
200  * that the genl_info item that is passed refers to.
201  *
202  * The result of this can be a PTR_ERR and hence must
203  * be checked with IS_ERR() for errors.
204  */
205 static struct cfg80211_registered_device *
206 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
207 {
208         return __cfg80211_rdev_from_attrs(netns, info->attrs);
209 }
210
211 /* policy for the attributes */
212 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
213         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
214         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
215                                       .len = 20-1 },
216         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
217
218         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
219         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
220         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
221         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
222         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
223
224         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
225         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
226         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
227         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
228         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
229         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
230
231         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
232         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
233         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
234
235         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
236         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
237
238         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
239         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
240                                     .len = WLAN_MAX_KEY_LEN },
241         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
242         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
243         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
244         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
245         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
246
247         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
248         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
249         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
250                                        .len = IEEE80211_MAX_DATA_LEN },
251         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
252                                        .len = IEEE80211_MAX_DATA_LEN },
253         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
254         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
255         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
256         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
257                                                .len = NL80211_MAX_SUPP_RATES },
258         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
259         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
260         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
261         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
262                                    .len = IEEE80211_MAX_MESH_ID_LEN },
263         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
264
265         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
266         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
267
268         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
269         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
270         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
271         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
272                                            .len = NL80211_MAX_SUPP_RATES },
273         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
274
275         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
276         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
277
278         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
279
280         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
281         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
282                               .len = IEEE80211_MAX_DATA_LEN },
283         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
284         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
285
286         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
287                                 .len = IEEE80211_MAX_SSID_LEN },
288         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
289         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
290         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
291         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
292         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
293         [NL80211_ATTR_STA_FLAGS2] = {
294                 .len = sizeof(struct nl80211_sta_flag_update),
295         },
296         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
297         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
298         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
299         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
300         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
301         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
302         [NL80211_ATTR_PID] = { .type = NLA_U32 },
303         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
304         [NL80211_ATTR_PMKID] = { .type = NLA_BINARY,
305                                  .len = WLAN_PMKID_LEN },
306         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
307         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
308         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
309         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
310                                  .len = IEEE80211_MAX_DATA_LEN },
311         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
312         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
313         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
314         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
315         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
316         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
317         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
318         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
319         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
320         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
321         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
322         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
323         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
324         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
325         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
326         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
327         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
328         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
329         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
330         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
331                                          .len = IEEE80211_MAX_DATA_LEN },
332         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
333                                          .len = IEEE80211_MAX_DATA_LEN },
334         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
335         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
336         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
337         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
338         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
339         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
340         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
341         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
342         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
343         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
344         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
345                                       .len = IEEE80211_MAX_DATA_LEN },
346         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
347         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
348         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
349                 .len = NL80211_HT_CAPABILITY_LEN
350         },
351         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
352         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
353         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
354         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
355         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
356         [NL80211_ATTR_SAE_DATA] = { .type = NLA_BINARY, },
357         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
358         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
359         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
360         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
361         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
362         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
363         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
364         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
365         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
366         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
367         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
368                 .len = NL80211_VHT_CAPABILITY_LEN,
369         },
370         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
371         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
372                                   .len = IEEE80211_MAX_DATA_LEN },
373         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
374         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
375         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
376         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
377         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
378         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
379         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
380         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
381         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
382         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
383         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
384         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
385         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
386         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
387                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
388         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
389         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
390         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
391         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
392         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
393         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
394         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
395         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
396         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
397         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
398         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
399 };
400
401 /* policy for the key attributes */
402 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
403         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
404         [NL80211_KEY_IDX] = { .type = NLA_U8 },
405         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
406         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
407         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
408         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
409         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
410         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
411 };
412
413 /* policy for the key default flags */
414 static const struct nla_policy
415 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
416         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
417         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
418 };
419
420 /* policy for WoWLAN attributes */
421 static const struct nla_policy
422 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
423         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
424         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
425         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
426         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
427         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
428         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
429         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
430         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
431         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
432         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
433 };
434
435 static const struct nla_policy
436 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
437         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
438         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
439         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
440         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
441         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
442         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
443         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
444                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
445         },
446         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
447                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
448         },
449         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
450         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
451         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
452 };
453
454 /* policy for coalesce rule attributes */
455 static const struct nla_policy
456 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
457         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
458         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
459         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
460 };
461
462 /* policy for GTK rekey offload attributes */
463 static const struct nla_policy
464 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
465         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
466         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
467         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
468 };
469
470 static const struct nla_policy
471 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
472         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
473                                                  .len = IEEE80211_MAX_SSID_LEN },
474         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
475 };
476
477 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
478                                      struct netlink_callback *cb,
479                                      struct cfg80211_registered_device **rdev,
480                                      struct wireless_dev **wdev)
481 {
482         int err;
483
484         rtnl_lock();
485
486         if (!cb->args[0]) {
487                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
488                                   nl80211_fam.attrbuf, nl80211_fam.maxattr,
489                                   nl80211_policy);
490                 if (err)
491                         goto out_unlock;
492
493                 *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk),
494                                                    nl80211_fam.attrbuf);
495                 if (IS_ERR(*wdev)) {
496                         err = PTR_ERR(*wdev);
497                         goto out_unlock;
498                 }
499                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
500                 /* 0 is the first index - add 1 to parse only once */
501                 cb->args[0] = (*rdev)->wiphy_idx + 1;
502                 cb->args[1] = (*wdev)->identifier;
503         } else {
504                 /* subtract the 1 again here */
505                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
506                 struct wireless_dev *tmp;
507
508                 if (!wiphy) {
509                         err = -ENODEV;
510                         goto out_unlock;
511                 }
512                 *rdev = wiphy_to_rdev(wiphy);
513                 *wdev = NULL;
514
515                 list_for_each_entry(tmp, &(*rdev)->wdev_list, list) {
516                         if (tmp->identifier == cb->args[1]) {
517                                 *wdev = tmp;
518                                 break;
519                         }
520                 }
521
522                 if (!*wdev) {
523                         err = -ENODEV;
524                         goto out_unlock;
525                 }
526         }
527
528         return 0;
529  out_unlock:
530         rtnl_unlock();
531         return err;
532 }
533
534 static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev)
535 {
536         rtnl_unlock();
537 }
538
539 /* IE validation */
540 static bool is_valid_ie_attr(const struct nlattr *attr)
541 {
542         const u8 *pos;
543         int len;
544
545         if (!attr)
546                 return true;
547
548         pos = nla_data(attr);
549         len = nla_len(attr);
550
551         while (len) {
552                 u8 elemlen;
553
554                 if (len < 2)
555                         return false;
556                 len -= 2;
557
558                 elemlen = pos[1];
559                 if (elemlen > len)
560                         return false;
561
562                 len -= elemlen;
563                 pos += 2 + elemlen;
564         }
565
566         return true;
567 }
568
569 /* message building helper */
570 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
571                                    int flags, u8 cmd)
572 {
573         /* since there is no private header just add the generic one */
574         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
575 }
576
577 static int nl80211_msg_put_channel(struct sk_buff *msg,
578                                    struct ieee80211_channel *chan,
579                                    bool large)
580 {
581         /* Some channels must be completely excluded from the
582          * list to protect old user-space tools from breaking
583          */
584         if (!large && chan->flags &
585             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
586                 return 0;
587
588         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
589                         chan->center_freq))
590                 goto nla_put_failure;
591
592         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
593             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
594                 goto nla_put_failure;
595         if (chan->flags & IEEE80211_CHAN_NO_IR) {
596                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
597                         goto nla_put_failure;
598                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
599                         goto nla_put_failure;
600         }
601         if (chan->flags & IEEE80211_CHAN_RADAR) {
602                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
603                         goto nla_put_failure;
604                 if (large) {
605                         u32 time;
606
607                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
608
609                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
610                                         chan->dfs_state))
611                                 goto nla_put_failure;
612                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
613                                         time))
614                                 goto nla_put_failure;
615                         if (nla_put_u32(msg,
616                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
617                                         chan->dfs_cac_ms))
618                                 goto nla_put_failure;
619                 }
620         }
621
622         if (large) {
623                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
624                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
625                         goto nla_put_failure;
626                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
627                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
628                         goto nla_put_failure;
629                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
630                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
631                         goto nla_put_failure;
632                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
633                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
634                         goto nla_put_failure;
635                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
636                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
637                         goto nla_put_failure;
638                 if ((chan->flags & IEEE80211_CHAN_GO_CONCURRENT) &&
639                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_GO_CONCURRENT))
640                         goto nla_put_failure;
641                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
642                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
643                         goto nla_put_failure;
644                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
645                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
646                         goto nla_put_failure;
647         }
648
649         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
650                         DBM_TO_MBM(chan->max_power)))
651                 goto nla_put_failure;
652
653         return 0;
654
655  nla_put_failure:
656         return -ENOBUFS;
657 }
658
659 /* netlink command implementations */
660
661 struct key_parse {
662         struct key_params p;
663         int idx;
664         int type;
665         bool def, defmgmt;
666         bool def_uni, def_multi;
667 };
668
669 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
670 {
671         struct nlattr *tb[NL80211_KEY_MAX + 1];
672         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
673                                    nl80211_key_policy);
674         if (err)
675                 return err;
676
677         k->def = !!tb[NL80211_KEY_DEFAULT];
678         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
679
680         if (k->def) {
681                 k->def_uni = true;
682                 k->def_multi = true;
683         }
684         if (k->defmgmt)
685                 k->def_multi = true;
686
687         if (tb[NL80211_KEY_IDX])
688                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
689
690         if (tb[NL80211_KEY_DATA]) {
691                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
692                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
693         }
694
695         if (tb[NL80211_KEY_SEQ]) {
696                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
697                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
698         }
699
700         if (tb[NL80211_KEY_CIPHER])
701                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
702
703         if (tb[NL80211_KEY_TYPE]) {
704                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
705                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
706                         return -EINVAL;
707         }
708
709         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
710                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
711                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
712                                        tb[NL80211_KEY_DEFAULT_TYPES],
713                                        nl80211_key_default_policy);
714                 if (err)
715                         return err;
716
717                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
718                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
719         }
720
721         return 0;
722 }
723
724 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
725 {
726         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
727                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
728                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
729         }
730
731         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
732                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
733                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
734         }
735
736         if (info->attrs[NL80211_ATTR_KEY_IDX])
737                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
738
739         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
740                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
741
742         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
743         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
744
745         if (k->def) {
746                 k->def_uni = true;
747                 k->def_multi = true;
748         }
749         if (k->defmgmt)
750                 k->def_multi = true;
751
752         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
753                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
754                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
755                         return -EINVAL;
756         }
757
758         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
759                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
760                 int err = nla_parse_nested(
761                                 kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
762                                 info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
763                                 nl80211_key_default_policy);
764                 if (err)
765                         return err;
766
767                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
768                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
769         }
770
771         return 0;
772 }
773
774 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
775 {
776         int err;
777
778         memset(k, 0, sizeof(*k));
779         k->idx = -1;
780         k->type = -1;
781
782         if (info->attrs[NL80211_ATTR_KEY])
783                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
784         else
785                 err = nl80211_parse_key_old(info, k);
786
787         if (err)
788                 return err;
789
790         if (k->def && k->defmgmt)
791                 return -EINVAL;
792
793         if (k->defmgmt) {
794                 if (k->def_uni || !k->def_multi)
795                         return -EINVAL;
796         }
797
798         if (k->idx != -1) {
799                 if (k->defmgmt) {
800                         if (k->idx < 4 || k->idx > 5)
801                                 return -EINVAL;
802                 } else if (k->def) {
803                         if (k->idx < 0 || k->idx > 3)
804                                 return -EINVAL;
805                 } else {
806                         if (k->idx < 0 || k->idx > 5)
807                                 return -EINVAL;
808                 }
809         }
810
811         return 0;
812 }
813
814 static struct cfg80211_cached_keys *
815 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
816                        struct nlattr *keys, bool *no_ht)
817 {
818         struct key_parse parse;
819         struct nlattr *key;
820         struct cfg80211_cached_keys *result;
821         int rem, err, def = 0;
822
823         result = kzalloc(sizeof(*result), GFP_KERNEL);
824         if (!result)
825                 return ERR_PTR(-ENOMEM);
826
827         result->def = -1;
828         result->defmgmt = -1;
829
830         nla_for_each_nested(key, keys, rem) {
831                 memset(&parse, 0, sizeof(parse));
832                 parse.idx = -1;
833
834                 err = nl80211_parse_key_new(key, &parse);
835                 if (err)
836                         goto error;
837                 err = -EINVAL;
838                 if (!parse.p.key)
839                         goto error;
840                 if (parse.idx < 0 || parse.idx > 4)
841                         goto error;
842                 if (parse.def) {
843                         if (def)
844                                 goto error;
845                         def = 1;
846                         result->def = parse.idx;
847                         if (!parse.def_uni || !parse.def_multi)
848                                 goto error;
849                 } else if (parse.defmgmt)
850                         goto error;
851                 err = cfg80211_validate_key_settings(rdev, &parse.p,
852                                                      parse.idx, false, NULL);
853                 if (err)
854                         goto error;
855                 result->params[parse.idx].cipher = parse.p.cipher;
856                 result->params[parse.idx].key_len = parse.p.key_len;
857                 result->params[parse.idx].key = result->data[parse.idx];
858                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
859
860                 if (parse.p.cipher == WLAN_CIPHER_SUITE_WEP40 ||
861                     parse.p.cipher == WLAN_CIPHER_SUITE_WEP104) {
862                         if (no_ht)
863                                 *no_ht = true;
864                 }
865         }
866
867         return result;
868  error:
869         kfree(result);
870         return ERR_PTR(err);
871 }
872
873 static int nl80211_key_allowed(struct wireless_dev *wdev)
874 {
875         ASSERT_WDEV_LOCK(wdev);
876
877         switch (wdev->iftype) {
878         case NL80211_IFTYPE_AP:
879         case NL80211_IFTYPE_AP_VLAN:
880         case NL80211_IFTYPE_P2P_GO:
881         case NL80211_IFTYPE_MESH_POINT:
882                 break;
883         case NL80211_IFTYPE_ADHOC:
884         case NL80211_IFTYPE_STATION:
885         case NL80211_IFTYPE_P2P_CLIENT:
886                 if (!wdev->current_bss)
887                         return -ENOLINK;
888                 break;
889         case NL80211_IFTYPE_UNSPECIFIED:
890         case NL80211_IFTYPE_OCB:
891         case NL80211_IFTYPE_MONITOR:
892         case NL80211_IFTYPE_P2P_DEVICE:
893         case NL80211_IFTYPE_WDS:
894         case NUM_NL80211_IFTYPES:
895                 return -EINVAL;
896         }
897
898         return 0;
899 }
900
901 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
902                                                         struct nlattr *tb)
903 {
904         struct ieee80211_channel *chan;
905
906         if (tb == NULL)
907                 return NULL;
908         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
909         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
910                 return NULL;
911         return chan;
912 }
913
914 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
915 {
916         struct nlattr *nl_modes = nla_nest_start(msg, attr);
917         int i;
918
919         if (!nl_modes)
920                 goto nla_put_failure;
921
922         i = 0;
923         while (ifmodes) {
924                 if ((ifmodes & 1) && nla_put_flag(msg, i))
925                         goto nla_put_failure;
926                 ifmodes >>= 1;
927                 i++;
928         }
929
930         nla_nest_end(msg, nl_modes);
931         return 0;
932
933 nla_put_failure:
934         return -ENOBUFS;
935 }
936
937 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
938                                           struct sk_buff *msg,
939                                           bool large)
940 {
941         struct nlattr *nl_combis;
942         int i, j;
943
944         nl_combis = nla_nest_start(msg,
945                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
946         if (!nl_combis)
947                 goto nla_put_failure;
948
949         for (i = 0; i < wiphy->n_iface_combinations; i++) {
950                 const struct ieee80211_iface_combination *c;
951                 struct nlattr *nl_combi, *nl_limits;
952
953                 c = &wiphy->iface_combinations[i];
954
955                 nl_combi = nla_nest_start(msg, i + 1);
956                 if (!nl_combi)
957                         goto nla_put_failure;
958
959                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
960                 if (!nl_limits)
961                         goto nla_put_failure;
962
963                 for (j = 0; j < c->n_limits; j++) {
964                         struct nlattr *nl_limit;
965
966                         nl_limit = nla_nest_start(msg, j + 1);
967                         if (!nl_limit)
968                                 goto nla_put_failure;
969                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
970                                         c->limits[j].max))
971                                 goto nla_put_failure;
972                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
973                                                 c->limits[j].types))
974                                 goto nla_put_failure;
975                         nla_nest_end(msg, nl_limit);
976                 }
977
978                 nla_nest_end(msg, nl_limits);
979
980                 if (c->beacon_int_infra_match &&
981                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
982                         goto nla_put_failure;
983                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
984                                 c->num_different_channels) ||
985                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
986                                 c->max_interfaces))
987                         goto nla_put_failure;
988                 if (large &&
989                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
990                                 c->radar_detect_widths) ||
991                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
992                                 c->radar_detect_regions)))
993                         goto nla_put_failure;
994
995                 nla_nest_end(msg, nl_combi);
996         }
997
998         nla_nest_end(msg, nl_combis);
999
1000         return 0;
1001 nla_put_failure:
1002         return -ENOBUFS;
1003 }
1004
1005 #ifdef CONFIG_PM
1006 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1007                                         struct sk_buff *msg)
1008 {
1009         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1010         struct nlattr *nl_tcp;
1011
1012         if (!tcp)
1013                 return 0;
1014
1015         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1016         if (!nl_tcp)
1017                 return -ENOBUFS;
1018
1019         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1020                         tcp->data_payload_max))
1021                 return -ENOBUFS;
1022
1023         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1024                         tcp->data_payload_max))
1025                 return -ENOBUFS;
1026
1027         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1028                 return -ENOBUFS;
1029
1030         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1031                                 sizeof(*tcp->tok), tcp->tok))
1032                 return -ENOBUFS;
1033
1034         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1035                         tcp->data_interval_max))
1036                 return -ENOBUFS;
1037
1038         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1039                         tcp->wake_payload_max))
1040                 return -ENOBUFS;
1041
1042         nla_nest_end(msg, nl_tcp);
1043         return 0;
1044 }
1045
1046 static int nl80211_send_wowlan(struct sk_buff *msg,
1047                                struct cfg80211_registered_device *rdev,
1048                                bool large)
1049 {
1050         struct nlattr *nl_wowlan;
1051
1052         if (!rdev->wiphy.wowlan)
1053                 return 0;
1054
1055         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1056         if (!nl_wowlan)
1057                 return -ENOBUFS;
1058
1059         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1060              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1061             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1062              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1063             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1064              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1065             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1066              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1067             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1068              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1069             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1070              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1071             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1072              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1073             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1074              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1075                 return -ENOBUFS;
1076
1077         if (rdev->wiphy.wowlan->n_patterns) {
1078                 struct nl80211_pattern_support pat = {
1079                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1080                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1081                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1082                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1083                 };
1084
1085                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1086                             sizeof(pat), &pat))
1087                         return -ENOBUFS;
1088         }
1089
1090         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1091                 return -ENOBUFS;
1092
1093         /* TODO: send wowlan net detect */
1094
1095         nla_nest_end(msg, nl_wowlan);
1096
1097         return 0;
1098 }
1099 #endif
1100
1101 static int nl80211_send_coalesce(struct sk_buff *msg,
1102                                  struct cfg80211_registered_device *rdev)
1103 {
1104         struct nl80211_coalesce_rule_support rule;
1105
1106         if (!rdev->wiphy.coalesce)
1107                 return 0;
1108
1109         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1110         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1111         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1112         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1113         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1114         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1115
1116         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1117                 return -ENOBUFS;
1118
1119         return 0;
1120 }
1121
1122 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1123                                       struct ieee80211_supported_band *sband)
1124 {
1125         struct nlattr *nl_rates, *nl_rate;
1126         struct ieee80211_rate *rate;
1127         int i;
1128
1129         /* add HT info */
1130         if (sband->ht_cap.ht_supported &&
1131             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1132                      sizeof(sband->ht_cap.mcs),
1133                      &sband->ht_cap.mcs) ||
1134              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1135                          sband->ht_cap.cap) ||
1136              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1137                         sband->ht_cap.ampdu_factor) ||
1138              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1139                         sband->ht_cap.ampdu_density)))
1140                 return -ENOBUFS;
1141
1142         /* add VHT info */
1143         if (sband->vht_cap.vht_supported &&
1144             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1145                      sizeof(sband->vht_cap.vht_mcs),
1146                      &sband->vht_cap.vht_mcs) ||
1147              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1148                          sband->vht_cap.cap)))
1149                 return -ENOBUFS;
1150
1151         /* add bitrates */
1152         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1153         if (!nl_rates)
1154                 return -ENOBUFS;
1155
1156         for (i = 0; i < sband->n_bitrates; i++) {
1157                 nl_rate = nla_nest_start(msg, i);
1158                 if (!nl_rate)
1159                         return -ENOBUFS;
1160
1161                 rate = &sband->bitrates[i];
1162                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1163                                 rate->bitrate))
1164                         return -ENOBUFS;
1165                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1166                     nla_put_flag(msg,
1167                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1168                         return -ENOBUFS;
1169
1170                 nla_nest_end(msg, nl_rate);
1171         }
1172
1173         nla_nest_end(msg, nl_rates);
1174
1175         return 0;
1176 }
1177
1178 static int
1179 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1180                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1181 {
1182         u16 stypes;
1183         struct nlattr *nl_ftypes, *nl_ifs;
1184         enum nl80211_iftype ift;
1185         int i;
1186
1187         if (!mgmt_stypes)
1188                 return 0;
1189
1190         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1191         if (!nl_ifs)
1192                 return -ENOBUFS;
1193
1194         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1195                 nl_ftypes = nla_nest_start(msg, ift);
1196                 if (!nl_ftypes)
1197                         return -ENOBUFS;
1198                 i = 0;
1199                 stypes = mgmt_stypes[ift].tx;
1200                 while (stypes) {
1201                         if ((stypes & 1) &&
1202                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1203                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1204                                 return -ENOBUFS;
1205                         stypes >>= 1;
1206                         i++;
1207                 }
1208                 nla_nest_end(msg, nl_ftypes);
1209         }
1210
1211         nla_nest_end(msg, nl_ifs);
1212
1213         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1214         if (!nl_ifs)
1215                 return -ENOBUFS;
1216
1217         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1218                 nl_ftypes = nla_nest_start(msg, ift);
1219                 if (!nl_ftypes)
1220                         return -ENOBUFS;
1221                 i = 0;
1222                 stypes = mgmt_stypes[ift].rx;
1223                 while (stypes) {
1224                         if ((stypes & 1) &&
1225                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1226                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1227                                 return -ENOBUFS;
1228                         stypes >>= 1;
1229                         i++;
1230                 }
1231                 nla_nest_end(msg, nl_ftypes);
1232         }
1233         nla_nest_end(msg, nl_ifs);
1234
1235         return 0;
1236 }
1237
1238 struct nl80211_dump_wiphy_state {
1239         s64 filter_wiphy;
1240         long start;
1241         long split_start, band_start, chan_start;
1242         bool split;
1243 };
1244
1245 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1246                               enum nl80211_commands cmd,
1247                               struct sk_buff *msg, u32 portid, u32 seq,
1248                               int flags, struct nl80211_dump_wiphy_state *state)
1249 {
1250         void *hdr;
1251         struct nlattr *nl_bands, *nl_band;
1252         struct nlattr *nl_freqs, *nl_freq;
1253         struct nlattr *nl_cmds;
1254         enum ieee80211_band band;
1255         struct ieee80211_channel *chan;
1256         int i;
1257         const struct ieee80211_txrx_stypes *mgmt_stypes =
1258                                 rdev->wiphy.mgmt_stypes;
1259         u32 features;
1260
1261         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1262         if (!hdr)
1263                 return -ENOBUFS;
1264
1265         if (WARN_ON(!state))
1266                 return -EINVAL;
1267
1268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1269             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1270                            wiphy_name(&rdev->wiphy)) ||
1271             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1272                         cfg80211_rdev_list_generation))
1273                 goto nla_put_failure;
1274
1275         if (cmd != NL80211_CMD_NEW_WIPHY)
1276                 goto finish;
1277
1278         switch (state->split_start) {
1279         case 0:
1280                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1281                                rdev->wiphy.retry_short) ||
1282                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1283                                rdev->wiphy.retry_long) ||
1284                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1285                                 rdev->wiphy.frag_threshold) ||
1286                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1287                                 rdev->wiphy.rts_threshold) ||
1288                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1289                                rdev->wiphy.coverage_class) ||
1290                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1291                                rdev->wiphy.max_scan_ssids) ||
1292                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1293                                rdev->wiphy.max_sched_scan_ssids) ||
1294                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1295                                 rdev->wiphy.max_scan_ie_len) ||
1296                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1297                                 rdev->wiphy.max_sched_scan_ie_len) ||
1298                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1299                                rdev->wiphy.max_match_sets))
1300                         goto nla_put_failure;
1301
1302                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1303                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1304                         goto nla_put_failure;
1305                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1306                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1307                         goto nla_put_failure;
1308                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1309                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1310                         goto nla_put_failure;
1311                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1312                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1313                         goto nla_put_failure;
1314                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1315                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1316                         goto nla_put_failure;
1317                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1318                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1319                         goto nla_put_failure;
1320                 state->split_start++;
1321                 if (state->split)
1322                         break;
1323         case 1:
1324                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1325                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1326                             rdev->wiphy.cipher_suites))
1327                         goto nla_put_failure;
1328
1329                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1330                                rdev->wiphy.max_num_pmkids))
1331                         goto nla_put_failure;
1332
1333                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1334                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1335                         goto nla_put_failure;
1336
1337                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1338                                 rdev->wiphy.available_antennas_tx) ||
1339                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1340                                 rdev->wiphy.available_antennas_rx))
1341                         goto nla_put_failure;
1342
1343                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1344                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1345                                 rdev->wiphy.probe_resp_offload))
1346                         goto nla_put_failure;
1347
1348                 if ((rdev->wiphy.available_antennas_tx ||
1349                      rdev->wiphy.available_antennas_rx) &&
1350                     rdev->ops->get_antenna) {
1351                         u32 tx_ant = 0, rx_ant = 0;
1352                         int res;
1353                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1354                         if (!res) {
1355                                 if (nla_put_u32(msg,
1356                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1357                                                 tx_ant) ||
1358                                     nla_put_u32(msg,
1359                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1360                                                 rx_ant))
1361                                         goto nla_put_failure;
1362                         }
1363                 }
1364
1365                 state->split_start++;
1366                 if (state->split)
1367                         break;
1368         case 2:
1369                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1370                                         rdev->wiphy.interface_modes))
1371                                 goto nla_put_failure;
1372                 state->split_start++;
1373                 if (state->split)
1374                         break;
1375         case 3:
1376                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1377                 if (!nl_bands)
1378                         goto nla_put_failure;
1379
1380                 for (band = state->band_start;
1381                      band < IEEE80211_NUM_BANDS; band++) {
1382                         struct ieee80211_supported_band *sband;
1383
1384                         sband = rdev->wiphy.bands[band];
1385
1386                         if (!sband)
1387                                 continue;
1388
1389                         nl_band = nla_nest_start(msg, band);
1390                         if (!nl_band)
1391                                 goto nla_put_failure;
1392
1393                         switch (state->chan_start) {
1394                         case 0:
1395                                 if (nl80211_send_band_rateinfo(msg, sband))
1396                                         goto nla_put_failure;
1397                                 state->chan_start++;
1398                                 if (state->split)
1399                                         break;
1400                         default:
1401                                 /* add frequencies */
1402                                 nl_freqs = nla_nest_start(
1403                                         msg, NL80211_BAND_ATTR_FREQS);
1404                                 if (!nl_freqs)
1405                                         goto nla_put_failure;
1406
1407                                 for (i = state->chan_start - 1;
1408                                      i < sband->n_channels;
1409                                      i++) {
1410                                         nl_freq = nla_nest_start(msg, i);
1411                                         if (!nl_freq)
1412                                                 goto nla_put_failure;
1413
1414                                         chan = &sband->channels[i];
1415
1416                                         if (nl80211_msg_put_channel(
1417                                                         msg, chan,
1418                                                         state->split))
1419                                                 goto nla_put_failure;
1420
1421                                         nla_nest_end(msg, nl_freq);
1422                                         if (state->split)
1423                                                 break;
1424                                 }
1425                                 if (i < sband->n_channels)
1426                                         state->chan_start = i + 2;
1427                                 else
1428                                         state->chan_start = 0;
1429                                 nla_nest_end(msg, nl_freqs);
1430                         }
1431
1432                         nla_nest_end(msg, nl_band);
1433
1434                         if (state->split) {
1435                                 /* start again here */
1436                                 if (state->chan_start)
1437                                         band--;
1438                                 break;
1439                         }
1440                 }
1441                 nla_nest_end(msg, nl_bands);
1442
1443                 if (band < IEEE80211_NUM_BANDS)
1444                         state->band_start = band + 1;
1445                 else
1446                         state->band_start = 0;
1447
1448                 /* if bands & channels are done, continue outside */
1449                 if (state->band_start == 0 && state->chan_start == 0)
1450                         state->split_start++;
1451                 if (state->split)
1452                         break;
1453         case 4:
1454                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1455                 if (!nl_cmds)
1456                         goto nla_put_failure;
1457
1458                 i = 0;
1459 #define CMD(op, n)                                                      \
1460                  do {                                                   \
1461                         if (rdev->ops->op) {                            \
1462                                 i++;                                    \
1463                                 if (nla_put_u32(msg, i, NL80211_CMD_ ## n)) \
1464                                         goto nla_put_failure;           \
1465                         }                                               \
1466                 } while (0)
1467
1468                 CMD(add_virtual_intf, NEW_INTERFACE);
1469                 CMD(change_virtual_intf, SET_INTERFACE);
1470                 CMD(add_key, NEW_KEY);
1471                 CMD(start_ap, START_AP);
1472                 CMD(add_station, NEW_STATION);
1473                 CMD(add_mpath, NEW_MPATH);
1474                 CMD(update_mesh_config, SET_MESH_CONFIG);
1475                 CMD(change_bss, SET_BSS);
1476                 CMD(auth, AUTHENTICATE);
1477                 CMD(assoc, ASSOCIATE);
1478                 CMD(deauth, DEAUTHENTICATE);
1479                 CMD(disassoc, DISASSOCIATE);
1480                 CMD(join_ibss, JOIN_IBSS);
1481                 CMD(join_mesh, JOIN_MESH);
1482                 CMD(set_pmksa, SET_PMKSA);
1483                 CMD(del_pmksa, DEL_PMKSA);
1484                 CMD(flush_pmksa, FLUSH_PMKSA);
1485                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1486                         CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1487                 CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1488                 CMD(mgmt_tx, FRAME);
1489                 CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1490                 if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1491                         i++;
1492                         if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1493                                 goto nla_put_failure;
1494                 }
1495                 if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1496                     rdev->ops->join_mesh) {
1497                         i++;
1498                         if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1499                                 goto nla_put_failure;
1500                 }
1501                 CMD(set_wds_peer, SET_WDS_PEER);
1502                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1503                         CMD(tdls_mgmt, TDLS_MGMT);
1504                         CMD(tdls_oper, TDLS_OPER);
1505                 }
1506                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_SCHED_SCAN)
1507                         CMD(sched_scan_start, START_SCHED_SCAN);
1508                 CMD(probe_client, PROBE_CLIENT);
1509                 CMD(set_noack_map, SET_NOACK_MAP);
1510                 if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1511                         i++;
1512                         if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1513                                 goto nla_put_failure;
1514                 }
1515                 CMD(start_p2p_device, START_P2P_DEVICE);
1516                 CMD(set_mcast_rate, SET_MCAST_RATE);
1517 #ifdef CONFIG_NL80211_TESTMODE
1518                 CMD(testmode_cmd, TESTMODE);
1519 #endif
1520                 if (state->split) {
1521                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1522                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1523                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1524                                 CMD(channel_switch, CHANNEL_SWITCH);
1525                         CMD(set_qos_map, SET_QOS_MAP);
1526                         if (rdev->wiphy.features &
1527                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1528                                 CMD(add_tx_ts, ADD_TX_TS);
1529                 }
1530                 /* add into the if now */
1531 #undef CMD
1532
1533                 if (rdev->ops->connect || rdev->ops->auth) {
1534                         i++;
1535                         if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1536                                 goto nla_put_failure;
1537                 }
1538
1539                 if (rdev->ops->disconnect || rdev->ops->deauth) {
1540                         i++;
1541                         if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1542                                 goto nla_put_failure;
1543                 }
1544
1545                 nla_nest_end(msg, nl_cmds);
1546                 state->split_start++;
1547                 if (state->split)
1548                         break;
1549         case 5:
1550                 if (rdev->ops->remain_on_channel &&
1551                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1552                     nla_put_u32(msg,
1553                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1554                                 rdev->wiphy.max_remain_on_channel_duration))
1555                         goto nla_put_failure;
1556
1557                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1558                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1559                         goto nla_put_failure;
1560
1561                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1562                         goto nla_put_failure;
1563                 state->split_start++;
1564                 if (state->split)
1565                         break;
1566         case 6:
1567 #ifdef CONFIG_PM
1568                 if (nl80211_send_wowlan(msg, rdev, state->split))
1569                         goto nla_put_failure;
1570                 state->split_start++;
1571                 if (state->split)
1572                         break;
1573 #else
1574                 state->split_start++;
1575 #endif
1576         case 7:
1577                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1578                                         rdev->wiphy.software_iftypes))
1579                         goto nla_put_failure;
1580
1581                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1582                                                    state->split))
1583                         goto nla_put_failure;
1584
1585                 state->split_start++;
1586                 if (state->split)
1587                         break;
1588         case 8:
1589                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1590                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1591                                 rdev->wiphy.ap_sme_capa))
1592                         goto nla_put_failure;
1593
1594                 features = rdev->wiphy.features;
1595                 /*
1596                  * We can only add the per-channel limit information if the
1597                  * dump is split, otherwise it makes it too big. Therefore
1598                  * only advertise it in that case.
1599                  */
1600                 if (state->split)
1601                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1602                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1603                         goto nla_put_failure;
1604
1605                 if (rdev->wiphy.ht_capa_mod_mask &&
1606                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1607                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1608                             rdev->wiphy.ht_capa_mod_mask))
1609                         goto nla_put_failure;
1610
1611                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1612                     rdev->wiphy.max_acl_mac_addrs &&
1613                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1614                                 rdev->wiphy.max_acl_mac_addrs))
1615                         goto nla_put_failure;
1616
1617                 /*
1618                  * Any information below this point is only available to
1619                  * applications that can deal with it being split. This
1620                  * helps ensure that newly added capabilities don't break
1621                  * older tools by overrunning their buffers.
1622                  *
1623                  * We still increment split_start so that in the split
1624                  * case we'll continue with more data in the next round,
1625                  * but break unconditionally so unsplit data stops here.
1626                  */
1627                 state->split_start++;
1628                 break;
1629         case 9:
1630                 if (rdev->wiphy.extended_capabilities &&
1631                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1632                              rdev->wiphy.extended_capabilities_len,
1633                              rdev->wiphy.extended_capabilities) ||
1634                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1635                              rdev->wiphy.extended_capabilities_len,
1636                              rdev->wiphy.extended_capabilities_mask)))
1637                         goto nla_put_failure;
1638
1639                 if (rdev->wiphy.vht_capa_mod_mask &&
1640                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1641                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1642                             rdev->wiphy.vht_capa_mod_mask))
1643                         goto nla_put_failure;
1644
1645                 state->split_start++;
1646                 break;
1647         case 10:
1648                 if (nl80211_send_coalesce(msg, rdev))
1649                         goto nla_put_failure;
1650
1651                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1652                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1653                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1654                         goto nla_put_failure;
1655
1656                 if (rdev->wiphy.max_ap_assoc_sta &&
1657                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1658                                 rdev->wiphy.max_ap_assoc_sta))
1659                         goto nla_put_failure;
1660
1661                 state->split_start++;
1662                 break;
1663         case 11:
1664                 if (rdev->wiphy.n_vendor_commands) {
1665                         const struct nl80211_vendor_cmd_info *info;
1666                         struct nlattr *nested;
1667
1668                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1669                         if (!nested)
1670                                 goto nla_put_failure;
1671
1672                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1673                                 info = &rdev->wiphy.vendor_commands[i].info;
1674                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1675                                         goto nla_put_failure;
1676                         }
1677                         nla_nest_end(msg, nested);
1678                 }
1679
1680                 if (rdev->wiphy.n_vendor_events) {
1681                         const struct nl80211_vendor_cmd_info *info;
1682                         struct nlattr *nested;
1683
1684                         nested = nla_nest_start(msg,
1685                                                 NL80211_ATTR_VENDOR_EVENTS);
1686                         if (!nested)
1687                                 goto nla_put_failure;
1688
1689                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1690                                 info = &rdev->wiphy.vendor_events[i];
1691                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1692                                         goto nla_put_failure;
1693                         }
1694                         nla_nest_end(msg, nested);
1695                 }
1696                 state->split_start++;
1697                 break;
1698         case 12:
1699                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1700                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1701                                rdev->wiphy.max_num_csa_counters))
1702                         goto nla_put_failure;
1703
1704                 /* done */
1705                 state->split_start = 0;
1706                 break;
1707         }
1708  finish:
1709         return genlmsg_end(msg, hdr);
1710
1711  nla_put_failure:
1712         genlmsg_cancel(msg, hdr);
1713         return -EMSGSIZE;
1714 }
1715
1716 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1717                                     struct netlink_callback *cb,
1718                                     struct nl80211_dump_wiphy_state *state)
1719 {
1720         struct nlattr **tb = nl80211_fam.attrbuf;
1721         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
1722                               tb, nl80211_fam.maxattr, nl80211_policy);
1723         /* ignore parse errors for backward compatibility */
1724         if (ret)
1725                 return 0;
1726
1727         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1728         if (tb[NL80211_ATTR_WIPHY])
1729                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1730         if (tb[NL80211_ATTR_WDEV])
1731                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1732         if (tb[NL80211_ATTR_IFINDEX]) {
1733                 struct net_device *netdev;
1734                 struct cfg80211_registered_device *rdev;
1735                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1736
1737                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1738                 if (!netdev)
1739                         return -ENODEV;
1740                 if (netdev->ieee80211_ptr) {
1741                         rdev = wiphy_to_rdev(
1742                                 netdev->ieee80211_ptr->wiphy);
1743                         state->filter_wiphy = rdev->wiphy_idx;
1744                 }
1745         }
1746
1747         return 0;
1748 }
1749
1750 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1751 {
1752         int idx = 0, ret;
1753         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1754         struct cfg80211_registered_device *rdev;
1755
1756         rtnl_lock();
1757         if (!state) {
1758                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1759                 if (!state) {
1760                         rtnl_unlock();
1761                         return -ENOMEM;
1762                 }
1763                 state->filter_wiphy = -1;
1764                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1765                 if (ret) {
1766                         kfree(state);
1767                         rtnl_unlock();
1768                         return ret;
1769                 }
1770                 cb->args[0] = (long)state;
1771         }
1772
1773         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1774                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1775                         continue;
1776                 if (++idx <= state->start)
1777                         continue;
1778                 if (state->filter_wiphy != -1 &&
1779                     state->filter_wiphy != rdev->wiphy_idx)
1780                         continue;
1781                 /* attempt to fit multiple wiphy data chunks into the skb */
1782                 do {
1783                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1784                                                  skb,
1785                                                  NETLINK_CB(cb->skb).portid,
1786                                                  cb->nlh->nlmsg_seq,
1787                                                  NLM_F_MULTI, state);
1788                         if (ret < 0) {
1789                                 /*
1790                                  * If sending the wiphy data didn't fit (ENOBUFS
1791                                  * or EMSGSIZE returned), this SKB is still
1792                                  * empty (so it's not too big because another
1793                                  * wiphy dataset is already in the skb) and
1794                                  * we've not tried to adjust the dump allocation
1795                                  * yet ... then adjust the alloc size to be
1796                                  * bigger, and return 1 but with the empty skb.
1797                                  * This results in an empty message being RX'ed
1798                                  * in userspace, but that is ignored.
1799                                  *
1800                                  * We can then retry with the larger buffer.
1801                                  */
1802                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
1803                                     !skb->len && !state->split &&
1804                                     cb->min_dump_alloc < 4096) {
1805                                         cb->min_dump_alloc = 4096;
1806                                         state->split_start = 0;
1807                                         rtnl_unlock();
1808                                         return 1;
1809                                 }
1810                                 idx--;
1811                                 break;
1812                         }
1813                 } while (state->split_start > 0);
1814                 break;
1815         }
1816         rtnl_unlock();
1817
1818         state->start = idx;
1819
1820         return skb->len;
1821 }
1822
1823 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
1824 {
1825         kfree((void *)cb->args[0]);
1826         return 0;
1827 }
1828
1829 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
1830 {
1831         struct sk_buff *msg;
1832         struct cfg80211_registered_device *rdev = info->user_ptr[0];
1833         struct nl80211_dump_wiphy_state state = {};
1834
1835         msg = nlmsg_new(4096, GFP_KERNEL);
1836         if (!msg)
1837                 return -ENOMEM;
1838
1839         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
1840                                info->snd_portid, info->snd_seq, 0,
1841                                &state) < 0) {
1842                 nlmsg_free(msg);
1843                 return -ENOBUFS;
1844         }
1845
1846         return genlmsg_reply(msg, info);
1847 }
1848
1849 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
1850         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
1851         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
1852         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
1853         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
1854         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
1855 };
1856
1857 static int parse_txq_params(struct nlattr *tb[],
1858                             struct ieee80211_txq_params *txq_params)
1859 {
1860         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
1861             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
1862             !tb[NL80211_TXQ_ATTR_AIFS])
1863                 return -EINVAL;
1864
1865         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
1866         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
1867         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
1868         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
1869         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
1870
1871         if (txq_params->ac >= NL80211_NUM_ACS)
1872                 return -EINVAL;
1873
1874         return 0;
1875 }
1876
1877 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
1878 {
1879         /*
1880          * You can only set the channel explicitly for WDS interfaces,
1881          * all others have their channel managed via their respective
1882          * "establish a connection" command (connect, join, ...)
1883          *
1884          * For AP/GO and mesh mode, the channel can be set with the
1885          * channel userspace API, but is only stored and passed to the
1886          * low-level driver when the AP starts or the mesh is joined.
1887          * This is for backward compatibility, userspace can also give
1888          * the channel in the start-ap or join-mesh commands instead.
1889          *
1890          * Monitors are special as they are normally slaved to
1891          * whatever else is going on, so they have their own special
1892          * operation to set the monitor channel if possible.
1893          */
1894         return !wdev ||
1895                 wdev->iftype == NL80211_IFTYPE_AP ||
1896                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
1897                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
1898                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
1899 }
1900
1901 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
1902                                  struct genl_info *info,
1903                                  struct cfg80211_chan_def *chandef)
1904 {
1905         u32 control_freq;
1906
1907         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
1908                 return -EINVAL;
1909
1910         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
1911
1912         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
1913         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
1914         chandef->center_freq1 = control_freq;
1915         chandef->center_freq2 = 0;
1916
1917         /* Primary channel not allowed */
1918         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
1919                 return -EINVAL;
1920
1921         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
1922                 enum nl80211_channel_type chantype;
1923
1924                 chantype = nla_get_u32(
1925                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1926
1927                 switch (chantype) {
1928                 case NL80211_CHAN_NO_HT:
1929                 case NL80211_CHAN_HT20:
1930                 case NL80211_CHAN_HT40PLUS:
1931                 case NL80211_CHAN_HT40MINUS:
1932                         cfg80211_chandef_create(chandef, chandef->chan,
1933                                                 chantype);
1934                         break;
1935                 default:
1936                         return -EINVAL;
1937                 }
1938         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
1939                 chandef->width =
1940                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
1941                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
1942                         chandef->center_freq1 =
1943                                 nla_get_u32(
1944                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
1945                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
1946                         chandef->center_freq2 =
1947                                 nla_get_u32(
1948                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
1949         }
1950
1951         if (!cfg80211_chandef_valid(chandef))
1952                 return -EINVAL;
1953
1954         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
1955                                      IEEE80211_CHAN_DISABLED))
1956                 return -EINVAL;
1957
1958         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
1959              chandef->width == NL80211_CHAN_WIDTH_10) &&
1960             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
1961                 return -EINVAL;
1962
1963         return 0;
1964 }
1965
1966 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
1967                                  struct net_device *dev,
1968                                  struct genl_info *info)
1969 {
1970         struct cfg80211_chan_def chandef;
1971         int result;
1972         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
1973         struct wireless_dev *wdev = NULL;
1974
1975         if (dev)
1976                 wdev = dev->ieee80211_ptr;
1977         if (!nl80211_can_set_dev_channel(wdev))
1978                 return -EOPNOTSUPP;
1979         if (wdev)
1980                 iftype = wdev->iftype;
1981
1982         result = nl80211_parse_chandef(rdev, info, &chandef);
1983         if (result)
1984                 return result;
1985
1986         switch (iftype) {
1987         case NL80211_IFTYPE_AP:
1988         case NL80211_IFTYPE_P2P_GO:
1989                 if (!cfg80211_reg_can_beacon(&rdev->wiphy, &chandef, iftype)) {
1990                         result = -EINVAL;
1991                         break;
1992                 }
1993                 if (wdev->beacon_interval) {
1994                         if (!dev || !rdev->ops->set_ap_chanwidth ||
1995                             !(rdev->wiphy.features &
1996                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
1997                                 result = -EBUSY;
1998                                 break;
1999                         }
2000
2001                         /* Only allow dynamic channel width changes */
2002                         if (chandef.chan != wdev->preset_chandef.chan) {
2003                                 result = -EBUSY;
2004                                 break;
2005                         }
2006                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2007                         if (result)
2008                                 break;
2009                 }
2010                 wdev->preset_chandef = chandef;
2011                 result = 0;
2012                 break;
2013         case NL80211_IFTYPE_MESH_POINT:
2014                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2015                 break;
2016         case NL80211_IFTYPE_MONITOR:
2017                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2018                 break;
2019         default:
2020                 result = -EINVAL;
2021         }
2022
2023         return result;
2024 }
2025
2026 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2027 {
2028         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2029         struct net_device *netdev = info->user_ptr[1];
2030
2031         return __nl80211_set_channel(rdev, netdev, info);
2032 }
2033
2034 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2035 {
2036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2037         struct net_device *dev = info->user_ptr[1];
2038         struct wireless_dev *wdev = dev->ieee80211_ptr;
2039         const u8 *bssid;
2040
2041         if (!info->attrs[NL80211_ATTR_MAC])
2042                 return -EINVAL;
2043
2044         if (netif_running(dev))
2045                 return -EBUSY;
2046
2047         if (!rdev->ops->set_wds_peer)
2048                 return -EOPNOTSUPP;
2049
2050         if (wdev->iftype != NL80211_IFTYPE_WDS)
2051                 return -EOPNOTSUPP;
2052
2053         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2054         return rdev_set_wds_peer(rdev, dev, bssid);
2055 }
2056
2057
2058 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2059 {
2060         struct cfg80211_registered_device *rdev;
2061         struct net_device *netdev = NULL;
2062         struct wireless_dev *wdev;
2063         int result = 0, rem_txq_params = 0;
2064         struct nlattr *nl_txq_params;
2065         u32 changed;
2066         u8 retry_short = 0, retry_long = 0;
2067         u32 frag_threshold = 0, rts_threshold = 0;
2068         u8 coverage_class = 0;
2069
2070         ASSERT_RTNL();
2071
2072         /*
2073          * Try to find the wiphy and netdev. Normally this
2074          * function shouldn't need the netdev, but this is
2075          * done for backward compatibility -- previously
2076          * setting the channel was done per wiphy, but now
2077          * it is per netdev. Previous userland like hostapd
2078          * also passed a netdev to set_wiphy, so that it is
2079          * possible to let that go to the right netdev!
2080          */
2081
2082         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2083                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2084
2085                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2086                 if (netdev && netdev->ieee80211_ptr)
2087                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2088                 else
2089                         netdev = NULL;
2090         }
2091
2092         if (!netdev) {
2093                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2094                                                   info->attrs);
2095                 if (IS_ERR(rdev))
2096                         return PTR_ERR(rdev);
2097                 wdev = NULL;
2098                 netdev = NULL;
2099                 result = 0;
2100         } else
2101                 wdev = netdev->ieee80211_ptr;
2102
2103         /*
2104          * end workaround code, by now the rdev is available
2105          * and locked, and wdev may or may not be NULL.
2106          */
2107
2108         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2109                 result = cfg80211_dev_rename(
2110                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2111
2112         if (result)
2113                 return result;
2114
2115         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2116                 struct ieee80211_txq_params txq_params;
2117                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2118
2119                 if (!rdev->ops->set_txq_params)
2120                         return -EOPNOTSUPP;
2121
2122                 if (!netdev)
2123                         return -EINVAL;
2124
2125                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2126                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2127                         return -EINVAL;
2128
2129                 if (!netif_running(netdev))
2130                         return -ENETDOWN;
2131
2132                 nla_for_each_nested(nl_txq_params,
2133                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2134                                     rem_txq_params) {
2135                         result = nla_parse(tb, NL80211_TXQ_ATTR_MAX,
2136                                            nla_data(nl_txq_params),
2137                                            nla_len(nl_txq_params),
2138                                            txq_params_policy);
2139                         if (result)
2140                                 return result;
2141                         result = parse_txq_params(tb, &txq_params);
2142                         if (result)
2143                                 return result;
2144
2145                         result = rdev_set_txq_params(rdev, netdev,
2146                                                      &txq_params);
2147                         if (result)
2148                                 return result;
2149                 }
2150         }
2151
2152         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2153                 result = __nl80211_set_channel(
2154                         rdev,
2155                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2156                         info);
2157                 if (result)
2158                         return result;
2159         }
2160
2161         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2162                 struct wireless_dev *txp_wdev = wdev;
2163                 enum nl80211_tx_power_setting type;
2164                 int idx, mbm = 0;
2165
2166                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2167                         txp_wdev = NULL;
2168
2169                 if (!rdev->ops->set_tx_power)
2170                         return -EOPNOTSUPP;
2171
2172                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2173                 type = nla_get_u32(info->attrs[idx]);
2174
2175                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2176                     (type != NL80211_TX_POWER_AUTOMATIC))
2177                         return -EINVAL;
2178
2179                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2180                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2181                         mbm = nla_get_u32(info->attrs[idx]);
2182                 }
2183
2184                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2185                 if (result)
2186                         return result;
2187         }
2188
2189         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2190             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2191                 u32 tx_ant, rx_ant;
2192                 if ((!rdev->wiphy.available_antennas_tx &&
2193                      !rdev->wiphy.available_antennas_rx) ||
2194                     !rdev->ops->set_antenna)
2195                         return -EOPNOTSUPP;
2196
2197                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2198                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2199
2200                 /* reject antenna configurations which don't match the
2201                  * available antenna masks, except for the "all" mask */
2202                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2203                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2204                         return -EINVAL;
2205
2206                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2207                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2208
2209                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2210                 if (result)
2211                         return result;
2212         }
2213
2214         changed = 0;
2215
2216         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2217                 retry_short = nla_get_u8(
2218                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2219                 if (retry_short == 0)
2220                         return -EINVAL;
2221
2222                 changed |= WIPHY_PARAM_RETRY_SHORT;
2223         }
2224
2225         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2226                 retry_long = nla_get_u8(
2227                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2228                 if (retry_long == 0)
2229                         return -EINVAL;
2230
2231                 changed |= WIPHY_PARAM_RETRY_LONG;
2232         }
2233
2234         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2235                 frag_threshold = nla_get_u32(
2236                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2237                 if (frag_threshold < 256)
2238                         return -EINVAL;
2239
2240                 if (frag_threshold != (u32) -1) {
2241                         /*
2242                          * Fragments (apart from the last one) are required to
2243                          * have even length. Make the fragmentation code
2244                          * simpler by stripping LSB should someone try to use
2245                          * odd threshold value.
2246                          */
2247                         frag_threshold &= ~0x1;
2248                 }
2249                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2250         }
2251
2252         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2253                 rts_threshold = nla_get_u32(
2254                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2255                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2256         }
2257
2258         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2259                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2260                         return -EINVAL;
2261
2262                 coverage_class = nla_get_u8(
2263                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2264                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2265         }
2266
2267         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2268                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2269                         return -EOPNOTSUPP;
2270
2271                 changed |= WIPHY_PARAM_DYN_ACK;
2272         }
2273
2274         if (changed) {
2275                 u8 old_retry_short, old_retry_long;
2276                 u32 old_frag_threshold, old_rts_threshold;
2277                 u8 old_coverage_class;
2278
2279                 if (!rdev->ops->set_wiphy_params)
2280                         return -EOPNOTSUPP;
2281
2282                 old_retry_short = rdev->wiphy.retry_short;
2283                 old_retry_long = rdev->wiphy.retry_long;
2284                 old_frag_threshold = rdev->wiphy.frag_threshold;
2285                 old_rts_threshold = rdev->wiphy.rts_threshold;
2286                 old_coverage_class = rdev->wiphy.coverage_class;
2287
2288                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2289                         rdev->wiphy.retry_short = retry_short;
2290                 if (changed & WIPHY_PARAM_RETRY_LONG)
2291                         rdev->wiphy.retry_long = retry_long;
2292                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2293                         rdev->wiphy.frag_threshold = frag_threshold;
2294                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2295                         rdev->wiphy.rts_threshold = rts_threshold;
2296                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2297                         rdev->wiphy.coverage_class = coverage_class;
2298
2299                 result = rdev_set_wiphy_params(rdev, changed);
2300                 if (result) {
2301                         rdev->wiphy.retry_short = old_retry_short;
2302                         rdev->wiphy.retry_long = old_retry_long;
2303                         rdev->wiphy.frag_threshold = old_frag_threshold;
2304                         rdev->wiphy.rts_threshold = old_rts_threshold;
2305                         rdev->wiphy.coverage_class = old_coverage_class;
2306                 }
2307         }
2308         return 0;
2309 }
2310
2311 static inline u64 wdev_id(struct wireless_dev *wdev)
2312 {
2313         return (u64)wdev->identifier |
2314                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2315 }
2316
2317 static int nl80211_send_chandef(struct sk_buff *msg,
2318                                 const struct cfg80211_chan_def *chandef)
2319 {
2320         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2321                 return -EINVAL;
2322
2323         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2324                         chandef->chan->center_freq))
2325                 return -ENOBUFS;
2326         switch (chandef->width) {
2327         case NL80211_CHAN_WIDTH_20_NOHT:
2328         case NL80211_CHAN_WIDTH_20:
2329         case NL80211_CHAN_WIDTH_40:
2330                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2331                                 cfg80211_get_chandef_type(chandef)))
2332                         return -ENOBUFS;
2333                 break;
2334         default:
2335                 break;
2336         }
2337         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2338                 return -ENOBUFS;
2339         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2340                 return -ENOBUFS;
2341         if (chandef->center_freq2 &&
2342             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2343                 return -ENOBUFS;
2344         return 0;
2345 }
2346
2347 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2348                               struct cfg80211_registered_device *rdev,
2349                               struct wireless_dev *wdev, bool removal)
2350 {
2351         struct net_device *dev = wdev->netdev;
2352         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2353         void *hdr;
2354
2355         if (removal)
2356                 cmd = NL80211_CMD_DEL_INTERFACE;
2357
2358         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2359         if (!hdr)
2360                 return -1;
2361
2362         if (dev &&
2363             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2364              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2365                 goto nla_put_failure;
2366
2367         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2368             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2369             nla_put_u64(msg, NL80211_ATTR_WDEV, wdev_id(wdev)) ||
2370             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2371             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2372                         rdev->devlist_generation ^
2373                         (cfg80211_rdev_list_generation << 2)))
2374                 goto nla_put_failure;
2375
2376         if (rdev->ops->get_channel) {
2377                 int ret;
2378                 struct cfg80211_chan_def chandef;
2379
2380                 ret = rdev_get_channel(rdev, wdev, &chandef);
2381                 if (ret == 0) {
2382                         if (nl80211_send_chandef(msg, &chandef))
2383                                 goto nla_put_failure;
2384                 }
2385         }
2386
2387         if (wdev->ssid_len) {
2388                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2389                         goto nla_put_failure;
2390         }
2391
2392         return genlmsg_end(msg, hdr);
2393
2394  nla_put_failure:
2395         genlmsg_cancel(msg, hdr);
2396         return -EMSGSIZE;
2397 }
2398
2399 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2400 {
2401         int wp_idx = 0;
2402         int if_idx = 0;
2403         int wp_start = cb->args[0];
2404         int if_start = cb->args[1];
2405         struct cfg80211_registered_device *rdev;
2406         struct wireless_dev *wdev;
2407
2408         rtnl_lock();
2409         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2410                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2411                         continue;
2412                 if (wp_idx < wp_start) {
2413                         wp_idx++;
2414                         continue;
2415                 }
2416                 if_idx = 0;
2417
2418                 list_for_each_entry(wdev, &rdev->wdev_list, list) {
2419                         if (if_idx < if_start) {
2420                                 if_idx++;
2421                                 continue;
2422                         }
2423                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2424                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2425                                                rdev, wdev, false) < 0) {
2426                                 goto out;
2427                         }
2428                         if_idx++;
2429                 }
2430
2431                 wp_idx++;
2432         }
2433  out:
2434         rtnl_unlock();
2435
2436         cb->args[0] = wp_idx;
2437         cb->args[1] = if_idx;
2438
2439         return skb->len;
2440 }
2441
2442 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2443 {
2444         struct sk_buff *msg;
2445         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2446         struct wireless_dev *wdev = info->user_ptr[1];
2447
2448         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2449         if (!msg)
2450                 return -ENOMEM;
2451
2452         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2453                                rdev, wdev, false) < 0) {
2454                 nlmsg_free(msg);
2455                 return -ENOBUFS;
2456         }
2457
2458         return genlmsg_reply(msg, info);
2459 }
2460
2461 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2462         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2463         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2464         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2465         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2466         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2467         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2468 };
2469
2470 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2471 {
2472         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2473         int flag;
2474
2475         *mntrflags = 0;
2476
2477         if (!nla)
2478                 return -EINVAL;
2479
2480         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX,
2481                              nla, mntr_flags_policy))
2482                 return -EINVAL;
2483
2484         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2485                 if (flags[flag])
2486                         *mntrflags |= (1<<flag);
2487
2488         return 0;
2489 }
2490
2491 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2492                                struct net_device *netdev, u8 use_4addr,
2493                                enum nl80211_iftype iftype)
2494 {
2495         if (!use_4addr) {
2496                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2497                         return -EBUSY;
2498                 return 0;
2499         }
2500
2501         switch (iftype) {
2502         case NL80211_IFTYPE_AP_VLAN:
2503                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2504                         return 0;
2505                 break;
2506         case NL80211_IFTYPE_STATION:
2507                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2508                         return 0;
2509                 break;
2510         default:
2511                 break;
2512         }
2513
2514         return -EOPNOTSUPP;
2515 }
2516
2517 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2518 {
2519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2520         struct vif_params params;
2521         int err;
2522         enum nl80211_iftype otype, ntype;
2523         struct net_device *dev = info->user_ptr[1];
2524         u32 _flags, *flags = NULL;
2525         bool change = false;
2526
2527         memset(&params, 0, sizeof(params));
2528
2529         otype = ntype = dev->ieee80211_ptr->iftype;
2530
2531         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2532                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2533                 if (otype != ntype)
2534                         change = true;
2535                 if (ntype > NL80211_IFTYPE_MAX)
2536                         return -EINVAL;
2537         }
2538
2539         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2540                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2541
2542                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2543                         return -EINVAL;
2544                 if (netif_running(dev))
2545                         return -EBUSY;
2546
2547                 wdev_lock(wdev);
2548                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2549                              IEEE80211_MAX_MESH_ID_LEN);
2550                 wdev->mesh_id_up_len =
2551                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2552                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2553                        wdev->mesh_id_up_len);
2554                 wdev_unlock(wdev);
2555         }
2556
2557         if (info->attrs[NL80211_ATTR_4ADDR]) {
2558                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2559                 change = true;
2560                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2561                 if (err)
2562                         return err;
2563         } else {
2564                 params.use_4addr = -1;
2565         }
2566
2567         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2568                 if (ntype != NL80211_IFTYPE_MONITOR)
2569                         return -EINVAL;
2570                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2571                                           &_flags);
2572                 if (err)
2573                         return err;
2574
2575                 flags = &_flags;
2576                 change = true;
2577         }
2578
2579         if (flags && (*flags & MONITOR_FLAG_ACTIVE) &&
2580             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2581                 return -EOPNOTSUPP;
2582
2583         if (change)
2584                 err = cfg80211_change_iface(rdev, dev, ntype, flags, &params);
2585         else
2586                 err = 0;
2587
2588         if (!err && params.use_4addr != -1)
2589                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2590
2591         return err;
2592 }
2593
2594 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2595 {
2596         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2597         struct vif_params params;
2598         struct wireless_dev *wdev;
2599         struct sk_buff *msg, *event;
2600         int err;
2601         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2602         u32 flags;
2603
2604         /* to avoid failing a new interface creation due to pending removal */
2605         cfg80211_destroy_ifaces(rdev);
2606
2607         memset(&params, 0, sizeof(params));
2608
2609         if (!info->attrs[NL80211_ATTR_IFNAME])
2610                 return -EINVAL;
2611
2612         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2613                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2614                 if (type > NL80211_IFTYPE_MAX)
2615                         return -EINVAL;
2616         }
2617
2618         if (!rdev->ops->add_virtual_intf ||
2619             !(rdev->wiphy.interface_modes & (1 << type)))
2620                 return -EOPNOTSUPP;
2621
2622         if ((type == NL80211_IFTYPE_P2P_DEVICE ||
2623              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2624             info->attrs[NL80211_ATTR_MAC]) {
2625                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2626                            ETH_ALEN);
2627                 if (!is_valid_ether_addr(params.macaddr))
2628                         return -EADDRNOTAVAIL;
2629         }
2630
2631         if (info->attrs[NL80211_ATTR_4ADDR]) {
2632                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2633                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2634                 if (err)
2635                         return err;
2636         }
2637
2638         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2639         if (!msg)
2640                 return -ENOMEM;
2641
2642         err = parse_monitor_flags(type == NL80211_IFTYPE_MONITOR ?
2643                                   info->attrs[NL80211_ATTR_MNTR_FLAGS] : NULL,
2644                                   &flags);
2645
2646         if (!err && (flags & MONITOR_FLAG_ACTIVE) &&
2647             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2648                 return -EOPNOTSUPP;
2649
2650         wdev = rdev_add_virtual_intf(rdev,
2651                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2652                                 type, err ? NULL : &flags, &params);
2653         if (WARN_ON(!wdev)) {
2654                 nlmsg_free(msg);
2655                 return -EPROTO;
2656         } else if (IS_ERR(wdev)) {
2657                 nlmsg_free(msg);
2658                 return PTR_ERR(wdev);
2659         }
2660
2661         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2662                 wdev->owner_nlportid = info->snd_portid;
2663
2664         switch (type) {
2665         case NL80211_IFTYPE_MESH_POINT:
2666                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2667                         break;
2668                 wdev_lock(wdev);
2669                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2670                              IEEE80211_MAX_MESH_ID_LEN);
2671                 wdev->mesh_id_up_len =
2672                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2673                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2674                        wdev->mesh_id_up_len);
2675                 wdev_unlock(wdev);
2676                 break;
2677         case NL80211_IFTYPE_P2P_DEVICE:
2678                 /*
2679                  * P2P Device doesn't have a netdev, so doesn't go
2680                  * through the netdev notifier and must be added here
2681                  */
2682                 mutex_init(&wdev->mtx);
2683                 INIT_LIST_HEAD(&wdev->event_list);
2684                 spin_lock_init(&wdev->event_lock);
2685                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2686                 spin_lock_init(&wdev->mgmt_registrations_lock);
2687
2688                 wdev->identifier = ++rdev->wdev_id;
2689                 list_add_rcu(&wdev->list, &rdev->wdev_list);
2690                 rdev->devlist_generation++;
2691                 break;
2692         default:
2693                 break;
2694         }
2695
2696         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2697                                rdev, wdev, false) < 0) {
2698                 nlmsg_free(msg);
2699                 return -ENOBUFS;
2700         }
2701
2702         event = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2703         if (event) {
2704                 if (nl80211_send_iface(event, 0, 0, 0,
2705                                        rdev, wdev, false) < 0) {
2706                         nlmsg_free(event);
2707                         goto out;
2708                 }
2709
2710                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2711                                         event, 0, NL80211_MCGRP_CONFIG,
2712                                         GFP_KERNEL);
2713         }
2714
2715 out:
2716         return genlmsg_reply(msg, info);
2717 }
2718
2719 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
2720 {
2721         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2722         struct wireless_dev *wdev = info->user_ptr[1];
2723         struct sk_buff *msg;
2724         int status;
2725
2726         if (!rdev->ops->del_virtual_intf)
2727                 return -EOPNOTSUPP;
2728
2729         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2730         if (msg && nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, true) < 0) {
2731                 nlmsg_free(msg);
2732                 msg = NULL;
2733         }
2734
2735         /*
2736          * If we remove a wireless device without a netdev then clear
2737          * user_ptr[1] so that nl80211_post_doit won't dereference it
2738          * to check if it needs to do dev_put(). Otherwise it crashes
2739          * since the wdev has been freed, unlike with a netdev where
2740          * we need the dev_put() for the netdev to really be freed.
2741          */
2742         if (!wdev->netdev)
2743                 info->user_ptr[1] = NULL;
2744
2745         status = rdev_del_virtual_intf(rdev, wdev);
2746         if (status >= 0 && msg)
2747                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
2748                                         msg, 0, NL80211_MCGRP_CONFIG,
2749                                         GFP_KERNEL);
2750         else
2751                 nlmsg_free(msg);
2752
2753         return status;
2754 }
2755
2756 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
2757 {
2758         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2759         struct net_device *dev = info->user_ptr[1];
2760         u16 noack_map;
2761
2762         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
2763                 return -EINVAL;
2764
2765         if (!rdev->ops->set_noack_map)
2766                 return -EOPNOTSUPP;
2767
2768         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
2769
2770         return rdev_set_noack_map(rdev, dev, noack_map);
2771 }
2772
2773 struct get_key_cookie {
2774         struct sk_buff *msg;
2775         int error;
2776         int idx;
2777 };
2778
2779 static void get_key_callback(void *c, struct key_params *params)
2780 {
2781         struct nlattr *key;
2782         struct get_key_cookie *cookie = c;
2783
2784         if ((params->key &&
2785              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
2786                      params->key_len, params->key)) ||
2787             (params->seq &&
2788              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
2789                      params->seq_len, params->seq)) ||
2790             (params->cipher &&
2791              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
2792                          params->cipher)))
2793                 goto nla_put_failure;
2794
2795         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
2796         if (!key)
2797                 goto nla_put_failure;
2798
2799         if ((params->key &&
2800              nla_put(cookie->msg, NL80211_KEY_DATA,
2801                      params->key_len, params->key)) ||
2802             (params->seq &&
2803              nla_put(cookie->msg, NL80211_KEY_SEQ,
2804                      params->seq_len, params->seq)) ||
2805             (params->cipher &&
2806              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
2807                          params->cipher)))
2808                 goto nla_put_failure;
2809
2810         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
2811                 goto nla_put_failure;
2812
2813         nla_nest_end(cookie->msg, key);
2814
2815         return;
2816  nla_put_failure:
2817         cookie->error = 1;
2818 }
2819
2820 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
2821 {
2822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2823         int err;
2824         struct net_device *dev = info->user_ptr[1];
2825         u8 key_idx = 0;
2826         const u8 *mac_addr = NULL;
2827         bool pairwise;
2828         struct get_key_cookie cookie = {
2829                 .error = 0,
2830         };
2831         void *hdr;
2832         struct sk_buff *msg;
2833
2834         if (info->attrs[NL80211_ATTR_KEY_IDX])
2835                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
2836
2837         if (key_idx > 5)
2838                 return -EINVAL;
2839
2840         if (info->attrs[NL80211_ATTR_MAC])
2841                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2842
2843         pairwise = !!mac_addr;
2844         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
2845                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
2846                 if (kt >= NUM_NL80211_KEYTYPES)
2847                         return -EINVAL;
2848                 if (kt != NL80211_KEYTYPE_GROUP &&
2849                     kt != NL80211_KEYTYPE_PAIRWISE)
2850                         return -EINVAL;
2851                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
2852         }
2853
2854         if (!rdev->ops->get_key)
2855                 return -EOPNOTSUPP;
2856
2857         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
2858                 return -ENOENT;
2859
2860         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2861         if (!msg)
2862                 return -ENOMEM;
2863
2864         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
2865                              NL80211_CMD_NEW_KEY);
2866         if (!hdr)
2867                 goto nla_put_failure;
2868
2869         cookie.msg = msg;
2870         cookie.idx = key_idx;
2871
2872         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2873             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
2874                 goto nla_put_failure;
2875         if (mac_addr &&
2876             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
2877                 goto nla_put_failure;
2878
2879         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
2880                            get_key_callback);
2881
2882         if (err)
2883                 goto free_msg;
2884
2885         if (cookie.error)
2886                 goto nla_put_failure;
2887
2888         genlmsg_end(msg, hdr);
2889         return genlmsg_reply(msg, info);
2890
2891  nla_put_failure:
2892         err = -ENOBUFS;
2893  free_msg:
2894         nlmsg_free(msg);
2895         return err;
2896 }
2897
2898 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
2899 {
2900         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2901         struct key_parse key;
2902         int err;
2903         struct net_device *dev = info->user_ptr[1];
2904
2905         err = nl80211_parse_key(info, &key);
2906         if (err)
2907                 return err;
2908
2909         if (key.idx < 0)
2910                 return -EINVAL;
2911
2912         /* only support setting default key */
2913         if (!key.def && !key.defmgmt)
2914                 return -EINVAL;
2915
2916         wdev_lock(dev->ieee80211_ptr);
2917
2918         if (key.def) {
2919                 if (!rdev->ops->set_default_key) {
2920                         err = -EOPNOTSUPP;
2921                         goto out;
2922                 }
2923
2924                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2925                 if (err)
2926                         goto out;
2927
2928                 err = rdev_set_default_key(rdev, dev, key.idx,
2929                                                  key.def_uni, key.def_multi);
2930
2931                 if (err)
2932                         goto out;
2933
2934 #ifdef CONFIG_CFG80211_WEXT
2935                 dev->ieee80211_ptr->wext.default_key = key.idx;
2936 #endif
2937         } else {
2938                 if (key.def_uni || !key.def_multi) {
2939                         err = -EINVAL;
2940                         goto out;
2941                 }
2942
2943                 if (!rdev->ops->set_default_mgmt_key) {
2944                         err = -EOPNOTSUPP;
2945                         goto out;
2946                 }
2947
2948                 err = nl80211_key_allowed(dev->ieee80211_ptr);
2949                 if (err)
2950                         goto out;
2951
2952                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
2953                 if (err)
2954                         goto out;
2955
2956 #ifdef CONFIG_CFG80211_WEXT
2957                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
2958 #endif
2959         }
2960
2961  out:
2962         wdev_unlock(dev->ieee80211_ptr);
2963
2964         return err;
2965 }
2966
2967 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
2968 {
2969         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2970         int err;
2971         struct net_device *dev = info->user_ptr[1];
2972         struct key_parse key;
2973         const u8 *mac_addr = NULL;
2974
2975         err = nl80211_parse_key(info, &key);
2976         if (err)
2977                 return err;
2978
2979         if (!key.p.key)
2980                 return -EINVAL;
2981
2982         if (info->attrs[NL80211_ATTR_MAC])
2983                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
2984
2985         if (key.type == -1) {
2986                 if (mac_addr)
2987                         key.type = NL80211_KEYTYPE_PAIRWISE;
2988                 else
2989                         key.type = NL80211_KEYTYPE_GROUP;
2990         }
2991
2992         /* for now */
2993         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
2994             key.type != NL80211_KEYTYPE_GROUP)
2995                 return -EINVAL;
2996
2997         if (!rdev->ops->add_key)
2998                 return -EOPNOTSUPP;
2999
3000         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3001                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3002                                            mac_addr))
3003                 return -EINVAL;
3004
3005         wdev_lock(dev->ieee80211_ptr);
3006         err = nl80211_key_allowed(dev->ieee80211_ptr);
3007         if (!err)
3008                 err = rdev_add_key(rdev, dev, key.idx,
3009                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3010                                     mac_addr, &key.p);
3011         wdev_unlock(dev->ieee80211_ptr);
3012